Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Internet Explorer öffnet sich mit Werbung (https://www.trojaner-board.de/87932-internet-explorer-oeffnet-werbung.html)

bastian111 08.07.2010 20:39
Internet Explorer öffnet sich mit Werbung
 
Hi,
ich habe folgendes Problem:
Mein Internet Explorer öffnet sich gelegentlich mit Werbung für verschiedene Dinge. Kann kein Muster erkenenn passiert nicht etwa alle 5 Minuten.
Hab mir zwar die Threads zu dem Thema durchgelesen aber konnte keine Lösung finden.
Hoffe ihr könnt mir helfen.
Danke im Voraus
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:08:16, on 08.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOKUME~1\Bastian\LOKALE~1\Temp\Dwd.exe
C:\WINDOWS\Dpamia.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programme\Trend Micro\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] -RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] -RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] -"C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [C-Media Mixer] -Mixer.exe /startup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office 2007\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EWABQAF7KL] C:\DOKUME~1\Bastian\LOKALE~1\Temp\Dwd.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MI69DF~1\Office12\EXCEL.EXE/3000
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI69DF~1\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Dokumente und Einstellungen\Bastian\Startmenü\Programme\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class) - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MI69DF~1\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8256 bytes
--- --- ---

cosinus 08.07.2010 21:52
Hallo und :hallo:

bitte nen Vollscan mit malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

bastian111 10.07.2010 09:50
Also hier is das von malwarebytes:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4296

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09.07.2010 22:11:46
mbam-log-2010-07-09 (22-11-46).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 189644
Laufzeit: 2 Stunde(n), 31 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 2
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7

Infizierte Speicherprozesse:
C:\WINDOWS\Dpamia.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Dokumente und Einstellungen\Bastian\Lokale Einstellungen\Temp\Dwd.exe (Trojan.FraudPack.Gen) -> Unloaded process successfully.

Infizierte Speichermodule:
c:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\UBC5AB1IDP (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\EWABQAF7KL (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sshnas (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewabqaf7kl (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\Dpamia.exe (Trojan.Downloader) -> Delete on reboot.
C:\Dokumente und Einstellungen\Bastian\Lokale Einstellungen\Temp\Dwd.exe (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Bastian\Lokale Einstellungen\Temp\Dwc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

hier von otl otl.txt

OTL Logfile:
Code:
OTL logfile created on: 10.07.2010 10:42:34 - Run 1
OTL by OldTimer - Version 3.2.8.1    Folder = C:\Dokumente und Einstellungen\Bastian\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 175,00 Mb Available Physical Memory | 34,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,55 Gb Total Space | 26,53 Gb Free Space | 35,59% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: BASTIAN-PC
Current User Name: Bastian
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Bastian\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office 2007\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\aol\acs\AOLacsd.exe (AOL LLC)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Bastian\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe File not found
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (fsssvc) -- C:\Programme\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SeaPort) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office 2007\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AOL ACS) -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe (AOL LLC)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (EagleNT) -- C:\WINDOWS\System32\drivers\EagleNT.sys File not found
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (fssfltr) -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (BlueletAudio) -- C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation)
DRV - (Btcsrusb) -- C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation)
DRV - (BTHidEnum) -- C:\WINDOWS\system32\drivers\vbtenum.sys ()
DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation)
DRV - (BT) -- C:\WINDOWS\system32\drivers\BtNetDrv.sys (IVT Corporation)
DRV - (VcommMgr) -- C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation)
DRV - (VComm) -- C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation)
DRV - (SIS163u) -- C:\WINDOWS\system32\drivers\sis163u.sys (SiS Corporation)
DRV - (ovt519) -- C:\WINDOWS\system32\drivers\ov519vid.sys (OmniVision Technologies, Inc.)
DRV - (Ser2pl) -- C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (qcusbser) -- C:\WINDOWS\system32\drivers\qcusbser.sys (QUALCOMM Incorporated)
DRV - (qcusbmdm) Qualcomm Proprietary USB Driver (PID 3197) -- C:\WINDOWS\system32\drivers\qcusbmdm.sys (QUALCOMM Incorporated)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (nvidesm) -- C:\WINDOWS\system32\drivers\nvidesm.sys (NVIDIA Corporation)
DRV - (NVENET) -- C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nv_agp) -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (cmpci) C-Media PCI Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\cmaudio.sys (C-Media Inc)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.9
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2010.02.21 21:40:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.02 01:03:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.03 08:41:04 | 000,000,000 | ---D | M]
 
[2009.06.26 19:46:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Extensions
[2009.06.26 19:46:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2010.07.09 19:21:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\extensions
[2010.05.29 12:26:06 | 000,000,000 | ---D | M] (Stylish) -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010.05.11 15:36:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.04.02 14:07:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\extensions\dvscontextmenuy@dvdvideosoft.com
[2010.07.06 10:16:27 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\searchplugins\icqplugin.xml
[2010.07.09 19:21:56 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.01.19 17:18:04 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.05.02 19:06:29 | 000,239,432 | ---- | M] (Pando Networks) -- C:\Programme\Mozilla Firefox\plugins\npPandoWebInst.dll
[2010.03.13 18:59:05 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.13 18:59:05 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.13 18:59:05 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.13 18:59:05 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.13 18:59:06 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2002.12.31 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office 2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [C-Media Mixer]  File not found
O4 - HKLM..\Run: [GrooveMonitor] C:\Programme\Microsoft Office 2007\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office 2007\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office 2007\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Dokumente und Einstellungen\Bastian\Startmenü\Programme\IMVU\Run IMVU.lnk File not found
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab (NeffyLauncherCtl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office 2007\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Bastian\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Bastian\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office 2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.04.06 19:21:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{4cbfc742-0404-11dd-a810-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{4cbfc742-0404-11dd-a810-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4cbfc742-0404-11dd-a810-806d6172696f}\Shell\AutoRun\command - "" = D:\CDSTART.EXE -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.09 19:44:47 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Bastian\Desktop\OTL.exe
[2010.07.09 19:25:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Malwarebytes
[2010.07.09 19:25:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.07.09 19:25:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.07.09 19:25:12 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.07.09 19:25:11 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.07.08 22:06:32 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.07.08 20:55:46 | 000,000,000 | ---D | C] -- C:\VundoFix Backups
[2010.07.01 12:13:02 | 000,018,816 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2010.07.01 12:12:52 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2010.07.01 12:12:24 | 000,008,320 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\nmwcdnsuc.sys
[2010.07.01 12:12:23 | 000,137,344 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\nmwcdnsu.sys
[2010.07.01 12:12:22 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys
[2010.07.01 12:12:21 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys
[2010.07.01 12:12:20 | 000,022,528 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys
[2010.07.01 12:12:19 | 001,461,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfcoinstaller01009.dll
[2010.07.01 12:12:19 | 000,662,016 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcocls.dll
[2010.07.01 12:12:19 | 000,018,176 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.10 10:27:50 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.10 10:27:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.09 22:21:23 | 006,553,600 | -H-- | M] () -- C:\Dokumente und Einstellungen\Bastian\NTUSER.DAT
[2010.07.09 22:21:23 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\Bastian\ntuser.ini
[2010.07.09 22:21:14 | 005,866,354 | -H-- | M] () -- C:\Dokumente und Einstellungen\Bastian\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.07.09 21:58:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.07.09 19:44:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Bastian\Desktop\OTL.exe
[2010.07.08 22:07:15 | 000,002,665 | ---- | M] () -- C:\Dokumente und Einstellungen\Bastian\Desktop\HiJackThis.lnk
[2010.07.08 17:50:48 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.03 08:41:11 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2010.07.01 12:07:28 | 000,001,827 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nokia Software Updater.lnk
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.07.08 22:06:42 | 000,002,665 | ---- | C] () -- C:\Dokumente und Einstellungen\Bastian\Desktop\HiJackThis.lnk
[2010.07.03 08:41:09 | 000,001,709 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2010.07.01 12:07:28 | 000,001,827 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nokia Software Updater.lnk
[2009.10.21 22:17:33 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009.09.19 17:54:39 | 000,000,039 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2009.04.04 17:39:25 | 000,138,512 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.02.02 02:09:17 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009.01.06 18:45:15 | 000,000,070 | ---- | C] () -- C:\WINDOWS\CMMPLAY.INI
[2008.11.28 15:04:48 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2008.11.28 15:04:48 | 000,011,860 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2008.10.30 14:25:20 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008.04.30 15:47:01 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008.04.06 21:38:03 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.04.06 20:55:14 | 000,000,140 | ---- | C] () -- C:\WINDOWS\CMMIXER.INI
[2008.04.06 20:08:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\swunilog.ini
[2008.04.06 19:51:33 | 000,000,107 | ---- | C] () -- C:\WINDOWS\CMSurround.ini
[2008.04.06 19:34:03 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2008.04.06 19:33:57 | 000,004,333 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2008.04.06 19:33:32 | 000,015,448 | ---- | C] () -- C:\WINDOWS\cmaudio.ini
[2008.04.06 19:33:28 | 000,000,411 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2008.04.06 19:33:27 | 000,000,040 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2007.12.05 01:41:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007.12.05 01:41:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007.12.05 01:41:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007.12.05 01:41:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007.12.05 01:41:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 85 bytes -> C:\Dokumente und Einstellungen\All Users\Desktop:$ES_DESCRIPTOR_PBVUV1VK9V89KMRVCL9YERB3CKNVYNK9DBGB4WKX8JVX6RVDBFNTBV3CHBPB2PY6VVV4VVVVVVFJVX
@Alternate Data Stream - 85 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Namco Networks:$ES_DESCRIPTOR_PBVUV1VK9V89KMRVCL9YERB3CKNVYNK9DBGB4WKX8JVX6RVDBFNTBV3CHBPB2PY6VVV4VVVVVVFJVX
@Alternate Data Stream - 487 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:05EE1EEF
@Alternate Data Stream - 170 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:7D43E156
< End of report >
--- --- ---

und hier von otl extras.txt

OTL Logfile:
Code:
OTL Extras logfile created on: 10.07.2010 10:42:34 - Run 1
OTL by OldTimer - Version 3.2.8.1    Folder = C:\Dokumente und Einstellungen\Bastian\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 175,00 Mb Available Physical Memory | 34,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,55 Gb Total Space | 26,53 Gb Free Space | 35,59% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: BASTIAN-PC
Current User Name: Bastian
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office 2007\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office 2007\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Programme\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Programme\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Programme\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [OneNote.Open] -- C:\PROGRA~1\MI69DF~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"57434:TCP" = 57434:TCP:*:Enabled:Pando Media Booster
"57434:UDP" = 57434:UDP:*:Enabled:Pando Media Booster
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Programme\ICQ7.1\ICQ.exe" = C:\Programme\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1 -- (ICQ, LLC.)
"C:\Programme\ICQ7.1\aolload.exe" = C:\Programme\ICQ7.1\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Gemeinsame Dateien\aol\acs\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\acs\AOLDial.exe:*:Enabled:AOL Optimized Dial-In -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\acs\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\acs\AOLacsd.exe:*:Enabled:AOL Optimized Dial-In -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\1207507019\ee\aolsoftware.exe" = C:\Programme\Gemeinsame Dateien\aol\1207507019\ee\aolsoftware.exe:*:Enabled:AOL Shared Components -- (America Online, Inc.)
"C:\Programme\AOL 9.0 VR\waol.exe" = C:\Programme\AOL 9.0 VR\waol.exe:*:Enabled:AOL -- (AOL, LLC.)
"C:\Programme\Gemeinsame Dateien\aol\TopSpeed\3.0\aoltpsd3.exe" = C:\Programme\Gemeinsame Dateien\aol\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\Loader\aolload.exe" = C:\Programme\Gemeinsame Dateien\aol\Loader\aolload.exe:*:Enabled:AOL Loader -- (America Online, Inc.)
"C:\Programme\Gemeinsame Dateien\aol\System Information\sinf.exe" = C:\Programme\Gemeinsame Dateien\aol\System Information\sinf.exe:*:Enabled:AOL System Information -- (AOL LLC)
"C:\Programme\Metin2_Germany\metin2.bin" = C:\Programme\Metin2_Germany\metin2.bin:*:Enabled:metin2 -- File not found
"C:\Programme\Veoh Networks\Veoh\VeohClient.exe" = C:\Programme\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client -- File not found
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\Miranda IM\miranda32.exe" = C:\Programme\Miranda IM\miranda32.exe:*:Enabled:Miranda IM -- File not found
"C:\Rohan\rohanclient.exe" = C:\Rohan\rohanclient.exe:*:Enabled:Rohan Online Game -- File not found
"C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\cs 1.6\hl.exe" = C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\cs 1.6\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\chinatown\5imt2\5iMt2_II.exe" = C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\chinatown\5imt2\5iMt2_II.exe:*:Enabled:5iMt2_II -- File not found
"C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\chinatown\5imt2\5iMt2.exe" = C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\chinatown\5imt2\5iMt2.exe:*:Enabled:5iMt2 -- File not found
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\EA Games\Command & Conquer Generals Zero Hour\game.dat" = C:\Programme\EA Games\Command & Conquer Generals Zero Hour\game.dat:*:Enabled:game -- ()
"C:\Programme\Xfire\Xfire.exe" = C:\Programme\Xfire\Xfire.exe:*:Enabled:Xfire -- File not found
"C:\Programme\Wolfenstein - Enemy Territory\ET.exe" = C:\Programme\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET -- File not found
"C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player  -- File not found
"C:\Programme\EA Games\Need for Speed Most Wanted\speed.exe" = C:\Programme\EA Games\Need for Speed Most Wanted\speed.exe:*:Enabled:speed -- ()
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- File not found
"C:\Programme\Subagames\Metin2\metin2.bin" = C:\Programme\Subagames\Metin2\metin2.bin:*:Enabled:metin2 -- File not found
"C:\Programme\bmoworld\BomberMan.exe" = C:\Programme\bmoworld\BomberMan.exe:*:Enabled:BomberMan -- File not found
"C:\Programme\alaplaya\S4League\S4Client.exe" = C:\Programme\alaplaya\S4League\S4Client.exe:*:Enabled:Project S4 Client.exe -- File not found
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\p\metin_longjuyt2.exe" = C:\Programme\p\metin_longjuyt2.exe:*:Enabled:metin_longjuyt2 -- File not found
"C:\Programme\p\metin2.bin" = C:\Programme\p\metin2.bin:*:Enabled:metin2 -- File not found
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Programme\Metin2_Germany\metin2client.bin" = C:\Programme\Metin2_Germany\metin2client.bin:*:Enabled:metin2client -- File not found
"C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater -- (Nokia Corporation)
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process  -- (Nokia Corporation)
"C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\Downloads\New World2 -- 21.03.2010 -- 11-44----B-Dauni\metin2.bin" = C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\Downloads\New World2 -- 21.03.2010 -- 11-44----B-Dauni\metin2.bin:*:Enabled:metin2 -- File not found
"C:\Programme\ICQ7.1\ICQ.exe" = C:\Programme\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1 -- (ICQ, LLC.)
"C:\Programme\ICQ7.1\aolload.exe" = C:\Programme\ICQ7.1\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
"C:\Programme\Microsoft Office 2007\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office 2007\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Microsoft Office 2007\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office 2007\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Programme\Microsoft Office 2007\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office 2007\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\Downloads\FMT2patch\metin2client.bin" = C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\Downloads\FMT2patch\metin2client.bin:*:Enabled:metin2client -- File not found
"C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\Downloads\epix-network\epix-network\metin2client.bin" = C:\Dokumente und Einstellungen\Bastian\Eigene Dateien\Downloads\epix-network\epix-network\metin2client.bin:*:Enabled:metin2client -- ()
"C:\Programme\Metin2\metin2client.bin" = C:\Programme\Metin2\metin2client.bin:*:Enabled:metin2client -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{09C468CA-2940-466A-AAE8-DCC0C6E9323C}" = Nokia Software Updater
"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{49FC50FC-F965-40D9-89B4-CBFF80941033}" = Windows Movie Maker 2.0
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{70C592EC-AE9B-4734-928B-676E824FB41E}" = MFC RunTime files
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7BF68B83-5057-4D4B-0093-28285EEB9EE3}" = Harry Potter II
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"{DCD22647-6D31-479D-8F97-16D0AA934D9E}" = PC Connectivity Solution
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows-Treiberpaket - Nokia Modem  (10/05/2009 4.2)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.4)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Windows-Treiberpaket - Nokia Modem  (05/22/2008 7.00.0.1)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AOL Deinstallation" = AOL Deinstallation
"AOL Installations-Manager" = AOL Installations-Manager
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows-Treiberpaket - Nokia Modem  (05/22/2008 3.8)
"CCleaner" = CCleaner (remove only)
"DXTXTRA" = Microsoft DirectX Transform optional components
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.3
"Icy Tower v1.4_is1" = Icy Tower v1.4
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaMonkey_is1" = MediaMonkey 3.2
"Metin2_is1" = Metin2
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"PCI Audio Applications" = PCI Audio Applications
"PCI Audio Driver" = PCI Audio Driver
"Sony Eyetoy Webcam" = Sony Eyetoy Webcam
"StoneAge 2" = StoneAge 2 v1.11
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.0.2
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mask Surf Pro" = Mask Surf Pro
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 28.05.2010 09:43:59 | Computer Name = BASTIAN-PC | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
Error - 01.06.2010 14:02:40 | Computer Name = BASTIAN-PC | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
Error - 20.06.2010 05:05:44 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 21.06.2010 08:16:54 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 22.06.2010 14:39:47 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1256) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 25.06.2010 06:46:50 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 26.06.2010 08:43:08 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 29.06.2010 03:42:09 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 30.06.2010 01:41:47 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 05.07.2010 05:08:41 | Computer Name = BASTIAN-PC | Source = ESENT | ID = 490
Description = svchost (1232) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
[ System Events ]
Error - 08.07.2010 12:17:21 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "helpsvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}
 
Error - 08.07.2010 12:42:02 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 08.07.2010 13:00:28 | Computer Name = BASTIAN-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AOL Connectivity Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 08.07.2010 15:25:49 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 08.07.2010 15:41:46 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 09.07.2010 01:32:51 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "helpsvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}
 
Error - 09.07.2010 13:13:13 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "helpsvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}
 
Error - 09.07.2010 13:13:32 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "helpsvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}
 
Error - 09.07.2010 15:01:18 | Computer Name = BASTIAN-PC | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 09.07.2010 16:15:08 | Computer Name = BASTIAN-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  atapi  PCIIde
 
 
< End of report >
--- --- ---

cosinus 10.07.2010 13:56
Ok, mach mal nen Durchgang mit CF bitte:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

bastian111 10.07.2010 15:05
Okay CCleaner hab ich alles gemacht und die Logdatei von ComboFix:

Combofix Logfile:
Code:
ComboFix 10-07-09.02 - Bastian 10.07.2010  15:41:03.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.511.244 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Bastian\Desktop\cofi.exe.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


(((((((((((((((((((((((  Dateien erstellt von 2010-06-10 bis 2010-07-10  ))))))))))))))))))))))))))))))
.

2010-07-09 17:25 . 2010-07-09 17:25        --------        d-----w-        c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Malwarebytes
2010-07-09 17:25 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-09 17:25 . 2010-07-09 17:25        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-07-09 17:25 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-07-09 17:25 . 2010-07-09 17:25        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-07-08 20:06 . 2010-07-08 20:06        --------        d-----w-        c:\programme\Trend Micro
2010-07-08 18:55 . 2010-07-08 18:55        --------        d-----w-        C:\VundoFix Backups
2010-07-01 10:13 . 2008-08-26 08:26        18816        ----a-w-        c:\windows\system32\drivers\pccsmcfd.sys
2010-07-01 10:12 . 2010-07-01 10:12        --------        d-----w-        c:\programme\PC Connectivity Solution
2010-07-01 10:12 . 2010-02-26 12:21        8320        ----a-w-        c:\windows\system32\drivers\nmwcdnsuc.sys
2010-07-01 10:12 . 2010-02-26 12:21        137344        ----a-w-        c:\windows\system32\drivers\nmwcdnsu.sys
2010-07-01 10:12 . 2010-02-26 12:32        8192        ----a-w-        c:\windows\system32\drivers\usbser_lowerfltj.sys
2010-07-01 10:12 . 2010-02-26 12:32        8192        ----a-w-        c:\windows\system32\drivers\usbser_lowerflt.sys
2010-07-01 10:12 . 2010-02-26 12:32        22528        ----a-w-        c:\windows\system32\drivers\ccdcmbo.sys
2010-07-01 10:12 . 2010-02-26 12:32        662016        ----a-w-        c:\windows\system32\nmwcdcocls.dll
2010-07-01 10:12 . 2010-02-26 12:32        18176        ----a-w-        c:\windows\system32\drivers\ccdcmb.sys
2010-07-01 10:12 . 2010-02-26 12:19        1461992        ----a-w-        c:\windows\system32\wdfcoinstaller01009.dll

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-10 13:17 . 2009-03-29 15:12        --------        d-----w-        c:\programme\CCleaner
2010-07-08 20:01 . 2010-04-20 14:24        --------        d-----w-        c:\dokumente und einstellungen\Bastian\Anwendungsdaten\ICQ
2010-07-07 07:34 . 2010-05-31 12:44        --------        d-----w-        c:\programme\Metin2
2010-07-01 10:13 . 2008-09-02 15:16        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Installations
2010-07-01 10:12 . 2008-09-02 15:17        --------        d-----w-        c:\programme\Nokia
2010-07-01 10:07 . 2009-01-19 12:49        --------        d-----w-        c:\programme\Gemeinsame Dateien\Nokia
2010-06-24 11:38 . 2008-09-10 11:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS
2010-06-09 20:03 . 2010-04-20 14:24        --------        d-----w-        c:\programme\ICQ7.1
2010-06-07 13:17 . 2010-06-06 19:20        --------        d-----w-        c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Tor
2010-06-07 12:24 . 2009-01-12 13:21        --------        d---a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
2010-06-06 19:21 . 2010-06-06 19:20        --------        d-----w-        c:\programme\Mask Surf Pro
2010-06-06 19:20 . 2010-06-06 19:20        --------        d-----w-        c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Mask Surf
2010-05-24 18:42 . 2010-05-24 18:41        --------        d-----w-        c:\programme\MediaMonkey
2010-05-24 17:05 . 2009-09-23 16:25        --------        d-----w-        c:\dokumente und einstellungen\Bastian\Anwendungsdaten\vlc
2010-05-20 12:33 . 2008-04-06 17:30        74720        ----a-w-        c:\dokumente und einstellungen\Bastian\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-05-19 19:00 . 2010-05-18 20:02        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
2010-05-18 20:13 . 2010-05-18 20:13        --------        d-----w-        c:\programme\Microsoft Works
2010-05-18 20:13 . 2010-05-18 20:13        --------        d-----w-        c:\programme\MSBuild
2010-05-18 20:12 . 2010-05-18 20:02        --------        d-----w-        c:\programme\Microsoft Office 2007
2010-05-18 20:04 . 2010-05-18 20:04        --------        d-----w-        c:\programme\Microsoft Visual Studio 8
2010-05-18 19:35 . 2010-05-18 19:35        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AOL Downloads
2010-05-18 12:19 . 2010-05-18 12:19        --------        d-----w-        c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Bump Technologies, Inc
2010-04-17 11:51 . 2002-12-31 12:00        71946        ----a-w-        c:\windows\system32\perfc007.dat
2010-04-17 11:51 . 2002-12-31 12:00        408950        ----a-w-        c:\windows\system32\perfh007.dat
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"GrooveMonitor"="c:\programme\Microsoft Office 2007\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04        35760        ----a-w-        c:\programme\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2007-06-21 14:11        50480        ----a-w-        c:\programme\AOL 9.0 VR\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 05:53        110592        ----a-w-        c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Echo Control]
2001-12-05 14:47        147456        ----a-w-        c:\programme\PCI Audio Applications\Bin\EchoCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
2002-03-04 03:02        1454080        ----a-w-        c:\windows\mixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40        687560        ----a-w-        c:\programme\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-26 00:52        50736        ----a-w-        c:\programme\Gemeinsame Dateien\aol\1207507019\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2010-06-08 11:39        133368        ----a-w-        c:\programme\ICQ7.1\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 05:52        1695232        ------w-        c:\programme\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44        3883840        ----a-w-        c:\programme\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
2009-10-26 16:26        753664        ----a-w-        c:\programme\Nokia\Nokia PC Suite 7\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-12-04 23:41        1626112        ----a-w-        c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-11-11 09:57        1451520        ----a-w-        c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 03:17        149280        ----a-w-        c:\programme\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\acs\\AOLDial.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\acs\\AOLacsd.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\1207507019\\ee\\aolsoftware.exe"=
"c:\\Programme\\AOL 9.0 VR\\waol.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\Loader\\aolload.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\System Information\\sinf.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"=
"c:\\Programme\\EA Games\\Need for Speed Most Wanted\\speed.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programme\\ICQ7.1\\ICQ.exe"=
"c:\\Programme\\ICQ7.1\\aolload.exe"=
"c:\\Programme\\Microsoft Office 2007\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office 2007\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office 2007\\Office12\\ONENOTE.EXE"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"57434:TCP"= 57434:TCP:Pando Media Booster
"57434:UDP"= 57434:UDP:Pando Media Booster

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [17.03.2009 22:28 108289]
R3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\sis163u.sys [06.04.2008 20:07 162304]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [01.07.2010 12:12 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [01.07.2010 12:12 8320]
S3 qcusbmdm;Qualcomm Proprietary USB Driver (PID 3197);c:\windows\system32\drivers\qcusbmdm.sys [15.07.2008 13:44 59632]
S3 qcusbser;Qualcomm Diagnostic Port 3197;c:\windows\system32\drivers\qcusbser.sys [15.07.2008 13:45 59632]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [02.02.2009 02:09 717296]
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\Bastian\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MI69DF~1\Office12\EXCEL.EXE/3000
IE: Save YouTube Video
IE: Save YouTube Video as MP3
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\programme\ICQ7.1\ICQ.exe
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\dokumente und einstellungen\Bastian\Startmenü\Programme\IMVU\Run IMVU.lnk
DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab
FF - ProfilePath - c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q=
FF - plugin: c:\programme\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\programme\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-NvCplDaemon - -RUNDLL32.EXE
HKLM-Run-NvMediaCenter - -RUNDLL32.EXE
HKLM-Run-avgnt - -c:\programme\Avira\AntiVir Desktop\avgnt.exe
HKLM-Run-C-Media Mixer - -Mixer.exe
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\programme\Gemeinsame Dateien\Nero\Lib\NMBgMonitor.exe
MSConfigStartUp-BluetoothRC - c:\programme\Bluetooth Remote Control\BluetoothRemoteControl.exe
MSConfigStartUp-ICQ Lite - c:\programme\ICQLite\ICQLite.exe
MSConfigStartUp-ISUSPM Startup - c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe
MSConfigStartUp-MessengerPlus3 - c:\programme\MessengerPlus! 3\MsgPlus.exe
MSConfigStartUp-NBKeyScan - c:\programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-NeroFilterCheck - c:\programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe
MSConfigStartUp-swg - c:\programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
MSConfigStartUp-Veoh - c:\programme\Veoh Networks\Veoh\VeohClient.exe
MSConfigStartUp-WinampAgent - c:\programme\Winamp\winampa.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-07-10 15:51
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\pluginreg.dat.bak 6359 bytes
c:\dokumente und einstellungen\Bastian\Anwendungsdaten\Mozilla\Firefox\Profiles\v4m2zmc4.default\prefs.js.BAK 5223 bytes

Scan erfolgreich abgeschlossen
versteckte Dateien: 2

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1801674531-117609710-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:4c,7c,59,8d,54,6a,40,73,09,44,5a,5a,04,18,70,0a,0c,62,ed,91,8e,9b,49,
  a7,05,e5,df,e3,28,75,a0,58,4d,5a,1f,f5,2d,35,d2,f5,a6,80,cc,32,b4,2b,5a,89,\
"??"=hex:4e,5b,94,3c,fd,7c,e9,4e,cd,39,69,eb,e3,76,76,ba
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'explorer.exe'(3044)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-07-10  16:02:07 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-07-10 14:02

Vor Suchlauf: 12 Verzeichnis(se), 28.709.437.440 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 28.966.268.928 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - FE86D36E1ECC44309567DC0DC64007D6
--- --- ---

cosinus 11.07.2010 21:33
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

bastian111 12.07.2010 09:42
Okay hab ich gemacht

GMER:

GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-07-12 10:19:02
Windows 5.1.2600 Service Pack 3
Running: dnjf67iz.exe; Driver: C:\DOKUME~1\Bastian\LOKALE~1\Temp\pwliyfow.sys


---- System - GMER 1.0.15 ----

SSDT            F8DC9EEE                                                                                                                                ZwCreateKey
SSDT            F8DC9EE4                                                                                                                                ZwCreateThread
SSDT            F8DC9EF3                                                                                                                                ZwDeleteKey
SSDT            F8DC9EFD                                                                                                                                ZwDeleteValueKey
SSDT            spnv.sys                                                                                                                                ZwEnumerateKey [0xF85F4CA2]
SSDT            spnv.sys                                                                                                                                ZwEnumerateValueKey [0xF85F5030]
SSDT            F8DC9F02                                                                                                                                ZwLoadKey
SSDT            spnv.sys                                                                                                                                ZwOpenKey [0xF85D60C0]
SSDT            F8DC9ED0                                                                                                                                ZwOpenProcess
SSDT            F8DC9ED5                                                                                                                                ZwOpenThread
SSDT            spnv.sys                                                                                                                                ZwQueryKey [0xF85F5108]
SSDT            spnv.sys                                                                                                                                ZwQueryValueKey [0xF85F4F88]
SSDT            F8DC9F0C                                                                                                                                ZwReplaceKey
SSDT            F8DC9F07                                                                                                                                ZwRestoreKey
SSDT            F8DC9EF8                                                                                                                                ZwSetValueKey
SSDT            F8DC9EDF                                                                                                                                ZwTerminateProcess

INT 0x63        ?                                                                                                                                      82E0BF00
INT 0x73        ?                                                                                                                                      82E0BF00
INT 0x83        ?                                                                                                                                      82FE0BF8

---- Kernel code sections - GMER 1.0.15 ----

?              spnv.sys                                                                                                                                Das System kann die angegebene Datei nicht finden. !
.text          USBPORT.SYS!DllUnload                                                                                                                  F7D9A8AC 5 Bytes  JMP 82E0B4E0
.text          C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                                section is writeable [0xF754E380, 0x346307, 0xE8000020]
.text          akprqyx8.SYS                                                                                                                            F74C4386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text          akprqyx8.SYS                                                                                                                            F74C43AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text          akprqyx8.SYS                                                                                                                            F74C43C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text          akprqyx8.SYS                                                                                                                            F74C43C9 1 Byte  [2E]
.text          akprqyx8.SYS                                                                                                                            F74C43C9 11 Bytes  [2E, 00, 00, 00, 5C, 02, 00, ...] {ADD CS:[EAX], AL; ADD [EDX+EAX+0x0], BL; ADD [EAX], AL; ADD [EAX], AL}
.text          ...                                                                                                                                   

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                      82FE02D8
IAT            pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                                    [F8607C4C] spnv.sys
IAT            pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                                      [F8607CA0] spnv.sys
IAT            atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                                      [F85D7040] spnv.sys
IAT            atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                                              [F85D713C] spnv.sys
IAT            atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                                    [F85D70BE] spnv.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                                            [F85D77FC] spnv.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                                    [F85D76D2] spnv.sys
IAT            \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                    82E0B5E0
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlInitUnicodeString]                                                            2266E852
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!swprintf]                                                                        478B0000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeSetEvent]                                                                      50016A40
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoCreateSymbolicLink]                                                            1CAC8E8D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoGetConfigurationInformation]                                                  E8510000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoDeleteSymbolicLink]                                                            00002254
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmFreeMappingAddress]                                                            6A18538B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoFreeErrorLogEntry]                                                            868D5200
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoDisconnectInterrupt]                                                          00001C98
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmUnmapIoSpace]                                                                  2242E850
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ObReferenceObjectByPointer]                                                      4B8B0000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IofCompleteRequest]                                                              51016A18
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlCompareUnicodeString]                                                        1CB4968D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IofCallDriver]                                                                  E8520000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmAllocateMappingAddress]                                                        00002230
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry]                                                        8A05478A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoConnectInterrupt]                                                              001CBB8E
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoDetachDevice]                                                                  30C48300
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeWaitForSingleObject]                                                          1CBD8688
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeInitializeEvent]                                                              80E90000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeCancelTimer]                                                                  C6000000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString]                                                    001CBB86
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlInitAnsiString]                                                              438B0100
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest]                                                  8E8D5018
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoQueueWorkItem]                                                                00001C90
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmMapIoSpace]                                                                    2202E851
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations]                                                    538B0000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoReportDetectedDevice]                                                          52016A18
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoReportResourceForDetection]                                                    1CAC868D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize]                                                    E8500000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!NlsMbCodePageTag]                                                                000021F0
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!PoRequestPowerIrp]                                                              8A05478A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue]                                                        001CBB8E
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection]                                                18C48300
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!sprintf]                                                                        1CBD8688
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache]                                                    43EB0000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ObfDereferenceObject]                                                            320C538A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference]                                                    88F93BC0
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoInvalidateDeviceState]                                                        001CBB96
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ZwClose]                                                                        F6317300
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ObReferenceObjectByHandle]                                                      74070647
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ZwCreateDirectoryObject]                                                        75C0841A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest]                                                    05578A0B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!PoStartNextPowerIrp]                                                            968801B0
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoCreateDevice]                                                                  00001CBD
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlCopyUnicodeString]                                                            57B60F66
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension]                                                533B6604
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlQueryRegistryValues]                                                          03087408
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ZwOpenKey]                                                                      72F93B3F
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlFreeUnicodeString]                                                            8A09EBDA
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoStartTimer]                                                                    86880547
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeInitializeTimer]                                                              00001CBD
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoInitializeTimer]                                                              88084B8A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeInitializeDpc]                                                                001CBE8E
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeInitializeSpinLock]                                                            40578B00
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoInitializeIrp]                                                                8D52006A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ZwCreateKey]                                                                    001CC086
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString]                                                  81E85000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString]                                                      8B000021
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ZwSetValueKey]                                                                  001CB88E
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeInsertQueueDpc]                                                                BC968B00
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel]                                                    8900001C
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoStartPacket]                                                                  001CC48E
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel]                                                  C8968900
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest]                                                  8B00001C
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoFreeMdl]                                                                      016A4047
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmUnlockPages]                                                                  CCC68150
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoWriteErrorLogEntry]                                                            5600001C
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue]                                                        002157E8
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping]                                            18C48300
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmUnmapReservedMapping]                                                          5D5B5E5F
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeSynchronizeExecution]                                                          CCCCCCC3
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoStartNextPacket]                                                              CCCCCCCC
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeBugCheckEx]                                                                    CCCCCCCC
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeRemoveDeviceQueue]                                                            CCCCCCCC
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeSetTimer]                                                                      8BEC8B55
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!_allmul]                                                                        00C73445
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmProbeAndLockPages]                                                            00000000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!_except_handler3]                                                                830C458B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!PoSetPowerState]                                                                C0840CEC
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey]                                                        053C0D74
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlWriteRegistryValue]                                                          57B80974
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlDeleteRegistryValue]                                                          8B000000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!_aulldiv]                                                                        56C35DE5
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!strstr]                                                                          8D08758B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!_strupr]                                                                        8D51FC4D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeQuerySystemTime]                                                              8D52FD55
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoWMIRegistrationControl]                                                        8D51FE4D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!KeTickCount]                                                                    8D52FF55
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                    8D51F84D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoDeleteDevice]                                                                  5052F455
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ExAllocatePoolWithTag]                                                          EACAE856
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoAllocateWorkItem]                                                              C483FFFF
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoAllocateIrp]                                                                  0FC08520
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoAllocateMdl]                                                                  0001AD85
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool]                                                      46B70F00
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmLockPagableDataSection]                                                        F44D8B48
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoGetDriverObjectExtension]                                                      C1815753
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmUnlockPagableImageSection]                                                    00002590
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!ExFreePoolWithTag]                                                              467C8D51
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoFreeIrp]                                                                      7622E84A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!IoFreeWorkItem]                                                                  D88BFFFF
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!InitSafeBootMode]                                                                8504C483
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!RtlCompareMemory]                                                                5F0A75DB
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!PoCallDriver]                                                                    5B08438D
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!memmove]                                                                        5DE58B5E
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[ntoskrnl.exe!MmHighestUserAddress]                                                            259068C3
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!KfAcquireSpinLock]                                                                    4B8BDF8B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!READ_PORT_UCHAR]                                                                      8D3F0304
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!KeGetCurrentIrql]                                                                    CB033043
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!KfRaiseIrql]                                                                          0673C13B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!KfLowerIrql]                                                                          C13B0003
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!HalGetInterruptVector]                                                                8366FA72
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!HalTranslateBusAddress]                                                              75000E7B
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!KeStallExecutionProcessor]                                                            0B7D80E3
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!KfReleaseSpinLock]                                                                    307B8D00
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                                              00AA840F
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!READ_PORT_USHORT]                                                                    83660000
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                            6A000E7A
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                                    C6647400
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[WMILIB.SYS!WmiSystemControl]                                                                  4F8B0200
IAT            \SystemRoot\System32\Drivers\akprqyx8.SYS[WMILIB.SYS!WmiCompleteRequest]                                                                968D5140
IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                                      [F85E7048] spnv.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA]                [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]                    [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]                    [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\psapi.dll [KERNEL32.dll!LoadLibraryA]                    [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\psapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA]                [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!LoadLibraryA]                  [6BFA9979] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT            C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe[772] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  [6BFA9A27] C:\Programme\Gemeinsame Dateien\AOL\AOLDiag\tbdiag.dll (AOL Diagnostics/AOL LLC)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                                                  82FDC1F8
Device          \FileSystem\Fastfat \FatCdrom                                                                                                          8258D1F8
Device          \Driver\PCI_PNP6256 \Device\00000050                                                                                                    spnv.sys
Device          \Driver\PCI_PNP6256 \Device\00000050                                                                                                    spnv.sys
Device          \Driver\NetBT \Device\NetBT_Tcpip_{456385D4-1FC4-40D7-9DF1-FEFD9D2C9D62}                                                                82D83500
Device          \Driver\usbohci \Device\USBPDO-0                                                                                                        82E0E500
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                                              82FDE1F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                                                82FDE1F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                                    82FDE1F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                                                  82FDE1F8
Device          \Driver\usbohci \Device\USBPDO-1                                                                                                        82E0E500
Device          \Driver\usbehci \Device\USBPDO-2                                                                                                        82E0D500

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                              fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                                                  82F731F8
Device          \Driver\Cdrom \Device\CdRom0                                                                                                            82E0C500
Device          \Driver\Cdrom \Device\CdRom1                                                                                                            82E0C500
Device          \Driver\Cdrom \Device\CdRom2                                                                                                            82E0C500
Device          \Driver\Cdrom \Device\CdRom3                                                                                                            82E0C500
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                                                82D83500
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                                        82D83500
Device          \Driver\usbohci \Device\USBFDO-0                                                                                                        82E0E500
Device          \Driver\sptd \Device\4121517506                                                                                                        spnv.sys
Device          \Driver\usbohci \Device\USBFDO-1                                                                                                        82E0E500
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                                      82E14500
Device          \Driver\usbehci \Device\USBFDO-2                                                                                                        82E0D500
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                                            82E14500
Device          \Driver\Ftdisk \Device\FtControl                                                                                                        82F731F8
Device          \Driver\akprqyx8 \Device\Scsi\akprqyx81Port1Path0Target0Lun0                                                                            82CCA1F8
Device          \Driver\nvidesm \Device\Scsi\nvidesm1Port0Path0Target0Lun0                                                                              82FDD1F8
Device          \Driver\nvidesm \Device\Scsi\nvidesm1                                                                                                  82FDD1F8
Device          \Driver\nvidesm \Device\Scsi\nvidesm1Port0Path1Target1Lun0                                                                              82FDD1F8
Device          \Driver\akprqyx8 \Device\Scsi\akprqyx81                                                                                                82CCA1F8
Device          \Driver\akprqyx8 \Device\Scsi\akprqyx81Port1Path0Target1Lun0                                                                            82CCA1F8
Device          \Driver\nvidesm \Device\Scsi\nvidesm1Port0Path1Target0Lun0                                                                              82FDD1F8
Device          \FileSystem\Fastfat \Fat                                                                                                                8258D1F8

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device          \FileSystem\Cdfs \Cdfs                                                                                                                  82E12500

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\111111111111                                                           
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\111111111111@001a895d656a                                                0xF7 0x0D 0xAD 0x2A ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\111111111111@00266973c466                                                0x7D 0x48 0x41 0x3D ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\111111111111@001963ef8d10                                                0x8C 0xF5 0x9A 0xC7 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                                      771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                                      285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                                      1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                                       
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                    C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                                    0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                                  0x33 0xE9 0xD1 0x38 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                                             
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                                        0x18 0x48 0xE2 0x1E ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                                       
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                                  0xF0 0x3E 0x94 0x13 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41                                       
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                                  0x59 0xA6 0x3D 0x7C ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\111111111111 (not active ControlSet)                                       
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\111111111111@001a895d656a                                                    0xF7 0x0D 0xAD 0x2A ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\111111111111@00266973c466                                                    0x7D 0x48 0x41 0x3D ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\111111111111@001963ef8d10                                                    0x8C 0xF5 0x9A 0xC7 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                                   
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                        C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                                        0
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                                      0x33 0xE9 0xD1 0x38 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)                         
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                                0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                                            0x18 0x48 0xE2 0x1E ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)                   
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                                      0xF0 0x3E 0x94 0x13 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)                   
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                                      0x59 0xA6 0x3D 0x7C ...

---- EOF - GMER 1.0.15 ----
--- --- ---

OSAM:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 10:41:45 on 12.07.2010

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - ? - C:\Programme\Apple Software Update\SoftwareUpdate.exe  (File not found)

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
"wuaucpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir Personal – Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir PersonalEdition Classic " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\MLCFG32.CPL
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"Pando" - ? - C:\Programme\Pando Networks\Media Booster\PMB.cpl  (File not found)

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"%USB\vid_054c&pid_0155.DeviceDesc%" (ovt519) - "OmniVision Technologies, Inc." - C:\WINDOWS\System32\Drivers\ov519vid.sys
"akprqyx8" (akprqyx8) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\akprqyx8.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"Bluetooth Audio Service" (BlueletAudio) - "IVT Corporation" - C:\WINDOWS\System32\DRIVERS\blueletaudio.sys
"Bluetooth HID Enumerator" (BTHidEnum) - ? - C:\WINDOWS\System32\DRIVERS\vbtenum.sys  (File found, but it contains no detailed information)
"Bluetooth HID Manager Service" (BTHidMgr) - "IVT Corporation" - C:\WINDOWS\System32\Drivers\BTHidMgr.sys
"Bluetooth PAN Network Adapter" (BT) - "IVT Corporation" - C:\WINDOWS\System32\DRIVERS\btnetdrv.sys
"Bluetooth USB For Bluetooth Service" (Btcsrusb) - "IVT Corporation" - C:\WINDOWS\System32\Drivers\btcusb.sys
"Bluetooth VComm Manager Service" (VcommMgr) - "IVT Corporation" - C:\WINDOWS\System32\Drivers\VcommMgr.sys
"C-Media PCI Audio Driver (WDM)" (cmpci) - "C-Media Inc" - C:\WINDOWS\System32\drivers\cmaudio.sys
"catchme" (catchme) - ? - C:\cofi.exe\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"EagleNT" (EagleNT) - ? - C:\WINDOWS\system32\drivers\EagleNT.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\fssfltr_tdi.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MAT Serial port driver" (Ser2pl) - "Prolific Technology Inc." - C:\WINDOWS\System32\DRIVERS\ser2pl.sys
"nvidesm" (nvidesm) - "NVIDIA Corporation" - C:\WINDOWS\System32\drivers\nvidesm.sys
"NVIDIA nForce AGP Bus Filter" (nv_agp) - "NVIDIA Corporation" - C:\WINDOWS\System32\DRIVERS\nv_agp.sys
"NVIDIA nForce MCP Networking Adapter Driver" (NVENET) - "NVIDIA Corporation" - C:\WINDOWS\System32\DRIVERS\NVENET.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"pwliyfow" (pwliyfow) - ? - C:\DOKUME~1\Bastian\LOKALE~1\Temp\pwliyfow.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Qualcomm Diagnostic Port 3197" (qcusbser) - "QUALCOMM Incorporated" - C:\WINDOWS\System32\DRIVERS\qcusbser.sys
"Qualcomm Proprietary USB Driver (PID 3197)" (qcusbmdm) - "QUALCOMM Incorporated" - C:\WINDOWS\System32\DRIVERS\qcusbmdm.sys
"SiS 163 usb Wireless LAN Adapter Driver" (SIS163u) - "SiS Corporation" - C:\WINDOWS\System32\DRIVERS\sis163u.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"Virtual Serial port driver" (VComm) - "IVT Corporation" - C:\WINDOWS\System32\DRIVERS\VComm.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GR99D3~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{5F327514-6C5E-4d60-8F16-D07FA08A78ED} "Auto Update Property Sheet Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office 2007\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Programme\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Programme\Windows Live\Toolbar\wltcore.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
{AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} "NeffyLauncherCtl Class" - "CDNetworks" - C:\WINDOWS\Downloaded Program Files\NeffyLauncher.dll / hxxp://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab
{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - "Oberon Media, Inc." - C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\WINDOWS\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -  (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\ONBttnIE.dll
"ICQ7.2" - "ICQ, LLC." - C:\Programme\ICQ7.2\ICQ.exe
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Programme\Windows Live\Toolbar\wltcore.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MI69DF~1\Office12\GRA8E1~1.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Programme\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Bastian\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"AOL Connectivity Service" (AOL ACS) - "AOL LLC" - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office 2007\Office12\GrooveAuditService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)
"SeaPort" (SeaPort) - "Microsoft Corp." - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"Windows Live Family Safety-Dienst" (fsssvc) - "Microsoft Corporation" - C:\Programme\Windows Live\Family Safety\fsssvc.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 12.07.2010 10:29
Ok. Bitte den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.

Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

bastian111 12.07.2010 12:23
Bootkit Remover version 1.0.0.1
<c> 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhsysicalDrive0
MD5: 5ddc20efcc4d1dab37c348c7db7289cf

Size Device Name MBR Status
74 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

cosinus 12.07.2010 12:31
Bitte mal die Konsole starten über Start, Ausführen, cmd eintippen, ok.

Den Text im folgenden Codefeld eintippen und mit Enter/Return ausführen:
Code:
remover.exe fix \\.\PhysicalDrive0
Falls der den Befehl remover.exe nicht findet, die Datei remover.exe (vom BootkitRemover) vom Desktop nach c:\windows\system32 kopieren!

bastian111 12.07.2010 12:33
hab ich gemacht da stand

Restoring boot code at \\.\PhysicalDrive0
OK

cosinus 12.07.2010 12:53
Zitat:
Zitat von bastian111 (Beitrag 540879)
hab ich gemacht da stand

Restoring boot code at \\.\PhysicalDrive0
OK
Ja, das müsste so richtig gewesen sein.
Du kannst die remover.exe ja nochmal ausführen (doppelklicken) und schauen was der jetzt ausspuckt. Sollte eine grüne Schrift mit der meldung DOS/Win Bootcode found (sinngemäß) ist der MBR wieder ok.

bastian111 12.07.2010 12:58
Zitat:
Sollte eine grüne Schrift mit der meldung DOS/Win Bootcode found
genau so stands da

cosinus 12.07.2010 13:07
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

bastian111 14.07.2010 12:20
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4309

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13.07.2010 17:37:53
mbam-log-2010-07-13 (17-37-53).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 180121
Laufzeit: 1 Stunde(n), 26 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/14/2010 at 01:05 PM

Application Version : 4.40.1002

Core Rules Database Version : 5197
Trace Rules Database Version: 3009

Scan type : Complete Scan
Total Scan Time : 01:57:43

Memory items scanned : 450
Memory threats detected : 0
Registry items scanned : 7764
Registry threats detected : 0
File items scanned : 53362
File threats detected : 8

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\Bastian\Cookies\bastian@content.yieldmanager[3].txt
C:\Dokumente und Einstellungen\Bastian\Cookies\bastian@atwola[1].txt
C:\Dokumente und Einstellungen\Bastian\Cookies\bastian@atdmt[2].txt
C:\Dokumente und Einstellungen\Bastian\Cookies\bastian@content.yieldmanager[2].txt
C:\Dokumente und Einstellungen\Bastian\Cookies\bastian@doubleclick[2].txt
C:\Dokumente und Einstellungen\Bastian\Cookies\bastian@ad.yieldmanager[2].txt
media.zedmobil.de [ C:\Dokumente und Einstellungen\Bastian\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\KW956NDE ]

Trojan.Agent/Gen-SVC[Fake]
C:\DOKUMENTE UND EINSTELLUNGEN\BASTIAN\PATCHER.EXE


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:16 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131