Trojaner-Board - TR/Crypt.ZPACK.Gen (cyitlzra.sys) läßt sich nicht entfernen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/Crypt.ZPACK.Gen (cyitlzra.sys) läßt sich nicht entfernen (https://www.trojaner-board.de/88370-tr-crypt-zpack-gen-cyitlzra-sys-laesst-entfernen.html)

TR/Crypt.ZPACK.Gen (cyitlzra.sys) läßt sich nicht entfernen

Hallo zusammen,
hab ein kleines Problem, die oben angegebene Datei läßt sich nicht entfernen.
Die Datei ist nach dem booten immer wieder da.
Ich hoffe das ich alle nötigen Log-Dateien angehängt habe.
Vielen Dank schon im Voraus
Gruß, Sascha

Hier die Log-Datei von Malwarebytes :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4325

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

19.07.2010 08:53:37
mbam-log-2010-07-19 (08-53-37).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 152751
Laufzeit: 7 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\drivers\cyitlzra.sys (Backdoor.IEbooot) -> No action taken.
--------------------------------------------------------------------------
RSIT-Info:
info.txtRSIT Logfile:

Code:

logfile of random's system information tool 1.08 2010-07-19 08:55:38
 

======Uninstall list======
 

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

ACT! by Sage Premium 2008 (10.0)-->C:\Programme\InstallShield Installation Information\{0580A7ED-75C0-44EA-B90F-2C566C79B8E4}\setup.exe -runfromtemp -l0x0407

ActLook-->C:\WINDOWS\ActLook Uninstaller.exe

Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}

Avira AntiVir Premium-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE

AVM FRITZ!Fernzugang-->MsiExec.exe /X{37C19C2D-9BB3-4CB0-A83C-26213C73C0BD}

Baphomets Fluch - Der schlafende Drache-->C:\WINDOWS\unvise32.exe C:\Programme\THQ\Baphomets Fluch - Der schlafende Drache\uninstal.log

Brother MFL-Pro Suite MFC-490CW-->"C:\Programme\InstallShield Installation Information\{D9461574-5FC0-4641-BBDC-D1038B196F55}\Setup.exe"  -runfromtemp -l0x0007 UNINSTALL Reg=BH9_C2 -removeonly

CCleaner-->"C:\Programme\CCleaner\uninst.exe"

CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}

Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}

COMODO Internet Security-->C:\Programme\COMODO\COMODO Internet Security\cfpconfg.exe -u

Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}

Decker Maschinenelemente-->MsiExec.exe /I{24D18C8F-7C7C-4620-9A8E-71145762A2A0}

Dell Sicherungs- und Wiederherstellungs-Manager-->MsiExec.exe /I{842EFEDE-6700-4CC8-802A-444C7F927021}

Dell Support Center (Support Software)-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}

Dell Touchpad-->C:\Programme\DellTPad\Uninstap.exe ADDREMOVE

Dienstprogramm für Dell Wireless WLAN Karte-->"C:\Programme\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Programme\Dell\Dell Wireless WLAN Card"

DWGeditor-->MsiExec.exe /X{56DCD20A-E558-4396-AF59-14D15AA737BB}

EAX4 Unified Redist-->MsiExec.exe /X{89661B04-C646-4412-B6D3-5E19F02F1F37}

FLV Player 2.0 (build 25)-->C:\Programme\FLV Player\uninst.exe

Free YouTube Download 2.4-->"C:\Programme\DVDVideoSoft\Free YouTube Download\unins000.exe"

FreePDF (Remove only)-->C:\Programme\FreePDF_XP\fpsetup.exe /r

FTP-Watchdog-->MsiExec.exe /X{52C97E71-DC72-4BFC-8F27-3DD60228FBAF}

GameShadow-->MsiExec.exe /I{D98C9637-93DA-44DB-B73A-B11A1192AB26}

GIMP 2.6.8-->"C:\Programme\GIMP-2.0\setup\unins000.exe"

Google Earth Plug-in-->MsiExec.exe /X{75AE638F-750A-11DF-96D5-005056806466}

Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

GPL Ghostscript 8.70-->C:\Programme\gs\uninstgs.exe "C:\Programme\gs\gs8.70\uninstal.txt"

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"

Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB981793)-->"C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.exe"

HPP-21-->C:\Programme\Hitecrcd\HPP-21\Uninstall.exe

IsoBuster 1.5-->"C:\Programme\Smart Projects\IsoBuster\Uninst\unins000.exe"

Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}

KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}

Logitech SetPoint-->"C:\Programme\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe" -runfromtemp -l0x0007 -removeonly

Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"

Microsoft .NET Framework 1.1 Security Update (KB979906)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M979906\M979906Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe

Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

Microsoft .NET Framework 3.0 German Language Pack-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 German Language Pack\setup.exe

Microsoft .NET Framework 3.0 German Language Pack-->MsiExec.exe /X{F2A7F421-1679-48D5-B918-96999014ED53}

Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft ActiveSync 3.8-->"C:\WINDOWS\ISUN0407.EXE" -f"C:\Programme\Microsoft ActiveSync\DeIsL1.isu" -c"C:\Programme\Microsoft ActiveSync\ceuninst.dll"

Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"

Microsoft Kernel-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe"

Microsoft Office 2003 Web Components-->MsiExec.exe /I{90120000-00A4-0409-0000-0000000FF1CE}

Microsoft Office Access 2003 Runtime-->MsiExec.exe /I{901C0407-6000-11D3-8CFE-0150048383C9}

Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}

Microsoft Office Enterprise 2007-->"C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL

Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}

Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}

Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}

Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}

Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}

Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}

Microsoft Office Project MUI (German) 2007-->MsiExec.exe /X{90120000-00B4-0407-0000-0000000FF1CE}

Microsoft Office Project Professional 2007-->"C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJPRO /dll OSETUP.DLL

Microsoft Office Project Professional 2007-->MsiExec.exe /X{90120000-003B-0000-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}

Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}

Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}

Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}

Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}

Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft SQL Server 2005 Express Edition (ACT7)-->MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}

Microsoft SQL Server 2005-->"C:\Programme\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove

Microsoft SQL Server 2005-Abwärtskompatibilität-->MsiExec.exe /I{741D603B-85BB-4077-A779-4FCBAAF3AA3E}

Microsoft SQL Server Native Client-->MsiExec.exe /I{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}

Microsoft SQL Server Setup Support Files (English)-->MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}

Microsoft SQL Server VSS Writer-->MsiExec.exe /I{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}

Microsoft User-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWudf01007$\spuninst\spuninst.exe"

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

Microsoft Visual Studio 2005 Tools for Applications - ENU-->MsiExec.exe /X{D481EA96-2313-4A7C-98EE-710D1AF884AC}

Microsoft Visual Studio 2005 Tools for Applications - ENU-->MsiExec.exe /X{D481EA96-2313-4A7C-98EE-710D1AF884AC}

Microsoft Works-->MsiExec.exe /I{39D0E034-1042-4905-BECB-5502909FCB7C}

Microsoft XML Parser and SDK-->MsiExec.exe /I{2AEBE10C-D819-4EBF-BC60-03BF2327D340}

Mozilla Firefox (3.5)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe

MSVC80_x86_v2-->MsiExec.exe /I{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}

MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 6.0 Parser-->MsiExec.exe /I{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}

Nokia Connectivity Cable Driver-->MsiExec.exe /I{B9C9DB4C-6D77-4AE9-AD1C-C708C23239A0}

Nokia PC Suite-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations\{19DC9559-9C20-4A46-A67D-7ECBA52A2788}\Nokia_PC_Suite_ger.exe

Nokia PC Suite-->MsiExec.exe /I{19DC9559-9C20-4A46-A67D-7ECBA52A2788}

Nokia Software Updater-->MsiExec.exe /X{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}

NSS (remove only)-->C:\Programme\NSS\uninstall.exe

NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI

PaperPort Image Printer-->MsiExec.exe /X{2BC2781A-F7F6-452E-95EB-018A522F1B2C}

PC Connectivity Solution-->MsiExec.exe /I{7397EDED-F38A-4654-B669-BF61065803D0}

PDF-XChange 3-->"C:\Programme\Tracker Software\PDF-XChange 3\unins000.exe"

PhotoView 360-->MsiExec.exe /I{736D2DAD-3D87-4CAA-8646-83D238AD68E0}

PowerDVD DX-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -l0x7  -cluninstall

PrintKey2000-->C:\WINDOWS\unin0407.exe -fC:\Programme\PrintKey2000\DeIsL1.isu  -cC:\Programme\PrintKey2000\_ISREG32.DLL

RedMon - Redirection Port Monitor-->C:\WINDOWS\system32\unredmon.exe

Rigs of Rods 0.36.2-->C:\Programme\Rigs of Rods 0.36.2\uninst.exe

Sage Office Line-->MsiExec.exe /I{23637147-34AA-4C9C-A1D1-58B6419A3767}

ScanSoft PaperPort 11-->MsiExec.exe /I{7A8FF745-BBC5-482B-88E4-18D3178249A9}

Security Task Manager 1.7h-->C:\Programme\Security Task Manager\Uninstal.exe "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Security Task Manager"

Sicherheitsupdate für Windows Media Player (KB978695)-->"C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows Media Player (KB979402)-->"C:\WINDOWS\$NtUninstallKB979402_WM9$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB2229593)-->"C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB975562)-->"C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB978542)-->"C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB979482)-->"C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB979559)-->"C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB980195)-->"C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB980218)-->"C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB982381)-->"C:\WINDOWS\$NtUninstallKB982381$\spuninst\spuninst.exe"

Silent Hunter III-->C:\Programme\Gemeinsame Dateien\InstallShield\Driver\8\Intel 32\IDriver.exe /M{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7} /l1031 

SimCity 4 Deluxe-->C:\Programme\Maxis\SimCity 4 Deluxe\EAUninstall.exe

Sonic CinePlayer Decoder Pack-->MsiExec.exe /I{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}

Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe"

TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}

Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"

Update für Windows XP (KB980182)-->"C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.exe"

USB2.0 Card Reader Software-->"C:\Programme\InstallShield Installation Information\{96AE7E41-E34E-47D0-AC07-1091A8127911}\setup.exe" -runfromtemp -l0x0007 -removeonly

Voice Tracer-->C:\Programme\InstallShield Installation Information\{B7908330-93A8-4DB1-B6EE-6B0446E26939}\setup.exe -runfromtemp -l0x0009 -removeonly

Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll

Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"

Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall

Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"

Windows Presentation Foundation Language Pack (DEU)-->MsiExec.exe /X{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}

Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}

Windows Workflow Foundation DE Language Pack-->MsiExec.exe /I{7228FD8C-3B9E-4204-AE36-8A466107685B}

Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.4)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_0777326F40B753DD4E385F058ADB286B70A301FE\nokbtmdm.inf

Windows-Treiberpaket - Nokia Modem  (10/05/2009 4.2)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_AAB746D5658CCF4CAE7A35CED5F0ADA3C447A973\nokia_bluetooth.inf

Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\B4723E9A0713E5B1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf

WinRAR Archivierer-->C:\Programme\WinRAR\uninstall.exe

XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
 

======Security center information======
 

AV: AntiVir Desktop

FW: COMODO Firewall
 

======System event log======
 

Computer Name: LAPTOP_SG

Event Code: 4201

Message: Netzwerkadapter "Dell...1397 WLAN Mini-Card - Paketplaner-Miniport" wurde mit dem Netzwerk verbunden, und das

System wurde über das Netzwerk im normalen Zustand gestartet.
 

Record Number: 45087

Source Name: Tcpip

Time Written: 20100710002402.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 7036

Message: Dienst "FLEXnet Licensing Service" befindet sich jetzt im Status "Beendet".
 

Record Number: 45086

Source Name: Service Control Manager

Time Written: 20100710002341.000000+120

Event Type: Informationen

User: 
 

Record Number: 45085

Source Name: Service Control Manager

Time Written: 20100710002337.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 7036

Message: Dienst "FLEXnet Licensing Service" befindet sich jetzt im Status "Ausgeführt".
 

Record Number: 45084

Source Name: Service Control Manager

Time Written: 20100710002041.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 7035

Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "FLEXnet Licensing Service" gesendet.
 

Record Number: 45083

Source Name: Service Control Manager

Time Written: 20100710002041.000000+120

Event Type: Informationen

User: LAPTOP_SG\Sascha
 

=====Application event log=====
 

Computer Name: LAPTOP_SG

Event Code: 17164

Message: Detected 2 CPUs. This is an informational message; no user action is required.
 

Record Number: 50183

Source Name: MSSQL$ACT7

Time Written: 20100709145049.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 17162

Message: SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.
 

Record Number: 50182

Source Name: MSSQL$ACT7

Time Written: 20100709145049.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 17110

Message: Registry startup parameters:
 

Record Number: 50181

Source Name: MSSQL$ACT7

Time Written: 20100709145048.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 17176

Message: This instance of SQL Server last reported using a process ID of 168 at 09.07.2010 14:49:19 (local) 09.07.2010 12:49:19 (UTC). This is an informational message only; no user action is required.
 

Record Number: 50180

Source Name: MSSQL$ACT7

Time Written: 20100709145048.000000+120

Event Type: Informationen

User: 
 

Computer Name: LAPTOP_SG

Event Code: 17111

Message: Logging SQL Server messages in file 'C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\LOG\ERRORLOG'.
 

Record Number: 50179

Source Name: MSSQL$ACT7

Time Written: 20100709145048.000000+120

Event Type: Informationen

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Programme\PC Connectivity Solution;C:\Programme\Gemeinsame Dateien\Roxio Shared\DLLShared;C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\DLLShared;C:\Programme\Microsoft SQL Server\90\Tools\binn;C:\Programme\Microsoft SQL Server\80\Tools\Binn

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel

"PROCESSOR_REVISION"=170a

"NUMBER_OF_PROCESSORS"=2

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP
 

-----------------EOF-----------------

--- --- ---

--------------------------------------------------------------------------
RSIT-Log:
RSIT Logfile:

Code:

Logfile of random's system information tool 1.08 (written by random/random)

Run by Sascha at 2010-07-19 08:54:57

Microsoft Windows XP Professional Service Pack 3

System drive C: has 85 GB (55%) free of 153 GB

Total RAM: 3067 MB (75% free)
 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 08:55:35, on 19.07.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

c:\drivers\audio\r211990\stacsv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\FRITZ!Fernzugang\certsrv.exe

C:\Programme\Avira\AntiVir Desktop\avshadow.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe

C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Programme\FRITZ!Fernzugang\nwtsrv.exe

C:\WINDOWS\system32\DRIVERS\o2flash.exe

c:\programme\gemeinsame dateien\protexis\license service\psiservice_2.exe

C:\Programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe

C:\Programme\Dell Support Center\bin\sprtsvc.exe

C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\Programme\Avira\AntiVir Desktop\avmailc.exe

C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\IDT\WDM\sttray.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe

C:\Programme\FreePDF_XP\fpassist.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\Programme\ScanSoft\PaperPort\pptd40nt.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\Programme\COMODO\COMODO Internet Security\cfp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe

C:\Programme\Logitech\SetPoint\SetPoint.exe

C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe

C:\Programme\Brother\Brmfcmon\BrMfcmon.exe

C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE

C:\Programme\PC Connectivity Solution\ServiceLayer.exe

C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe

C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe

C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE

C:\Programme\FRITZ!Fernzugang\avmike.exe

C:\02 Privat\loadz\Viren\RSIT.exe

C:\Programme\trend micro\Sascha.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.live.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = ftp://ftpuser@gerlach-iv.dyndns.org/

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start

O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [Act.Outlook.Service] "C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe"

O4 - HKLM\..\Run: [Act! Preloader] "C:\Programme\ACT\Act for Windows\ActSage.exe" -preload

O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [ControlCenter3] C:\Programme\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [IndexSearch] "C:\Programme\ScanSoft\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Programme\ScanSoft\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Programme\COMODO\COMODO Internet Security\cfp.exe" -h

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Status Monitor.lnk = C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe

O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll

O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: Webseite zu ACT! Kontakt hinzufügen - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)

O9 - Extra 'Tools' menuitem: Webseite zu ACT! Kontakt hinzufügen... - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{DBA5E288-A303-4E63-AFC1-272D6FE97CDD}: NameServer = 192.168.3.111

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: ACT! Scheduler - Sage Software, Inc. - C:\Programme\ACT\Act for Windows\Act.Scheduler.exe

O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avmailc.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

O23 - Service: AVM FRITZ!Fernzugang IKE Service (avmike) - AVM Berlin - C:\Programme\FRITZ!Fernzugang\avmike.exe

O23 - Service: AVM FRITZ!Fernzugang Cert Service (certsrv) - AVM Berlin - C:\Programme\FRITZ!Fernzugang\certsrv.exe

O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe

O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systèmes SolidWorks Corp. - C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdateInstaller - Sage Software - C:\Programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: AVM FRITZ!Fernzugang Client (nwtsrv) - AVM Berlin - C:\Programme\FRITZ!Fernzugang\nwtsrv.exe

O23 - Service: O2FLASH - O2Micro International - C:\WINDOWS\system32\DRIVERS\o2flash.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\programme\gemeinsame dateien\protexis\license service\psiservice_2.exe

O23 - Service: Sage Registrierungsdienst (Registry) - Sage Software - C:\Programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe

O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Programme\Dell Support Center\bin\sprtsvc.exe

O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\drivers\audio\r211990\stacsv.exe

O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
 

--

End of file - 11682 bytes
 

======Scheduled tasks folder======
 

C:\WINDOWS\tasks\1-Klick-Wartung.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D5233FCD-D258-4903-89B8-FB1568E7413D}]

Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - C:\WINDOWS\system32\mscoree.dll [2009-11-07 297808]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"=C:\Programme\IDT\WDM\sttray.exe [2009-02-23 483420]

"AESTFltr"=C:\WINDOWS\system32\AESTFltr.exe [2009-02-23 729088]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-01-22 13590528]

"nwiz"=nwiz.exe /installquiet []

"NVHotkey"=nvHotkey.dll,Start []

"Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2008-12-12 2220032]

"Act.Outlook.Service"=C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe [2008-08-14 20480]

"Act! Preloader"=C:\Programme\ACT\Act for Windows\ActSage.exe [2008-06-25 393216]

"FreePDF Assistant"=C:\Programme\FreePDF_XP\fpassist.exe [2009-08-06 381440]

"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2009-06-17 55824]

"ControlCenter3"=C:\Programme\Brother\ControlCenter3\brctrcen.exe [2007-12-21 86016]

"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []

"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit []

"IndexSearch"=C:\Programme\ScanSoft\PaperPort\IndexSearch.exe [2007-10-11 46368]

"PaperPort PTD"=C:\Programme\ScanSoft\PaperPort\pptd40nt.exe [2007-10-11 29984]

"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2010-07-08 282792]

"COMODO Internet Security"=C:\Programme\COMODO\COMODO Internet Security\cfp.exe [2010-07-14 1800464]

"Malwarebytes Anti-Malware (reboot)"=C:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2010-04-29 1090952]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

"PC Suite Tray"=C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-11-11 1451520]
 

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart

Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe

Status Monitor.lnk - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoRecentDocsNetHood"=1

"NoDriveAutoRun"=67108863
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=1

"NoDriveAutoRun"=67108863

"NoDriveTypeAutoRun"=323
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"

"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

"C:\Programme\ACT\Act for Windows\ActSage.exe"="C:\Programme\ACT\Act for Windows\ActSage.exe:*:Enabled:ACT! by Sage"
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
 

======List of files/folders created in the last 1 months======
 

2010-07-19 08:55:08 ----D---- C:\Programme\trend micro

2010-07-19 08:54:57 ----D---- C:\rsit

2010-07-19 08:54:43 ----A---- C:\WINDOWS\system32\drivers\tolmeqn.sys

2010-07-19 08:41:48 ----D---- C:\Programme\CCleaner

2010-07-16 13:02:24 ----SHD---- C:\Config.Msi

2010-07-16 10:27:19 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$

2010-07-16 10:27:10 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$

2010-07-16 10:25:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$

2010-07-16 10:25:34 ----A---- C:\WINDOWS\system32\MRT.INI

2010-07-16 10:21:24 ----D---- C:\WINDOWS\system32\MpEngineStore

2010-07-16 10:12:49 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$

2010-07-16 10:12:40 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$

2010-07-16 10:12:29 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$

2010-07-16 10:12:18 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$

2010-07-16 10:02:06 ----HDC---- C:\WINDOWS\$NtUninstallKB982381$

2010-07-15 22:05:22 ----D---- C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\Help

2010-07-15 21:58:27 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan

2010-07-15 21:58:17 ----D---- C:\Programme\Security Task Manager

2010-07-14 13:56:22 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Comodo

2010-07-14 13:56:19 ----A---- C:\WINDOWS\system32\guard32.dll

2010-07-14 13:56:19 ----A---- C:\WINDOWS\system32\drivers\inspect.sys

2010-07-14 13:56:19 ----A---- C:\WINDOWS\system32\drivers\cmdhlp.sys

2010-07-14 13:56:19 ----A---- C:\WINDOWS\system32\drivers\cmdguard.sys

2010-07-14 11:29:49 ----D---- C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\Malwarebytes

2010-07-14 11:29:39 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2010-07-14 11:29:37 ----D---- C:\Programme\Malwarebytes' Anti-Malware

2010-07-14 11:29:37 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-07-14 11:29:37 ----A---- C:\WINDOWS\system32\drivers\mbam.sys

2010-07-14 10:48:40 ----ASH---- C:\hiberfil.sys

2010-07-14 10:44:36 ----SD---- C:\CoFi

2010-07-09 13:02:11 ----D---- C:\WINDOWS\temp

2010-07-09 12:19:47 ----D---- C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\Google

2010-07-08 18:12:55 ----SHD---- C:\RECYCLER

2010-07-08 18:01:08 ----A---- C:\Boot.bak

2010-07-08 18:00:57 ----RASHD---- C:\cmdcons

2010-07-08 17:57:54 ----A---- C:\WINDOWS\MBR.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\zip.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\SWXCACLS.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\SWSC.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\SWREG.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\sed.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\PEV.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\NIRCMD.exe

2010-07-08 17:57:53 ----A---- C:\WINDOWS\grep.exe

2010-07-08 17:57:44 ----D---- C:\WINDOWS\ERDNT

2010-07-08 17:56:21 ----D---- C:\Qoobox

2010-07-08 13:03:50 ----D---- C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\Avira

2010-07-08 12:57:25 ----A---- C:\WINDOWS\system32\drivers\ssmdrv.sys

2010-07-08 12:57:22 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys

2010-07-08 12:57:22 ----A---- C:\WINDOWS\system32\drivers\avgntmgr.sys

2010-07-08 12:57:22 ----A---- C:\WINDOWS\system32\drivers\avgntdd.sys

2010-07-08 11:39:26 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software

2010-07-06 16:40:00 ----D---- C:\Programme\Google

2010-07-05 16:53:20 ----D---- C:\Programme\SotS Gold Demo

2010-06-28 13:57:14 ----D---- C:\Programme\Spybot - Search & Destroy

2010-06-28 13:57:14 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy

2010-06-28 13:42:13 ----A---- C:\WINDOWS\system32\drivers\cyitlzra.sys

2010-06-28 13:39:49 ----A---- C:\WINDOWS\system32\drivers\lbrtfdc.sys

2010-06-28 13:38:13 ----A---- C:\WINDOWS\system32\drivers\changer.sys
 

======List of files/folders modified in the last 1 months======
 

2010-07-19 08:55:08 ----RD---- C:\Programme

2010-07-19 08:55:04 ----D---- C:\WINDOWS\Prefetch

2010-07-19 08:54:43 ----D---- C:\WINDOWS\system32\drivers

2010-07-19 08:54:43 ----D---- C:\WINDOWS\Debug

2010-07-19 08:44:26 ----D---- C:\WINDOWS\Minidump

2010-07-19 08:44:26 ----AD---- C:\WINDOWS

2010-07-19 08:33:17 ----D---- C:\Programme\Mozilla Firefox

2010-07-19 07:32:16 ----D---- C:\WINDOWS\system32\CatRoot2

2010-07-19 07:31:36 ----D---- C:\WINDOWS\ime

2010-07-18 02:51:22 ----N---- C:\WINDOWS\SchedLgU.Txt

2010-07-18 00:46:27 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$

2010-07-16 16:43:06 ----SHD---- C:\System Volume Information

2010-07-16 16:40:57 ----D---- C:\WINDOWS\system32\NtmsData

2010-07-16 13:26:34 ----D---- C:\WINDOWS\Registration

2010-07-16 13:24:36 ----D---- C:\WINDOWS\Microsoft.NET

2010-07-16 13:24:13 ----RSD---- C:\WINDOWS\assembly

2010-07-16 13:04:25 ----SHD---- C:\WINDOWS\Installer

2010-07-16 13:04:12 ----AD---- C:\WINDOWS\system32

2010-07-16 13:03:34 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-07-16 13:03:19 ----D---- C:\WINDOWS\WinSxS

2010-07-16 10:27:24 ----HD---- C:\WINDOWS\inf

2010-07-16 10:27:21 ----RSHDC---- C:\WINDOWS\system32\dllcache

2010-07-16 10:27:09 ----HD---- C:\WINDOWS\$hf_mig$

2010-07-16 09:06:45 ----D---- C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\gtk-2.0

2010-07-16 07:21:01 ----A---- C:\WINDOWS\cfplogvw.INI

2010-07-14 13:56:10 ----D---- C:\Programme\COMODO

2010-07-14 13:44:22 ----RASH---- C:\boot.ini

2010-07-14 13:44:22 ----A---- C:\WINDOWS\win.ini

2010-07-14 13:44:22 ----A---- C:\WINDOWS\system.ini

2010-07-14 13:17:08 ----D---- C:\WINDOWS\addins

2010-07-14 11:09:08 ----A---- C:\WINDOWS\wininit.ini

2010-07-13 15:54:06 ----D---- C:\temp

2010-07-13 14:51:33 ----D---- C:\Dokumente und Einstellungen\Sascha\Anwendungsdaten\SolidWorks

2010-07-13 13:20:07 ----D---- C:\Programme\FreePDF_XP

2010-07-09 13:01:00 ----D---- C:\WINDOWS\AppPatch

2010-07-09 13:00:59 ----D---- C:\Programme\Gemeinsame Dateien

2010-07-08 18:07:14 ----D---- C:\WINDOWS\system32\drivers\etc

2010-07-08 13:57:33 ----D---- C:\WINDOWS\repair

2010-07-08 13:51:09 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

2010-07-08 12:54:33 ----D---- C:\Programme\Panzerkrieg_&_Blitzkrieg_RT

2010-07-07 13:52:25 ----D---- C:\02 Privat

2010-07-06 16:40:04 ----SD---- C:\WINDOWS\Tasks

2010-07-02 21:39:05 ----A---- C:\WINDOWS\system32\MRT.exe
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R0 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2007-07-23 14576]

R0 DRVMCDB;DRVMCDB; C:\WINDOWS\System32\Drivers\DRVMCDB.SYS [2007-07-23 99808]

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2009-01-19 328728]

R0 Inspect;COMODO Internet Security Firewall Driver; C:\WINDOWS\System32\DRIVERS\inspect.sys [2010-07-14 87104]

R0 ohci1394;OHCI-konformer IEEE 1394-Hostcontroller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]

R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-03-03 48640]

R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-02-23 6656]

R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x); C:\WINDOWS\System32\drivers\sfsync02.sys [2004-12-03 20544]

R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-01-18 77696]

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-07-08 124784]

R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2010-07-14 132808]

R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2010-07-14 25160]

R1 DLARTL_M;DLARTL_M; C:\WINDOWS\System32\Drivers\DLARTL_M.SYS [2007-07-23 30064]

R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]

R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]

R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]

R2 DLABMFSM;DLABMFSM; C:\WINDOWS\System32\Drivers\DLABMFSM.SYS [2007-07-23 37360]

R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\Drivers\DLABOIOM.SYS [2007-07-23 32848]

R2 DLADResM;DLADResM; C:\WINDOWS\System32\Drivers\DLADResM.SYS [2007-07-23 9104]

R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\Drivers\DLAIFS_M.SYS [2007-07-23 108752]

R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\Drivers\DLAOPIOM.SYS [2007-07-23 27216]

R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\Drivers\DLAPoolM.SYS [2007-07-23 16304]

R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\Drivers\DLAUDF_M.SYS [2007-07-23 98448]

R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\Drivers\DLAUDFAM.SYS [2007-07-23 93552]

R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2007-07-23 52000]

R2 LBeepKE;LBeepKE; C:\WINDOWS\System32\Drivers\LBeepKE.sys [2009-06-17 10384]

R3 AESTAud;AE Audio Service; C:\WINDOWS\system32\drivers\AESTAud.sys [2009-02-23 112512]

R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2009-04-01 196144]

R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]

R3 BCM43XX;Treiber für Dell Wireless WLAN Karte; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2008-12-12 1287552]

R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]

R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]

R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2009-06-17 35472]

R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2009-06-17 37392]

R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2009-06-17 28560]

R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]

R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]

R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-22 6163552]

R3 NWIM;AVM VPN Miniport; C:\WINDOWS\system32\DRIVERS\avmnwim.sys [2008-10-02 337200]

R3 O2MDGRDR;O2MDGRDR; C:\WINDOWS\system32\DRIVERS\o2mdg.sys [2009-01-21 51616]

R3 O2SDGRDR;O2SDGRDR; C:\WINDOWS\system32\DRIVERS\o2sdg.sys [2009-01-21 41760]

R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-02-03 120064]

R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2009-02-23 1548339]

R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]

R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]

S0 vixtfcml;vixtfcml; C:\WINDOWS\System32\drivers\tolmeqn.sys [2010-07-19 54016]

S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]

S3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys [2004-10-15 15295]

S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver; C:\WINDOWS\System32\Drivers\BrSerIf.sys [2006-12-12 52224]

S3 BrUsbSer;Brother MFC USB Serial WDM Driver; C:\WINDOWS\System32\Drivers\BrUsbSer.sys [2006-09-03 11904]

S3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024]

S3 BTHMODEM;Bluetooth-Modemkommunikationstreiber; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-14 37888]

S3 BthPan;Bluetooth-Gerät (PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120]

S3 BTHPORT;Bluetooth-Porttreiber; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 273024]

S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944]

S3 catchme;catchme; \??\C:\DOKUME~1\Sascha\LOKALE~1\Temp\catchme.sys []

S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-01-21 18048]

S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-12-30 22016]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2009-12-30 137344]

S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2009-12-30 8320]

S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]

S3 PRODIGY;PRODIGY; C:\WINDOWS\System32\Drivers\PRODIGY.SYS [2006-08-29 32377]

S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136]

S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RTS5121.sys []

S3 Rts516xIR;Realtek IR Driver; C:\WINDOWS\system32\DRIVERS\Rts516xIR.sys []

S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-14 79232]

S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]

S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]

S3 USBCCID;Realtek Smartcard Reader Driver; C:\WINDOWS\system32\DRIVERS\Rts5161ccid.sys []

S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]

S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]

S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]

S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328]

S4 agp440;Intel AGP-Bus-Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]

S4 agpCPQ;Compaq AGP-Bus-Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928]

S4 alim1541;ALI AGP-Bus-Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752]

S4 amdagp;AMD AGP-Bus-Filtertreiber; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008]

S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952]

S4 sisagp;SIS AGP-Bus-Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960]

S4 viaagp;VIA AGP-Bus-Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AntiVirMailService;Avira AntiVir MailGuard; C:\Programme\Avira\AntiVir Desktop\avmailc.exe [2010-07-08 337064]

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2010-07-08 135336]

R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2010-07-08 267432]

R2 AntiVirWebService;Avira AntiVir WebGuard; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [2010-07-08 405672]

R2 avmike;AVM FRITZ!Fernzugang IKE Service; C:\Programme\FRITZ!Fernzugang\avmike.exe [2008-10-02 267568]

R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

R2 certsrv;AVM FRITZ!Fernzugang Cert Service; C:\Programme\FRITZ!Fernzugang\certsrv.exe [2008-10-02 132400]

R2 cmdAgent;COMODO Internet Security Helper Service; C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe [2010-07-14 723632]

R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-07-25 153376]

R2 LiveUpdateInstaller;LiveUpdateInstaller; C:\Programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe [2006-04-19 659456]

R2 MSSQL$ACT7;SQL Server (ACT7); C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]

R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-22 168004]

R2 nwtsrv;AVM FRITZ!Fernzugang Client; C:\Programme\FRITZ!Fernzugang\nwtsrv.exe [2008-10-02 161072]

R2 O2FLASH;O2FLASH; C:\WINDOWS\system32\DRIVERS\o2flash.exe [2009-01-21 72224]

R2 PSI_SVC_2;Protexis Licensing V2; c:\programme\gemeinsame dateien\protexis\license service\psiservice_2.exe [2007-04-12 178752]

R2 Registry;Sage Registrierungsdienst; C:\Programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe [2007-04-16 94208]

R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Programme\Dell Support Center\bin\sprtsvc.exe [2008-08-14 201968]

R2 SQLBrowser;SQL Server Browser; C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]

R2 SQLWriter;SQL Server VSS Writer; C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]

R2 STacSV;Audio Service; c:\drivers\audio\r211990\stacsv.exe [2009-02-23 249938]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-07-17 604416]

R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]

R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2008-12-12 24064]

R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

R3 ServiceLayer;ServiceLayer; C:\Programme\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]

S2 ACT! Scheduler;ACT! Scheduler; C:\Programme\ACT\Act for Windows\Act.Scheduler.exe [2008-06-25 65536]

S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]

S2 gupdate;Google Update Service (gupdate); C:\Programme\Google\Update\GoogleUpdate.exe [2010-07-06 136176]

S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service; C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2009-10-15 87336]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-18 867080]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]

S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe [2009-11-18 79360]

S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-07-17 360704]

S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]

S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]

S4 msvsmon80;Visual Studio 2005 Remote Debugger; C:\Programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2005-09-23 2799808]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
 

-----------------EOF-----------------

--- --- ---

Hallo und :hallo:

bitte nen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Hi Arne,
vielen dank erstmal für deine Hilfe.
Hier sind die Log-dateien, ich hoffe das ich alles richtig gemacht habe.

Gruß, Sascha

mbam-log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4338

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

22.07.2010 19:09:10
mbam-log-2010-07-22 (19-09-10).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 155155
Laufzeit: 10 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\drivers\cyitlzra.sys (Backdoor.IEbooot) -> No action taken.

OTL.txt:
OTL Logfile:

Code:

OTL logfile created on: 22.07.2010 19:35:20 - Run 2

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\S****a\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 71,00% Memory free

5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 149,01 Gb Total Space | 82,14 Gb Free Space | 55,12% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: LAPTOP_SG

Current User Name: S****a

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Dokumente und Einstellungen\Sascha\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)

PRC - C:\Programme\COMODO\COMODO Internet Security\cfp.exe (COMODO)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe (Nokia)

PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)

PRC - C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)

PRC - C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)

PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

PRC - C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)

PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)

PRC - C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)

PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)

PRC - c:\drivers\audio\R211990\stacsv.exe (IDT, Inc.)

PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)

PRC - C:\WINDOWS\system32\drivers\o2flash.exe (O2Micro International)

PRC - C:\Programme\FRITZ!Fernzugang\nwtsrv.exe (AVM Berlin)

PRC - C:\Programme\FRITZ!Fernzugang\certsrv.exe (AVM Berlin)

PRC - C:\Programme\FRITZ!Fernzugang\avmike.exe (AVM Berlin)

PRC - C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe (Sage Software, Inc.)

PRC - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)

PRC - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)

PRC - C:\Programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe (Sage Software)

PRC - c:\Programme\Gemeinsame Dateien\Protexis\License Service\PSIService_2.exe (Protexis Inc.)

PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)

PRC - C:\Programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe (Sage Software)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Dokumente und Einstellungen\S****a\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Programme\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.)

MOD - C:\Programme\Logitech\SetPoint\GameHook.dll (Logitech, Inc.)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (cmdAgent) -- C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)

SRV - (AntiVirMailService) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)

SRV - (SolidWorks Licensing Service) -- C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe (SolidWorks)

SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (CoordinatorServiceHost) -- C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe (Dassault Systèmes SolidWorks Corp.)

SRV - (TuneUp.ProgramStatisticsSvc) -- C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)

SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software)

SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)

SRV - (STacSV) -- c:\drivers\audio\R211990\stacsv.exe (IDT, Inc.)

SRV - (O2FLASH) -- C:\WINDOWS\system32\drivers\o2flash.exe (O2Micro International)

SRV - (nwtsrv) -- C:\Programme\FRITZ!Fernzugang\nwtsrv.exe (AVM Berlin)

SRV - (certsrv) -- C:\Programme\FRITZ!Fernzugang\certsrv.exe (AVM Berlin)

SRV - (avmike) -- C:\Programme\FRITZ!Fernzugang\avmike.exe (AVM Berlin)

SRV - (ACT! Scheduler) -- C:\Programme\ACT\Act for Windows\Act.Scheduler.exe (Sage Software, Inc.)

SRV - (Registry) -- C:\Programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe (Sage Software)

SRV - (PSI_SVC_2) -- c:\Programme\Gemeinsame Dateien\Protexis\License Service\PSIService_2.exe (Protexis Inc.)

SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)

SRV - (MSSQL$ACT7) SQL Server (ACT7) -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)

SRV - (SQLBrowser) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)

SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)

SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (LiveUpdateInstaller) -- C:\Programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe (Sage Software)

SRV - (MSSQLServerADHelper) -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)

SRV - (msvsmon80) -- C:\Programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (USBCCID) -- C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys File not found

DRV - (Rts516xIR) -- C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys File not found

DRV - (RSUSBSTOR) -- C:\WINDOWS\System32\Drivers\RTS5121.sys File not found

DRV - (catchme) -- C:\DOKUME~1\S****a\LOKALE~1\Temp\catchme.sys File not found

DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdguard.sys (COMODO)

DRV - (Inspect) -- C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)

DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)

DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)

DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)

DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)

DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)

DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)

DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)

DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)

DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)

DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)

DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)

DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)

DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                           )

DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)

DRV - (O2SDGRDR) -- C:\WINDOWS\system32\drivers\o2sdg.sys (O2Micro )

DRV - (O2MDGRDR) -- C:\WINDOWS\system32\drivers\o2mdg.sys (O2Micro )

DRV - (iaStor) -- C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)

DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)

DRV - (NWIM) -- C:\WINDOWS\system32\drivers\avmnwim.sys (AVM Berlin)

DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)

DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)

DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)

DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)

DRV - (Changer) -- C:\WINDOWS\System32\drivers\changer.sys (Microsoft Corporation)

DRV - (lbrtfdc) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys (Toshiba Corp.)

DRV - (DLADResM) -- C:\WINDOWS\system32\drivers\DLADResM.SYS (Roxio)

DRV - (DLABMFSM) -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS (Roxio)

DRV - (DLAUDF_M) -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS (Roxio)

DRV - (DLAUDFAM) -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS (Roxio)

DRV - (DLAOPIOM) -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS (Roxio)

DRV - (DLABOIOM) -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS (Roxio)

DRV - (DLAPoolM) -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS (Roxio)

DRV - (DLAIFS_M) -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS (Roxio)

DRV - (DRVMCDB) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)

DRV - (DLARTL_M) -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS (Roxio)

DRV - (DLACDBHM) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Roxio)

DRV - (DRVNDDM) -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Roxio)

DRV - (BrSerIf) -- C:\WINDOWS\system32\drivers\brserif.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) -- C:\WINDOWS\system32\drivers\brusbser.sys (Brother Industries Ltd.)

DRV - (PRODIGY) -- C:\WINDOWS\system32\drivers\prodigy.sys (B-phreaks)

DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)

DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)

DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology)

DRV - (BrScnUsb) -- C:\WINDOWS\system32\drivers\brscnusb.sys (Brother Industries Ltd.)

DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)

DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)

DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)

DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)

DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)

DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)

DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)

DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)

DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)

DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)

DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)

DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)

DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)

DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.msn.com/sphome.aspx

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = hxxp://g.uk.msn.com/USSMB/8

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.live.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245

IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=ffpro&type=moz35awe&p="

FF - prefs.js..browser.search.selectedEngine: "Ecosia"

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.startup.homepage: "hxxp://www.ecosia.org/index.php"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1

FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6

FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:1.0.5

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.5.8.6

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: C:\Programme\Mozilla Firefox\components [2009.07.17 10:56:44 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2009.11.18 08:50:18 | 000,000,000 | ---D | M]

 

[2009.08.28 11:13:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Mozilla\Extensions

[2010.07.07 13:05:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\S***a\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions

[2010.04.29 00:28:12 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2010.04.18 02:39:24 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}

[2010.07.07 13:04:58 | 000,000,000 | ---D | M] (Ecosia (eco-friendly search engine)) -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}

[2009.08.28 17:42:00 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.04.18 02:39:51 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}

[2010.07.07 13:05:01 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2009.10.14 18:21:24 | 000,155,648 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Programme\Mozilla Firefox\plugins\npEModelPlugin.dll

[2009.06.24 14:37:42 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2009.06.24 14:37:42 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2009.06.24 14:37:42 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2009.06.24 14:37:42 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2009.06.24 14:37:42 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.07.08 18:07:14 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)

O4 - HKLM..\Run: [Act! Preloader] C:\Programme\ACT\Act for Windows\ActSage.exe (Sage Software, Inc.)

O4 - HKLM..\Run: [Act.Outlook.Service] C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe (Sage Software, Inc.)

O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)

O4 - HKLM..\Run: [COMODO Internet Security] C:\Programme\COMODO\COMODO Internet Security\cfp.exe (COMODO)

O4 - HKLM..\Run: [ControlCenter3] C:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [IndexSearch] C:\Programme\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)

O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [PaperPort PTD] C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)

O4 - HKCU..\Run: [PC Suite Tray] C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Status Monitor.lnk = C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Programme\Microsoft ActiveSync\aatp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.04.25 17:00:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.07.22 19:17:27 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\S****a\Desktop\OTL.exe

[2010.07.21 14:29:12 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\S****a\Recent

[2010.07.21 12:32:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Comodo

[2010.07.21 12:32:18 | 000,171,552 | ---- | C] (COMODO) -- C:\WINDOWS\System32\guard32.dll

[2010.07.21 12:32:18 | 000,132,808 | ---- | C] (COMODO) -- C:\WINDOWS\System32\drivers\cmdguard.sys

[2010.07.21 12:32:18 | 000,087,104 | ---- | C] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys

[2010.07.21 12:32:18 | 000,025,160 | ---- | C] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys

[2010.07.21 08:49:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\softonic-de3

[2010.07.21 08:49:05 | 000,000,000 | ---D | C] -- C:\Programme\softonic-de3

[2010.07.19 11:09:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Comodo Downloader

[2010.07.19 08:55:08 | 000,000,000 | ---D | C] -- C:\Programme\trend micro

[2010.07.19 08:54:57 | 000,000,000 | ---D | C] -- C:\rsit

[2010.07.19 08:41:48 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2010.07.19 08:23:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Desktop\Kampf

[2010.07.16 10:47:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\PCHealth

[2010.07.16 10:21:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MpEngineStore

[2010.07.15 22:05:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\Help

[2010.07.15 22:05:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Help

[2010.07.15 21:58:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan

[2010.07.15 21:58:17 | 000,000,000 | ---D | C] -- C:\Programme\Security Task Manager

[2010.07.14 11:29:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Malwarebytes

[2010.07.14 11:29:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.07.14 11:29:37 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.07.14 11:29:37 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.07.14 11:29:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2010.07.14 10:44:36 | 000,000,000 | --SD | C] -- C:\CoFi

[2010.07.13 15:10:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Avira

[2010.07.09 13:02:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2010.07.09 12:19:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Google

[2010.07.08 18:14:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Avira

[2010.07.08 18:12:55 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010.07.08 18:00:57 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010.07.08 17:57:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.07.08 17:57:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.07.08 17:57:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.07.08 17:57:53 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.07.08 17:57:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.07.08 17:56:21 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.07.08 13:03:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Anwendungsdaten\Avira

[2010.07.08 12:57:25 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys

[2010.07.08 12:57:22 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2010.07.08 12:57:22 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys

[2010.07.08 12:57:22 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys

[2010.07.08 11:39:34 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\avastSS.scr

[2010.07.08 11:39:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software

[2010.07.07 07:29:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google

[2010.07.06 16:40:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\Temp

[2010.07.06 16:40:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google

[2010.07.06 16:40:00 | 000,000,000 | ---D | C] -- C:\Programme\Google

[2010.07.06 16:40:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S****a\Lokale Einstellungen\Anwendungsdaten\Google

[2010.07.05 16:53:20 | 000,000,000 | ---D | C] -- C:\Programme\SotS Gold Demo

[2010.06.28 13:57:14 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy

[2010.06.28 13:57:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy

[2010.06.28 13:39:49 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys

[2010.06.28 13:39:49 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys

[2010.06.28 13:38:13 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys

[2010.06.28 13:38:13 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys

[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.07.22 19:36:56 | 000,772,096 | ---- | M] () -- C:\WINDOWS\System32\drivers\cyitlzra.sys

[2010.07.22 19:17:25 | 000,094,054 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001

[2010.07.22 19:15:24 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\S****a\Desktop\OTL.exe

[2010.07.22 19:12:00 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\pknndmet.sys

[2010.07.22 19:00:00 | 000,000,510 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job

[2010.07.22 18:54:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010.07.22 18:38:50 | 000,000,952 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

[2010.07.22 16:58:08 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010.07.22 07:11:53 | 000,200,610 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2010.07.22 07:06:03 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.07.22 07:05:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.07.22 07:05:49 | 3215,863,808 | -HS- | M] () -- C:\hiberfil.sys

[2010.07.21 14:29:35 | 010,485,760 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\NTUSER.DAT

[2010.07.21 14:29:32 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\S****a\ntuser.ini

[2010.07.21 14:29:08 | 000,000,824 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Status Monitor.lnk

[2010.07.21 12:33:16 | 000,000,790 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\COMODO Internet Security.lnk

[2010.07.21 12:32:11 | 000,171,552 | ---- | M] (COMODO) -- C:\WINDOWS\System32\guard32.dll

[2010.07.21 12:32:11 | 000,132,808 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdguard.sys

[2010.07.21 12:32:11 | 000,087,104 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys

[2010.07.21 12:32:11 | 000,025,160 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys

[2010.07.19 08:41:54 | 000,000,656 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\Desktop\CCleaner.lnk

[2010.07.19 07:32:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.07.16 13:03:34 | 001,169,868 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.07.16 13:03:34 | 000,511,116 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.07.16 13:03:34 | 000,492,412 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.07.16 13:03:34 | 000,103,894 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.07.16 13:03:34 | 000,090,192 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.07.16 10:34:54 | 000,304,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.07.16 10:25:34 | 000,000,127 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI

[2010.07.16 09:43:47 | 000,107,132 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\Desktop\diag

[2010.07.16 09:06:45 | 000,003,457 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\.recently-used.xbel

[2010.07.16 07:21:01 | 000,000,130 | ---- | M] () -- C:\WINDOWS\cfplogvw.INI

[2010.07.14 13:44:22 | 000,000,654 | ---- | M] () -- C:\WINDOWS\win.ini

[2010.07.14 13:44:22 | 000,000,281 | RHS- | M] () -- C:\boot.ini

[2010.07.14 13:44:22 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.07.14 11:09:08 | 000,000,610 | ---- | M] () -- C:\WINDOWS\wininit.ini

[2010.07.13 12:13:15 | 000,150,118 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\Desktop\Drehmaschine.pdf

[2010.07.12 11:33:12 | 000,284,610 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\Desktop\gmer1.0.15.15279.zip

[2010.07.09 11:47:23 | 000,002,953 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT

[2010.07.08 18:07:14 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010.07.08 16:19:17 | 003,728,433 | R--- | M] () -- C:\Dokumente und Einstellungen\S****a\Desktop\CoFi.exe

[2010.07.08 13:49:07 | 000,124,784 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys

[2010.07.08 13:49:05 | 000,017,016 | ---- | M] (AVIRA GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys

[2010.07.08 13:49:03 | 000,051,992 | ---- | M] (AVIRA GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys

[2010.07.08 12:57:37 | 000,001,673 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk

[2010.07.05 17:36:29 | 000,094,054 | ---- | M] () -- C:\WINDOWS\System32\nvModes.dat

[2010.07.05 16:53:54 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb

[2010.07.05 16:53:54 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb

[2010.07.01 14:16:32 | 000,000,937 | ---- | M] () -- C:\Dokumente und Einstellungen\S****a\Desktop\Spybot - Search & Destroy.lnk

[2010.06.28 22:57:33 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\avastSS.scr

[2010.06.28 14:54:33 | 000,408,639 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100628-171448.backup

[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.07.22 19:12:00 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\pknndmet.sys

[2010.07.21 12:33:16 | 000,000,790 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\COMODO Internet Security.lnk

[2010.07.20 16:40:48 | 000,002,272 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.07.19 08:41:54 | 000,000,656 | ---- | C] () -- C:\Dokumente und Einstellungen\S****a\Desktop\CCleaner.lnk

[2010.07.16 10:25:34 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI

[2010.07.16 09:43:46 | 000,107,132 | ---- | C] () -- C:\Dokumente und Einstellungen\S****a\Desktop\diag

[2010.07.16 09:06:45 | 000,003,457 | ---- | C] () -- C:\Dokumente und Einstellungen\S****a\.recently-used.xbel

[2010.07.14 10:48:40 | 3215,863,808 | -HS- | C] () -- C:\hiberfil.sys

[2010.07.13 12:13:15 | 000,150,118 | ---- | C] () -- C:\Dokumente und Einstellungen\Sascha\Desktop\Drehmaschine.pdf

[2010.07.12 23:06:37 | 000,000,824 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Status Monitor.lnk

[2010.07.12 11:43:34 | 000,292,864 | ---- | C] () -- C:\Dokumente und Einstellungen\S****a\Desktop\gmer.exe

[2010.07.12 11:33:04 | 000,284,610 | ---- | C] () -- C:\Dokumente und Einstellungen\S****a\Desktop\gmer1.0.15.15279.zip

[2010.07.08 18:01:08 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2010.07.08 18:01:00 | 000,262,448 | ---- | C] () -- C:\cmldr

[2010.07.08 17:57:54 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.07.08 17:57:53 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.07.08 17:57:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.07.08 17:57:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.07.08 17:57:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.07.08 16:18:40 | 003,728,433 | R--- | C] () -- C:\Dokumente und Einstellungen\S****a\Desktop\CoFi.exe

[2010.07.08 12:57:37 | 000,001,673 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk

[2010.07.06 16:40:04 | 000,001,088 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010.07.06 16:40:03 | 000,001,084 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010.06.28 13:57:28 | 000,000,937 | ---- | C] () -- C:\Dokumente und Einstellungen\S****a\Desktop\Spybot - Search & Destroy.lnk

[2010.06.28 13:42:13 | 000,772,096 | ---- | C] () -- C:\WINDOWS\System32\drivers\cyitlzra.sys

[2010.06.28 13:36:52 | 000,000,016 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\qcopjv.dat

[2010.04.13 18:12:04 | 000,000,234 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini

[2010.04.13 18:12:04 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini

[2010.04.13 18:11:44 | 000,000,425 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI

[2010.04.13 18:11:44 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI

[2010.04.13 18:06:41 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll

[2010.04.13 18:06:41 | 000,000,091 | ---- | C] () -- C:\WINDOWS\Brfaxrx.ini

[2010.04.13 17:59:32 | 000,031,664 | ---- | C] () -- C:\WINDOWS\maxlink.ini

[2010.03.24 13:17:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\KHKSManC.INI

[2010.02.01 16:12:43 | 000,000,801 | ---- | C] () -- C:\WINDOWS\solvermfc.INI

[2009.11.25 15:20:49 | 000,000,130 | ---- | C] () -- C:\WINDOWS\cfplogvw.INI

[2009.11.18 08:50:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI

[2009.10.19 14:28:18 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll

[2009.08.28 11:20:31 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2009.07.17 12:07:32 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009.07.09 18:13:04 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2009.07.09 18:13:04 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2009.07.09 18:13:04 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2009.07.09 18:13:04 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2009.07.09 18:10:04 | 000,001,501 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2009.07.09 15:36:53 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2009.07.09 15:28:20 | 000,000,610 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2009.07.09 15:26:32 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll

[2009.07.09 15:26:30 | 000,753,664 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll

[2008.04.25 16:57:02 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2007.08.21 21:46:34 | 000,059,160 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll

[2001.08.29 19:16:58 | 000,452,096 | ---- | C] () -- C:\WINDOWS\System32\hidcrtp.dll

[1998.07.20 11:41:02 | 000,226,816 | ---- | C] () -- C:\WINDOWS\System32\VCFI5DE.dll

< End of report >

--- --- ---

Extras.txt
OTL Logfile:

Code:

OTL Extras logfile created on: 22.07.2010 19:35:20 - Run 2

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\Sascha\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 71,00% Memory free

5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 149,01 Gb Total Space | 82,14 Gb Free Space | 55,12% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: LAPTOP_SG

Current User Name: Sascha

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\Gibbs\GibbsCAM\8.7.16_NLO(w)\Virtual.exe" = C:\Programme\Gibbs\GibbsCAM\8.7.16_NLO(w)\Virtual.exe:*:Disabled:GibbsCAM 2007 v8.7.16_NLO(w) -- (Gibbs and Associates)

"C:\Programme\SolidWorks Corp\SolidWorks eDrawings\EModelViewer.exe" = C:\Programme\SolidWorks Corp\SolidWorks eDrawings\EModelViewer.exe:*:Disabled:SolidWorks eDrawings 2010 -- (Dassault Systèmes SolidWorks Corp.)

"C:\Programme\ACT\Act for Windows\ActSage.exe" = C:\Programme\ACT\Act for Windows\ActSage.exe:*:Enabled:ACT! by Sage -- (Sage Software, Inc.)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0580A7ED-75C0-44EA-B90F-2C566C79B8E4}" = ACT! by Sage Premium 2008 (10.0)

"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer

"{1959101B-E34C-4266-8915-20F23B5BCF43}" = SolidWorks eDrawings 2010

"{19DC9559-9C20-4A46-A67D-7ECBA52A2788}" = Nokia PC Suite

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86

"{23637147-34AA-4C9C-A1D1-58B6419A3767}" = Sage Office Line

"{24D18C8F-7C7C-4620-9A8E-71145762A2A0}" = Decker Maschinenelemente

"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 15

"{2AEBE10C-D819-4EBF-BC60-03BF2327D340}" = Microsoft XML Parser and SDK

"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (ACT7)

"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer

"{2D8D14CC-5B31-44B9-87FC-BEC3D8AFFD1D}" = SolidWorks Explorer 2010 SP0

"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{37C19C2D-9BB3-4CB0-A83C-26213C73C0BD}" = AVM FRITZ!Fernzugang

"{380E8FE7-D202-47FE-904E-908F55B48B84}" = GibbsCAM 2007, v8.7.16

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe

"{41844F24-9CA6-11D4-A74E-00D0B76FE248}" = VBA (2816b)

"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU

"{52C97E71-DC72-4BFC-8F27-3DD60228FBAF}" = FTP-Watchdog

"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)

"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009

"{56DCD20A-E558-4396-AF59-14D15AA737BB}" = DWGeditor

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{736D2DAD-3D87-4CAA-8646-83D238AD68E0}" = PhotoView 360

"{7397EDED-F38A-4654-B669-BF61065803D0}" = PC Connectivity Solution

"{741D603B-85BB-4077-A779-4FCBAAF3AA3E}" = Microsoft SQL Server 2005-Abwärtskompatibilität

"{75AE638F-750A-11DF-96D5-005056806466}" = Google Earth Plug-in

"{7A8FF745-BBC5-482B-88E4-18D3178249A9}" = ScanSoft PaperPort 11

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{842EFEDE-6700-4CC8-802A-444C7F927021}" = Dell Sicherungs- und Wiederherstellungs-Manager

"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU

"{89661B04-C646-4412-B6D3-5E19F02F1F37}" = EAX4 Unified Redist

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack

"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard

"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components

"{90120000-00B4-0407-0000-0000000FF1CE}" = Microsoft Office Project MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{901C0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Access 2003 Runtime

"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = USB2.0 Card Reader Software

"{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}" = Silent Hunter III

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch

"{AF2066F6-7C57-46A1-A306-077EBBFC7B2B}" = SolidWorks 2010 SP0

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B7908330-93A8-4DB1-B6EE-6B0446E26939}" = Voice Tracer

"{B9C9DB4C-6D77-4AE9-AD1C-C708C23239A0}" = Nokia Connectivity Cable Driver

"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU

"{D8DDC00B-2881-407D-AAC2-44AEE70AF0B7}" = Nokia Software Updater

"{D9461574-5FC0-4641-BBDC-D1038B196F55}" = Brother MFL-Pro Suite MFC-490CW

"{D98C9637-93DA-44DB-B73A-B11A1192AB26}" = GameShadow

"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)

"{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}" = Microsoft SQL Server VSS Writer

"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint

"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack

"{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}" = Microsoft SQL Server Native Client

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"05B59228C7E1C21DFBE89260F879BD95880548D8" = Windows-Treiberpaket - Nokia Modem  (10/05/2009 4.2)

"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"8CDCFB95BB84DD9C0F88F22266A0CA86035E55BA" = Windows-Treiberpaket - Nokia Modem  (06/01/2009 7.01.0.4)

"ActLook" = ActLook

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Avira AntiVir Desktop" = Avira AntiVir Premium

"Baphomets Fluch - Der schlafende Drache" = Baphomets Fluch - Der schlafende Drache

"Broadcom 802.11b Network Adapter" = Dienstprogramm für Dell Wireless WLAN Karte

"CCleaner" = CCleaner

"COMODO Internet Security" = COMODO Internet Security

"ENTERPRISE" = Microsoft Office Enterprise 2007

"FLV Player" = FLV Player 2.0 (build 25)

"Free YouTube Download_is1" = Free YouTube Download 2.4

"FreePDF_XP" = FreePDF (Remove only)

"GPL Ghostscript 8.70" = GPL Ghostscript 8.70

"HPP-21" = HPP-21

"InstallShield_{0580A7ED-75C0-44EA-B90F-2C566C79B8E4}" = ACT! by Sage Premium 2008 (10.0)

"InstallShield_{380E8FE7-D202-47FE-904E-908F55B48B84}" = GibbsCAM 2007, v8.7.16_NLO(w)

"InstallShield_{9720C029-0C2C-4D1E-9DE0-E89971C4C8C7}" = Silent Hunter III

"IsoBuster_is1" = IsoBuster 1.5

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU

"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft SQL Server 2005" = Microsoft SQL Server 2005

"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU

"Mozilla Firefox (3.5)" = Mozilla Firefox (3.5)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nokia PC Suite" = Nokia PC Suite

"NSS" = NSS (remove only)

"NVIDIA Drivers" = NVIDIA Drivers

"PDF-XChange 3_is1" = PDF-XChange 3

"PrintKey2000" = PrintKey2000

"PRJPRO" = Microsoft Office Project Professional 2007

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Rigs of Rods" = Rigs of Rods 0.36.2

"Security Task Manager" = Security Task Manager 1.7h

"softonic-de3 Toolbar" = softonic-de3 Toolbar

"SolidWorks Installation Manager 20100-40000-1100-200" = SolidWorks 2010 SP0

"Uninstall_is1" = Uninstall 1.0.0.1

"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7

"Windows CE Services" = Microsoft ActiveSync 3.8

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinGimp-2.0_is1" = GIMP 2.6.8

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7

"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 22.07.2010 10:51:12 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:51:12 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:51:12 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:53:26 | Computer Name = LAPTOP_SG | Source = VSS | ID = 5013

Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"

 aufgerufene Routine "MoveFilesInDirectory" ist mit Status "0x80070005" (konvertiert

 in 0x800423f4) fehlgeschlagen.

 

Error - 22.07.2010 10:55:01 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:55:01 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:55:01 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:55:01 | Computer Name = LAPTOP_SG | Source = SQLWRITER | ID = 24583

Description = Sqllib error: OLEDB Error encountered calling IDBInitialize::Initialize.

 hr = 0x80040e4d.  SQLSTATE: 28000, Native Error: 18456 Error state: 1, Severity: 14

Source:

 Microsoft SQL Native Client Error message: Login failed for user 'NT-AUTORITÄT\SYSTEM'.

DBPROP_INIT_DATASOURCE:

 LAPTOP_SG\ACT7 DBPROP_INIT_CATALOG: master DBPROP_AUTH_INTEGRATED: SSPI 

 

Error - 22.07.2010 10:57:02 | Computer Name = LAPTOP_SG | Source = VSS | ID = 5013

Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"

 aufgerufene Routine "MoveFilesInDirectory" ist mit Status "0x80070005" (konvertiert

 in 0x800423f4) fehlgeschlagen.

 

Error - 22.07.2010 11:06:21 | Computer Name = LAPTOP_SG | Source = VSS | ID = 5013

Description = Volumeschattenkopie-Dienstfehler: Von Schattenkopieautor "RemovableStorageManager"

 aufgerufene Routine "MoveFilesInDirectory" ist mit Status "0x80070005" (konvertiert

 in 0x800423f4) fehlgeschlagen.

 

[ OSession Events ]

Error - 22.04.2010 01:39:40 | Computer Name = LAPTOP_SG | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3610

 seconds with 300 seconds of active time.  This session ended with a crash.

 

Error - 24.04.2010 20:43:20 | Computer Name = LAPTOP_SG | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 179

 seconds with 120 seconds of active time.  This session ended with a crash.

 

Error - 14.05.2010 19:46:30 | Computer Name = LAPTOP_SG | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4561

 seconds with 540 seconds of active time.  This session ended with a crash.

 

Error - 14.05.2010 19:55:25 | Computer Name = LAPTOP_SG | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 277

 seconds with 180 seconds of active time.  This session ended with a crash.

 

Error - 15.05.2010 09:52:19 | Computer Name = LAPTOP_SG | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 243

 seconds with 120 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 19.07.2010 06:12:30 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden

 Fehlers nicht gestartet:   %%1053

 

Error - 19.07.2010 09:35:02 | Computer Name = LAPTOP_SG | Source = ACPIEC | ID = 327681

Description = \Device\ACPIEC: Die Hardware des Embedded Controllers (EC) hat nicht

 innerhalb des Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware

 oder -Firmware bzw. auf ein schlecht angelegtes BIOS hin, das auf nicht sichere

 Art und Weise auf den EC zugreift. Der EC-Treiber wird erneut versuchen, die fehlgeschlagene

 Transaktion durchzuführen.

 

Error - 19.07.2010 09:35:53 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   Inspect

 

Error - 19.07.2010 09:37:38 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7009

Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst

 auf Anwendungsebene.

 

Error - 19.07.2010 09:37:38 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden

 Fehlers nicht gestartet:   %%1053

 

Error - 20.07.2010 07:25:30 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7024

Description = Der Dienst "SQL Server (ACT7)" wurde mit folgendem dienstspezifischem

 Fehler beendet: 1814 (0x716).

 

Error - 20.07.2010 07:25:35 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   Inspect

 

Error - 20.07.2010 07:40:40 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7031

Description = Der Dienst "Avira AntiVir MailGuard" wurde unerwartet beendet. Dies

 ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden

 durchgeführt: Starten Sie den Dienst neu..

 

Error - 20.07.2010 11:20:32 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   Inspect

 

Error - 21.07.2010 01:58:54 | Computer Name = LAPTOP_SG | Source = Service Control Manager | ID = 7026

Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:

   Inspect

 

[ TuneUp Events ]

Error - 14.07.2010 05:31:17 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-14 11:31:17', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','3668',0)

 

Error - 14.07.2010 07:18:04 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-14 13:18:04', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','2616',0)

 

Error - 17.07.2010 18:28:22 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-18 00:28:22', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','2456',0)

 

Error - 17.07.2010 20:42:32 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-18 02:42:32', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','1960',0)

 

Error - 19.07.2010 01:34:17 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-19 07:34:16', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','3192',0)

 

Error - 19.07.2010 02:29:02 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-19 08:29:02', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','4028',0)

 

Error - 19.07.2010 02:31:47 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-19 08:31:47', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','3424',0)

 

Error - 19.07.2010 02:45:20 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-19 08:45:20', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','3124',0)

 

Error - 19.07.2010 05:19:31 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-19 11:19:30', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','3004',0)

 

Error - 20.07.2010 17:57:07 | Computer Name = LAPTOP_SG | Source = TuneUp Program Statistics | ID = 131840

Description = SQL Error: near "anti": syntax error; when executing SQL: INSERT INTO

 ActiveApps (Started, Exe, ProcID, Resumed) VALUES ('2010-07-20 23:57:07', '\device\harddiskvolume2\programme\malwarebytes'

 anti-malware\mbam.exe','2040',0)

 

 

< End of report >

--- --- ---

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

[2010.07.22 19:36:56 | 000,772,096 | ---- | M] () -- C:\WINDOWS\System32\drivers\cyitlzra.sys

[2010.07.22 19:17:25 | 000,094,054 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001

[2010.07.22 19:12:00 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\pknndmet.sys

[2010.06.28 13:36:52 | 000,000,016 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\qcopjv.dat

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Hi Arne,
der Virenscaner jammert immer noch :crazy:
Hier der Logfile:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoRecentDocsNetHood deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
File move failed. C:\WINDOWS\system32\drivers\cyitlzra.sys scheduled to be moved on reboot.
C:\WINDOWS\system32\nvModes.001 moved successfully.
File C:\WINDOWS\System32\drivers\pknndmet.sys not found.
C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\qcopjv.dat moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: CURRENT_USER

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Sascha
->Temp folder emptied: 110145220 bytes
->Temporary Internet Files folder emptied: 3815837 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 110654290 bytes
->Flash cache emptied: 2717 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 3950983 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 735625 bytes
RecycleBin emptied: 47846953 bytes

Total Files Cleaned = 264,00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07232010_140155

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\system32\drivers\cyitlzra.sys scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hi Arne,
hier ist der Logfile vom CoFi.

Gruß, Sascha

Combofix Logfile:

Code:

ComboFix 10-07-23.01 - Sascha 24.07.2010   1:21.3.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3067.2470 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Sascha\Desktop\CoFi.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2010-06-23 bis 2010-07-23  ))))))))))))))))))))))))))))))

.
 

2010-07-23 12:01 . 2010-07-23 12:01        --------        d-----w-        C:\_OTL

2010-07-21 10:32 . 2010-07-22 05:13        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Comodo

2010-07-21 10:32 . 2010-07-21 10:32        87104        ----a-w-        c:\windows\system32\drivers\inspect.sys

2010-07-21 10:32 . 2010-07-21 10:32        25160        ----a-w-        c:\windows\system32\drivers\cmdhlp.sys

2010-07-21 10:32 . 2010-07-21 10:32        171552        ----a-w-        c:\windows\system32\guard32.dll

2010-07-21 10:32 . 2010-07-21 10:32        132808        ----a-w-        c:\windows\system32\drivers\cmdguard.sys

2010-07-21 06:49 . 2010-07-21 06:49        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\softonic-de3

2010-07-21 06:49 . 2010-07-21 07:10        --------        d-----w-        c:\programme\softonic-de3

2010-07-20 14:40 . 2010-07-20 14:40        2272        ----a-w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

2010-07-19 09:09 . 2010-07-21 08:03        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Comodo Downloader

2010-07-19 06:55 . 2010-07-19 06:55        --------        d-----w-        c:\programme\trend micro

2010-07-19 06:54 . 2010-07-19 06:55        --------        d-----w-        C:\rsit

2010-07-19 06:41 . 2010-07-19 06:41        --------        d-----w-        c:\programme\CCleaner

2010-07-16 08:47 . 2010-07-16 08:47        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\PCHealth

2010-07-16 08:21 . 2010-07-16 08:25        --------        d-----w-        c:\windows\system32\MpEngineStore

2010-07-15 20:05 . 2010-07-15 20:05        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\Help

2010-07-15 19:59 . 2009-02-09 10:51        678400        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\_entreelist.dll

2010-07-15 19:59 . 2009-02-09 10:51        740352        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\_enviewlist.dll

2010-07-15 19:59 . 2010-07-15 19:59        232        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_D2C91C733BB90BC48AC36212C3370CDB.dll

2010-07-15 19:59 . 2010-07-15 19:59        121        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_C01EBEA2918DFBE4CB0630FB32723D04.dll

2010-07-14 09:29 . 2010-07-14 09:29        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Malwarebytes

2010-07-14 09:29 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-14 09:29 . 2010-07-14 09:29        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2010-07-14 09:29 . 2010-07-14 09:29        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-07-14 09:29 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-07-13 13:10 . 2010-07-13 13:10        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Anwendungsdaten\Avira

2010-07-08 16:14 . 2010-07-08 16:14        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\Avira

2010-07-08 11:03 . 2010-07-08 11:03        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Avira

2010-07-08 10:57 . 2010-07-08 11:49        124784        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-07-08 10:57 . 2010-07-08 11:49        17016        ----a-w-        c:\windows\system32\drivers\avgntmgr.sys

2010-07-08 10:57 . 2010-07-08 11:49        51992        ----a-w-        c:\windows\system32\drivers\avgntdd.sys

2010-07-08 09:39 . 2010-06-28 20:57        38848        ----a-w-        c:\windows\avastSS.scr

2010-07-08 09:39 . 2010-07-08 09:39        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Alwil Software

2010-07-07 05:29 . 2010-07-07 05:29        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google

2010-07-06 14:40 . 2010-07-06 14:49        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\Temp

2010-07-06 14:40 . 2010-07-06 14:40        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google

2010-07-06 14:40 . 2010-07-06 14:45        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\Google

2010-07-06 14:40 . 2010-07-06 14:43        --------        d-----w-        c:\programme\Google

2010-07-05 14:53 . 2010-07-14 09:23        --------        d-----w-        c:\programme\SotS Gold Demo

2010-06-28 11:57 . 2010-07-23 23:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy

2010-06-28 11:57 . 2010-06-28 12:27        --------        d-----w-        c:\programme\Spybot - Search & Destroy

2010-06-28 11:42 . 2010-07-23 23:31        772096        ----a-w-        c:\windows\system32\drivers\cyitlzra.sys

2010-06-28 11:39 . 2008-04-13 22:10        34688        -c--a-w-        c:\windows\system32\dllcache\lbrtfdc.sys

2010-06-28 11:39 . 2008-04-13 22:10        34688        ----a-w-        c:\windows\system32\drivers\lbrtfdc.sys

2010-06-28 11:38 . 2008-04-13 22:11        8192        -c--a-w-        c:\windows\system32\dllcache\changer.sys

2010-06-28 11:38 . 2008-04-13 22:11        8192        ----a-w-        c:\windows\system32\drivers\changer.sys
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-23 23:06 . 2009-07-17 11:07        952        --sha-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

2010-07-23 23:06 . 2009-07-17 11:07        952        --sha-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

2010-07-23 12:20 . 2010-07-15 19:58        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan

2010-07-20 11:57 . 2009-11-18 06:30        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\SolidWorks

2010-07-19 09:32 . 2009-11-25 11:40        --------        d-----w-        c:\programme\COMODO

2010-07-16 11:03 . 2008-04-25 09:46        511116        ----a-w-        c:\windows\system32\perfh007.dat

2010-07-16 11:03 . 2008-04-25 09:46        103894        ----a-w-        c:\windows\system32\perfc007.dat

2010-07-16 07:06 . 2010-05-08 22:12        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\gtk-2.0

2010-07-15 20:05 . 2010-07-15 19:58        --------        d-----w-        c:\programme\Security Task Manager

2010-07-15 19:59 . 2010-07-15 19:58        336        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_A1872CB26F7FE25459BE10A825F2B1C2.dll

2010-07-13 11:20 . 2009-08-28 09:20        --------        d-----w-        c:\programme\FreePDF_XP

2010-07-08 11:51 . 2009-09-01 15:18        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2010-07-08 10:54 . 2009-12-14 13:10        --------        d-----w-        c:\programme\Panzerkrieg_&_Blitzkrieg_RT

2010-07-05 15:36 . 2009-07-09 13:20        94054        ----a-w-        c:\windows\system32\nvModes.dat

2010-06-14 14:31 . 2008-04-25 14:58        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-01 12:08 . 2010-06-01 12:08        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\EDrawings

2010-05-22 15:45 . 2010-05-22 15:45        530        ----a-w-        c:\windows\eReg.dat

2010-05-02 08:00 . 2008-04-25 09:46        1860480        ----a-w-        c:\windows\system32\win32k.sys

2010-04-28 21:14 . 2010-04-28 21:14        2560        ----a-w-        c:\windows\_MSRSTRT.EXE

2010-04-28 21:10 . 2010-04-28 21:10        114688        ----a-w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\npmozax.dll

2010-04-28 21:10 . 2010-04-18 00:39        52224        ----a-w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll

2009-10-26 07:22 . 2009-10-26 07:19        24437624        ----a-w-        c:\programme\NokiaSoftwareUpdaterSetup_de.exe

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
 

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

2010-06-03 16:24        2736736        ----a-w-        c:\programme\softonic-de3\tbsoft.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
 

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"="c:\programme\IDT\WDM\sttray.exe" [2009-02-22 483420]

"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-22 729088]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-22 13590528]

"nwiz"="nwiz.exe" [2009-01-22 1630208]

"NVHotkey"="nvHotkey.dll" [2009-01-22 90112]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-12 2220032]

"Act.Outlook.Service"="c:\programme\ACT\Act for Windows\Act.Outlook.Service.exe" [2008-08-14 20480]

"Act! Preloader"="c:\programme\ACT\Act for Windows\ActSage.exe" [2008-06-25 393216]

"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2009-08-06 381440]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]

"ControlCenter3"="c:\programme\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"NvMediaCenter"="NvMCTray.dll" [2009-01-22 86016]

"IndexSearch"="c:\programme\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]

"PaperPort PTD"="c:\programme\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-07-08 282792]

"COMODO Internet Security"="c:\programme\COMODO\COMODO Internet Security\cfp.exe" [2010-07-21 1800464]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2009-12-11 813584]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ISUSPM"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe" -scheduler

"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

"d:\angebote.ftpwd"=d:\angebote.ftpwd
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"DellSupportCenter"="c:\programme\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

"dscactivate"="c:\programme\Dell Support Center\gs_agent\custom\dsca.exe"

"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe"

"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k

"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit

"BrMfcWnd"=c:\programme\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Programme\\Gibbs\\GibbsCAM\\8.7.16_NLO(w)\\Virtual.exe"=

"c:\\Programme\\SolidWorks Corp\\SolidWorks eDrawings\\EModelViewer.exe"=

"c:\\Programme\\ACT\\Act for Windows\\ActSage.exe"=
 

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [21.07.2010 12:32 132808]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [21.07.2010 12:32 25160]

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [08.07.2010 13:51 337064]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [08.07.2010 12:57 135336]

R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [08.07.2010 13:51 405672]

R2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\programme\FRITZ!Fernzugang\avmike.exe [02.10.2008 20:42 267568]

R2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\programme\FRITZ!Fernzugang\certsrv.exe [02.10.2008 20:43 132400]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [11.12.2009 08:15 10384]

R2 LiveUpdateInstaller;LiveUpdateInstaller;c:\programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe [19.04.2006 12:47 659456]

R2 MSSQL$ACT7;SQL Server (ACT7);c:\programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [10.02.2007 05:29 29178224]

R2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\programme\FRITZ!Fernzugang\nwtsrv.exe [02.10.2008 20:43 161072]

R2 Registry;Sage Registrierungsdienst;c:\programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe [16.04.2007 15:27 94208]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [09.07.2009 18:13 112512]

R3 NWIM;AVM VPN Miniport;c:\windows\system32\drivers\avmnwim.sys [02.10.2008 19:42 337200]

R3 O2MDGRDR;O2MDGRDR;c:\windows\system32\drivers\o2mdg.sys [09.07.2009 18:13 51616]

R3 O2SDGRDR;O2SDGRDR;c:\windows\system32\drivers\o2sdg.sys [09.07.2009 18:13 41760]

S2 ACT! Scheduler;ACT! Scheduler;c:\programme\ACT\Act for Windows\Act.Scheduler.exe [28.08.2009 11:03 65536]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.07.2010 16:40 136176]

S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [15.10.2009 07:51 87336]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [16.03.2010 12:13 137344]

S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [16.03.2010 12:13 8320]

S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [13.01.2010 11:11 32377]

S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys --> c:\windows\system32\Drivers\RTS5121.sys [?]

S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.09.2005 08:01 2799808]
 

--- Andere Dienste/Treiber im Speicher ---
 

*Deregistered* - cyitlzra
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners
 

2010-07-23 c:\windows\Tasks\1-Klick-Wartung.job

- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2009-03-20 13:17]
 

2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-06 14:39]
 

2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-06 14:39]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245

mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen

uInternet Connection Wizard,ShellNext = ftp://ftpuser@gerlach-iv.dyndns.org/

IE: Free YouTube Download - c:\dokumente und einstellungen\Sascha\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll

TCP: {DBA5E288-A303-4E63-AFC1-272D6FE97CDD} = 192.168.3.111

FF - ProfilePath - c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\

FF - prefs.js: browser.search.selectedEngine - Ecosia

FF - prefs.js: browser.startup.homepage - hxxp://www.ecosia.org/index.php

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll

FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\programme\Google\Update\1.2.183.29\npGoogleOneClick8.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: browser.blink_allowed - false

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-07-24 01:31

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************
 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cyitlzra]
 

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'lsass.exe'(1204)

c:\programme\Avira\AntiVir Desktop\avsda.dll
 

- - - - - - - > 'explorer.exe'(2508)

c:\programme\Logitech\SetPoint\GameHook.dll

c:\programme\Logitech\SetPoint\lgscroll.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU

.

Zeit der Fertigstellung: 2010-07-24  01:33:49

ComboFix-quarantined-files.txt  2010-07-23 23:33
 

Vor Suchlauf: 20 Verzeichnis(se), 88.290.852.864 Bytes frei

Nach Suchlauf: 24 Verzeichnis(se), 88.261.222.400 Bytes frei
 

- - End Of File - - EA3C8F6EB0D5762159274728FE04D1CB

--- --- ---

Zitat:

der Virenscaner jammert immer noch

Wo genauer jammerte oder jammert der noch?

Immer noch diese hier? => C:\WINDOWS\system32\drivers\cyitlzra.sys

Edit: Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Driver::

cyitlzra
 

File::

c:\windows\system32\drivers\cyitlzra.sys
 

Rootkit::

c:\windows\system32\drivers\cyitlzra.sys
 

Registry::

[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cyitlzra]

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hi Arne,
das Ding (cyitlzra.sys) treibt mich noch zum Wahnsinn :aufsmaul:

Hier die neue Logdatei:

Combofix Logfile:

Code:

ComboFix 10-07-23.01 - Sascha 24.07.2010  21:18:30.4.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3067.2449 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Sascha\Desktop\CoFi.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Sascha\Desktop\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
 

FILE ::

"c:\windows\system32\drivers\cyitlzra.sys"

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_CYITLZRA

-------\Service_cyitlzra
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-06-24 bis 2010-07-24  ))))))))))))))))))))))))))))))

.
 

2010-07-24 18:46 . 2010-07-24 18:46        --------        d-----r-        c:\dokumente und einstellungen\LocalService\Eigene Dateien

2010-07-23 23:19 . 2010-07-23 23:33        --------        d-----w-        C:\CoFi

2010-07-23 12:01 . 2010-07-23 12:01        --------        d-----w-        C:\_OTL

2010-07-21 10:32 . 2010-07-22 05:13        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Comodo

2010-07-21 10:32 . 2010-07-21 10:32        87104        ----a-w-        c:\windows\system32\drivers\inspect.sys

2010-07-21 10:32 . 2010-07-21 10:32        25160        ----a-w-        c:\windows\system32\drivers\cmdhlp.sys

2010-07-21 10:32 . 2010-07-21 10:32        171552        ----a-w-        c:\windows\system32\guard32.dll

2010-07-21 10:32 . 2010-07-21 10:32        132808        ----a-w-        c:\windows\system32\drivers\cmdguard.sys

2010-07-21 06:49 . 2010-07-21 06:49        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\softonic-de3

2010-07-21 06:49 . 2010-07-21 07:10        --------        d-----w-        c:\programme\softonic-de3

2010-07-20 14:40 . 2010-07-20 14:40        2272        ----a-w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

2010-07-19 09:09 . 2010-07-21 08:03        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Comodo Downloader

2010-07-19 06:55 . 2010-07-19 06:55        --------        d-----w-        c:\programme\trend micro

2010-07-19 06:54 . 2010-07-19 06:55        --------        d-----w-        C:\rsit

2010-07-19 06:41 . 2010-07-19 06:41        --------        d-----w-        c:\programme\CCleaner

2010-07-16 08:47 . 2010-07-16 08:47        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\PCHealth

2010-07-16 08:21 . 2010-07-16 08:25        --------        d-----w-        c:\windows\system32\MpEngineStore

2010-07-15 20:05 . 2010-07-15 20:05        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\Help

2010-07-15 19:59 . 2009-02-09 10:51        678400        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\_entreelist.dll

2010-07-15 19:59 . 2009-02-09 10:51        740352        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\_enviewlist.dll

2010-07-15 19:59 . 2010-07-15 19:59        232        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_D2C91C733BB90BC48AC36212C3370CDB.dll

2010-07-15 19:59 . 2010-07-15 19:59        121        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_C01EBEA2918DFBE4CB0630FB32723D04.dll

2010-07-14 09:29 . 2010-07-14 09:29        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Malwarebytes

2010-07-14 09:29 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-14 09:29 . 2010-07-14 09:29        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2010-07-14 09:29 . 2010-07-14 09:29        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-07-14 09:29 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-07-13 13:10 . 2010-07-13 13:10        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Anwendungsdaten\Avira

2010-07-08 16:14 . 2010-07-08 16:14        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\Avira

2010-07-08 11:03 . 2010-07-08 11:03        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Avira

2010-07-08 10:57 . 2010-07-08 11:49        124784        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-07-08 10:57 . 2010-07-08 11:49        17016        ----a-w-        c:\windows\system32\drivers\avgntmgr.sys

2010-07-08 10:57 . 2010-07-08 11:49        51992        ----a-w-        c:\windows\system32\drivers\avgntdd.sys

2010-07-08 09:39 . 2010-06-28 20:57        38848        ----a-w-        c:\windows\avastSS.scr

2010-07-08 09:39 . 2010-07-08 09:39        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Alwil Software

2010-07-07 05:29 . 2010-07-07 05:29        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google

2010-07-06 14:40 . 2010-07-06 14:49        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\Temp

2010-07-06 14:40 . 2010-07-06 14:40        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google

2010-07-06 14:40 . 2010-07-06 14:45        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\Google

2010-07-06 14:40 . 2010-07-06 14:43        --------        d-----w-        c:\programme\Google

2010-07-05 14:53 . 2010-07-14 09:23        --------        d-----w-        c:\programme\SotS Gold Demo

2010-06-28 11:57 . 2010-07-24 11:31        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy

2010-06-28 11:57 . 2010-06-28 12:27        --------        d-----w-        c:\programme\Spybot - Search & Destroy

2010-06-28 11:39 . 2008-04-13 22:10        34688        -c--a-w-        c:\windows\system32\dllcache\lbrtfdc.sys

2010-06-28 11:39 . 2008-04-13 22:10        34688        ----a-w-        c:\windows\system32\drivers\lbrtfdc.sys

2010-06-28 11:38 . 2008-04-13 22:11        8192        -c--a-w-        c:\windows\system32\dllcache\changer.sys

2010-06-28 11:38 . 2008-04-13 22:11        8192        ----a-w-        c:\windows\system32\drivers\changer.sys
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-24 19:32 . 2009-07-17 11:07        952        --sha-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

2010-07-24 19:32 . 2009-07-17 11:07        952        --sha-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys

2010-07-24 11:27 . 2009-07-09 13:33        --------        d--h--w-        c:\programme\InstallShield Installation Information

2010-07-23 23:36 . 2009-08-28 06:38        73248        ----a-w-        c:\dokumente und einstellungen\Sascha\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2010-07-23 12:20 . 2010-07-15 19:58        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan

2010-07-20 11:57 . 2009-11-18 06:30        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\SolidWorks

2010-07-19 09:32 . 2009-11-25 11:40        --------        d-----w-        c:\programme\COMODO

2010-07-16 11:03 . 2008-04-25 09:46        511116        ----a-w-        c:\windows\system32\perfh007.dat

2010-07-16 11:03 . 2008-04-25 09:46        103894        ----a-w-        c:\windows\system32\perfc007.dat

2010-07-16 07:06 . 2010-05-08 22:12        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\gtk-2.0

2010-07-15 20:05 . 2010-07-15 19:58        --------        d-----w-        c:\programme\Security Task Manager

2010-07-15 19:59 . 2010-07-15 19:58        336        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_A1872CB26F7FE25459BE10A825F2B1C2.dll

2010-07-13 11:20 . 2009-08-28 09:20        --------        d-----w-        c:\programme\FreePDF_XP

2010-07-08 11:51 . 2009-09-01 15:18        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2010-07-08 10:54 . 2009-12-14 13:10        --------        d-----w-        c:\programme\Panzerkrieg_&_Blitzkrieg_RT

2010-07-05 15:36 . 2009-07-09 13:20        94054        ----a-w-        c:\windows\system32\nvModes.dat

2010-06-14 14:31 . 2008-04-25 14:58        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-01 12:08 . 2010-06-01 12:08        --------        d-----w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\EDrawings

2010-05-22 15:45 . 2010-05-22 15:45        530        ----a-w-        c:\windows\eReg.dat

2010-05-02 08:00 . 2008-04-25 09:46        1860480        ----a-w-        c:\windows\system32\win32k.sys

2010-04-28 21:14 . 2010-04-28 21:14        2560        ----a-w-        c:\windows\_MSRSTRT.EXE

2010-04-28 21:10 . 2010-04-28 21:10        114688        ----a-w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\npmozax.dll

2010-04-28 21:10 . 2010-04-18 00:39        52224        ----a-w-        c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll

2009-10-26 07:22 . 2009-10-26 07:19        24437624        ----a-w-        c:\programme\NokiaSoftwareUpdaterSetup_de.exe

.
 

(((((((((((((((((((((((((((((   SnapShot@2010-07-23_23.31.22   )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-07-24 11:15 . 2010-07-24 11:15        16384              c:\windows\temp\Perflib_Perfdata_780.dat

+ 2010-07-24 11:15 . 2010-07-24 11:15        16384              c:\windows\temp\Perflib_Perfdata_61c.dat

+ 2010-07-24 19:27 . 2010-07-24 19:27        16384              c:\windows\temp\Perflib_Perfdata_354.dat

+ 2010-07-24 19:27 . 2010-07-24 19:27        16384              c:\windows\temp\Perflib_Perfdata_2dc.dat

+ 2008-04-25 01:51 . 2010-07-24 11:15        281336              c:\windows\system32\FNTCACHE.DAT

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
 

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

2010-06-03 16:24        2736736        ----a-w-        c:\programme\softonic-de3\tbsoft.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
 

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"="c:\programme\IDT\WDM\sttray.exe" [2009-02-22 483420]

"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-22 729088]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-22 13590528]

"nwiz"="nwiz.exe" [2009-01-22 1630208]

"NVHotkey"="nvHotkey.dll" [2009-01-22 90112]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-12 2220032]

"Act.Outlook.Service"="c:\programme\ACT\Act for Windows\Act.Outlook.Service.exe" [2008-08-14 20480]

"Act! Preloader"="c:\programme\ACT\Act for Windows\ActSage.exe" [2008-06-25 393216]

"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2009-08-06 381440]

"ControlCenter3"="c:\programme\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"NvMediaCenter"="NvMCTray.dll" [2009-01-22 86016]

"IndexSearch"="c:\programme\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]

"PaperPort PTD"="c:\programme\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-07-08 282792]

"COMODO Internet Security"="c:\programme\COMODO\COMODO Internet Security\cfp.exe" [2010-07-21 1800464]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ISUSPM"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe" -scheduler

"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

"d:\angebote.ftpwd"=d:\angebote.ftpwd
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"DellSupportCenter"="c:\programme\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

"dscactivate"="c:\programme\Dell Support Center\gs_agent\custom\dsca.exe"

"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe"

"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k

"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit

"BrMfcWnd"=c:\programme\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Programme\\Gibbs\\GibbsCAM\\8.7.16_NLO(w)\\Virtual.exe"=

"c:\\Programme\\SolidWorks Corp\\SolidWorks eDrawings\\EModelViewer.exe"=

"c:\\Programme\\ACT\\Act for Windows\\ActSage.exe"=
 

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [21.07.2010 12:32 132808]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [21.07.2010 12:32 25160]

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [08.07.2010 13:51 337064]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [08.07.2010 12:57 135336]

R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [08.07.2010 13:51 405672]

R2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\programme\FRITZ!Fernzugang\certsrv.exe [02.10.2008 20:43 132400]

R2 LiveUpdateInstaller;LiveUpdateInstaller;c:\programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe [19.04.2006 12:47 659456]

R2 MSSQL$ACT7;SQL Server (ACT7);c:\programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [10.02.2007 05:29 29178224]

R2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\programme\FRITZ!Fernzugang\nwtsrv.exe [02.10.2008 20:43 161072]

R2 Registry;Sage Registrierungsdienst;c:\programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe [16.04.2007 15:27 94208]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [09.07.2009 18:13 112512]

R3 NWIM;AVM VPN Miniport;c:\windows\system32\drivers\avmnwim.sys [02.10.2008 19:42 337200]

R3 O2MDGRDR;O2MDGRDR;c:\windows\system32\drivers\o2mdg.sys [09.07.2009 18:13 51616]

R3 O2SDGRDR;O2SDGRDR;c:\windows\system32\drivers\o2sdg.sys [09.07.2009 18:13 41760]

S2 ACT! Scheduler;ACT! Scheduler;c:\programme\ACT\Act for Windows\Act.Scheduler.exe [28.08.2009 11:03 65536]

S2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\programme\FRITZ!Fernzugang\avmike.exe [02.10.2008 20:42 267568]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.07.2010 16:40 136176]

S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [15.10.2009 07:51 87336]

S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [16.03.2010 12:13 137344]

S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [16.03.2010 12:13 8320]

S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [13.01.2010 11:11 32377]

S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys --> c:\windows\system32\Drivers\RTS5121.sys [?]

S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23.09.2005 08:01 2799808]
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners
 

2010-07-24 c:\windows\Tasks\1-Klick-Wartung.job

- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2009-03-20 13:17]
 

2010-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-06 14:39]
 

2010-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-06 14:39]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245

mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=de&l=de&s=gen

uInternet Connection Wizard,ShellNext = ftp://ftpuser@gerlach-iv.dyndns.org/

IE: Free YouTube Download - c:\dokumente und einstellungen\Sascha\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll

TCP: {DBA5E288-A303-4E63-AFC1-272D6FE97CDD} = 192.168.3.111

FF - ProfilePath - c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\

FF - prefs.js: browser.search.selectedEngine - Ecosia

FF - prefs.js: browser.startup.homepage - hxxp://www.ecosia.org/index.php

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll

FF - component: c:\dokumente und einstellungen\Sascha\Anwendungsdaten\Mozilla\Firefox\Profiles\nzw0vcfi.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll

FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\programme\Google\Update\1.2.183.29\npGoogleOneClick8.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: browser.blink_allowed - false

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-07-24 21:35

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'lsass.exe'(1136)

c:\programme\Avira\AntiVir Desktop\avsda.dll
 

- - - - - - - > 'explorer.exe'(2620)

c:\windows\system32\WPDShServiceObj.dll

c:\programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

c:\programme\Nokia\Nokia PC Suite 7\NGSCM.DLL

c:\programme\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ger.nlr

c:\programme\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\System32\WLTRYSVC.EXE

c:\windows\System32\bcmwltry.exe

c:\drivers\audio\r211990\stacsv.exe

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\DRIVERS\o2flash.exe

c:\programme\gemeinsame dateien\protexis\license service\psiservice_2.exe

c:\programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\windows\System32\TUProgSt.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\RunDLL32.exe

c:\programme\PC Connectivity Solution\ServiceLayer.exe

c:\programme\PC Connectivity Solution\Transports\NclUSBSrv.exe

c:\programme\PC Connectivity Solution\Transports\NclRSSrv.exe

c:\programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-07-24  21:39:17 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-07-24 19:38

ComboFix2.txt  2010-07-23 23:33
 

Vor Suchlauf: 24 Verzeichnis(se), 88.268.681.216 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 88.103.960.576 Bytes frei
 

- - End Of File - - 1724EDA003659085C73A4B0FF0B02673

--- --- ---

Hi Arne,
Weltklasse Du bist der GRÖSSTE.
Danke:dankeschoen:
Das Ding ist weg, soweit ich das bis jetzt sehen kann.
Wenn ich Dir mal einen Gefallen tun kann lass es mich wissen.

Gruß, Sascha

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

Hi Arne,
also GMER läuft nicht. Hier ist der logfile:
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 12:09:25 on 29.07.2010
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 6.00.2900.5512
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Programme\TuneUp Utilities 2009\OneClickStarter.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"BCMWLCPL.CPL" - "Dell Inc." - C:\WINDOWS\system32\BCMWLCPL.CPL

"cmdvdpak.cpl" - "Sonic Solutions" - C:\WINDOWS\system32\cmdvdpak.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"mbllnk.cpl" - "AvantGo, Inc." - C:\WINDOWS\system32\mbllnk.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL

"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"AVM VPN Miniport" (NWIM) - "AVM Berlin" - C:\WINDOWS\System32\DRIVERS\avmnwim.sys

"catchme" (catchme) - ? - C:\CoFi11228C\catchme.sys  (File not found)

"DLABMFSM" (DLABMFSM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLABMFSM.SYS

"DLABOIOM" (DLABOIOM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLABOIOM.SYS

"DLACDBHM" (DLACDBHM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLACDBHM.SYS

"DLADResM" (DLADResM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLADResM.SYS

"DLAIFS_M" (DLAIFS_M) - "Roxio" - C:\WINDOWS\System32\Drivers\DLAIFS_M.SYS

"DLAOPIOM" (DLAOPIOM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLAOPIOM.SYS

"DLAPoolM" (DLAPoolM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLAPoolM.SYS

"DLARTL_M" (DLARTL_M) - "Roxio" - C:\WINDOWS\System32\Drivers\DLARTL_M.SYS

"DLAUDFAM" (DLAUDFAM) - "Roxio" - C:\WINDOWS\System32\Drivers\DLAUDFAM.SYS

"DLAUDF_M" (DLAUDF_M) - "Roxio" - C:\WINDOWS\System32\Drivers\DLAUDF_M.SYS

"DRVMCDB" (DRVMCDB) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\DRVMCDB.SYS

"DRVNDDM" (DRVNDDM) - "Roxio" - C:\WINDOWS\System32\Drivers\DRVNDDM.SYS

"Logitech SetPoint KMDF HID Filter Driver" (LHidFilt) - "Logitech, Inc." - C:\WINDOWS\System32\DRIVERS\LHidFilt.Sys

"Logitech SetPoint KMDF Mouse Filter Driver" (LMouFilt) - "Logitech, Inc." - C:\WINDOWS\System32\DRIVERS\LMouFilt.Sys

"Logitech SetPoint KMDF USB Filter" (LUsbFilt) - "Logitech, Inc." - C:\WINDOWS\System32\Drivers\LUsbFilt.Sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PRODIGY" (PRODIGY) - "B-phreaks" - C:\WINDOWS\System32\Drivers\PRODIGY.SYS

"Realtek IR Driver" (Rts516xIR) - ? - C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys  (File not found)

"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys  (File not found)

"RTS5121.Sys Realtek USB Card Reader" (RSUSBSTOR) - ? - C:\WINDOWS\System32\Drivers\RTS5121.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfdrv01.sys

"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp02.sys

"StarForce Protection Synchronization Driver (version 2.x)" (sfsync02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfsync02.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll

{d7b95390-b1c5-11d0-b111-0080c712fe82} "mctp: Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Microsoft ActiveSync\aatp.dll

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{21D928D4-4850-45E3-9982-AD57051ECD42} "EdrawingThumbNailProvider Class" - "Dassault Systèmes SolidWorks Corp." - C:\Programme\SolidWorks Corp\SolidWorks eDrawings\edrwthumbnailprovider.dll

{E81FFB23-40E2-431C-A041-76AEA0E4B04C} "Enterprise-Projekte" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\NAMEEXT.DLL

{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll

{FBF23B40-E3F0-101B-8488-00AA003E56F8} "Internetverknüpfung" - ? - C:\WINDOWS\system32\ieframe.dll  (File not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2009\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2009\SDShelEx-win32.dll

{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)

Sldworks Shell Extension "{3AFCEAFB-FFC5-403D-AD33-5914AB4B7ECC}" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

<binary data> "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\Programme\Microsoft ActiveSync\inetrepl.dll

{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Mobilen Favoriten erstellen" - "Microsoft Corporation" - C:\Programme\Microsoft ActiveSync\inetrepl.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

{6F431AC3-364A-478b-BBDB-89C7CE1B18F6} "Webseite zu ACT! Kontakt hinzufügen" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{D5233FCD-D258-4903-89B8-FB1568E7413D} "Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll

{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"Status Monitor.lnk" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Status Monitor.lnk  (Shortcut exists | File not found)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Sascha\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"PC Suite Tray" - "Nokia" - "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Act! Preloader" - "Sage Software, Inc." - "C:\Programme\ACT\Act for Windows\ActSage.exe" -preload

"Act.Outlook.Service" - "Sage Software, Inc." - "C:\Programme\ACT\Act for Windows\Act.Outlook.Service.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"Broadcom Wireless Manager UI" - "Dell Inc." - C:\WINDOWS\system32\WLTRAY.exe

"ControlCenter3" - "Brother Industries, Ltd." - C:\Programme\Brother\ControlCenter3\brctrcen.exe /autorun

"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe

"IndexSearch" - "Nuance Communications, Inc." - "C:\Programme\ScanSoft\PaperPort\IndexSearch.exe"

"NVHotkey" - "NVIDIA Corporation" - rundll32.exe nvHotkey.dll,Start

"nwiz" - "NVIDIA Corporation" - nwiz.exe /installquiet

"PaperPort PTD" - "Nuance Communications, Inc." - "C:\Programme\ScanSoft\PaperPort\pptd40nt.exe"
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Dell Wireless WLAN Card Logon Provider" - "Dell Inc." - C:\WINDOWS\System32\BCMLogon.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDF-XChange" - "Tracker Software" - C:\WINDOWS\system32\pxc25pm.dll

"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"ACT! Scheduler" (ACT! Scheduler) - "Sage Software, Inc." - C:\Programme\ACT\Act for Windows\Act.Scheduler.exe

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir MailGuard" (AntiVirMailService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avmailc.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

"AVM FRITZ!Fernzugang Cert Service" (certsrv) - "AVM Berlin" - C:\Programme\FRITZ!Fernzugang\certsrv.exe

"AVM FRITZ!Fernzugang Client" (nwtsrv) - "AVM Berlin" - C:\Programme\FRITZ!Fernzugang\nwtsrv.exe

"AVM FRITZ!Fernzugang IKE Service" (avmike) - "AVM Berlin" - C:\Programme\FRITZ!Fernzugang\avmike.exe

"Dell Wireless WLAN Tray Service" (wltrysvc) - ? - C:\WINDOWS\System32\WLTRYSVC.EXE  (File found, but it contains no detailed information)

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"HID Input Service" (HidServ) - ? -  C:\WINDOWS\System32\hidserv.dll  (File not found)

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"LiveUpdateInstaller" (LiveUpdateInstaller) - "Sage Software" - C:\Programme\Gemeinsame Dateien\Sage KHK Shared\LiveUpdate\LiveUpdateInstaller.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\programme\gemeinsame dateien\protexis\license service\psiservice_2.exe

"Sage Registrierungsdienst" (Registry) - "Sage Software" - C:\Programme\Gemeinsame Dateien\Sage KHK Shared\Registry.exe

"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

"SolidWorks Licensing Service" (SolidWorks Licensing Service) - "SolidWorks" - C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe

"SQL Server (ACT7)" (MSSQL$ACT7) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

"SQL Server Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe

"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

"SW Distributed TS Coordinator Service" (CoordinatorServiceHost) - "Dassault Systèmes SolidWorks Corp." - C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe

"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - C:\WINDOWS\System32\TuneUpDefragService.exe

"TuneUp Program Statistics Service" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - C:\WINDOWS\System32\TUProgSt.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Und da ich ja völlig Blind bin komme ich mit dem REMOVER nicht weiter:juul:
Da kannst Du mir aber sicher auch weiter helfen. Das kommt halt wenn man nur vor der Kiste sitzt, in den Programmen rumm spielt und sich nicht weiter kümmert:balla:
Hier aber mal ein Bild

http://farm5.static.flickr.com/4083/...abfa751534.jpg

Gruß, Sascha

Zuerst mal bitte - falls noch nicht getan - die Datei remover.exe (vom BootkitRemover) vom Desktop nach c:\windows\system32 kopieren!
Danach die Konsole starten über Start, Ausführen, cmd eintippen, ok.

Den Text im folgenden Codefeld eintippen und mit Enter/Return ausführen:

Code:

remover.exe dump \\.\PhysicalDrive0 c:\mbr.dat

Lad danach die neu erstellte Datei c:\mbr.dat bitte bei uns hoch => http://www.trojaner-board.de/54791-a...ner-board.html

Hi Arne,
hab alles ausgeführt. Also die REMOVER exe ins system kopiert und gestartet,
hat aber wiedre nicht funktioniert:balla:
Dann hab ich die Datei hochgeladen.

Gruß, Sascha

Was meinst Du mit es hat nicht funktioniert? Wenn die mbr.dat erstellt wurde hat es funktioniert!!

Bitte jetzt diesen Text aus dem folgenden Codefeld eintippen und mit Enter/Return wieder in der Konsole cmd.exe ausführen:

Code:

remover.exe fix \\.\PhysicalDrive0