Trojaner-Board - virus Alureon.H gefunden und windows vista updates nicht mehr möglich

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - virus Alureon.H gefunden und windows vista updates nicht mehr möglich (https://www.trojaner-board.de/88975-virus-alureon-h-gefunden-windows-vista-updates-mehr-moeglich.html)

virus Alureon.H gefunden und windows vista updates nicht mehr möglich

hallo
seit ein paar tagen funktioniert das automatische windows update nicht mehr:fehlercode 80072EFE.

danach habe ich mal den online scanner von microsoft laufen gelassen, der dann
virus:win32 alureon.h gefunden hat´.
gdata antivirus und spybot s&d haben nichts gefunden.

malware bytes log

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4376
 

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18928
 

01.08.2010 13:58:21

mbam-log-2010-08-01 (13-58-21).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 138796

Laufzeit: 7 Minute(n), 42 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\Windows\Temp\svchost.exe (Worm.Koobface) -> Quarantined and deleted successfully.

RSit info log:
info.txtRSIT Logfile:

Code:

logfile of random's system information tool 1.08 2010-08-01 12:58:06
 

======Uninstall list======
 

Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE

Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex

Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin

Adobe Reader 9.3.3 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}

Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"

Advertising Center-->MsiExec.exe /X{b2ec4a38-b545-4a00-8214-13fe0e915e6d}

Apple Application Support-->MsiExec.exe /I{B2D328BE-45AD-4D92-96F9-2151490A203E}

Apple Mobile Device Support-->MsiExec.exe /I{85991ED2-010C-4930-96FA-52F43C2CE98A}

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

Auslogics Disk Defrag-->"C:\Program Files\Auslogics\Auslogics Disk Defrag\unins000.exe"

Bonjour-->MsiExec.exe /X{0CB9668D-F979-4F31-B8B8-67FE90F929F8}

CCleaner-->"C:\Program Files\CCleaner\uninst.exe"

Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}

Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}

CyberLink MediaShow-->"C:\Program Files\InstallShield Installation Information\{80E158EA-7181-40FE-A701-301CE6BE64AB}\Setup.exe" /z-uninstall

CyberLink MediaShow-->"C:\Program Files\InstallShield Installation Information\{80E158EA-7181-40FE-A701-301CE6BE64AB}\Setup.exe" /z-uninstall

CyberLink PhotoNow-->"C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" /z-uninstall

CyberLink PhotoNow-->"C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" /z-uninstall

CyberLink PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall

CyberLink PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall

CyberLink PowerDVD 8-->"C:\Program Files\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\Setup.exe" /z-uninstall

CyberLink PowerDVD 8-->"C:\Program Files\InstallShield Installation Information\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\Setup.exe" /z-uninstall

CyberLink PowerProducer-->"C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" /z-uninstall

CyberLink PowerProducer-->"C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" /z-uninstall

CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall

CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall

DivX Plus Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN

Fraps (remove only)-->"F:\fraps\uninstall.exe"

G Data AntiVirus 2011-->MsiExec.exe /I{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

ICQ7-->"C:\Program Files\InstallShield Installation Information\{88EB38EF-4D2C-436D-ABD3-56B232674062}\ICQ7.exe" -runfromtemp -l0x0009 -removeonly

IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe

iTunes-->MsiExec.exe /I{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}

Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}

Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe

Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}

Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft .NET Framework 4 Client Profile DEU Language Pack-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /lcid 1031 /parameterfolder ClientLP

Microsoft .NET Framework 4 Client Profile DEU Language Pack-->MsiExec.exe /X{F750C986-5310-3A5A-95F8-4EC71C8AC01C}

Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client

Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0407-0000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}

Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}

Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL

Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}

Microsoft Office Live Add-in 1.5-->MsiExec.exe /I{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}

Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint Viewer 2007 (German)-->MsiExec.exe /X{95120000-00AF-0407-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}

Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}

Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0410-0000-0000000FF1CE} /uninstall {322296D4-1EAE-4030-9FBC-D2787EB25FA2}

Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}

Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}

Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}

Microsoft VC9 runtime libraries-->MsiExec.exe /I{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Moorhuhn Kart Extra XXL-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE60CAE2-4CA8-4A6A-A557-0668004FE889}\Setup.exe" -l0x7 

Mozilla Firefox (3.6.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}

MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

Nero 9 Essentials-->C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="XM02-508X-MHAT-19WU-9Z3Z-0CH0-3U6E-85W5-MMHH-6647-1Z5L-7M8C-0U45-758P-0000"

Nero ControlCenter-->MsiExec.exe /X{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}

Nero Installer-->MsiExec.exe /X{e8a80433-302b-4ff1-815d-fcc8eac482ff}

Nero Online Upgrade-->MsiExec.exe /X{dba84796-8503-4ff0-af57-1747dd9a166d}

Nero StartSmart OEM-->MsiExec.exe /X{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}

Nero StartSmart-->MsiExec.exe /X{7748ac8c-18e3-43bb-959b-088faea16fb2}

neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}

Nokia Connectivity Cable Driver-->MsiExec.exe /I{52D02A2B-03D2-4E34-A358-DC5D951FD296}

NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI

QuickTime-->MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}

Realtek 8169 8168 8101E 8102E Ethernet Driver-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly

Realtek High Definition Audio Driver-->C:\Program Files\Realtek\Audio\HDA\RtlUpd.exe -r -m -nrg2709

Realtek USB 2.0 Card Reader-->C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe -runfromtemp -l0x0007 -removeonly

Revo Uninstaller 1.89-->C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe

RTC Client API v1.2-->MsiExec.exe /X{44CDBD1B-89FB-4E02-8319-2A4C550F664A}

Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}

Security Update for 2007 Microsoft Office System (KB976321)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A}

Security Update for 2007 Microsoft Office System (KB982312)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B0EC5722-241F-4CDA-83B4-AA5846B6F9F4}

Security Update for 2007 Microsoft Office System (KB982331)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E8766951-2B6C-4022-86E8-80D2D1762B76}

Security Update for Microsoft Office Excel 2007 (KB982308)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C3F9A0DC-A5D1-4BB6-870E-2953E5A2487B}

Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}

Security Update for Microsoft Office PowerPoint 2007 (KB982158)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F5B70033-E79C-4569-90BF-BC9B4E4F3F46}

Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}

Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}

Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}

Security Update for Microsoft Office Word 2007 (KB982135)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0112C750-A06F-4F92-9C40-E5C1EA9A70EB}

Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}

Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall

UMTS USB Modem Manager-->C:\Program Files\UMTS USB Modem Manager\uninst.exe

Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""

Update for Microsoft Office OneNote 2007 (KB980729)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF}

Update für Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}

Update für Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {EA160DA3-E9B5-4D03-A518-21D306665B96}

Update für Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {38472199-D7B6-4833-A949-10E4EE6365A1}

Update Manager-->MsiExec.exe /I{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}

USB Video Device-->C:\Program Files\InstallShield Installation Information\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}\setup.exe -runfromtemp -l0x0007 -removeonly

VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}

VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}

Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u

Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}

Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""

VLC media player 1.1.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe

Windows Live Call-->MsiExec.exe /I{835686C5-8650-49EB-8CA0-4528B4035495}

Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}

Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe

Windows Live Essentials-->MsiExec.exe /I{DF5F687F-8018-4542-9F98-7084E9022917}

Windows Live Fotogalerie-->MsiExec.exe /X{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}

Windows Live ID-Anmelde-Assistent-->MsiExec.exe /X{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}

Windows Live Mail-->MsiExec.exe /I{5A166C0B-9557-4364-A057-F946D674E6AC}

Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}

Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"

Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}

Windows Live Sync-->MsiExec.exe /X{8C1E2925-14F8-45AA-B999-1E2A74BF5607}

Windows Live Writer-->MsiExec.exe /X{81821BF8-DA20-4F8C-AA87-F70A274828D4}

Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}

WinRAR-->C:\Program Files\WinRAR\uninstall.exe
 

======Hosts File======
 

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com
 

======Security center information======
 

AS: Lavasoft Ad-Watch Live! (disabled)

AS: Windows Defender
 

======System event log======
 

Computer Name: p-PC

Event Code: 20003

Message: Der Prozess zum Hinzufügen von Dienst hwdatacard für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_02\6&1003F204&1&0002 wurde mit folgendem Status beendet: 0.

Record Number: 28129

Source Name: Microsoft-Windows-User-PnP

Time Written: 20091017154406.732800-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: p-PC

Event Code: 20001

Message: Der Prozess zum Installieren von Treiber FileRepository\ewser2k.inf_12542008\ewser2k.inf für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_01\6&1003F204&1&0001 wurde mit folgendem Status beendet: 0.

Record Number: 28128

Source Name: Microsoft-Windows-User-PnP

Time Written: 20091017154405.982000-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: p-PC

Event Code: 20003

Message: Der Prozess zum Hinzufügen von Dienst hwdatacard für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_01\6&1003F204&1&0001 wurde mit folgendem Status beendet: 0.

Record Number: 28127

Source Name: Microsoft-Windows-User-PnP

Time Written: 20091017154405.837000-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: p-PC

Event Code: 20001

Message: Der Prozess zum Installieren von Treiber FileRepository\ewmdm2k.inf_3e6e8a74\ewmdm2k.inf für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_00\6&1003F204&1&0000 wurde mit folgendem Status beendet: 0.

Record Number: 28126

Source Name: Microsoft-Windows-User-PnP

Time Written: 20091017154404.982400-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: p-PC

Event Code: 20003

Message: Der Prozess zum Hinzufügen von Dienst hwdatacard für Geräteinstanz-ID USB\VID_12D1&PID_1001&MI_00\6&1003F204&1&0000 wurde mit folgendem Status beendet: 0.

Record Number: 28125

Source Name: Microsoft-Windows-User-PnP

Time Written: 20091017154404.282800-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

=====Application event log=====
 

Computer Name: Computername

Event Code: 105

Message: 

Record Number: 5

Source Name: PLFlash DeviceIoControl Service

Time Written: 20090706165614.000000-000

Event Type: Informationen

User: 
 

Computer Name: Computername

Event Code: 0

Message: 

Record Number: 4

Source Name: Nero BackItUp Scheduler 3

Time Written: 20090706165614.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-CVTVHLCNH4O

Event Code: 4625

Message: Das EventSystem-Subsystem unterdrückt duplizierte Ereignisprotokolleinträge für eine Dauer von 86400 Sekunden. Dieses Zeitlimit kann durch den REG_DWORD-Wert SuppressDuplicateDuration unter folgendem Registrierungsschlüssel gesteuert werden: HKLM\Software\Microsoft\EventSystem\EventLog.

Record Number: 3

Source Name: Microsoft-Windows-EventSystem

Time Written: 20090706165610.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-CVTVHLCNH4O

Event Code: 900

Message: Der Softwarelizenzierungsdienst wird gestartet.
 

Record Number: 2

Source Name: Microsoft-Windows-Security-Licensing-SLC

Time Written: 20090706165610.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-CVTVHLCNH4O

Event Code: 1531

Message: Der Benutzerprofildienst wurde erfolgreich gestartet.  
 
 

Record Number: 1

Source Name: Microsoft-Windows-User Profiles Service

Time Written: 20090706165610.000000-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

=====Security event log=====
 

Computer Name: Computername

Event Code: 4624

Message: Ein Konto wurde erfolgreich angemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-0-0

        Kontoname:                -

        Kontodomäne:                -

        Anmelde-ID:                0x0
 

Anmeldetyp:                        0
 

Neue Anmeldung:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e7

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Prozessinformationen:

        Prozess-ID:                0x4

        Prozessname:                
 

Netzwerkinformationen:

        Arbeitsstationsname:        -

        Quellnetzwerkadresse:        -

        Quellport:                -
 

Detaillierte Authentifizierungsinformationen:

        Anmeldeprozess:                -

        Authentifizierungspaket:        -

        Übertragene Dienste:        -

        Paketname (nur NTLM):        -

        Schlüssellänge:                0
 

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
 

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
 

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
 

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
 

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
 

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.

         - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.

        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.

        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.

        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.

Record Number: 5

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090706165542.176585-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: Computername

Event Code: 4608

Message: Windows wird gestartet.
 

Dieses Ereignis wird protokolliert, wenn LSASS.EXE gestartet und das Überwachungssubsystem initialisiert wird.

Record Number: 4

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090706165542.176585-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: Computername

Event Code: 4647

Message: Benutzerinitiierte Abmeldung:
 

Antragsteller:

        Sicherheits-ID:                S-1-5-21-3842258658-2313958565-4179438055-500

        Kontoname:                Administrator

        Kontodomäne:                COMPUTERNAME

        Anmelde-ID:                0x3bf56
 

Dieses Ereignis wird generiert, wenn eine Abmeldung initiiert wird, aber die Anzahl der Tokenreferenzen nicht Null ist und die Anmeldesitzung nicht zerstört werden kann. Es kann keiner Benutzerinitiierte Aktion erfolgen. Dieses Ereignis kann als Abmeldeereignis interpretiert werden.

Record Number: 3

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090306065000.720000-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: Computername

Event Code: 4634

Message: Ein Konto wurde abgemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-7

        Kontoname:                ANONYMOUS-ANMELDUNG

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x1dcbf
 

Anmeldetyp:                        3
 

Dieses Ereignis wird generiert, wenn eine Anmeldesitzung zerstört wird. Es kann anhand des Wertes der Anmelde-ID positiv mit einem Anmeldeereignis korreliert werden. Anmelde-IDs sind nur zwischen Neustarts auf demselben Computer eindeutig.

Record Number: 2

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090306064959.643600-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: Computername

Event Code: 4616

Message: Die Systemzeit wurde geändert.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-19

        Kontoname:                LOKALER DIENST

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e5
 

Prozessinformationen:

        Prozess-ID:        0x494

        Name:                C:\Windows\System32\svchost.exe
 

Vorherige Zeit:                07:49:59 06.03.2009

Neue Zeit:                07:49:59 06.03.2009
 

Dieses Ereignis wird generiert, wenn die Systemzeit geändert wird. Es ist normal, dass der mit Systemberechtigung ausgeführte Windows-Zeitdienst die Systemzeit regelmäßig ändert. Andere Änderungen der Systemzeit können darauf hinweisen, dass der Computer manipuliert wird.

Record Number: 1

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090306064959.550000-000

Event Type: Überwachung erfolgreich

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=%CommonProgramFiles%\Microsoft Shared\Windows Live;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 10, GenuineIntel

"PROCESSOR_REVISION"=170a

"NUMBER_OF_PROCESSORS"=2

"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat

"DFSTRACINGON"=FALSE

"asl.log"=Destination=file;OnFirstLog=command,environment

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip

"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
 

-----------------EOF-----------------

--- --- ---

und das normale logfile

RSIT Logfile:

Code:

Logfile of random's system information tool 1.08 (written by random/random)

Run by p at 2010-08-01 13:40:52

Microsoft® Windows Vista™ Home Premium  Service Pack 2

System drive C: has 302 GB (67%) free of 451 GB

Total RAM: 3066 MB (57% free)
 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:41:23, on 01.08.2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18928)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\tsnp2uvc.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Users\p\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KSX4C9T6\windows-kb890830-v3.9[1].exe

c:\1287cab6b9e162ae02f069\mrtstub.exe

C:\Windows\system32\MRT.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

H:\RSIT.exe

C:\Program Files\trend micro\p.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aolwebmail.aol.de/landing-page

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: G Data WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [G Data AntiVirus Tray Application] C:\Program Files\G Data\AntiVirus\AVKTray\AVKTray.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)

O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)

O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)

O15 - Trusted Zone: hxxp://download.windowsupdate.com

O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: G Data AntiVirus Proxy (AVKProxy) - G Data Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe

O23 - Service: G Data Scheduler (AVKService) - G Data Software AG - C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe

O23 - Service: G Data Dateisystem Wächter (AVKWCtl) - G Data Software AG - C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe

O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: G Data Scanner (GDScan) - G Data Software AG - C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe

O23 - Service: Reset Reader (resetWinService) - Unknown owner - C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
 

--

End of file - 7566 bytes
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0124123D-61B4-456f-AF86-78C53A0790C5}]

G Data WebFilter - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll [2010-03-31 657480]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID-Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-19 41760]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{0124123D-61B4-456f-AF86-78C53A0790C5} - G Data WebFilter - C:\Program Files\G Data\AntiVirus\WebFilter\AvkWebIE.dll [2010-03-31 657480]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]

"tsnp2uvc"=C:\Windows\tsnp2uvc.exe [2008-08-28 233472]

"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-02-10 13605408]

"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-02-10 92704]

"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-02-27 1434920]

"G Data AntiVirus Tray Application"=C:\Program Files\G Data\AntiVirus\AVKTray\AVKTray.exe [2010-03-31 963144]

"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-07-21 141608]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2006-09-11 218032]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"EnableLUA"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"BindDirectlyToPropertySetStorage"=0

"NoResolveTrack"=1
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
 

======File associations======
 

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*
 

======List of files/folders created in the last 1 months======
 

2010-08-01 13:19:38 ----D---- C:\1287cab6b9e162ae02f069

2010-08-01 12:58:52 ----D---- C:\Users\p\AppData\Roaming\Malwarebytes

2010-08-01 12:58:37 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys

2010-08-01 12:58:29 ----D---- C:\ProgramData\Malwarebytes

2010-08-01 12:58:24 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2010-08-01 12:58:24 ----A---- C:\Windows\system32\drivers\mbam.sys

2010-08-01 12:58:00 ----D---- C:\Program Files\trend micro

2010-08-01 12:57:59 ----D---- C:\rsit

2010-08-01 12:28:32 ----D---- C:\Program Files\Windows Live Safety Center

2010-08-01 12:07:12 ----D---- C:\Program Files\iPod

2010-08-01 12:07:10 ----D---- C:\Program Files\iTunes

2010-08-01 11:28:06 ----A---- C:\Windows\msoffice.ini

2010-08-01 10:15:04 ----A---- C:\Windows\system32\drivers\bwizfgvr.sys

2010-08-01 10:01:48 ----D---- C:\Windows\system32\MpEngineStore

2010-08-01 09:49:48 ----D---- C:\Windows\CheckSur

2010-08-01 08:23:34 ----D---- C:\MGADiagToolOutput

2010-08-01 08:22:37 ----A---- C:\Windows\proxycfg.exe

2010-08-01 08:22:07 ----A---- C:\Descriptors.txt

2010-08-01 08:22:03 ----D---- C:\AULOGS

2010-08-01 08:02:34 ----D---- C:\ProgramData\Office Genuine Advantage

2010-08-01 00:17:03 ----A---- C:\Windows\system32\drivers\HookCentre.sys

2010-07-31 23:41:43 ----ASH---- C:\hiberfil.sys

2010-07-31 22:21:33 ----D---- C:\Program Files\TuneUp Utilities 2010

2010-07-31 22:08:11 ----D---- C:\Program Files\BitLocker

2010-07-31 18:56:11 ----HDC---- C:\ProgramData\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}

2010-07-28 17:31:12 ----D---- C:\ProgramData\WindowsSearch

2010-07-20 17:34:20 ----D---- C:\Program Files\Takatis - A Tribute To Manfred Trenz

2010-07-12 17:54:35 ----D---- C:\Users\p\AppData\Roaming\SharePod

2010-07-08 17:53:06 ----D---- C:\Windows\Minidump

2010-07-08 17:20:00 ----D---- C:\Windows\pss

2010-07-04 22:22:17 ----D---- C:\Program Files\QIP 2010

2010-07-02 16:57:20 ----A---- C:\Windows\system32\XAudio2_7.dll

2010-07-02 16:57:20 ----A---- C:\Windows\system32\XAPOFX1_5.dll

2010-07-02 16:57:19 ----A---- C:\Windows\system32\xactengine3_7.dll

2010-07-02 16:57:18 ----A---- C:\Windows\system32\D3DCompiler_43.dll

2010-07-02 16:57:17 ----A---- C:\Windows\system32\d3dx11_43.dll

2010-07-02 16:57:17 ----A---- C:\Windows\system32\d3dcsx_43.dll

2010-07-02 16:57:16 ----A---- C:\Windows\system32\d3dx10_43.dll

2010-07-02 16:57:15 ----A---- C:\Windows\system32\D3DX9_43.dll

2010-07-02 16:57:14 ----A---- C:\Windows\system32\XAudio2_6.dll

2010-07-02 16:57:14 ----A---- C:\Windows\system32\XAPOFX1_4.dll

2010-07-02 16:57:13 ----A---- C:\Windows\system32\xactengine3_6.dll

2010-07-02 16:57:12 ----A---- C:\Windows\system32\X3DAudio1_7.dll

2010-07-02 16:57:11 ----A---- C:\Windows\system32\XAudio2_5.dll

2010-07-02 16:57:10 ----A---- C:\Windows\system32\xactengine3_5.dll

2010-07-02 16:57:09 ----A---- C:\Windows\system32\D3DCompiler_42.dll

2010-07-02 16:57:08 ----A---- C:\Windows\system32\d3dcsx_42.dll

2010-07-02 16:57:07 ----A---- C:\Windows\system32\d3dx11_42.dll

2010-07-02 16:57:06 ----A---- C:\Windows\system32\d3dx10_42.dll

2010-07-02 16:57:05 ----A---- C:\Windows\system32\D3DX9_42.dll

2010-07-02 16:57:04 ----A---- C:\Windows\system32\d3dx10_41.dll

2010-07-02 16:57:04 ----A---- C:\Windows\system32\D3DCompiler_41.dll

2010-07-02 16:57:03 ----A---- C:\Windows\system32\D3DX9_41.dll

2010-07-02 16:57:02 ----A---- C:\Windows\system32\XAudio2_4.dll

2010-07-02 16:57:02 ----A---- C:\Windows\system32\XAPOFX1_3.dll

2010-07-02 16:57:01 ----A---- C:\Windows\system32\xactengine3_4.dll

2010-07-02 16:57:00 ----A---- C:\Windows\system32\X3DAudio1_6.dll

2010-07-02 16:56:59 ----A---- C:\Windows\system32\d3dx10_40.dll

2010-07-02 16:56:59 ----A---- C:\Windows\system32\D3DCompiler_40.dll

2010-07-02 16:56:58 ----A---- C:\Windows\system32\D3DX9_40.dll

2010-07-02 16:56:57 ----A---- C:\Windows\system32\XAudio2_3.dll

2010-07-02 16:56:57 ----A---- C:\Windows\system32\XAPOFX1_2.dll

2010-07-02 16:56:56 ----A---- C:\Windows\system32\xactengine3_3.dll

2010-07-02 16:56:54 ----A---- C:\Windows\system32\X3DAudio1_5.dll

2010-07-02 16:56:53 ----A---- C:\Windows\system32\XAudio2_2.dll

2010-07-02 16:56:53 ----A---- C:\Windows\system32\XAPOFX1_1.dll

2010-07-02 16:56:52 ----A---- C:\Windows\system32\xactengine3_2.dll

2010-07-02 16:56:51 ----A---- C:\Windows\system32\d3dx10_39.dll

2010-07-02 16:56:51 ----A---- C:\Windows\system32\D3DCompiler_39.dll

2010-07-02 16:56:50 ----A---- C:\Windows\system32\D3DX9_39.dll

2010-07-02 16:56:49 ----A---- C:\Windows\system32\XAPOFX1_0.dll

2010-07-02 16:56:48 ----A---- C:\Windows\system32\XAudio2_1.dll

2010-07-02 16:56:48 ----A---- C:\Windows\system32\xactengine3_1.dll

2010-07-02 16:56:47 ----A---- C:\Windows\system32\X3DAudio1_4.dll

2010-07-02 16:56:46 ----A---- C:\Windows\system32\d3dx10_38.dll

2010-07-02 16:56:46 ----A---- C:\Windows\system32\D3DCompiler_38.dll

2010-07-02 16:56:45 ----A---- C:\Windows\system32\D3DX9_38.dll

2010-07-02 16:56:44 ----A---- C:\Windows\system32\XAudio2_0.dll

2010-07-02 16:56:43 ----A---- C:\Windows\system32\xactengine3_0.dll

2010-07-02 16:56:42 ----A---- C:\Windows\system32\X3DAudio1_3.dll

2010-07-02 16:56:41 ----A---- C:\Windows\system32\d3dx10_37.dll

2010-07-02 16:56:41 ----A---- C:\Windows\system32\D3DCompiler_37.dll

2010-07-02 16:56:40 ----A---- C:\Windows\system32\D3DX9_37.dll

2010-07-02 16:56:39 ----A---- C:\Windows\system32\xactengine2_10.dll

2010-07-02 16:56:38 ----A---- C:\Windows\system32\d3dx10_36.dll

2010-07-02 16:56:37 ----A---- C:\Windows\system32\D3DCompiler_36.dll

2010-07-02 16:56:36 ----A---- C:\Windows\system32\d3dx9_36.dll

2010-07-02 16:56:35 ----A---- C:\Windows\system32\xactengine2_9.dll

2010-07-02 16:56:34 ----A---- C:\Windows\system32\d3dx10_35.dll

2010-07-02 16:56:34 ----A---- C:\Windows\system32\D3DCompiler_35.dll

2010-07-02 16:56:33 ----A---- C:\Windows\system32\d3dx9_35.dll

2010-07-02 16:56:32 ----A---- C:\Windows\system32\xactengine2_8.dll

2010-07-02 16:56:32 ----A---- C:\Windows\system32\X3DAudio1_2.dll

2010-07-02 16:56:31 ----A---- C:\Windows\system32\d3dx10_34.dll

2010-07-02 16:56:31 ----A---- C:\Windows\system32\D3DCompiler_34.dll

2010-07-02 16:56:30 ----A---- C:\Windows\system32\d3dx9_34.dll

2010-07-02 16:56:29 ----A---- C:\Windows\system32\xinput1_3.dll

2010-07-02 16:56:28 ----A---- C:\Windows\system32\xactengine2_7.dll

2010-07-02 16:56:27 ----A---- C:\Windows\system32\d3dx10_33.dll

2010-07-02 16:56:27 ----A---- C:\Windows\system32\D3DCompiler_33.dll

2010-07-02 16:56:26 ----A---- C:\Windows\system32\d3dx9_33.dll

2010-07-02 16:56:25 ----A---- C:\Windows\system32\xactengine2_6.dll

2010-07-02 16:56:24 ----A---- C:\Windows\system32\xactengine2_5.dll

2010-07-02 16:56:23 ----A---- C:\Windows\system32\d3dx10.dll

2010-07-02 16:56:21 ----A---- C:\Windows\system32\xactengine2_4.dll

2010-07-02 16:56:21 ----A---- C:\Windows\system32\x3daudio1_1.dll

2010-07-02 16:56:20 ----A---- C:\Windows\system32\d3dx9_31.dll

2010-07-02 16:56:19 ----A---- C:\Windows\system32\xactengine2_3.dll

2010-07-02 16:56:18 ----A---- C:\Windows\system32\xinput1_2.dll

2010-07-02 16:56:17 ----A---- C:\Windows\system32\xinput1_1.dll

2010-07-02 16:56:17 ----A---- C:\Windows\system32\xactengine2_2.dll

2010-07-02 16:56:16 ----A---- C:\Windows\system32\xactengine2_1.dll

2010-07-02 16:55:58 ----A---- C:\Windows\system32\xactengine2_0.dll

2010-07-02 16:55:58 ----A---- C:\Windows\system32\x3daudio1_0.dll

2010-07-02 16:55:57 ----A---- C:\Windows\system32\d3dx9_29.dll

2010-07-02 16:55:55 ----A---- C:\Windows\system32\d3dx9_27.dll

2010-07-02 16:55:54 ----A---- C:\Windows\system32\d3dx9_26.dll

2010-07-02 16:55:53 ----A---- C:\Windows\system32\d3dx9_25.dll

2010-07-02 16:55:52 ----A---- C:\Windows\system32\d3dx9_24.dll
 

======List of files/folders modified in the last 1 months======
 

2010-08-01 13:40:59 ----D---- C:\Windows\Temp

2010-08-01 13:19:40 ----D---- C:\Windows\Debug

2010-08-01 13:19:37 ----D---- C:\Windows\System32

2010-08-01 13:19:37 ----A---- C:\Windows\system32\PerfStringBackup.INI

2010-08-01 13:19:36 ----D---- C:\Windows\inf

2010-08-01 13:13:46 ----D---- C:\Windows

2010-08-01 13:13:37 ----D---- C:\Windows\system32\drivers

2010-08-01 13:12:47 ----D---- C:\Windows\PCHEALTH

2010-08-01 12:58:29 ----HD---- C:\ProgramData

2010-08-01 12:58:24 ----D---- C:\Program Files

2010-08-01 12:55:45 ----SHD---- C:\System Volume Information

2010-08-01 12:30:30 ----SHD---- C:\Windows\Installer

2010-08-01 12:28:32 ----SD---- C:\Windows\Downloaded Program Files

2010-08-01 12:07:11 ----D---- C:\Program Files\Common Files\Apple

2010-08-01 11:50:59 ----D---- C:\Program Files\Common Files

2010-08-01 11:49:30 ----D---- C:\ProgramData\AOL

2010-08-01 11:41:27 ----D---- C:\Windows\winsxs

2010-08-01 10:40:59 ----D---- C:\Program Files\VS Revo Group

2010-08-01 10:39:42 ----D---- C:\Windows\system32\Tasks

2010-08-01 10:38:21 ----D---- C:\Program Files\Spybot - Search & Destroy

2010-08-01 10:38:20 ----D---- C:\ProgramData\Spybot - Search & Destroy

2010-08-01 09:51:27 ----A---- C:\Windows\win.ini

2010-08-01 09:31:39 ----D---- C:\Windows\SoftwareDistribution

2010-08-01 08:44:35 ----D---- C:\Windows\system32\drivers\etc

2010-08-01 08:22:07 ----D---- C:\Windows\rescache

2010-08-01 08:10:15 ----D---- C:\Program Files\Mozilla Firefox

2010-08-01 07:52:59 ----D---- C:\Program Files\CCleaner

2010-08-01 07:45:10 ----D---- C:\Windows\system32\catroot2

2010-08-01 00:47:20 ----D---- C:\Windows\Tasks

2010-08-01 00:24:49 ----D---- C:\ProgramData\G DATA

2010-08-01 00:16:05 ----D---- C:\Program Files\Common Files\G DATA

2010-08-01 00:15:59 ----D---- C:\Program Files\G DATA

2010-07-31 23:41:41 ----D---- C:\Windows\system32\wbem

2010-07-31 23:40:49 ----D---- C:\Windows\system32\config

2010-07-31 23:40:30 ----D---- C:\Windows\system32\en-US

2010-07-31 23:40:30 ----D---- C:\Windows\system32\de-DE

2010-07-31 23:40:30 ----D---- C:\Program Files\Internet Explorer

2010-07-31 23:40:29 ----D---- C:\Windows\system32\spool

2010-07-31 23:40:29 ----D---- C:\Windows\system32\Msdtc

2010-07-31 23:40:29 ----D---- C:\Windows\system32\CodeIntegrity

2010-07-31 23:40:28 ----D---- C:\Windows\Microsoft.NET

2010-07-31 23:40:24 ----D---- C:\Users\p\AppData\Roaming\IrfanView

2010-07-31 23:40:17 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

2010-07-31 23:40:08 ----D---- C:\Windows\registration

2010-07-31 23:18:02 ----D---- C:\Users\p\AppData\Roaming\vlc(1508)

2010-07-31 23:17:35 ----D---- C:\Windows\prefetch

2010-07-31 22:12:58 ----RSD---- C:\Windows\assembly

2010-07-31 22:10:45 ----D---- C:\Windows\system32\catroot

2010-07-31 19:23:35 ----HD---- C:\extensions.exe

2010-07-28 17:38:49 ----D---- C:\felix

2010-07-21 17:29:16 ----D---- C:\Users\p\AppData\Roaming\ICQ

2010-07-19 17:10:54 ----D---- C:\Users\p\AppData\Roaming\Zidote

2010-07-19 06:26:21 ----D---- C:\Users\p\AppData\Roaming\Umru

2010-07-08 17:11:15 ----HD---- C:\Windows\system32\GroupPolicy

2010-07-02 16:54:35 ----D---- C:\Windows\Logs

2010-07-02 12:39:06 ----A---- C:\Windows\system32\mrt.exe
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R0 GDBehave;GDBehave; C:\Windows\system32\drivers\GDBehave.sys [2010-08-01 33480]

R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys [2010-06-05 64288]

R1 GDMnIcpt;GDMnIcpt; \??\C:\Windows\system32\drivers\MiniIcpt.sys [2010-08-01 61512]

R1 gdwfpcd;G DATA WFP CD; C:\Windows\system32\drivers\gdwfpcd32.sys [2010-08-01 40904]

R1 GRD;G Data Rootkit Detector Driver; \??\C:\Windows\system32\drivers\GRD.sys [2010-08-01 29992]

R1 MpKsl69bf2648;MpKsl69bf2648; \??\C:\Windows\system32\MpEngineStore\MpKsl69bf2648.sys [2010-08-01 28752]

R3 GearAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\drivers\GEARAspiWDM.sys [2009-05-18 26600]

R3 HookCentre;HookCentre; \??\C:\Windows\system32\drivers\HookCentre.sys [2010-08-01 38856]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-10-31 2231456]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2009-06-26 66080]

R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-02-10 7547360]

R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2010-03-04 261152]

R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2009-03-26 64000]

R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2008-12-29 1799808]

R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-02-27 205232]

S3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]

S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]

S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]

S3 BTHUSB;USB-Treiber für Bluetooth-Sender; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]

S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2007-08-24 101504]

S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]

S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]

S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-07-09 39424]

S3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]

S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]

S3 wanatw;WAN Miniport (ATW); C:\Windows\system32\DRIVERS\wanatw4.sys []

S3 WINIO;WINIO; \??\C:\Windows\system32\WinIo.sys [2007-01-04 9336]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-06-10 144176]

R2 AVKProxy;G Data AntiVirus Proxy; C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe [2010-04-30 1147976]

R2 AVKService;G Data Scheduler; C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe [2010-03-31 410696]

R2 AVKWCtl;G Data Dateisystem Wächter; C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe [2010-03-15 1279816]

R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-05-18 345376]

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]

R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-20 935208]

R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-02-10 203296]

R2 ProtexisLicensing;ProtexisLicensing; C:\Windows\system32\PSIService.exe [2007-06-05 177704]

R2 resetWinService;Reset Reader; C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [2008-10-29 70656]

R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\Cyberlink\Shared files\RichVideo.exe [2009-02-25 247152]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 1529728]

R3 GDScan;G Data Scanner; C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe [2010-04-22 339016]

R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-07-21 540968]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe []

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
 

-----------------EOF-----------------

:hallo:

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Downloade Dir bitte Load.exe

Das Tool benötigt eine aktive Internetverbindung, aber keinen offenen Browser
Sollte deine Firewall meckern, die Anwendung bitte zulassen.

Speichere die Datei am Desktop.
Doppelklick auf die load.exe
Belasse die Häckchen wie sie sind.
Schließe nun alle offenen Programme.
Klicke auf Download
Bitte während dem Download nicht in das Fenster klicken.
Folge den Anweisungen auf dem Bildschirm.
Wenn das Fenster Status aufpoppt klicke Start.

Nach dem Neustart findest Du einen Ordner MFTools auf dem Desktop. Darin befindet sich eine Anleitung.pdf.
Diese bitte öffnen und die darin beschriebenen Schritte abarbeiten.

habe die anleitung abgearbeitet, dabei sind allerdings manche fehler aufgetreten.
1. gmer fehler
hxxp://www.abload.de/img/gmerfehlert2gu.jpg
als ich dann nochmal gmer.exe starten wollte, ohne "als admin ausführen" gab es kurz einen bluescreen und der laptop hat sich neugestartet.
beim 3. versuch hat dann aber alles geklappt
2.otl fehler
hxxp://www.abload.de/img/otlfehlerief4.jpg
dieser kam mehrmals, aber immer bei unterschiedlichen registrierungsschlüsseln ( das,was immer unterschiedlich war, ist blau markiert im screenshot )
der scan lief ansonsten ohne probleme weiter.

die logs kann ich irgendwie nicht direkt posten...

Extras.txt
hxxp://striker159.bplaced.net/Extras.Txt

OTL.Txt
hxxp://striker159.bplaced.net/OTL.Txt

Gmer.log
hxxp://striker159.bplaced.net/Gmer.log

mbam log
hxxp://striker159.bplaced.net/mbam.txt

ich habe gerade festgestellt, dass irgendwie meine google suchen gespeichert werden, und dann später mit anderen suchmaschinen erneut aufgerufen werden, welche allerdings virenverseucht sind.
nach so einer umleitung hatte ich gerade infizierte .tmp dateien in meinem temporary internet files ordner -.-

das hier ist zb eine dieser dubiosen seiten. vielleicht taucht die ja in irgendwelchen logs auf:
h**p://gworkf2net.com/in.cgi?5&parameter=windows+vista+.....

Zitat:

Zitat von Larusso

Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

:rolleyes:
Ihr macht das absichtlich oder.

Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.

**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**

http://i266.photobucket.com/albums/i...ownload_FF.gif

http://i94.photobucket.com/albums/l8...x-Download.png

Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
Doppel-klicke auf ComboFix.exe und folge den Aufforderungen.
- Wenn ComboFix fertig ist, wird es ein Log für dich erstellen.
- Bitte poste mir den Inhalt von C:\ComboFix.txt hier in de Thread.

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

habe combofix laufen gelassen. während dessen kam drei mal die fehlermeldung, dass der registry editor nicht mehr reagiert und geschlossen werden muss.
einmal nach/bei schritt 50
einmal bei "log wird erstellt"
einmal als nach dem fertigen scan das log angezeigt wurde.

hier die combofix.txt

Combofix Logfile:

Code:

ComboFix 10-08-03.04 - p 04.08.2010  16:08:39.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3066.1904 [GMT 2:00]

ausgeführt von:: c:\users\p\Desktop\Combo-Fix.exe

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

 * Im Speicher befindliches AV aktiv.
 

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

Infizierte Kopie von c:\windows\system32\drivers\disk.sys wurde gefunden und desinfiziert 

Kopie von - Kitty had a snack :p wurde wiederhergestellt 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-07-04 bis 2010-08-04  ))))))))))))))))))))))))))))))

.
 

2010-08-04 14:22 . 2010-08-04 14:23        --------        d-----w-        c:\users\p\AppData\Local\temp

2010-08-04 14:22 . 2010-08-04 14:22        --------        d-----w-        c:\users\Gast\AppData\Local\temp

2010-08-04 14:22 . 2010-08-04 14:22        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-08-03 14:21 . 2010-08-03 14:21        --------        d-----w-        c:\program files\ERUNT

2010-08-03 14:16 . 2010-08-03 14:16        --------        d-----w-        c:\program files\7-Zip

2010-08-01 16:46 . 2009-06-10 09:43        71168        ----a-w-        c:\windows\system32\telnet.exe

2010-08-01 15:37 . 2010-08-01 16:53        --------        d-----w-        C:\inetpub

2010-08-01 14:54 . 2010-08-01 14:57        --------        d-----w-        C:\58f9b5a69083cd2823

2010-08-01 14:49 . 2010-08-01 14:49        53736        ----a-w-        c:\windows\system32\drivers\xnmxwela.sys

2010-08-01 14:23 . 2010-08-03 19:29        --------        d-----w-        c:\program files\Emsisoft Anti-Malware

2010-08-01 10:58 . 2010-08-01 10:58        --------        d-----w-        c:\users\p\AppData\Roaming\Malwarebytes

2010-08-01 10:58 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-01 10:58 . 2010-08-01 10:58        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-08-01 10:58 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-08-01 10:58 . 2010-08-01 11:41        --------        d-----w-        c:\program files\trend micro

2010-08-01 10:57 . 2010-08-01 10:58        --------        d-----w-        C:\rsit

2010-08-01 10:28 . 2010-08-01 14:17        --------        d-----w-        c:\program files\Windows Live Safety Center

2010-08-01 10:07 . 2010-08-01 10:07        --------        d-----w-        c:\program files\iPod

2010-08-01 10:07 . 2010-08-01 10:07        --------        d-----w-        c:\program files\iTunes

2010-08-01 08:15 . 2010-08-01 08:15        53736        ----a-w-        c:\windows\system32\drivers\bwizfgvr.sys

2010-08-01 08:01 . 2010-08-01 14:50        --------        d-----w-        c:\windows\system32\MpEngineStore

2010-08-01 07:49 . 2010-08-01 07:49        --------        d-----w-        c:\windows\CheckSur

2010-08-01 06:23 . 2010-08-01 14:59        --------        d-----w-        C:\MGADiagToolOutput

2010-08-01 06:22 . 2003-03-25 04:00        9216        ----a-w-        c:\windows\proxycfg.exe

2010-08-01 06:22 . 2010-08-01 14:59        --------        d-----w-        C:\AULOGS

2010-07-31 22:17 . 2010-07-31 22:17        38856        ----a-w-        c:\windows\system32\drivers\HookCentre.sys

2010-07-31 20:56 . 2010-07-31 20:56        680        ----a-w-        c:\users\p\AppData\Local\d3d9caps.dat

2010-07-31 20:21 . 2010-07-31 20:22        --------        d-----w-        c:\program files\TuneUp Utilities 2010

2010-07-31 20:08 . 2010-07-31 20:08        --------        d-----w-        c:\program files\BitLocker

2010-07-31 16:56 . 2010-07-31 16:56        --------        d-----w-        c:\users\p\AppData\Local\Sunbelt Software

2010-07-20 15:34 . 2010-07-20 15:45        --------        d-----w-        c:\program files\Takatis - A Tribute To Manfred Trenz

2010-07-12 15:54 . 2010-07-12 15:54        --------        d-----w-        c:\users\p\AppData\Roaming\SharePod

2010-07-08 19:53 . 2010-07-08 19:53        552        ----a-w-        c:\users\p\AppData\Local\d3d8caps.dat
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-04 14:11 . 2009-02-19 14:18        628742        ----a-w-        c:\windows\system32\perfh007.dat

2010-08-04 14:11 . 2009-02-19 14:18        126454        ----a-w-        c:\windows\system32\perfc007.dat

2010-08-04 14:06 . 2009-12-16 21:30        12        ----a-w-        c:\windows\bthservsdp.dat

2010-08-01 16:40 . 2009-07-06 19:49        --------        d-----w-        c:\users\p\AppData\Roaming\InstallShield

2010-08-01 10:07 . 2009-07-30 17:58        --------        d-----w-        c:\program files\Common Files\Apple

2010-08-01 08:40 . 2010-05-23 17:09        --------        d-----w-        c:\program files\VS Revo Group

2010-08-01 08:38 . 2009-07-10 19:45        --------        d-----w-        c:\program files\Spybot - Search & Destroy

2010-08-01 05:52 . 2009-07-06 17:53        --------        d-----w-        c:\program files\CCleaner

2010-07-31 22:48 . 2009-07-11 20:04        29992        ----a-w-        c:\windows\system32\drivers\GRD.sys

2010-07-31 22:16 . 2009-07-11 19:42        61512        ----a-w-        c:\windows\system32\drivers\MiniIcpt.sys

2010-07-31 22:16 . 2009-09-06 13:15        33480        ----a-w-        c:\windows\system32\drivers\GDBehave.sys

2010-07-31 22:16 . 2009-07-11 19:41        40904        ----a-w-        c:\windows\system32\drivers\gdwfpcd32.sys

2010-07-31 22:16 . 2009-07-11 19:40        --------        d-----w-        c:\program files\Common Files\G DATA

2010-07-31 22:15 . 2009-07-11 19:40        --------        d-----w-        c:\program files\G DATA

2010-07-31 21:40 . 2009-08-20 19:34        --------        d-----w-        c:\users\p\AppData\Roaming\IrfanView

2010-07-31 21:40 . 2010-07-04 20:22        --------        d-----w-        c:\program files\QIP 2010

2010-07-31 21:18 . 2010-02-17 19:17        --------        d-----w-        c:\users\p\AppData\Roaming\vlc(1508)

2010-07-21 15:29 . 2010-02-28 10:55        --------        d-----w-        c:\users\p\AppData\Roaming\ICQ

2010-07-19 15:10 . 2010-02-27 22:33        --------        d-----w-        c:\users\p\AppData\Roaming\Zidote

2010-07-19 04:26 . 2009-10-24 15:10        --------        d-----w-        c:\users\p\AppData\Roaming\Umru

2010-06-23 20:27 . 2009-02-26 19:36        --------        d-----w-        c:\program files\Microsoft.NET

2010-06-17 19:11 . 2009-07-10 20:15        15880        ----a-w-        c:\windows\system32\lsdelete.exe

2010-06-17 18:57 . 2010-06-17 18:57        --------        d-----w-        c:\program files\Bonjour

2010-06-12 15:34 . 2009-07-06 17:18        --------        d-----w-        c:\program files\UMTS USB Modem Manager

2010-06-09 18:31 . 2010-02-28 10:54        --------        d-----w-        c:\program files\ICQ7.0

2010-06-09 16:42 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail

2010-06-05 16:15 . 2010-06-05 16:15        --------        d-----w-        c:\program files\Auslogics

2010-06-05 16:00 . 2009-07-16 21:11        --------        d-----w-        c:\users\p\AppData\Roaming\Auslogics

2010-06-05 15:35 . 2009-02-26 19:12        --------        d-----w-        c:\program files\Microsoft Silverlight

2010-06-05 15:27 . 2010-06-05 15:32        64288        ----a-w-        c:\windows\system32\drivers\Lbd.sys

2010-06-02 02:55 . 2010-07-02 14:57        74072        ----a-w-        c:\windows\system32\XAPOFX1_5.dll

2010-06-02 02:55 . 2010-07-02 14:57        527192        ----a-w-        c:\windows\system32\XAudio2_7.dll

2010-06-02 02:55 . 2010-07-02 14:57        239960        ----a-w-        c:\windows\system32\xactengine3_7.dll

2010-05-26 17:06 . 2010-06-09 16:30        34304        ----a-w-        c:\windows\system32\atmlib.dll

2010-05-26 14:47 . 2010-06-09 16:30        289792        ----a-w-        c:\windows\system32\atmfd.dll

2010-05-26 09:41 . 2010-07-02 14:57        2106216        ----a-w-        c:\windows\system32\D3DCompiler_43.dll

2010-05-26 09:41 . 2010-07-02 14:57        248672        ----a-w-        c:\windows\system32\d3dx11_43.dll

2010-05-26 09:41 . 2010-07-02 14:57        1868128        ----a-w-        c:\windows\system32\d3dcsx_43.dll

2010-05-26 09:41 . 2010-07-02 14:57        470880        ----a-w-        c:\windows\system32\d3dx10_43.dll

2010-05-26 09:41 . 2010-07-02 14:57        1998168        ----a-w-        c:\windows\system32\D3DX9_43.dll

2010-05-25 17:18 . 2009-07-06 17:05        75832        ----a-w-        c:\users\p\AppData\Local\GDIPFONTCACHEV1.DAT

2010-05-23 15:50 . 2010-08-03 16:15        73216        ----a-w-        c:\users\p\AppData\Roaming\Mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll

2010-05-21 12:14 . 2009-10-05 17:38        221568        ----a-w-        c:\windows\system32\MpSigStub.exe

2010-05-18 14:35 . 2010-05-18 14:35        91424        ----a-w-        c:\windows\system32\dnssd.dll

2010-05-18 14:35 . 2010-05-18 14:35        107808        ----a-w-        c:\windows\system32\dns-sd.exe

2009-07-15 20:40 . 2009-07-15 20:40        8        --sh--r-        c:\windows\System32\C594C45BC0.sys

2009-02-26 20:09 . 2009-02-26 20:09        8        --sh--r-        c:\windows\System32\F928A0FA17.sys

2009-07-15 20:41 . 2009-02-26 20:09        2828        --sha-w-        c:\windows\System32\KGyGaAvL.sys

2009-01-14 14:19 . 2009-01-14 14:12        8192        --sha-w-        c:\windows\Users\Default\NTUSER.DAT

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"tsnp2uvc"="c:\windows\tsnp2uvc.exe" [2008-08-28 233472]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-10 13605408]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-10 92704]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-27 1434920]

"G Data AntiVirus Tray Application"="c:\program files\G Data\AntiVirus\AVKTray\AVKTray.exe" [2010-03-31 963144]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

SetupExecute        REG_MULTI_SZ           \0
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-squared]

2010-08-01 14:28        3634568        ----a-w-        c:\program files\Emsisoft Anti-Malware\a2guard.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-06-09 08:06        976832        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-06-20 02:04        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]

2006-09-11 03:40        218032        ----a-w-        c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-07-21 13:53        141608        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(b):f2,a2,ba,fe,7a,fe,c9,01
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-294008640-1295144867-2791281675-1000]

"EnableNotificationsRef"=dword:00000001
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 resetWinService;Reset Reader;c:\program files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe [2008-10-29 70656]

R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2010-07-31 33480]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-06-05 64288]

S1 a2injectiondriver;a2injectiondriver;c:\program files\Emsisoft Anti-Malware\a2dix86.sys [2010-05-15 39576]

S1 a2util;a-squared Malware-IDS utility driver;c:\program files\Emsisoft Anti-Malware\a2util32.sys [2010-05-05 11776]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2010-07-31 61512]

S1 gdwfpcd;G DATA WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [2010-07-31 40904]

S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2010-07-31 29992]

S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2010-08-01 1935656]

S2 AVKProxy;G Data AntiVirus Proxy;c:\program files\Common Files\G DATA\AVKProxy\AVKProxy.exe [2010-04-30 1147976]

S2 AVKService;G Data Scheduler;c:\program files\G DATA\AntiVirus\AVK\AVKService.exe [2010-03-31 410696]

S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files\G DATA\AntiVirus\AVK\AVKWCtl.exe [2010-03-15 1279816]

S3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [2010-06-28 71008]

S3 GDScan;G Data Scanner;c:\program files\Common Files\G DATA\GDScan\GDScan.exe [2010-04-22 339016]

S3 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2010-07-31 38856]

S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-26 66080]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

bthsvcs        REG_MULTI_SZ           BthServ

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://aolwebmail.aol.de/landing-page

mDefault_Page_URL = hxxp://www.aldi.com/

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4

Trusted Zone: microsoft.com

Trusted Zone: microsoft.com\*.update

Trusted Zone: microsoft.com\support

Trusted Zone: microsoft.com\update

Trusted Zone: windowsupdate.com\download

FF - ProfilePath - c:\users\p\AppData\Roaming\Mozilla\Firefox\Profiles\l33mc6ry.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tb50ffTB50CL-chromesbox-en-us&query=

FF - prefs.js: browser.startup.homepage - hxxp://www.aol.de/?r=www.aol.com

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=tb50ffTB50CL-ab-en-us&query=

FF - component: c:\program files\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}\components\avkwebfilterff.dll

FF - component: c:\users\p\AppData\Roaming\Mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll

FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 

---- FIREFOX Richtlinien ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.pipelining.ssl - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

AddRemove-Fraps - f:\fraps\uninstall.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-08-04 16:22

Windows 6.0.6002 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2010-08-04  16:28:58

ComboFix-quarantined-files.txt  2010-08-04 14:28
 

Vor Suchlauf: 13 Verzeichnis(se), 316.249.260.032 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 316.149.506.048 Bytes frei
 

- - End Of File - - 687468A7A1ECF38CF90181073570075F

--- --- ---

Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen

Code:

c:\windows\system32\drivers\xnmxwela.sys

Also gehe wie hier beschrieben vor:

Öffne diese Webseite: virustotal
Klicke auf "Durchsuchen"
Suche die Datei auf deinem Rechner--> Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
"Senden der Datei"
Warte, bis der Scandurchlauf aller Virenscanner beendet ist
Auf "Compact" klicken (Links oben zu finden)
Ein neuer Tab dürfte sich öffnen.
Den Inhalt komplett kopieren und hier einfügen

Sollte die Datei als schädlich erkannt werden bitte noch nicht entfernen

Es gibt kein "compact" auf der Seite, habe auch schon mit strg+f danach gesucht.
Wenn ich allerdings auf "Filter" klicke , wird eine compacto.html in einem neuen Fenster geöffnet. Soll ich den Inhalt dieses Fensters hier posten?

Ergebnis ist übrigens 0/42, also anscheindend kein Fund

EInmal finden die Leute Filter nicht einmal compact nicht. :confused:

Schritt 1

Downloade Dir bitte Malwarebytes

Installiere das Programm in den vorgegebenen Pfad.
Denke daran, bei Vista das Programm als Admin zu starten, ansonsten per Doppelklick starten.
Lasse es online updaten (Reiter Aktualisierungen), sofern sich das Programm bereits auf dem Rechner befand.
Aktiviere "Quick-Scan durchführen" => Scannen.
Wenn der Scan beendet ist, klicke auf "Ergebnisse anzeigen".
Versichere Dich, dass alle Funde markiert sind und drücke "Entferne Auswahl".
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
Dein Anti-Virus-Programm während des Scans deaktivieren.

Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Hacken bei Yes, i accept the Terms of Use.
Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Remove found threads" und "Scan archives".
http://img707.imageshack.us/img707/687/starteg.jpg drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt suchen und mit Deinem Editor öffnen.
Logfile hier posten.

Schritt 3

Downloade Dir bitte SecurityCheck

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.

Poste den Inhalt bitte hier.

Schritt 4

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.

Bitte poste in Deiner nächsten Antwort
MBAM LOg
ESET Log
sescan.log
OTL.txt
Extras.txt
Berichte wie der Rechner läuft

mbam

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4388
 

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18928
 

04.08.2010 18:23:10

mbam-log-2010-08-04 (18-23-10).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 140275

Laufzeit: 8 Minute(n), 3 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

eset log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=69c59e8d2db3c74499704a202248c0e9

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-08-04 06:12:53

# local_time=2010-08-04 08:12:53 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 276629 276629 0 0

# compatibility_mode=4096 16777215 100 0 324953 324953 0 0

# compatibility_mode=5892 16776573 100 100 6095 118472240 0 0

# compatibility_mode=8192 67108863 100 0 202 202 0 0

# scanned=157548

# found=1

# cleaned=1

# scan_time=6060

C:\ProgramData\Spybot - Search & Destroy\Recovery\Virtumondesdn.zip        Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined)        00000000000000000000000000000000        C

checkup.txt

Code:

 Results of screen317's Security Check version 0.99.5  

 Windows Vista Service Pack 2 (UAC is disabled!) 

 Internet Explorer 8  
 `````````````````````````````` 
 Antivirus/Firewall Check: 

 ESET Online Scanner v3   

 G Data AntiVirus 2011   

 WMI entry may not exist for antivirus; attempting automatic update. 
 ``````````````````````````````` 
 Anti-malware/Other Utilities Check: 

 Malwarebytes' Anti-Malware    

 CCleaner     

 Java(TM) 6 Update 18  

 Out of date Java installed! 

 Adobe Flash Player 10.1.53.64  

Adobe Reader 9.3.3 - Deutsch 

 Mozilla Firefox (3.6.8) 
 ```````````````````````````````` 

Process Check:  
 objlist.exe by Laurent 

 Windows Defender MSASCui.exe 

 G DATA AntiVirus AVK AVKService.exe 

 G DATA AntiVirus AVK AVKWCtl.exe 

 G DATA AntiVirus AVKTray AVKTray.exe 

 Realtek Semiconductor Corp Realtek USB 2.0 Card Reader reset.exe  

 Emsisoft Anti-Malware a2service.exe   

 Windows Defender MSASCui.exe   
 ````````````````````````````````
 DNS Vulnerability Check:
 
 ``````````End of Log````````````

otl.txt [CODE]
OTL Logfile:

Code:

OTL logfile created on: 04.08.2010 20:21:28 - Run 2

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\p\Desktop\MFTools

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18928)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 78,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 440,37 Gb Total Space | 294,58 Gb Free Space | 66,89% Space Free | Partition Type: NTFS

Drive D: | 25,38 Gb Total Space | 12,55 Gb Free Space | 49,46% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: P-PC

Current User Name: p

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.08.03 16:15:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\p\Desktop\MFTools\OTL.exe

PRC - [2010.08.01 16:28:27 | 001,935,656 | ---- | M] (Emsi Software GmbH) -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe

PRC - [2010.08.01 08:09:56 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2010.06.10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010.04.30 14:30:18 | 001,147,976 | ---- | M] (G Data Software AG) -- C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe

PRC - [2010.04.22 13:59:36 | 000,339,016 | ---- | M] (G Data Software AG) -- C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe

PRC - [2010.03.31 16:06:48 | 000,963,144 | ---- | M] (G Data Software AG) -- C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe

PRC - [2010.03.31 16:06:48 | 000,410,696 | ---- | M] (G Data Software AG) -- C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe

PRC - [2010.03.15 11:24:00 | 001,279,816 | ---- | M] (G Data Software AG) -- C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe

PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

PRC - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

PRC - [2009.04.11 08:28:04 | 000,047,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\snmp.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2008.10.29 17:20:34 | 000,070,656 | ---- | M] () -- C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe

PRC - [2008.08.28 16:03:22 | 000,233,472 | ---- | M] () -- C:\Windows\tsnp2uvc.exe

PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe

PRC - [2007.06.05 14:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.08.03 16:15:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\p\Desktop\MFTools\OTL.exe

MOD - [2010.05.09 18:50:02 | 000,212,896 | ---- | M] (Emsi Software GmbH) -- C:\Program Files\Emsisoft Anti-Malware\a2hooks32.dll

MOD - [2009.04.11 08:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll

MOD - [2008.01.21 04:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2010.08.01 16:28:27 | 001,935,656 | ---- | M] (Emsi Software GmbH) [Auto | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)

SRV - [2010.06.10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010.04.30 14:30:18 | 001,147,976 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe -- (AVKProxy)

SRV - [2010.04.22 13:59:36 | 000,339,016 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files\Common Files\G DATA\GDScan\GDScan.exe -- (GDScan)

SRV - [2010.04.21 19:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)

SRV - [2010.03.31 16:06:48 | 000,410,696 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe -- (AVKService)

SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.03.15 11:24:00 | 001,279,816 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe -- (AVKWCtl)

SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)

SRV - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)

SRV - [2009.04.11 08:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)

SRV - [2009.04.11 08:28:04 | 000,047,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\snmp.exe -- (SNMP)

SRV - [2008.10.29 17:20:34 | 000,070,656 | ---- | M] () [Auto | Running] -- C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe -- (resetWinService)

SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.06.05 14:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\p\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - [2010.08.01 00:48:13 | 000,029,992 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)

DRV - [2010.08.01 00:17:03 | 000,038,856 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HookCentre.sys -- (HookCentre)

DRV - [2010.08.01 00:16:35 | 000,061,512 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\MiniIcpt.sys -- (GDMnIcpt)

DRV - [2010.08.01 00:16:34 | 000,033,480 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\GDBehave.sys -- (GDBehave)

DRV - [2010.08.01 00:16:32 | 000,040,904 | ---- | M] (G DATA Software AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\gdwfpcd32.sys -- (gdwfpcd)

DRV - [2010.06.28 14:13:32 | 000,071,008 | ---- | M] (Emsi Software GmbH) [File_System | On_Demand | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2accx86.sys -- (a2acc)

DRV - [2010.06.05 17:27:53 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\Lbd.sys -- (Lbd)

DRV - [2010.05.15 12:37:26 | 000,039,576 | ---- | M] (Emsi Software GmbH) [File_System | System | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys -- (a2injectiondriver)

DRV - [2010.05.05 09:40:32 | 000,011,776 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2util32.sys -- (a2util)

DRV - [2010.03.04 13:50:14 | 000,261,152 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2009.06.26 22:55:12 | 000,066,080 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)

DRV - [2009.04.11 06:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB-Audiotreiber (WDM)

DRV - [2009.03.26 08:00:02 | 000,064,000 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTSTOR.sys -- (RTSTOR)

DRV - [2009.02.27 14:24:10 | 000,205,232 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)

DRV - [2009.02.10 07:38:00 | 007,547,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008.12.29 19:06:54 | 001,799,808 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)

DRV - [2008.10.31 12:43:30 | 002,231,456 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008.04.28 15:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)

DRV - [2008.01.21 04:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)

DRV - [2008.01.21 04:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)

DRV - [2008.01.21 04:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)

DRV - [2008.01.21 04:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)

DRV - [2008.01.21 04:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)

DRV - [2008.01.21 04:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)

DRV - [2008.01.21 04:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)

DRV - [2008.01.21 04:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)

DRV - [2008.01.21 04:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)

DRV - [2008.01.21 04:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)

DRV - [2008.01.21 04:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)

DRV - [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)

DRV - [2008.01.21 04:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)

DRV - [2008.01.21 04:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)

DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)

DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)

DRV - [2008.01.21 04:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)

DRV - [2008.01.21 04:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)

DRV - [2008.01.21 04:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)

DRV - [2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)

DRV - [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)

DRV - [2008.01.21 04:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)

DRV - [2008.01.21 04:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)

DRV - [2008.01.21 04:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)

DRV - [2008.01.21 04:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)

DRV - [2007.08.24 19:44:54 | 000,101,504 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)

DRV - [2007.01.04 12:15:08 | 000,009,336 | ---- | M] (hxxp://www.internals.com) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\WinIo.sys -- (WINIO)

DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)

DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)

DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)

DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)

DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)

DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)

DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)

DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)

DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)

DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)

DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)

DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)

DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)

DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)

DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)

DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)

DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)

DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://aolwebmail.aol.de/landing-page

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "AOL Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.aol.com/aolcom/search?invocationType=tb50ffTB50CL-chromesbox-en-us&query="

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.aol.de/?r=www.aol.com"

FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:20.1.0.4

FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1

FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9

FF - prefs.js..keyword.URL: "hxxp://search.aol.com/aolcom/search?invocationType=tb50ffTB50CL-ab-en-us&query="

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.08.01 08:10:09 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.08.01 11:34:24 | 000,000,000 | ---D | M]

 

[2009.07.06 20:26:05 | 000,000,000 | ---D | M] -- C:\Users\p\AppData\Roaming\mozilla\Extensions

[2010.08.04 18:37:21 | 000,000,000 | ---D | M] -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions

[2010.08.03 18:15:30 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}

[2010.07.31 23:40:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2010.07.29 21:08:26 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(1012)

[2010.07.14 17:01:13 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}

[2010.08.01 09:55:29 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.07.12 21:55:31 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(1013)

[2010.07.14 17:14:15 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\p\AppData\Roaming\mozilla\Firefox\Profiles\l33mc6ry.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

[2010.03.24 16:13:02 | 000,000,917 | ---- | M] () -- C:\Users\p\AppData\Roaming\Mozilla\FireFox\Profiles\l33mc6ry.default\searchplugins\conduit.xml

[2010.08.04 18:37:21 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010.08.01 00:16:41 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}

[2009.10.26 15:45:36 | 000,102,400 | ---- | M] (Zylom) -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll

[2010.08.01 08:10:04 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.08.01 08:10:05 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.08.01 08:10:05 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.08.01 08:10:05 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.08.01 08:10:05 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.08.01 08:44:35 | 000,415,664 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 14350 more lines...

O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG)

O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG)

O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe ()

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)

O15 - HKCU\..Trusted Domains: microsoft.com ([]https in Vertrauenswürdige Sites)

O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Vertrauenswürdige Sites)

O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Vertrauenswürdige Sites)

O15 - HKCU\..Trusted Domains: microsoft.com ([support] http in Vertrauenswürdige Sites)

O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Vertrauenswürdige Sites)

O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Vertrauenswürdige Sites)

O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] https in Vertrauenswürdige Sites)

O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab (Windows Live OneCare safety scanner control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.44.1 192.168.44.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\p\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Users\p\Downloads\stkatharinen.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2008.08.21 11:50:32 | 000,000,672 | RH-- | M] () - D:\autoexec.bat -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.08.04 18:28:30 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2010.08.04 16:29:24 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2010.08.04 16:29:03 | 000,000,000 | ---D | C] -- C:\Users\p\AppData\Local\temp

[2010.08.04 16:00:22 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2010.08.04 16:00:22 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2010.08.04 16:00:21 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2010.08.04 16:00:05 | 000,000,000 | ---D | C] -- C:\Combo-Fix

[2010.08.04 15:59:17 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.08.04 15:58:39 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe

[2010.08.03 16:22:26 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2010.08.03 16:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2010.08.03 16:16:55 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip

[2010.08.03 16:15:23 | 000,000,000 | ---D | C] -- C:\Users\p\Desktop\MFTools

[2010.08.01 18:46:35 | 000,071,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\telnet.exe

[2010.08.01 17:37:25 | 000,000,000 | ---D | C] -- C:\inetpub

[2010.08.01 16:54:12 | 000,000,000 | ---D | C] -- C:\58f9b5a69083cd2823

[2010.08.01 16:49:58 | 000,053,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\xnmxwela.sys

[2010.08.01 16:23:52 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware

[2010.08.01 16:23:52 | 000,000,000 | ---D | C] -- C:\Users\p\Documents\Anti-Malware

[2010.08.01 16:10:51 | 015,431,056 | ---- | C] (Microsoft Corporation) -- C:\Users\p\Desktop\mpas-fe.exe

[2010.08.01 12:58:52 | 000,000,000 | ---D | C] -- C:\Users\p\AppData\Roaming\Malwarebytes

[2010.08.01 12:58:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010.08.01 12:58:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010.08.01 12:58:24 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010.08.01 12:58:24 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010.08.01 12:58:00 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro

[2010.08.01 12:57:59 | 000,000,000 | ---D | C] -- C:\rsit

[2010.08.01 12:28:32 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center

[2010.08.01 12:07:12 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2010.08.01 12:07:10 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2010.08.01 10:15:04 | 000,053,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\bwizfgvr.sys

[2010.08.01 10:01:48 | 000,000,000 | ---D | C] -- C:\Windows\System32\MpEngineStore

[2010.08.01 09:49:48 | 000,000,000 | ---D | C] -- C:\Windows\CheckSur

[2010.08.01 08:23:34 | 000,000,000 | ---D | C] -- C:\MGADiagToolOutput

[2010.08.01 08:22:37 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\proxycfg.exe

[2010.08.01 08:22:03 | 000,000,000 | ---D | C] -- C:\AULOGS

[2010.08.01 08:02:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Office Genuine Advantage

[2010.08.01 00:17:03 | 000,038,856 | ---- | C] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys

[2010.07.31 22:21:33 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2010

[2010.07.31 22:08:11 | 000,000,000 | ---D | C] -- C:\Program Files\BitLocker

[2010.07.31 18:56:42 | 000,000,000 | ---D | C] -- C:\Users\p\AppData\Local\Sunbelt Software

[2010.07.31 18:56:11 | 000,000,000 | -H-D | C] -- C:\ProgramData\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}

[2010.07.28 17:31:12 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch

[2010.07.26 19:19:06 | 000,000,000 | ---D | C] -- C:\Users\p\Desktop\Gelöbnis

[2010.07.20 17:34:20 | 000,000,000 | ---D | C] -- C:\Program Files\Takatis - A Tribute To Manfred Trenz

[2010.07.12 17:55:12 | 000,000,000 | ---D | C] -- C:\Users\p\Desktop\ipod felix

[2010.07.12 17:54:35 | 000,000,000 | ---D | C] -- C:\Users\p\AppData\Roaming\SharePod

[2010.07.08 17:53:06 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

[2010.07.08 17:20:00 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2009.02.27 19:17:28 | 000,225,280 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll

[2009.02.27 19:17:27 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.08.04 20:21:10 | 006,291,456 | -HS- | M] () -- C:\Users\p\ntuser.dat

[2010.08.04 20:17:50 | 000,869,051 | ---- | M] () -- C:\Users\p\Desktop\SecurityCheck.exe

[2010.08.04 19:34:29 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010.08.04 19:34:29 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010.08.04 18:28:07 | 002,672,312 | ---- | M] () -- C:\Users\p\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 17:42:11 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2010.08.04 17:42:11 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010.08.04 17:42:11 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2010.08.04 17:42:11 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010.08.04 17:42:10 | 001,445,310 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010.08.04 17:36:10 | 000,216,621 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2010.08.04 17:36:09 | 000,216,621 | ---- | M] () -- C:\ProgramData\nvModes.001

[2010.08.04 17:34:30 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010.08.04 17:34:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010.08.04 17:33:51 | 3215,851,520 | -HS- | M] () -- C:\hiberfil.sys

[2010.08.04 17:33:06 | 000,524,288 | -HS- | M] () -- C:\Users\p\ntuser.dat{c2a1311d-9cea-11df-b03a-8a9cd467a7e6}.TMContainer00000000000000000001.regtrans-ms

[2010.08.04 17:33:06 | 000,065,536 | -HS- | M] () -- C:\Users\p\ntuser.dat{c2a1311d-9cea-11df-b03a-8a9cd467a7e6}.TM.blf

[2010.08.04 17:32:51 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2010.08.04 17:32:36 | 006,291,456 | -H-- | M] () -- C:\Users\p\AppData\Local\IconCache.db

[2010.08.04 16:23:16 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini

[2010.08.04 15:57:34 | 003,749,693 | R--- | M] () -- C:\Users\p\Desktop\Combo-Fix.exe

[2010.08.03 16:21:19 | 000,000,697 | ---- | M] () -- C:\Users\p\Desktop\NTREGOPT.lnk

[2010.08.03 16:21:19 | 000,000,678 | ---- | M] () -- C:\Users\p\Desktop\ERUNT.lnk

[2010.08.03 16:15:34 | 000,284,915 | ---- | M] () -- C:\Users\p\Desktop\Gmer.zip

[2010.08.03 16:14:52 | 000,410,626 | ---- | M] () -- C:\Users\p\Desktop\Load.exe

[2010.08.01 16:49:58 | 000,053,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\xnmxwela.sys

[2010.08.01 16:24:22 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2010.08.01 16:11:15 | 015,431,056 | ---- | M] (Microsoft Corporation) -- C:\Users\p\Desktop\mpas-fe.exe

[2010.08.01 12:58:41 | 000,000,800 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.08.01 11:28:06 | 000,000,002 | ---- | M] () -- C:\Windows\msoffice.ini

[2010.08.01 10:15:04 | 000,053,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\bwizfgvr.sys

[2010.08.01 10:04:25 | 000,000,036 | ---- | M] () -- C:\Users\p\AppData\Local\housecall.guid.cache

[2010.08.01 09:51:27 | 000,000,249 | ---- | M] () -- C:\Windows\win.ini

[2010.08.01 08:44:35 | 000,415,664 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2010.08.01 07:52:10 | 000,000,823 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk

[2010.08.01 00:48:13 | 000,029,992 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys

[2010.08.01 00:17:03 | 000,038,856 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\HookCentre.sys

[2010.08.01 00:16:35 | 000,061,512 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\MiniIcpt.sys

[2010.08.01 00:16:34 | 000,033,480 | ---- | M] (G Data Software AG) -- C:\Windows\System32\drivers\GDBehave.sys

[2010.08.01 00:16:32 | 000,040,904 | ---- | M] (G DATA Software AG) -- C:\Windows\System32\drivers\gdwfpcd32.sys

[2010.07.31 23:51:46 | 000,524,288 | -HS- | M] () -- C:\Users\p\ntuser.dat{c2a1311d-9cea-11df-b03a-8a9cd467a7e6}.TMContainer00000000000000000002.regtrans-ms

[2010.07.31 23:35:44 | 000,524,288 | -HS- | M] () -- C:\Users\p\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2010.07.31 23:35:44 | 000,065,536 | -HS- | M] () -- C:\Users\p\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2010.07.31 22:56:53 | 000,000,680 | ---- | M] () -- C:\Users\p\AppData\Local\d3d9caps.dat

[2010.07.31 17:46:19 | 000,000,000 | ---- | M] () -- C:\Users\p\Desktop\SharePodSettings.xml

[2010.07.08 21:53:56 | 000,000,552 | ---- | M] () -- C:\Users\p\AppData\Local\d3d8caps.dat

 
 ========== Files Created - No Company Name ==========

 

[2010.08.04 20:17:42 | 000,869,051 | ---- | C] () -- C:\Users\p\Desktop\SecurityCheck.exe

[2010.08.04 18:27:49 | 002,672,312 | ---- | C] () -- C:\Users\p\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 16:00:22 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe

[2010.08.04 16:00:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2010.08.04 16:00:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2010.08.04 16:00:22 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe

[2010.08.04 16:00:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2010.08.04 15:57:18 | 003,749,693 | R--- | C] () -- C:\Users\p\Desktop\Combo-Fix.exe

[2010.08.03 16:36:34 | 000,293,376 | ---- | C] () -- C:\Users\p\Desktop\gmer.exe

[2010.08.03 16:21:19 | 000,000,697 | ---- | C] () -- C:\Users\p\Desktop\NTREGOPT.lnk

[2010.08.03 16:21:19 | 000,000,678 | ---- | C] () -- C:\Users\p\Desktop\ERUNT.lnk

[2010.08.03 16:15:33 | 000,284,915 | ---- | C] () -- C:\Users\p\Desktop\Gmer.zip

[2010.08.03 16:14:46 | 000,410,626 | ---- | C] () -- C:\Users\p\Desktop\Load.exe

[2010.08.01 16:24:22 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2010.08.01 12:58:41 | 000,000,800 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.08.01 11:28:06 | 000,000,002 | ---- | C] () -- C:\Windows\msoffice.ini

[2010.08.01 10:04:25 | 000,000,036 | ---- | C] () -- C:\Users\p\AppData\Local\housecall.guid.cache

[2010.08.01 07:52:10 | 000,000,823 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk

[2010.07.31 23:42:41 | 000,524,288 | -HS- | C] () -- C:\Users\p\ntuser.dat{c2a1311d-9cea-11df-b03a-8a9cd467a7e6}.TMContainer00000000000000000002.regtrans-ms

[2010.07.31 23:42:41 | 000,524,288 | -HS- | C] () -- C:\Users\p\ntuser.dat{c2a1311d-9cea-11df-b03a-8a9cd467a7e6}.TMContainer00000000000000000001.regtrans-ms

[2010.07.31 23:42:40 | 000,065,536 | -HS- | C] () -- C:\Users\p\ntuser.dat{c2a1311d-9cea-11df-b03a-8a9cd467a7e6}.TM.blf

[2010.07.31 23:41:43 | 3215,851,520 | -HS- | C] () -- C:\hiberfil.sys

[2010.07.31 22:56:53 | 000,000,680 | ---- | C] () -- C:\Users\p\AppData\Local\d3d9caps.dat

[2010.07.31 17:46:19 | 000,000,000 | ---- | C] () -- C:\Users\p\Desktop\SharePodSettings.xml

[2010.07.08 21:53:56 | 000,000,552 | ---- | C] () -- C:\Users\p\AppData\Local\d3d8caps.dat

[2009.12.03 09:27:28 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2009.08.01 08:00:16 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini

[2009.07.15 22:40:55 | 000,000,008 | RHS- | C] () -- C:\Windows\System32\C594C45BC0.sys

[2009.07.10 17:58:53 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2009.07.06 22:23:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.02.27 19:17:28 | 001,799,808 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys

[2009.02.27 19:17:28 | 000,028,544 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys

[2009.02.27 19:17:28 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini

[2009.02.26 22:09:31 | 000,002,828 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys

[2009.02.26 22:09:31 | 000,000,008 | RHS- | C] () -- C:\Windows\System32\F928A0FA17.sys

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:07BF512B

< End of report >

--- --- ---

extras.txt[CODE]
OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 04.08.2010 20:21:28 - Run 2

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\p\Desktop\MFTools

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18928)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 58,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 78,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 440,37 Gb Total Space | 294,58 Gb Free Space | 66,89% Space Free | Partition Type: NTFS

Drive D: | 25,38 Gb Total Space | 12,55 Gb Free Space | 49,46% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: P-PC

Current User Name: p

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-294008640-1295144867-2791281675-1000]

"EnableNotifications" = 0

"EnableNotificationsRef" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{2F828256-A407-4A9C-8EBA-0045EBB63B5E}" = lport=445 | protocol=6 | dir=in | app=system | 

"{327C65E6-49A1-4537-AD4E-AADE73777077}" = rport=445 | protocol=6 | dir=out | app=system | 

"{541F1FD7-B18F-4CDC-80CD-7D06F6D81ED3}" = rport=137 | protocol=17 | dir=out | app=system | 

"{738E122A-0FB4-4610-87F1-EF6EB53BBFD9}" = lport=139 | protocol=6 | dir=in | app=system | 

"{78EADD69-0E7F-48C7-9A51-4EE2A4430159}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{94EF7593-F742-42C0-8DC7-65D14473B5EA}" = rport=139 | protocol=6 | dir=out | app=system | 

"{A564B61F-492E-4114-ABBD-25131B9652F3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{A58133DB-6AD3-409D-A191-62397626FF2B}" = lport=138 | protocol=17 | dir=in | app=system | 

"{AEED8DBE-66EF-471E-A439-65104F61BA8F}" = lport=137 | protocol=17 | dir=in | app=system | 

"{BE4054F6-2320-4BB1-8158-5840CCAE1409}" = rport=138 | protocol=17 | dir=out | app=system | 

"{C90DE755-AC5A-48CE-9A79-77608B8D396B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{FC521FF4-E94A-40B6-BF72-81642B6865F7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{09FABCB3-B0B1-4939-ACC1-6478AB36C247}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 

"{0DEE00E7-FD50-46B8-ABE6-3D5664A32E70}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{0FEF4989-76E9-4FDA-841C-B651EA3B8943}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{15C7E744-C89A-49ED-94B8-BAD6892CC36D}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 

"{16519162-75A1-4D4E-BF37-EF58FEB9EF1B}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 

"{20A88B22-AE74-4C0F-9E72-A76B138F5B17}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 

"{24756425-6EA9-453D-B695-59578712989C}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 

"{28C15D13-16F3-4324-8BC7-745B8F1F13A7}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 

"{322A7DD1-1D3E-4C81-A458-52F44B9B7F8D}" = protocol=6 | dir=in | app=c:\program files\aol 9.5\waol.exe | 

"{3F33C070-139A-43FE-B23E-EB5FFC9F8D1D}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{4A84B039-9ED0-4824-AD1D-8D17A0A677F7}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{4C0209E8-AD52-47B7-AE4E-CDD8B04CD1CD}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 

"{4D21F655-F65E-4CE7-8C36-F00AA9FF062B}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 

"{4FD3110A-746C-49F8-B499-404F755F022E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{5180B208-82EC-4BEF-B1B5-4AA2DF822BF8}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1262986491\ee\aolsoftware.exe | 

"{54C13352-8338-4637-862E-1C936E9E5849}" = protocol=17 | dir=in | app=c:\felix\schtserv psobb\psobb.exe | 

"{5AD6B509-EA9B-4F9F-BA5F-6EFF7F21A0AD}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 

"{5E6D0C49-70E8-4417-84AC-74AD1D18F721}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe | 

"{5F234E26-8DD8-4457-8F26-7AFD65B310DF}" = protocol=6 | dir=in | app=c:\felix\schtserv psobb\psobb.exe | 

"{666CF554-FE0E-4A61-8BA3-2F5CD7DE200F}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 

"{6E0EE42A-82E6-49F5-A788-EBD4FE1ECBAA}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1262986491\ee\aolsoftware.exe | 

"{708D9159-D173-4246-9C64-05783EB2ECEE}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 

"{7714F107-452F-446D-801A-98B91621B94E}" = protocol=17 | dir=in | app=c:\felix\schtserv psobb\online.exe | 

"{772332D9-8E63-45F2-A78E-F6288046BF59}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1262986491\ee\aolsoftware.exe | 

"{7778180D-C1D6-432A-98B8-DC8B35CC3913}" = protocol=17 | dir=in | app=c:\felix\schtserv psobb\shpsobb.exe | 

"{7860479F-27AB-49C7-A7F2-6DAAC9BD4D39}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 

"{7BE72E0C-40C3-460C-8284-2076E0253729}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 

"{7F912898-C366-44B9-AC82-EF948C61652D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{81004F3B-0679-4834-A29D-9128F38F08AF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{84E0C4C7-E7A2-4856-B547-5D456F0CF840}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 

"{8B07C8C4-7006-4BAE-9A25-EA991F5B11A4}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 

"{97F43610-293A-4D1E-B22A-2FA088E7A8F1}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1262986491\ee\aolsoftware.exe | 

"{A3BC4C39-933D-4E13-B690-F1C28D3D4781}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 

"{A6A4B417-FFC1-4830-9E99-8881ECA3CF01}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 

"{AE17506D-032F-4F66-B086-D0846FD7478D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{AF9FDBA0-22F3-4B80-A595-5368E084689E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{B74D3210-765E-466F-831C-0EF2D7E1D0AF}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 

"{B8276A8F-8B82-4686-B463-A4F63BE94BAF}" = dir=in | app=c:\program files\homecinema\powerdvd8\powerdvd8.exe | 

"{BF92D166-59F8-41CE-B8B3-FA40D55EC235}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 

"{C0CEDCED-E86C-4BBE-817A-DFFD5900B100}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 

"{D2E42D1F-70CD-4B9E-9FA3-96412C051C63}" = protocol=6 | dir=in | app=c:\felix\schtserv psobb\online.exe | 

"{D7A6F9B7-FA6C-4F48-A93C-7D86C9C9D558}" = protocol=6 | dir=in | app=c:\felix\schtserv psobb\shpsobb.exe | 

"{D922FDB0-6A89-40CF-8D10-B45F64F5B177}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 

"{DB872373-8577-4F9D-AFC4-6F74DEB8096B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{DE2879EC-AE02-4C96-AF20-4261E65579DD}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{E4F1FBE7-5091-41DB-9E5A-11A1478E23D4}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 

"{E541673A-7677-497C-B4E5-E3E0E13B9C5F}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 

"{E65DFA9C-5CE1-449F-80D5-BE188069D70E}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 

"{E741FDE0-F3C4-4D0E-A668-A8B3435EDF8D}" = protocol=17 | dir=in | app=c:\felix\schtserv psobb\option.exe | 

"{E7A228C7-225E-45BF-AF68-7A5A59CD2537}" = protocol=17 | dir=in | app=c:\program files\aol 9.5\waol.exe | 

"{EC74BC79-1B2A-4702-9C27-8D6AE71594C9}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 

"{EE5F334C-3215-4B8A-89A2-ABFE252EEA46}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{EF233382-B1B0-4BF6-B232-01127AB65F71}" = protocol=6 | dir=in | app=c:\felix\schtserv psobb\option.exe | 

"TCP Query User{07BB5C59-0E3B-4A6B-B37D-C1FCE5CD9D5D}G:\chef-chat.exe" = protocol=6 | dir=in | app=g:\chef-chat.exe | 

"TCP Query User{3363D869-9881-43EA-8F23-D9084CB51D4D}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

"TCP Query User{7CBCA921-B5DC-49F9-BC1B-75BD63533263}C:\users\p\desktop\chat\chef-chat.exe" = protocol=6 | dir=in | app=c:\users\p\desktop\chat\chef-chat.exe | 

"TCP Query User{8C985E95-676C-4039-A04F-6ACEF846C1D0}C:\program files\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 

"TCP Query User{CEB45F5A-E1E2-4C1D-9495-4885712CB37E}F:\felix\csvondaniel\hl.exe" = protocol=6 | dir=in | app=f:\felix\csvondaniel\hl.exe | 

"UDP Query User{399A0EB2-7FFB-444D-9BB0-8A758E46AB18}C:\program files\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 

"UDP Query User{9FD27C88-DDA6-4391-8F4F-9031599FB5A1}F:\felix\csvondaniel\hl.exe" = protocol=17 | dir=in | app=f:\felix\csvondaniel\hl.exe | 

"UDP Query User{C9DB93FF-42B6-4606-A6EA-DC3F51EEB438}C:\users\p\desktop\chat\chef-chat.exe" = protocol=17 | dir=in | app=c:\users\p\desktop\chat\chef-chat.exe | 

"UDP Query User{E46D1FAF-D49F-40B5-9FB3-7F75D76DE837}G:\chef-chat.exe" = protocol=17 | dir=in | app=g:\chef-chat.exe | 

"UDP Query User{F7B66185-AE2A-40E5-91C2-BAE819143B06}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent

"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 18

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8

"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup

"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB Video Device

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update

"{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}" = Nero StartSmart OEM

"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail

"{5A96225D-A3B7-4535-AE49-3BF217999669}" = RPG Maker Fonts

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart

"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries

"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow

"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer

"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger

"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver

"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync

"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{a270d477-c50f-4199-bd3a-bda8e386c327}" = Nero 9 Essentials

"{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}" = G Data AntiVirus 2011

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support

"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center

"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player

"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer

"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow

"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade

"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader

"{DE60CAE2-4CA8-4A6A-A557-0668004FE889}" = Moorhuhn Kart Extra XXL

"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag

"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager

"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner

"7-Zip" = 7-Zip 4.65

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"CCleaner" = CCleaner

"Emsisoft Anti-Malware_is1" = Emsisoft Anti-Malware 5.0

"ERUNT_is1" = ERUNT 1.1j

"ESET Online Scanner" = ESET Online Scanner v3

"HOMESTUDENTR" = Microsoft Office Home and Student 2007

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8

"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow

"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector

"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow

"IrfanView" = IrfanView (remove only)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)

"NVIDIA Drivers" = NVIDIA Drivers

"Revo Uninstaller" = Revo Uninstaller 1.89

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"UMTS USB Modem Manager" = UMTS USB Modem Manager

"ViewpointMediaPlayer" = Viewpoint Media Player

"VLC media player" = VLC media player 1.1.2

"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"QIP 2010" = QIP 2010 10.6.16.3632

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 03.08.2010 14:24:12 | Computer Name = p-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 03.08.2010 14:24:12 | Computer Name = p-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 9438

 

Error - 03.08.2010 14:24:12 | Computer Name = p-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 9438

 

Error - 04.08.2010 09:56:39 | Computer Name = p-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.08.2010 10:08:39 | Computer Name = p-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.08.2010 10:22:36 | Computer Name = p-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung REGT.cfxxe, Version 6.0.6001.18000, Zeitstempel

 0x47918ae8, fehlerhaftes Modul a2hooks32.dll, Version 5.0.0.27, Zeitstempel 0x4be67d71,

 Ausnahmecode 0xc0000005, Fehleroffset 0x000024df,  Prozess-ID 0xf78, Anwendungsstartzeit

 01cb33e07bfbb5ec.

 

Error - 04.08.2010 10:22:57 | Computer Name = p-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung REGT.cfxxe, Version 6.0.6001.18000, Zeitstempel

 0x47918ae8, fehlerhaftes Modul a2hooks32.dll, Version 5.0.0.27, Zeitstempel 0x4be67d71,

 Ausnahmecode 0xc0000005, Fehleroffset 0x000024df,  Prozess-ID 0xbb4, Anwendungsstartzeit

 01cb33e08873c9cc.

 

Error - 04.08.2010 10:29:04 | Computer Name = p-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung regedit.exe, Version 6.0.6001.18000, Zeitstempel

 0x47918ae8, fehlerhaftes Modul a2hooks32.dll, Version 5.0.0.27, Zeitstempel 0x4be67d71,

 Ausnahmecode 0xc0000005, Fehleroffset 0x000024df,  Prozess-ID 0xfc0, Anwendungsstartzeit

 01cb33e16355b94c.

 

Error - 04.08.2010 10:34:54 | Computer Name = p-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 04.08.2010 11:35:35 | Computer Name = p-PC | Source = WinMgmt | ID = 10

Description = 

 

[ Media Center Events ]

Error - 10.07.2009 15:58:39 | Computer Name = p-PC | Source = Media Center Guide | ID = 0

Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;

 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide
 

 

[ System Events ]

Error - 03.08.2010 12:28:59 | Computer Name = p-PC | Source = Service Control Manager | ID = 7032

Description = 

 

Error - 04.08.2010 09:56:40 | Computer Name = p-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 04.08.2010 10:03:43 | Computer Name = p-PC | Source = Service Control Manager | ID = 7034

Description = 

 

Error - 04.08.2010 10:03:51 | Computer Name = p-PC | Source = Service Control Manager | ID = 7030

Description = 

 

Error - 04.08.2010 10:08:40 | Computer Name = p-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 04.08.2010 10:08:40 | Computer Name = p-PC | Source = Service Control Manager | ID = 7034

Description = 

 

Error - 04.08.2010 10:08:40 | Computer Name = p-PC | Source = Service Control Manager | ID = 7030

Description = 

 

Error - 04.08.2010 10:22:52 | Computer Name = p-PC | Source = Service Control Manager | ID = 7030

Description = 

 

Error - 04.08.2010 10:34:55 | Computer Name = p-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 04.08.2010 11:35:36 | Computer Name = p-PC | Source = Service Control Manager | ID = 7000

Description = 

 

 

< End of report >

--- --- ---

der laptop läuft meiner ansicht nach wieder normal.
es gab noch keine aufrufe dubioser seiten,
und die windows updates funktionieren wieder.

Warum ist der UAC ausgeschalten ? Bitte nach den folgenden Schritten anstellen.

Logfile ist sauber :daumenhoc

Hier noch die letzten paar Schritte zur Säuberung Deines Rechners.

Schritt 1

Java aktualisieren

Deine Javaversion ist veraltet. Da einige Schädlinge (z. B. Vundo) über Java-Exploits in das System eindringen, muss Java aktualisiert werden und alte Versionen müssen vom System entfernt werden, da die alten Versionen ein Sicherheitsrisiko darstellen. Lade JavaRa von prm753 herunter und entpacke es auf den Desktop. JavaRA ist geeignet für Windows 9x, 2k, XP und Vista (mit deaktivierter Benuterkontensteuerung).

Schließe alle Browserfenster.
Doppelklicke die JavaRa.exe, um das Programm zu starten.
Die Sprache auswählen, nimm Englisch und klicke "Select".
Klicke auf Additional Task, mache Haken bei Remove Useless JRE Files und [b]Remove Sun Download Manager[b].
Klicke auf Go und jeweils auf Ok und schließe das Fenster "Additional Tasks" wieder.
Klicke auf Remove Older Versions, um alte Java-Versionen, die auf dem Rechner installiert sind, zu entfernen.
Klicke auf Yes wenn es verlangt wird. Wenn JavaRa fertig, erscheint eine Notiz, dass ein Logfile erstellt wurde, klicke OK.
Das Logfile wird im Editor geöffnet, bitte speichern und später hier posten.
Kontrolliere in Systemsteuerung => Programme, ob noch Java-Versionen vorhanden sind und deinstalliere diese.
Rechner neu starten.

Downloade nun Java (Java Runtime Environment (JRE) 6 Update XX) von Oracle und installiere es. Vor dem Download musst Du die Lizenzbedingungen akzeptieren, indem Du "Accept License Agreement" aktivierst. Erweiterte Optionen anhaken, Sponsoren-Programm (Toolbar oder ähnliches) ggfs. abwählen.

Schritt 2

Combofix deinstallieren

Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Start => Ausführen (bei Vista (Windows-Taste + R) => dort reinschreiben ComboFix /uninstall => Enter drücken - damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch auch dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.

Schritt 3

Tool CleanUp

Starte bitte die OTL.exe.
Klicke nun auf den Bereinigung Button. Dies wird die meisten Tools und Logfiles entfernen.
Sollte denoch etwas bestehen bleiben, bitte manuell entfernen sowie den Papierkorb leeren.

Schritt 4

Automatische Updates

Sehen wir nach ob die Updates für Windows sich automatisch downloaden. Das ist der beste Weg um all die Sicherheits- Patches und Fixes zu erhalten.

Windows + R Taste drücken. Kopiere nun folgenden Text in die Kommandozeile

RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

und klicke auf OK.
Stelle sicher das die automatischen Updates aktiviert sind.

Schritt 5

Um Dich für die Zukunft vor weiteren Infizierungen zu schützen empfehle ich Dir noch ein paar Programme.

SpywareBlaster
Ein Tutorial zur Verwendung findest Du Hier
MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
Hinweis: MBAM ersetzt keine Anti- Viren- Software.
Temp File Cleaner
TFC ist ein wirklich starkes Tool zum entfernen von Temp Dateien vom IE und WIndows, leert den Papierkorb und noch viel mehr.
Ausserdem hilft es Deinen Computer zu beschleunigen.
Du kannst Dir TFC ( by OldTimer ) hier downloaden.
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
Halte Dein System aktuell
Ich kann gar nicht oft genug betonen, wie wichtig es ist, dass der PC auf dem aktuellsten Stand der Dinge ist.
Es werden oft genug Sicherheitslücken in Windows eigenen Anwendungen gefunden. Diese "Löcher" gehören entfernt, weil Angreifer diese womöglich nutzen um unauthorisiert auf Dein System zu zugreifen.
Jeden zweiten Dienstag im Monat ist Update Tag. Besuche bitte dazu die Microsoft Update Seite.
Halte Deine Software aktuell
Der einfachste Weg dafür ist der Secunia Online Software.

Schritt 6

Tipps für sicheres Surfen

Das sind meine Vorschläge.
Verwende einen alternativen Browser statt den IE.
Ich empfehle Mozilla Firefox.

Für Firefox gibt es verschiedenste AddOns um sicher durch das WWW zu kommen.

NoScript
Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
AdblockPlus
Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
Es spart ausserdem Downloadkapazität.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

habe jetzt alles gemacht.
und den log von der java installation schon vernichtet...

habe noch einen hinweis.
in der anleitung zu combofix steht, dass man die datei auf dem desktop speichern soll. um allerdings per "ausführen" auf dateien auf dem desktop zuzugreifen( im falle combofix zur deinstallation), muss der absolute pfad angegeben werden, also zb C:\users\xxx\desktop\combofix.exe /uninstall

ohne pfadangabe wird die datei nämlich in c:\windows\system32 gesucht

dann noch eine frage. an welchem log/ eintrag hast du gesehen, dass mit dem rechner etwas nicht stimmt, und was hat dann combofix gemacht, um dies zu ändern?

vielen dank für die hilfe :)

Nein, es geht auch ohne die Pfadangabe ;)
Wie und wieso darf und werd ich nicht sagen. Keine Infos zu Combofix

Zitat:

Infizierte Kopie von c:\windows\system32\drivers\disk.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt