Trojaner-Board - Musik-Problem

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Musik-Problem (https://www.trojaner-board.de/89064-musik-problem.html)

Leftis

03.08.2010 14:48

Musik-Problem

Hallo zusammen,

habe genau das Problem wie hier bereits beschrieben:

http://www.trojaner-board.de/88952-m...ntergrund.html

und

http://www.trojaner-board.de/88827-m...-trojaner.html

Ich bin absolut neu auf dem Gebiet und wäre für Hilfe sehr dankbar.
Ich habe gelesen, dass der MBRcheck.exe hier hilfreich sein soll und habe mal einen ausgeführt:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 2 (build 2600)

Logical Drives Mask:                0x000003fc
 

Kernel Drivers (total 132):

  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

  0x806CE000 \WINDOWS\system32\hal.dll

  0xF8B66000 \WINDOWS\system32\KDCOM.DLL

  0xF8A76000 \WINDOWS\system32\BOOTVID.dll

  0xF8465000 spys.sys

  0xF8B68000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF844D000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF841E000 ACPI.sys

  0xF840D000 pci.sys

  0xF8666000 ohci1394.sys

  0xF8676000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF8686000 isapnp.sys

  0xF8B6A000 viaide.sys

  0xF88E6000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF8696000 MountMgr.sys

  0xF83EE000 ftdisk.sys

  0xF8B6C000 dmload.sys

  0xF83C8000 dmio.sys

  0xF88EE000 PartMgr.sys

  0xF86A6000 VolSnap.sys

  0xF83B0000 atapi.sys

  0xF86B6000 disk.sys

  0xF86C6000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF8391000 fltMgr.sys

  0xF837F000 sr.sys

  0xF86D6000 PxHelp20.sys

  0xF8368000 KSecDD.sys

  0xF82DB000 Ntfs.sys

  0xF82AE000 NDIS.sys

  0xF88F6000 viaagp1.sys

  0xF8293000 Mup.sys

  0xF86E6000 gagp30kx.sys

  0xF8716000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xF7B29000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xF7B15000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF7AE9000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys

  0xF79DA000 \SystemRoot\system32\DRIVERS\HSF_DP.sys

  0xF7942000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

  0xF899E000 \SystemRoot\System32\Drivers\Modem.SYS

  0xF7903000 \SystemRoot\system32\DRIVERS\mrv8k51.sys

  0xF88D6000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF8726000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF8736000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF78E0000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF89A6000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0xF78BD000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF89AE000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF8746000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF8B5A000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys

  0xF89B6000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF8756000 \SystemRoot\system32\DRIVERS\L8042mou.Sys

  0xF78AB000 \SystemRoot\system32\DRIVERS\LMouKE.Sys

  0xF89BE000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF789A000 \SystemRoot\system32\DRIVERS\serial.sys

  0xF8B5E000 \SystemRoot\system32\DRIVERS\serenum.sys

  0xF7828000 \SystemRoot\system32\drivers\ALCXWDM.SYS

  0xF7804000 \SystemRoot\system32\drivers\portcls.sys

  0xF8766000 \SystemRoot\system32\drivers\drmk.sys

  0xF77A2000 \SystemRoot\system32\drivers\ALCXSENS.SYS

  0xF8776000 \SystemRoot\system32\DRIVERS\AmdK8.sys

  0xF7783000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0xF8D57000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF8786000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF8B62000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF776C000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF8796000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF87A6000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF89C6000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF771A000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF87B6000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF89D6000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF89DE000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF76E9000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF87E6000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF8B98000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF76B5000 \SystemRoot\system32\DRIVERS\update.sys

  0xF8257000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF7CCE000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF8B0A000 \SystemRoot\system32\drivers\MODEMCSA.sys

  0xF7C8E000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF8B9A000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF8B9C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF8D23000 \SystemRoot\System32\Drivers\Null.SYS

  0xF8B9E000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF89FE000 \SystemRoot\System32\drivers\vga.sys

  0xF8BA0000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF8BA2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF8A06000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF8A0E000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF7D61000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xBAEDD000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xBAE85000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xBAE5D000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xBAE3B000 \SystemRoot\System32\drivers\afd.sys

  0xF7C7E000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF8A16000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xBAE0F000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xBADA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF87F6000 \SystemRoot\System32\Drivers\Fips.SYS

  0xBAD7F000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF8806000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xF8816000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xBAD63000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF8BA8000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xBAD18000 \SystemRoot\System32\Drivers\Fastfat.SYS

  0xF8A36000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0xBAD00000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF8BCE000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xBAF20000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF8A4E000 \SystemRoot\System32\watchdog.sys

  0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys

  0xF8CF4000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF9D6000 \SystemRoot\System32\ati2dvag.dll

  0xBFA0D000 \SystemRoot\System32\ati2cqag.dll

  0xBFA41000 \SystemRoot\System32\atikvmag.dll

  0xBFA76000 \SystemRoot\System32\ati3duag.dll

  0xBFCB8000 \SystemRoot\System32\ativvaxx.dll

  0xB8BD4000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xB8BC8000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xB876F000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xB8732000 \SystemRoot\system32\drivers\wdmaud.sys

  0xB8914000 \SystemRoot\system32\drivers\sysaudio.sys

  0xB8462000 \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys

  0xB8998000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

  0xB8399000 \SystemRoot\system32\DRIVERS\srv.sys

  0xF89E6000 \SystemRoot\system32\DRIVERS\strmdisp.sys

  0xB853C000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xB7E30000 \SystemRoot\System32\Drivers\HTTP.sys

  0xB7C54000 \??\C:\WINDOWS\system32\ASNDIS5.SYS

  0xB765C000 \SystemRoot\system32\drivers\kmixer.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll
 

Processes (total 49):

       0 System Idle Process

       4 System

     868 C:\WINDOWS\system32\smss.exe

     928 csrss.exe

     956 C:\WINDOWS\system32\winlogon.exe

    1000 C:\WINDOWS\system32\services.exe

    1012 C:\WINDOWS\system32\lsass.exe

    1172 C:\WINDOWS\system32\ati2evxx.exe

    1188 C:\WINDOWS\system32\svchost.exe

    1296 svchost.exe

    1336 C:\WINDOWS\system32\svchost.exe

    1392 svchost.exe

    1628 svchost.exe

    1664 C:\WINDOWS\system32\ati2evxx.exe

    1740 C:\WINDOWS\explorer.exe

    2032 C:\WINDOWS\system32\svchost.exe

     224 C:\WINDOWS\system32\spoolsv.exe

     276 scardsvr.exe

     264 C:\Programme\Avira\AntiVir Desktop\sched.exe

     340 svchost.exe

     480 C:\Programme\Avira\AntiVir Desktop\avguard.exe

     508 C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

     632 C:\Programme\Java\jre6\bin\jqs.exe

     712 C:\WINDOWS\system32\svchost.exe

     780 C:\WINDOWS\system32\svchost.exe

    1760 C:\WINDOWS\system32\wuauclt.exe

    2212 alg.exe

    2268 wmiprvse.exe

    2804 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    2836 C:\Programme\FreePDF_XP\fpassist.exe

    2880 C:\Programme\Winamp\winampa.exe

    2912 C:\WINDOWS\SOUNDMAN.EXE

    2928 C:\WINDOWS\system32\carpserv.exe

    2940 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

    2948 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

    3000 C:\Programme\ASUS\WLAN Card Utilities\Center.exe

    3096 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    3168 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

    3220 C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

    3228 C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

    3236 C:\Programme\Messenger\msmsgs.exe

    3252 C:\WINDOWS\system32\ctfmon.exe

     136 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    3208 C:\Programme\Logitech\SetPoint\SetPoint.exe

    2788 C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

    2688 C:\WINDOWS\system32\wuauclt.exe

    1696 C:\Programme\Mozilla Firefox\firefox.exe

    3292 C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe

     496 C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000017`b5f8b800  (FAT32)

\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001a`57987400  (FAT32)

\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000022`0493c400  (FAT32)
 

PhysicalDrive0 Model Number: WDCWD2000BB-00FTA0, Rev: 15.05R15
 

      Size  Device Name          MBR Status

  --------------------------------------------

    186 GB  \\.\PhysicalDrive0   Known-bad MBR code detected (Whistler / Black Internet)!

            SHA1: 46D3B9479F6720E786D9F5AE377E237205627CCF
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
 

Done!

Kann mir jemand weiterhelfen?

Larusso

03.08.2010 18:15

:hallo:

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Lösche bitte die vorhandenen MBRCheck.txt.

Starte bitte MBRCheck.exe erneut.
Diesmal tippe in das Fenster folgendes ein und bestätige jede Eingabe mit Enter
bei

Enter 'Y' and hit ENTER for more options, or 'N' to exit: y
Enter your choice: 2
Enter the physical disk number to fix (0-99, -1 to cancel): 0
PLease select the MBR code to write to this drive: 1

Die rot eingerahmten Zahlen aus der Anleitung entnehmen!!!
http://img831.imageshack.us/img831/5659/mbr.jpg

Gib nun Yes ein und bestätige mit ENTER.
Starte den Rechner neu auf.

Nach dem Neustart starte bitte MBRCheck.exe erneut.
Nun findest Du 2 MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop.
Poste mir den Inhalt von beiden .txt Dokumenten

Schritt 2

Downloade Dir bitte Load.exe

Das Tool benötigt eine aktive Internetverbindung, aber keinen offenen Browser
Sollte deine Firewall meckern, die Anwendung bitte zulassen.

Speichere die Datei am Desktop.
Doppelklick auf die load.exe
Belasse die Häckchen wie sie sind.
Schließe nun alle offenen Programme.
Klicke auf Download
Bitte während dem Download nicht in das Fenster klicken.
Folge den Anweisungen auf dem Bildschirm.
Wenn das Fenster Status aufpoppt klicke Start.

Nach dem Neustart findest Du einen Ordner MFTools auf dem Desktop. Darin befindet sich eine Anleitung.pdf.
Diese bitte öffnen und die darin beschriebenen Schritte abarbeiten.

Leftis

03.08.2010 20:48

Danke für die Hilfe!

Neue MBRCheck.txt:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 2 (build 2600)

Logical Drives Mask:                0x000003fc
 

Kernel Drivers (total 132):

  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

  0x806CE000 \WINDOWS\system32\hal.dll

  0xF8B66000 \WINDOWS\system32\KDCOM.DLL

  0xF8A76000 \WINDOWS\system32\BOOTVID.dll

  0xF8465000 spab.sys

  0xF8B68000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF844D000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF841E000 ACPI.sys

  0xF840D000 pci.sys

  0xF8666000 ohci1394.sys

  0xF8676000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF8686000 isapnp.sys

  0xF8B6A000 viaide.sys

  0xF88E6000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF8696000 MountMgr.sys

  0xF83EE000 ftdisk.sys

  0xF8B6C000 dmload.sys

  0xF83C8000 dmio.sys

  0xF88EE000 PartMgr.sys

  0xF86A6000 VolSnap.sys

  0xF83B0000 atapi.sys

  0xF86B6000 disk.sys

  0xF86C6000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF8391000 fltMgr.sys

  0xF837F000 sr.sys

  0xF86D6000 PxHelp20.sys

  0xF8368000 KSecDD.sys

  0xF82DB000 Ntfs.sys

  0xF82AE000 NDIS.sys

  0xF88F6000 viaagp1.sys

  0xF8293000 Mup.sys

  0xF86E6000 gagp30kx.sys

  0xF8716000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xF7B63000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xF7B4F000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF7B23000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys

  0xF7A14000 \SystemRoot\system32\DRIVERS\HSF_DP.sys

  0xF797C000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

  0xF89A6000 \SystemRoot\System32\Drivers\Modem.SYS

  0xF793D000 \SystemRoot\system32\DRIVERS\mrv8k51.sys

  0xF88D6000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF8726000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF8736000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF791A000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF89AE000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0xF78F7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF89B6000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF8746000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF826F000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys

  0xF89BE000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF8756000 \SystemRoot\system32\DRIVERS\L8042mou.Sys

  0xF78E5000 \SystemRoot\system32\DRIVERS\LMouKE.Sys

  0xF89C6000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF78D4000 \SystemRoot\system32\DRIVERS\serial.sys

  0xF826B000 \SystemRoot\system32\DRIVERS\serenum.sys

  0xF7862000 \SystemRoot\system32\drivers\ALCXWDM.SYS

  0xF783E000 \SystemRoot\system32\drivers\portcls.sys

  0xF8766000 \SystemRoot\system32\drivers\drmk.sys

  0xF77DC000 \SystemRoot\system32\drivers\ALCXSENS.SYS

  0xF8776000 \SystemRoot\system32\DRIVERS\AmdK8.sys

  0xF77BD000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0xF8D57000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF8786000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF8267000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF77A6000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF8796000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF87A6000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF89CE000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF7795000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF87B6000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF89D6000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF89DE000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF7764000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF87C6000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF8B8E000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF7730000 \SystemRoot\system32\DRIVERS\update.sys

  0xF8B02000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF7D28000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF8B16000 \SystemRoot\system32\drivers\MODEMCSA.sys

  0xF7CE8000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF8B90000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF8B92000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF8D2B000 \SystemRoot\System32\Drivers\Null.SYS

  0xF8B94000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF89FE000 \SystemRoot\System32\drivers\vga.sys

  0xF8B96000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF8B98000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF8A06000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF8A0E000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF7D93000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xBAEDD000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xBAE85000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xBAE5D000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xBAE3B000 \SystemRoot\System32\drivers\afd.sys

  0xF7CD8000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF8A16000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xBAE0F000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xBADA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF7CB8000 \SystemRoot\System32\Drivers\Fips.SYS

  0xBAD7F000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF7CA8000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xF87F6000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xBAD63000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF8B9C000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xBAD18000 \SystemRoot\System32\Drivers\Fastfat.SYS

  0xF8A1E000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0xBAD00000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF8BA0000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xBAFFC000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF8A26000 \SystemRoot\System32\watchdog.sys

  0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys

  0xF8C7A000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF9D6000 \SystemRoot\System32\ati2dvag.dll

  0xBFA0D000 \SystemRoot\System32\ati2cqag.dll

  0xBFA41000 \SystemRoot\System32\atikvmag.dll

  0xBFA76000 \SystemRoot\System32\ati3duag.dll

  0xBFCB8000 \SystemRoot\System32\ativvaxx.dll

  0xB8BD4000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xB8BF8000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xB880F000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xB8732000 \SystemRoot\system32\drivers\wdmaud.sys

  0xF7CC8000 \SystemRoot\system32\drivers\sysaudio.sys

  0xB8484000 \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys

  0xB875F000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

  0xB8405000 \SystemRoot\system32\DRIVERS\srv.sys

  0xF8926000 \SystemRoot\system32\DRIVERS\strmdisp.sys

  0xB8114000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xB7E5F000 \SystemRoot\System32\Drivers\HTTP.sys

  0xB89C8000 \??\C:\WINDOWS\system32\ASNDIS5.SYS

  0xB7895000 \SystemRoot\system32\drivers\kmixer.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll
 

Processes (total 49):

       0 System Idle Process

       4 System

     864 C:\WINDOWS\system32\smss.exe

     924 csrss.exe

     952 C:\WINDOWS\system32\winlogon.exe

     996 C:\WINDOWS\system32\services.exe

    1008 C:\WINDOWS\system32\lsass.exe

    1164 C:\WINDOWS\system32\ati2evxx.exe

    1180 C:\WINDOWS\system32\svchost.exe

    1292 svchost.exe

    1332 C:\WINDOWS\system32\svchost.exe

    1392 svchost.exe

    1524 svchost.exe

    1772 C:\WINDOWS\system32\ati2evxx.exe

    1848 C:\WINDOWS\explorer.exe

    2028 C:\WINDOWS\system32\svchost.exe

     204 C:\WINDOWS\system32\spoolsv.exe

     264 scardsvr.exe

     280 C:\Programme\Avira\AntiVir Desktop\sched.exe

     328 svchost.exe

     464 C:\Programme\Avira\AntiVir Desktop\avguard.exe

     496 C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

     616 C:\Programme\Java\jre6\bin\jqs.exe

     704 C:\WINDOWS\system32\svchost.exe

     556 C:\WINDOWS\system32\svchost.exe

    1232 C:\WINDOWS\system32\wuauclt.exe

    2192 alg.exe

    2244 wmiprvse.exe

    2408 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    2468 C:\Programme\FreePDF_XP\fpassist.exe

    2732 C:\Programme\Winamp\winampa.exe

    2752 C:\WINDOWS\SOUNDMAN.EXE

    2764 C:\WINDOWS\system32\carpserv.exe

    2772 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

    2788 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

    2816 C:\Programme\ASUS\WLAN Card Utilities\Center.exe

    2832 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    2880 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

    2892 C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

    3068 C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

    3076 C:\Programme\Messenger\msmsgs.exe

    3108 C:\WINDOWS\system32\ctfmon.exe

    3256 C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe

    3592 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    3732 C:\Programme\Logitech\SetPoint\SetPoint.exe

    2180 C:\Programme\Mozilla Firefox\firefox.exe

    3008 C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

    2176 C:\WINDOWS\system32\wuauclt.exe

    3776 C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000017`b5f8b800  (FAT32)

\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001a`57987400  (FAT32)

\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000022`0493c400  (FAT32)
 

PhysicalDrive0 Model Number: WDCWD2000BB-00FTA0, Rev: 15.05R15
 

      Size  Device Name          MBR Status

  --------------------------------------------

    186 GB  \\.\PhysicalDrive0   Known-bad MBR code detected (Whistler / Black Internet)!

            SHA1: 46D3B9479F6720E786D9F5AE377E237205627CCF
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
 

Done!

Mbam-Log

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4052
 

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702
 

03.08.2010 20:12:43

mbam-log-2010-08-03 (20-12-43).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 115276

Laufzeit: 4 Minute(n), 24 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Leftis

03.08.2010 20:49

OTL-log:

Code:

OTL logfile created on: 03.08.2010 21:28:44 - Run 1

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 142,00 Mb Available Physical Memory | 28,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 62,81 Gb Free Space | 66,23% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,15% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,30 Gb Free Space | 53,12% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 9,92 Gb Free Space | 19,76% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

PRC - [2010.03.07 18:09:48 | 000,072,704 | ---- | M] (Adobe Systems) -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe

PRC - [2010.02.18 12:43:18 | 000,248,040 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2007.06.26 21:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.05.15 00:22:22 | 000,035,328 | ---- | M] () -- C:\Programme\Winamp\winampa.exe

PRC - [2007.04.23 04:00:00 | 000,692,224 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe

PRC - [2007.04.11 15:32:22 | 000,056,080 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

PRC - [2006.02.28 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.08.06 02:07:30 | 000,061,440 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

PRC - [2005.04.06 17:53:04 | 000,856,064 | ---- | M] (Adobe Sytems Incorporated) -- C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

PRC - [2005.03.08 06:00:00 | 000,098,304 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

PRC - [2004.12.14 03:12:02 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

PRC - [2004.01.07 19:17:10 | 001,367,552 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Programme\ASUS\WLAN Card Utilities\Center.exe

PRC - [2003.10.08 11:41:10 | 000,057,344 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2003.06.17 17:14:40 | 000,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

PRC - [2003.03.19 02:13:00 | 000,004,608 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\system32\carpserv.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

MOD - [2009.07.12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll

MOD - [2009.07.12 02:09:20 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll

MOD - [2007.04.23 04:00:00 | 000,045,568 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\lgscroll.dll

MOD - [2006.02.28 14:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

MOD - [2006.02.28 14:00:00 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010.03.07 18:09:48 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)

SRV - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2005.04.06 17:53:02 | 000,163,840 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe -- (Adobe Version Cue CS2)

SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\trufos.sys -- (Trufos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\profos.sys -- (Profos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdrsdrv.sys -- (BDRsDrv)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdfsdrv.sys -- (BDFsDrv)

DRV - [2009.11.25 12:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.08.23 21:55:52 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.04.15 18:49:28 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.11.16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)

DRV - [2007.11.14 20:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)

DRV - [2007.04.11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)

DRV - [2007.04.11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)

DRV - [2007.04.11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV - [2007.01.18 21:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.08.04 05:10:18 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2003.12.24 13:43:42 | 000,256,512 | R--- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mrv8k51.sys -- (W8100PCI)

DRV - [2003.10.20 11:14:56 | 000,047,100 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\scrccid.sys -- (SCRx31 USB Smart Card Reader)

DRV - [2003.10.09 12:52:08 | 000,475,788 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2003.10.04 06:25:56 | 000,401,152 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)

DRV - [2003.07.02 05:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2003.03.19 02:13:00 | 001,107,072 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2003.03.19 02:13:00 | 000,622,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2003.03.19 02:13:00 | 000,177,024 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)

DRV - [2003.03.19 02:13:00 | 000,022,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)

DRV - [2002.09.09 20:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)

DRV - [2001.08.17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9A 9A F8 4A 05 1A CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.faz.de"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {8061ddcf-3632-4287-8d8a-133e219ae838}:0.9.7

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.08.02 19:53:17 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.02 19:53:16 | 000,000,000 | ---D | M]

 

[2008.12.21 15:30:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

[2010.08.02 19:54:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions

[2009.11.10 14:05:45 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}

[2010.04.22 23:13:34 | 000,000,000 | ---D | M] (Live PageRank) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}

[2010.01.07 19:26:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.05.07 14:02:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\firebug@software.joehewitt.com

[2009.04.05 13:41:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\moveplayer@movenetworks.com

[2009.04.12 22:14:24 | 000,000,945 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\searchplugins\youtube-videosuche.xml

[2010.08.02 19:54:17 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.04.03 17:43:15 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.04.03 17:43:15 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.04.03 17:43:15 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.04.03 17:43:15 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.04.03 17:43:15 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Version Cue CS2] C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated)

O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CARPService] C:\WINDOWS\System32\carpserv.exe (Conexant Systems, Inc.)

O4 - HKLM..\Run: [Control Center] C:\Programme\ASUS\WLAN Card Utilities\Center.exe (ASUSTeK COMPUTER INC.)

O4 - HKLM..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)

O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ATI CATALYST-Infobereich.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{92E30924-BF7D-4BE4-A9E7-38C94D739D16}\Icon3E5562ED7.ico ()

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Logitech-Produktregistrierung.lnk = C:\Programme\Gemeinsame Dateien\LogiShared\eReg\SetPoint\eReg.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.12.20 17:33:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2004.01.20 15:50:52 | 000,020,480 | ---- | M] (TARGA GmbH) - D:\AUTORUN.EXE -- [ FAT32 ]

O32 - AutoRun File - [2004.01.15 10:25:14 | 000,000,053 | ---- | M] () - D:\AUTORUN.INF -- [ FAT32 ]

O33 - MountPoints2\{9843b75f-ceaf-11dd-b658-806d6172696f}\Shell\AutoRun\command - "" = D:\AUTORUN.EXE -- [2004.01.20 15:50:52 | 000,020,480 | ---- | M] (TARGA GmbH)

O33 - MountPoints2\{bb65839e-88c2-11de-beb5-000ea671d45d}\Shell - "" = AutoRun

O33 - MountPoints2\{bb65839e-88c2-11de-beb5-000ea671d45d}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{bb65839e-88c2-11de-beb5-000ea671d45d}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -- File not found

O33 - MountPoints2\K\Shell - "" = AutoRun

O33 - MountPoints2\K\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)

Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)

Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)

Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)

Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)

Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)

Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)

Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)

Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)

Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)

Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)

Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (54619700398653440)

 
 ========== Files/Folders - Created Within 90 Days ==========

 

[2010.08.03 20:01:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.08.03 19:59:51 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.08.03 19:47:50 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2010.08.03 19:45:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\MFTools

[2010.08.02 19:53:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe

[2010.07.28 20:34:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia

[2010.07.08 23:12:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\11

[2010.06.25 15:30:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files - Modified Within 90 Days ==========

 

[2010.08.03 20:03:05 | 006,291,456 | ---- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.dat

[2010.08.03 20:00:49 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 20:00:49 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.08.03 19:55:06 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.08.03 19:54:36 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk

[2010.08.03 19:54:23 | 000,002,343 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[2010.08.03 19:53:54 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.08.03 19:53:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.08.03 19:53:51 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys

[2010.08.03 19:52:32 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini

[2010.08.03 19:45:56 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Gmer.zip

[2010.08.03 19:44:39 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Load.exe

[2010.08.03 19:38:46 | 000,000,512 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-03-10_19-38-46.bak

[2010.08.03 15:34:40 | 000,080,384 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

[2010.07.14 18:10:59 | 000,006,437 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\default.php

[2010.07.11 16:49:25 | 000,172,544 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.07.04 19:18:55 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2010.07.04 18:18:59 | 000,002,943 | ---- | M] () -- C:\WINDOWS\seRapid.INI

[2010.07.04 17:46:38 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI

[2010.07.01 19:11:49 | 000,000,637 | ---- | M] () -- C:\WINDOWS\win.ini

[2010.06.03 22:33:16 | 000,025,088 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ApopseStoXorioMas.doc

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.08.03 20:31:53 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\gmer.exe

[2010.08.03 19:59:51 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 19:59:51 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.08.03 19:45:55 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Gmer.zip

[2010.08.03 19:44:38 | 000,410,626 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Load.exe

[2010.08.03 19:38:46 | 000,000,512 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-03-10_19-38-46.bak

[2010.08.03 15:34:39 | 000,080,384 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

[2010.07.21 13:54:47 | 006,291,456 | ---- | C] () -- C:\Dokumente und Einstellungen\***\ntuser.dat
 

[2010.06.21 20:47:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2009.08.23 21:56:42 | 000,197,424 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll

[2009.08.23 21:56:34 | 000,193,328 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll

[2009.07.03 16:22:15 | 000,002,943 | ---- | C] () -- C:\WINDOWS\seRapid.INI

[2009.04.15 18:49:28 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2008.12.28 18:24:33 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.12.28 14:19:49 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE DX4200G.ini

[2008.12.28 14:02:37 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2008.12.21 16:12:49 | 000,000,677 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI

[2008.12.21 16:10:19 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

[2008.12.21 15:40:36 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008.12.21 15:30:55 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2006.02.28 14:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

 
 ========== LOP Check ==========

 

[2010.08.03 15:30:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Delphish

[2008.12.28 14:27:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\EPSON

[2010.03.31 17:32:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ICQ

[2009.05.13 18:54:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\JavaEditor

[2009.05.16 17:51:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Leadertech

[2009.05.21 19:53:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org

[2009.03.08 14:53:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Opera

[2008.12.21 17:52:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Subversion

[2009.12.18 20:20:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TeamViewer

[2010.01.25 21:34:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Trellian

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*.* >

[2008.12.20 17:33:24 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2008.12.20 17:27:37 | 000,000,211 | -HS- | M] () -- C:\boot.ini

[2006.02.28 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin

[2008.12.20 17:33:24 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2010.08.03 19:53:51 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys

[2008.12.21 21:08:51 | 000,008,492 | ---- | M] () -- C:\index.php

[2008.12.20 17:33:24 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2010.08.03 15:35:06 | 001,270,896 | ---- | M] () -- C:\Logdatei.txt

[2010.08.03 19:57:53 | 000,000,158 | ---- | M] () -- C:\mbam-error.txt

[2008.12.20 17:33:24 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2006.02.28 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2006.02.28 14:00:00 | 000,251,184 | RHS- | M] () -- C:\ntldr

[2010.08.03 19:53:50 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys

[2009.02.24 19:01:05 | 000,038,992 | ---- | M] () -- C:\sfakianakis.htm

[2010.01.29 17:41:17 | 000,001,295 | ---- | M] () -- C:\X.adb

 
 < %systemroot%\system32\*.wt >

 
 < %systemroot%\system32\*.ruy >

 
 < %systemroot%\Fonts\*.com >

 
 < %systemroot%\Fonts\*.dll >

 
 < %systemroot%\Fonts\*.ini >

[2008.12.20 17:32:54 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

 
 < %systemroot%\Fonts\*.ini2 >

 
 < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

[2003.06.18 18:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

 
 < %systemroot%\REPAIR\*.bak1 >

 
 < %systemroot%\REPAIR\*.ini >

 
 < %systemroot%\system32\*.jpg >

 
 < %systemroot%\*.scr >

 
 < %systemroot%\*._sy >

 
 < %APPDATA%\Adobe\Update\*.* >

 
 < %ALLUSERSPROFILE%\Favorites\*.* >

 
 < %APPDATA%\Microsoft\*.* >

 
 < %PROGRAMFILES%\*.* >

 
 < %APPDATA%\Update\*.* >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2006.02.28 14:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\cryptdll.dll

[2006.02.28 14:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iphlpapi.dll

[2006.02.28 14:00:00 | 000,072,192 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msacm32.dll

[2005.05.04 15:45:32 | 002,890,240 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msi.dll

[2006.02.28 14:00:00 | 000,061,440 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\msvcrt40.dll

[2006.02.28 14:00:00 | 000,236,544 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\rasapi32.dll

[2006.02.28 14:00:00 | 000,061,440 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\rasman.dll

[2006.02.28 14:00:00 | 000,044,032 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\rtutils.dll

[2006.02.28 14:00:00 | 000,006,656 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\sensapi.dll

[2006.02.28 14:00:00 | 000,014,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\serwvdrv.dll

[2006.02.28 14:00:00 | 000,715,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\sxs.dll

[2006.02.28 14:00:00 | 000,181,760 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\tapi32.dll

[2006.02.28 14:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\umdmxfrm.dll

[2006.02.28 14:00:00 | 002,981,888 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\xpsp2res.dll

 
 < %systemroot%\Tasks\*.job /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.12.20 18:12:27 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2008.12.20 18:12:27 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2008.12.20 18:12:27 | 000,438,272 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

 
 < %systemroot%\system32\user32.dll /md5 >

[2006.02.28 14:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\user32.dll

 
 < %systemroot%\system32\ws2_32.dll /md5 >

[2006.02.28 14:00:00 | 000,082,944 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ws2_32.dll

 
 < %systemroot%\system32\ws2help.dll /md5 >

[2006.02.28 14:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ws2help.dll

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-04-03 23:24:18

< End of report >

Leftis

03.08.2010 20:52

Extras.txt

Code:

OTL Extras logfile created on: 03.08.2010 21:28:44 - Run 1

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 142,00 Mb Available Physical Memory | 28,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 62,81 Gb Free Space | 66,23% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,15% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,30 Gb Free Space | 53,12% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 9,92 Gb Free Space | 19,76% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Adobe\Adobe GoLive CS2\GoLive.exe" "%1" ()

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Disabled:ICQ Library -- (ICQ, LLC.)

"F:\Age of\empires2.exe" = F:\Age of\empires2.exe:*:Disabled:Age of Empires II -- File not found

"F:\Age of\age2_x1.exe" = F:\Age of\age2_x1.exe:*:Enabled:Age of Empires II Expansion -- File not found

"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation)

"F:\Flight Simulator 9\fs9.exe" = F:\Flight Simulator 9\fs9.exe:*:Enabled:Microsoft Flight Simulator -- File not found

"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)

"F:\EA GAMES\Battlefield 1942\BF1942.exe" = F:\EA GAMES\Battlefield 1942\BF1942.exe:*:Enabled:BF1942 -- File not found

"C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)

"C:\Programme\eclipse\eclipse.exe" = C:\Programme\eclipse\eclipse.exe:*:Enabled:eclipse -- ()

"C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" = C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2 -- (Adobe Systems Incorporated)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0

"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2

"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2

"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint

"{314F6D08-A8B7-11D8-8446-0050BA1D384D}" = EPSON Image Clip Palette

"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4

"{32A3A4F4-B792-11D6-A78A-00B0D0160040}" = Java(TM) SE Development Kit 6 Update 4

"{32A3A4F4-B792-11D6-A78A-00B0D0160180}" = Java(TM) SE Development Kit 6 Update 18

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = Logitech Registration

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{46548E80-0407-0000-7E8A-45000F855001}" = Adobe GoLive CS2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{56918C0C-0D87-4CA6-92BF-4975A43AC719}" = KhalInstallWrapper

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{77B6DD3A-C7D0-479B-9CB1-BD8D42AAB1A2}" = SCRx31 CT-API and  PC/SC  Driver Installer

"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0

"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2

"{86EC42B5-346E-4BAB-948D-58E021EA4BD1}" = ATI Catalyst Control Center

"{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}" = CDDRV_Installer

"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer

"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage

"{92E30924-BF7D-4BE4-A9E7-38C94D739D16}" = Cisco Systems VPN Client 5.0.06.0100

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{ABC62001-AD9F-46DB-8668-9946154D6A07}" = AMD Athlon 64 Processor Driver

"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A00000000001}" = Adobe Reader 6.0.1 - Deutsch

"{ADBE46EE-54E0-4610-B436-D7E93D829100}" = Adobe Version Cue CS2

"{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2

"{B57A484C-B856-4249-892A-093170123000}" = GNATbench for Eclipse 2.3.0 (20090317)

"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0

"{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific

"{CB2174B0-F84A-11D4-ACAB-000000120090}" = GNAT GPL Ada Development Environment 2009

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari

"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Foto Premium 9

"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64

"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager

"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0

"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio

"7-Zip" = 7-Zip 4.65

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop 7.0" = Adobe Photoshop 7.0

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54

"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CDex" = CDex extraction audio

"CNXT_MODEM_PCI_VEN_14F1&DEV_2F00" = FM-56PCI-HSFi-AB

"Delphish" = Delphish

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"ERUNT_is1" = ERUNT 1.1j

"ESDX4800_4200 Benutzerhandbuch" = ESDX4800_4200 Benutzerhandbuch

"FileZilla" = FileZilla (remove only)

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2

"FreePDF_XP" = FreePDF XP (Remove only)

"GSiteCrawler" = GSiteCrawler

"ie8" = Windows Internet Explorer 8

"InfoRapid Suchen & Ersetzen" = InfoRapid Suchen & Ersetzen

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nero - Burning Rom!UninstallKey" = Nero 6

"PictureIt_v9" = Microsoft Picture It! Foto Premium 9

"RealPlayer 6.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Trellian Dictionary_is1" = Trellian Dictionary v1.0

"Trellian LiveUpgrade_is1" = Trellian LiveUpgrade v2.0

"Uninstall_is1" = Uninstall 1.0.0.1

"VLC media player" = VLC media player 0.9.8a

"Winamp" = Winamp (remove only)

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Works2004Setup" = Setup-Start von Microsoft Works 2004

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SwingSet3" = SwingSet3

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 11.11.2009 15:30:26 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 11.11.2009 15:31:01 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:28:50 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:37:17 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:38:09 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:41:59 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:14:15 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:19:32 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung wmplayer.exe, Version 11.0.5721.5145, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

[ System Events ]

Error - 25.06.2010 03:10:38 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 11.07.2010 10:29:26 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 11.07.2010 10:37:59 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 17.07.2010 07:43:08 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 22.07.2010 09:59:00 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.

 Dies ist bereits 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

 

< End of report >

Gmer habe ich nach 2,5 Stunden vorzeitig abgebrochen. Sollte ich den noch komplett durchlaufen lassen oder reicht dir die Info?

Leftis

03.08.2010 21:17

Wollte den Gmer gerade doch mal über Nacht durchlaufen lassen. Nach etwa 3 Minuten kam die Meldung:

Gmer hat ein Problem festgestellt und muss beendet werden.

Nachdem ich es nochmals versucht habe zu starten hat sich der PC reseted.

Nachdem er wieder hochgefahren ist, kam die Meldung von Windows: "...wird nach schwerwiegendem Fehler wieder ausgeführt".

Ich lass es jetzt mal die Finger davon und warte auf weitere Intruktionen.

Larusso

03.08.2010 21:34

Ja, Gmer ist kein spielzeug

Zitat:

* Gib nun Yes ein und bestätige mit ENTER.
* Starte den Rechner neu auf.

Nach dem Neustart starte bitte MBRCheck.exe erneut.
Nun findest Du 2 MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop.
Poste mir den Inhalt von beiden .txt Dokumenten

Wo ist die zweite Log von mbrcheck ?

Leftis

04.08.2010 14:24

Ah sorry, ok jetzt versteh ich.

Also MBRCheck die erste:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 2 (build 2600)

Logical Drives Mask:                0x000003fc
 

Kernel Drivers (total 132):

  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

  0x806CE000 \WINDOWS\system32\hal.dll

  0xF8B66000 \WINDOWS\system32\KDCOM.DLL

  0xF8A76000 \WINDOWS\system32\BOOTVID.dll

  0xF8465000 sphj.sys

  0xF8B68000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF844D000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF841E000 ACPI.sys

  0xF840D000 pci.sys

  0xF8666000 ohci1394.sys

  0xF8676000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF8686000 isapnp.sys

  0xF8B6A000 viaide.sys

  0xF88E6000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF8696000 MountMgr.sys

  0xF83EE000 ftdisk.sys

  0xF8B6C000 dmload.sys

  0xF83C8000 dmio.sys

  0xF88EE000 PartMgr.sys

  0xF86A6000 VolSnap.sys

  0xF83B0000 atapi.sys

  0xF86B6000 disk.sys

  0xF86C6000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF8391000 fltMgr.sys

  0xF837F000 sr.sys

  0xF86D6000 PxHelp20.sys

  0xF8368000 KSecDD.sys

  0xF82DB000 Ntfs.sys

  0xF82AE000 NDIS.sys

  0xF88F6000 viaagp1.sys

  0xF8293000 Mup.sys

  0xF86E6000 gagp30kx.sys

  0xF8716000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xF7B5E000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xF7B4A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF7B1E000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys

  0xF7A0F000 \SystemRoot\system32\DRIVERS\HSF_DP.sys

  0xF7977000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

  0xF89BE000 \SystemRoot\System32\Drivers\Modem.SYS

  0xF7938000 \SystemRoot\system32\DRIVERS\mrv8k51.sys

  0xF8726000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF8736000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF8746000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF7915000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF89C6000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0xF78F2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF89CE000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF8756000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF8B4E000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys

  0xF89D6000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF8766000 \SystemRoot\system32\DRIVERS\L8042mou.Sys

  0xF78E0000 \SystemRoot\system32\DRIVERS\LMouKE.Sys

  0xF89DE000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF78CF000 \SystemRoot\system32\DRIVERS\serial.sys

  0xF8B52000 \SystemRoot\system32\DRIVERS\serenum.sys

  0xF785D000 \SystemRoot\system32\drivers\ALCXWDM.SYS

  0xF7839000 \SystemRoot\system32\drivers\portcls.sys

  0xF8776000 \SystemRoot\system32\drivers\drmk.sys

  0xF77D7000 \SystemRoot\system32\drivers\ALCXSENS.SYS

  0xF8786000 \SystemRoot\system32\DRIVERS\AmdK8.sys

  0xF77B8000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0xF8C3B000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF8796000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF8B5A000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF7779000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF87A6000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF87B6000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF89E6000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF7768000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF87C6000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF89EE000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF89F6000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF7737000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF7D33000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF8B9C000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF7703000 \SystemRoot\system32\DRIVERS\update.sys

  0xF825F000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF7CF3000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF824B000 \SystemRoot\system32\drivers\MODEMCSA.sys

  0xF7CB3000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF8B9E000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF8BA0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF8C2E000 \SystemRoot\System32\Drivers\Null.SYS

  0xF8BA2000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF8A16000 \SystemRoot\System32\drivers\vga.sys

  0xF8BA4000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF8BA6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF8A1E000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF8A26000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF8B2A000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xBAEDD000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xBAE85000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xBAE5D000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xBAE3B000 \SystemRoot\System32\drivers\afd.sys

  0xF7CA3000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF8A2E000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xBAE0F000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xBADA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF87F6000 \SystemRoot\System32\Drivers\Fips.SYS

  0xBAD7F000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF8806000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xF8816000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xBAD63000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF8BB4000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xBAD18000 \SystemRoot\System32\Drivers\Fastfat.SYS

  0xF8A66000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0xBAD00000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF8BE4000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xBAF18000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF891E000 \SystemRoot\System32\watchdog.sys

  0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys

  0xF8CA6000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF9D6000 \SystemRoot\System32\ati2dvag.dll

  0xBFA0D000 \SystemRoot\System32\ati2cqag.dll

  0xBFA41000 \SystemRoot\System32\atikvmag.dll

  0xBFA76000 \SystemRoot\System32\ati3duag.dll

  0xBFCB8000 \SystemRoot\System32\ativvaxx.dll

  0xB8BD4000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xB8BEC000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xB880F000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xB870A000 \SystemRoot\system32\drivers\wdmaud.sys

  0xB8B1C000 \SystemRoot\system32\drivers\sysaudio.sys

  0xB8484000 \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys

  0xB89B0000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

  0xB83CC000 \SystemRoot\system32\DRIVERS\srv.sys

  0xF8A46000 \SystemRoot\system32\DRIVERS\strmdisp.sys

  0xB8B3C000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xB7F92000 \SystemRoot\System32\Drivers\HTTP.sys

  0xB7D9C000 \??\C:\WINDOWS\system32\ASNDIS5.SYS

  0xB79EA000 \SystemRoot\system32\drivers\kmixer.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll
 

Processes (total 51):

       0 System Idle Process

       4 System

     864 C:\WINDOWS\system32\smss.exe

     924 csrss.exe

     952 C:\WINDOWS\system32\winlogon.exe

     996 C:\WINDOWS\system32\services.exe

    1008 C:\WINDOWS\system32\lsass.exe

    1164 C:\WINDOWS\system32\ati2evxx.exe

    1180 C:\WINDOWS\system32\svchost.exe

    1292 svchost.exe

    1332 C:\WINDOWS\system32\svchost.exe

    1388 svchost.exe

    1488 svchost.exe

    1776 C:\WINDOWS\system32\ati2evxx.exe

    1852 C:\WINDOWS\explorer.exe

    2040 C:\WINDOWS\system32\svchost.exe

     208 C:\WINDOWS\system32\spoolsv.exe

     268 scardsvr.exe

     284 C:\Programme\Avira\AntiVir Desktop\sched.exe

     332 svchost.exe

     424 C:\Programme\Avira\AntiVir Desktop\avguard.exe

     480 C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

     620 C:\Programme\Java\jre6\bin\jqs.exe

     704 C:\WINDOWS\system32\svchost.exe

     124 C:\WINDOWS\system32\svchost.exe

    1624 C:\WINDOWS\system32\wuauclt.exe

    2192 wmiprvse.exe

    2200 alg.exe

    2284 wmiprvse.exe

    2520 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    2580 C:\Programme\FreePDF_XP\fpassist.exe

    2604 C:\Programme\Winamp\winampa.exe

    2620 C:\WINDOWS\SOUNDMAN.EXE

    2664 C:\WINDOWS\system32\carpserv.exe

    2748 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

    2772 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

    2876 C:\Programme\ASUS\WLAN Card Utilities\Center.exe

    2904 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    2932 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

    3028 C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

    3040 C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

    3064 C:\Programme\Messenger\msmsgs.exe

    3108 C:\WINDOWS\system32\ctfmon.exe

    3452 C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe

    3852 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    3860 C:\Programme\Logitech\SetPoint\SetPoint.exe

    1364 C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

    2832 C:\WINDOWS\system32\wuauclt.exe

    3796 C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

    3908 C:\Programme\Avira\AntiVir Desktop\update.exe

     908 <unknown>
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000017`b5f8b800  (FAT32)

\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001a`57987400  (FAT32)

\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000022`0493c400  (FAT32)
 

PhysicalDrive0 Model Number: WDCWD2000BB-00FTA0, Rev: 15.05R15
 

      Size  Device Name          MBR Status

  --------------------------------------------

    186 GB  \\.\PhysicalDrive0   Known-bad MBR code detected (Whistler / Black Internet)!

            SHA1: 46D3B9479F6720E786D9F5AE377E237205627CCF
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 

Options:

  [1] Dump the MBR of a physical disk to file.

  [2] Restore the MBR of a physical disk with a standard boot code.

  [3] Exit.
 

Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel): 0Available MBR codes:

 [ 0] Default (Windows XP)

 [ 1] Windows XP

 [ 2] Windows Server 2003

 [ 3] Windows Vista

 [ 4] Windows 2008

 [ 5] Windows 7

 [-1] Cancel
 

Please select the MBR code to write to this drive: 1

Do you want to fix the MBR code?  Type 'YES' and hit ENTER to continue: yes

Successfully wrote new MBR code!

Please reboot your computer to complete the fix.
 
 

Done!

Dann habe ich Y gedrückt etc. wie beschrieben und einen Neustart gemacht. Und dann den zweiten MBRCheck:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 2 (build 2600)

Logical Drives Mask:                0x000003fc
 

Kernel Drivers (total 131):

  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

  0x806CE000 \WINDOWS\system32\hal.dll

  0xF8B66000 \WINDOWS\system32\KDCOM.DLL

  0xF8A76000 \WINDOWS\system32\BOOTVID.dll

  0xF8465000 spun.sys

  0xF8B68000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF844D000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF841E000 ACPI.sys

  0xF840D000 pci.sys

  0xF8666000 ohci1394.sys

  0xF8676000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF8686000 isapnp.sys

  0xF8B6A000 viaide.sys

  0xF88E6000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF8696000 MountMgr.sys

  0xF83EE000 ftdisk.sys

  0xF8B6C000 dmload.sys

  0xF83C8000 dmio.sys

  0xF88EE000 PartMgr.sys

  0xF86A6000 VolSnap.sys

  0xF83B0000 atapi.sys

  0xF86B6000 disk.sys

  0xF86C6000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF8391000 fltMgr.sys

  0xF837F000 sr.sys

  0xF86D6000 PxHelp20.sys

  0xF8368000 KSecDD.sys

  0xF82DB000 Ntfs.sys

  0xF82AE000 NDIS.sys

  0xF88F6000 viaagp1.sys

  0xF8293000 Mup.sys

  0xF86E6000 gagp30kx.sys

  0xF8716000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xF7B5A000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xF7B46000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF7B1A000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys

  0xF7A0B000 \SystemRoot\system32\DRIVERS\HSF_DP.sys

  0xF7973000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

  0xF89AE000 \SystemRoot\System32\Drivers\Modem.SYS

  0xF7934000 \SystemRoot\system32\DRIVERS\mrv8k51.sys

  0xF88B6000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF88C6000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF88D6000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF7911000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF89B6000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0xF78EE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF89BE000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF8726000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF8B52000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys

  0xF89C6000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF8736000 \SystemRoot\system32\DRIVERS\L8042mou.Sys

  0xF78DC000 \SystemRoot\system32\DRIVERS\LMouKE.Sys

  0xF89CE000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF78CB000 \SystemRoot\system32\DRIVERS\serial.sys

  0xF8B56000 \SystemRoot\system32\DRIVERS\serenum.sys

  0xF7859000 \SystemRoot\system32\drivers\ALCXWDM.SYS

  0xF7835000 \SystemRoot\system32\drivers\portcls.sys

  0xF8746000 \SystemRoot\system32\drivers\drmk.sys

  0xF77D3000 \SystemRoot\system32\drivers\ALCXSENS.SYS

  0xF8756000 \SystemRoot\system32\DRIVERS\AmdK8.sys

  0xF77B4000 \SystemRoot\system32\DRIVERS\dne2000.sys

  0xF8D98000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF8766000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF8B5A000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF779D000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF8776000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF8786000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF89D6000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF7764000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF8796000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF89DE000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF89E6000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF7733000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF87A6000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF8B8C000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF76FF000 \SystemRoot\system32\DRIVERS\update.sys

  0xF825B000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF7D2F000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF8B02000 \SystemRoot\system32\drivers\MODEMCSA.sys

  0xF7CEF000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF8B8E000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF8B90000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF8D76000 \SystemRoot\System32\Drivers\Null.SYS

  0xF8B92000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF8A06000 \SystemRoot\System32\drivers\vga.sys

  0xF8B94000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF8B96000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF8A0E000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF8A16000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF8B2A000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xBAEDD000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xBAE85000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xBAE5D000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xBAE3B000 \SystemRoot\System32\drivers\afd.sys

  0xF7CDF000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF8A1E000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xBAE0F000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xBADA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF7CBF000 \SystemRoot\System32\Drivers\Fips.SYS

  0xBAD7F000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF7CAF000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xF7C9F000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xBAD63000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF8B9A000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xBAD18000 \SystemRoot\System32\Drivers\Fastfat.SYS

  0xF8A26000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0xBAD00000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF8BA4000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xBAFFC000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF8A2E000 \SystemRoot\System32\watchdog.sys

  0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys

  0xF8CDC000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF9D6000 \SystemRoot\System32\ati2dvag.dll

  0xBFA0D000 \SystemRoot\System32\ati2cqag.dll

  0xBFA41000 \SystemRoot\System32\atikvmag.dll

  0xBFA76000 \SystemRoot\System32\ati3duag.dll

  0xBFCB8000 \SystemRoot\System32\ativvaxx.dll

  0xB8BD4000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xB8BF8000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xB880F000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xB8732000 \SystemRoot\system32\drivers\wdmaud.sys

  0xB8B54000 \SystemRoot\system32\drivers\sysaudio.sys

  0xB8473000 \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys

  0xB876B000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

  0xB83D2000 \SystemRoot\system32\DRIVERS\srv.sys

  0xF891E000 \SystemRoot\system32\DRIVERS\strmdisp.sys

  0xB80A0000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xB7F5F000 \SystemRoot\System32\Drivers\HTTP.sys

  0xB7DF7000 \??\C:\WINDOWS\system32\ASNDIS5.SYS

  0x7C910000 \WINDOWS\system32\ntdll.dll
 

Processes (total 49):

       0 System Idle Process

       4 System

     864 C:\WINDOWS\system32\smss.exe

     924 csrss.exe

     952 C:\WINDOWS\system32\winlogon.exe

     996 C:\WINDOWS\system32\services.exe

    1008 C:\WINDOWS\system32\lsass.exe

    1164 C:\WINDOWS\system32\ati2evxx.exe

    1180 C:\WINDOWS\system32\svchost.exe

    1292 svchost.exe

    1332 C:\WINDOWS\system32\svchost.exe

    1396 svchost.exe

    1564 svchost.exe

    1772 C:\WINDOWS\system32\ati2evxx.exe

    1848 C:\WINDOWS\explorer.exe

    2028 C:\WINDOWS\system32\svchost.exe

     204 C:\WINDOWS\system32\spoolsv.exe

     264 scardsvr.exe

     276 C:\Programme\Avira\AntiVir Desktop\sched.exe

     328 svchost.exe

     468 C:\Programme\Avira\AntiVir Desktop\avguard.exe

     500 C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

     612 C:\Programme\Java\jre6\bin\jqs.exe

     704 C:\WINDOWS\system32\svchost.exe

     776 C:\WINDOWS\system32\svchost.exe

    1608 C:\WINDOWS\system32\wuauclt.exe

     644 wmiprvse.exe

     588 alg.exe

     896 wmiprvse.exe

    1436 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

     480 C:\Programme\FreePDF_XP\fpassist.exe

    2120 C:\Programme\Winamp\winampa.exe

    2328 C:\WINDOWS\SOUNDMAN.EXE

    2436 C:\WINDOWS\system32\carpserv.exe

    2444 C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

    2456 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

    2480 C:\Programme\ASUS\WLAN Card Utilities\Center.exe

    2496 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    2524 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

    2640 C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

    2656 C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

    2708 C:\Programme\Messenger\msmsgs.exe

    2716 C:\WINDOWS\system32\ctfmon.exe

    3244 C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe

    3852 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

    3916 C:\Programme\Logitech\SetPoint\SetPoint.exe

    3200 C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

    3416 C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

    3968 C:\WINDOWS\system32\wuauclt.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000017`b5f8b800  (FAT32)

\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000001a`57987400  (FAT32)

\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000022`0493c400  (FAT32)
 

PhysicalDrive0 Model Number: WDCWD2000BB-00FTA0, Rev: 15.05R15
 

      Size  Device Name          MBR Status

  --------------------------------------------

    186 GB  \\.\PhysicalDrive0   Known-bad MBR code detected (Whistler / Black Internet)!

            SHA1: 46D3B9479F6720E786D9F5AE377E237205627CCF
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Larusso

04.08.2010 14:38

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.

**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**

http://i266.photobucket.com/albums/i...ownload_FF.gif

http://i94.photobucket.com/albums/l8...x-Download.png

Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
Doppel-klicke auf ComboFix.exe und folge den Aufforderungen.
- Wenn ComboFix fertig ist, wird es ein Log für dich erstellen.
- Bitte poste mir den Inhalt von C:\ComboFix.txt hier in de Thread.

Leftis

04.08.2010 16:57

Erledigt:

Code:

ComboFix 10-08-03.04 - *** 04.08.2010  17:33:31.1.1 - x86

Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.511.218 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\Combo-Fix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
 

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\dokumente und einstellungen\***\calculate.exe

D:\Autorun.inf
 

.

\\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected

.

(((((((((((((((((((((((   Dateien erstellt von 2010-07-04 bis 2010-08-04  ))))))))))))))))))))))))))))))

.
 

2010-08-03 17:59 . 2010-08-03 18:00        --------        d-----w-        c:\programme\ERUNT

2010-08-03 17:47 . 2010-08-03 17:47        --------        d-----w-        c:\programme\7-Zip

2010-08-02 17:55 . 2010-08-02 17:55        --------        d-----w-        c:\windows\system32\wbem\Repository

2010-07-28 18:28 . 2010-07-28 18:28        --------        d-sh--w-        c:\dokumente und einstellungen\LocalService\PrivacIE
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-03 17:57 . 2010-04-03 23:01        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2010-08-03 13:30 . 2008-12-21 15:17        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Delphish

2010-07-04 17:02 . 2008-12-22 19:36        --------        d-----w-        c:\programme\ICQ6.5

2010-06-25 13:30 . 2010-06-25 13:30        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\McAfee

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2005-08-06 61440]

"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

"WinampAgent"="c:\programme\Winamp\winampa.exe" [2007-05-14 35328]

"SoundMan"="SOUNDMAN.EXE" [2003-10-08 57344]

"CARPService"="carpserv.exe" [2003-03-19 4608]

"EPSON Stylus DX4200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE" [2005-03-08 98304]

"Microsoft Works Update Detection"="c:\programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-17 50688]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Control Center"="c:\programme\ASUS\WLAN Card Utilities\Center.exe" [2004-01-07 1367552]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-09-05 417792]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040]

"Adobe Version Cue CS2"="c:\programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-06 856064]

"Acrobat Assistant 7.0"="c:\programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]
 

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2010-3-7 25214]

Adobe Gamma Loader.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-28 113664]

Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-28 113664]

ATI CATALYST-Infobereich.lnk - c:\programme\ATI Technologies\ATI.ACE\CLI.exe [2005-8-6 61440]

Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2009-5-16 692224]

Microsoft Office.lnk - c:\programme\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

VPN Client.lnk - c:\windows\Installer\{92E30924-BF7D-4BE4-A9E7-38C94D739D16}\Icon3E5562ED7.ico [2010-1-20 6144]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\ICQ6.5\\ICQ.exe"=

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"c:\\WINDOWS\\system32\\dpnsvr.exe"=

"c:\\Dokumente und Einstellungen\\***\\temp\\TeamViewer\\Version5\\TeamViewer.exe"=

"c:\\Programme\\eclipse\\eclipse.exe"=

"c:\\Programme\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"=
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [22.12.2009 22:21 108289]

S3 SCRx31 USB Smart Card Reader;SCRx31 USB Smart Card Reader;c:\windows\system32\drivers\scrccid.sys [20.10.2003 11:14 47100]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.04.2009 18:49 717296]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: In vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\

FF - prefs.js: browser.startup.homepage - www.faz.de

FF - plugin: c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
 

---- FIREFOX Richtlinien ----

c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-08-04 17:42

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,a8,70,6c,75,0c,33,4f,8c,bd,f4,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,a8,70,6c,75,0c,33,4f,8c,bd,f4,\

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'winlogon.exe'(932)

c:\windows\system32\Ati2evxx.dll

.

Zeit der Fertigstellung: 2010-08-04  17:49:54

ComboFix-quarantined-files.txt  2010-08-04 15:49
 

Vor Suchlauf: 7 Verzeichnis(se), 67.290.447.872 Bytes frei

Nach Suchlauf: 9 Verzeichnis(se), 67.263.791.104 Bytes frei
 

- - End Of File - - 9E010877FEA0E4AF7CE109CD5CB8D699

Larusso

04.08.2010 17:09

Schritt 1

Downloade Dir bitte Malwarebytes

Installiere das Programm in den vorgegebenen Pfad.
Denke daran, bei Vista das Programm als Admin zu starten, ansonsten per Doppelklick starten.
Lasse es online updaten (Reiter Aktualisierungen), sofern sich das Programm bereits auf dem Rechner befand.
Aktiviere "Quick-Scan durchführen" => Scannen.
Wenn der Scan beendet ist, klicke auf "Ergebnisse anzeigen".
Versichere Dich, dass alle Funde markiert sind und drücke "Entferne Auswahl".
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.

Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
Dein Anti-Virus-Programm während des Scans deaktivieren.

Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
- Firefox-User:
  Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
- IE-User:
  müssen das Installieren eines ActiveX Elements erlauben.
Setze den einen Hacken bei Yes, i accept the Terms of Use.
Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
Warte bis die Komponenten herunter geladen wurden.
Setze einen Haken bei "Remove found threads" und "Scan archives".
http://img707.imageshack.us/img707/687/starteg.jpg drücken.
Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde

Klicke Finish.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt suchen und mit Deinem Editor öffnen.
Logfile hier posten.

Schritt 3

Downloade Dir bitte SecurityCheck

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.

Poste den Inhalt bitte hier.

Schritt 4

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.

Bitte poste in Deiner nächsten Antwort
MBAM Log
ESET log
sescan.log
OTL.txt
Extras.txt
Berichte wie der Rechner läuft

Leftis

04.08.2010 21:26

Sorry, jetzt hats mir irgendwie alles doppelt und dreifach reinkopiert, weil der Text ein paar mal zu groß war. Die nächsten Beiträge einfach ignorieren, finde "Beitrag löschen" nicht!

Leftis

04.08.2010 21:27

***************************************

Leftis

04.08.2010 21:28

***********************

Leftis

04.08.2010 21:29

*****************

Leftis

04.08.2010 21:30

OTL log:

Code:

OTL logfile created on: 04.08.2010 21:43:17 - Run 2

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 109,00 Mb Available Physical Memory | 21,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 62,43 Gb Free Space | 65,83% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,14% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,30 Gb Free Space | 53,12% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 9,92 Gb Free Space | 19,76% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

PRC - [2010.06.27 21:24:51 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\plugin-container.exe

PRC - [2010.06.27 21:24:49 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2010.02.18 12:43:18 | 000,248,040 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2007.06.26 21:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.05.15 00:22:22 | 000,035,328 | ---- | M] () -- C:\Programme\Winamp\winampa.exe

PRC - [2007.04.23 04:00:00 | 000,692,224 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe

PRC - [2007.04.11 15:32:22 | 000,056,080 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

PRC - [2006.02.28 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.08.06 02:07:30 | 000,061,440 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

PRC - [2005.04.06 17:53:04 | 000,856,064 | ---- | M] (Adobe Sytems Incorporated) -- C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

PRC - [2005.03.08 06:00:00 | 000,098,304 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

PRC - [2004.12.14 03:12:02 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

PRC - [2004.01.07 19:17:10 | 001,367,552 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Programme\ASUS\WLAN Card Utilities\Center.exe

PRC - [2003.10.08 11:41:10 | 000,057,344 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2003.06.17 17:14:40 | 000,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

PRC - [2003.03.19 02:13:00 | 000,004,608 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\system32\carpserv.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

MOD - [2009.07.12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll

MOD - [2009.07.12 02:09:20 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll

MOD - [2007.04.23 04:00:00 | 000,045,568 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\lgscroll.dll

MOD - [2006.02.28 14:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

MOD - [2006.02.28 14:00:00 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010.03.07 18:09:48 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)

SRV - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2005.04.06 17:53:02 | 000,163,840 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe -- (Adobe Version Cue CS2)

SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\trufos.sys -- (Trufos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\profos.sys -- (Profos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdrsdrv.sys -- (BDRsDrv)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdfsdrv.sys -- (BDFsDrv)

DRV - [2009.11.25 12:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.08.23 21:55:52 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.04.15 18:49:28 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.11.16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)

DRV - [2007.11.14 20:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)

DRV - [2007.04.11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)

DRV - [2007.04.11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)

DRV - [2007.04.11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV - [2007.01.18 21:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.08.04 05:10:18 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2003.12.24 13:43:42 | 000,256,512 | R--- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mrv8k51.sys -- (W8100PCI)

DRV - [2003.10.20 11:14:56 | 000,047,100 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\scrccid.sys -- (SCRx31 USB Smart Card Reader)

DRV - [2003.10.09 12:52:08 | 000,475,788 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2003.10.04 06:25:56 | 000,401,152 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)

DRV - [2003.07.02 05:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2003.03.19 02:13:00 | 001,107,072 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2003.03.19 02:13:00 | 000,622,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2003.03.19 02:13:00 | 000,177,024 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)

DRV - [2003.03.19 02:13:00 | 000,022,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)

DRV - [2002.09.09 20:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)

DRV - [2001.08.17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D2 70 D2 C7 08 34 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.faz.de"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {8061ddcf-3632-4287-8d8a-133e219ae838}:0.9.7

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.08.02 19:53:17 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.02 19:53:16 | 000,000,000 | ---D | M]

 

[2008.12.21 15:30:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

[2010.08.03 21:47:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions

[2009.11.10 14:05:45 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}

[2010.04.22 23:13:34 | 000,000,000 | ---D | M] (Live PageRank) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}

[2010.01.07 19:26:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.05.07 14:02:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\firebug@software.joehewitt.com

[2009.04.05 13:41:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\moveplayer@movenetworks.com

[2009.04.12 22:14:24 | 000,000,945 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\searchplugins\youtube-videosuche.xml

[2010.08.03 21:47:43 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.04.03 17:43:15 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.04.03 17:43:15 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.04.03 17:43:15 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.04.03 17:43:15 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.04.03 17:43:15 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

Fortsetzung:

Leftis

04.08.2010 21:30

Code:

O1 HOSTS File: ([2010.08.04 17:41:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Version Cue CS2] C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated)

O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CARPService] C:\WINDOWS\System32\carpserv.exe (Conexant Systems, Inc.)

O4 - HKLM..\Run: [Control Center] C:\Programme\ASUS\WLAN Card Utilities\Center.exe (ASUSTeK COMPUTER INC.)

O4 - HKLM..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)

O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ATI CATALYST-Infobereich.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{92E30924-BF7D-4BE4-A9E7-38C94D739D16}\Icon3E5562ED7.ico ()

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Logitech-Produktregistrierung.lnk = C:\Programme\Gemeinsame Dateien\LogiShared\eReg\SetPoint\eReg.exe File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)

O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.12.20 17:33:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2004.01.20 15:50:52 | 000,020,480 | ---- | M] (TARGA GmbH) - D:\AUTORUN.EXE -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.08.04 20:16:17 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2010.08.04 20:14:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\final

[2010.08.04 17:27:42 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.08.04 17:27:42 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.08.04 17:27:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.08.04 17:27:41 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.08.04 17:24:40 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.08.04 15:14:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\E-B

[2010.08.03 20:01:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.08.03 19:59:51 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.08.03 19:47:50 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2010.08.03 19:45:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\MFTools

[2010.08.02 19:53:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe

[2010.07.28 20:34:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia

[2010.07.08 23:12:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\11

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.08.04 21:40:33 | 000,869,051 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\SecurityCheck.exe

[2010.08.04 21:34:21 | 000,036,352 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ErotasIne.doc

[2010.08.04 21:11:13 | 000,042,627 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\gl.rar

[2010.08.04 20:16:13 | 002,672,312 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 20:15:45 | 006,291,456 | ---- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.dat

[2010.08.04 19:53:58 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk

[2010.08.04 19:53:54 | 000,002,343 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[2010.08.04 19:53:39 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.08.04 19:53:17 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.08.04 19:53:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.08.04 19:53:08 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys

[2010.08.04 17:59:13 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini

[2010.08.04 17:42:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.08.04 17:41:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010.08.04 17:23:58 | 003,749,693 | R--- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Combo-Fix.exe

[2010.08.04 15:16:05 | 000,000,512 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-04-10_15-16-05.bak

[2010.08.03 20:00:49 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 20:00:49 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.08.03 19:45:56 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Gmer.zip

[2010.08.03 19:44:39 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Load.exe

[2010.07.11 16:49:25 | 000,172,544 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.08.04 21:40:26 | 000,869,051 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\SecurityCheck.exe

[2010.08.04 20:16:02 | 002,672,312 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 17:27:42 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.08.04 17:27:42 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.08.04 17:27:42 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.08.04 17:27:42 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.08.04 17:27:42 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.08.04 17:23:27 | 003,749,693 | R--- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Combo-Fix.exe

[2010.08.04 15:16:05 | 000,000,512 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-04-10_15-16-05.bak

[2010.06.21 20:47:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2009.08.23 21:56:42 | 000,197,424 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll

[2009.08.23 21:56:34 | 000,193,328 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll

[2009.07.03 16:22:15 | 000,002,943 | ---- | C] () -- C:\WINDOWS\seRapid.INI

[2009.04.15 18:49:28 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2008.12.28 18:24:33 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.12.28 14:19:49 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE DX4200G.ini

[2008.12.28 14:02:37 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2008.12.21 16:12:49 | 000,000,677 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI

[2008.12.21 16:10:19 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

[2008.12.21 15:40:36 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008.12.21 15:30:55 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2006.02.28 14:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

< End of report >

Extra:

Code:

OTL Extras logfile created on: 04.08.2010 21:43:17 - Run 2

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 109,00 Mb Available Physical Memory | 21,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 57,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 62,43 Gb Free Space | 65,83% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,14% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,30 Gb Free Space | 53,12% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 9,92 Gb Free Space | 19,76% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Adobe\Adobe GoLive CS2\GoLive.exe" "%1" ()

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Disabled:ICQ Library -- (ICQ, LLC.)

"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation)

"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)

"C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)

"C:\Programme\eclipse\eclipse.exe" = C:\Programme\eclipse\eclipse.exe:*:Enabled:eclipse -- ()

"C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" = C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2 -- (Adobe Systems Incorporated)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0

"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2

"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2

"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint

"{314F6D08-A8B7-11D8-8446-0050BA1D384D}" = EPSON Image Clip Palette

"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4

"{32A3A4F4-B792-11D6-A78A-00B0D0160040}" = Java(TM) SE Development Kit 6 Update 4

"{32A3A4F4-B792-11D6-A78A-00B0D0160180}" = Java(TM) SE Development Kit 6 Update 18

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = Logitech Registration

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{46548E80-0407-0000-7E8A-45000F855001}" = Adobe GoLive CS2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{56918C0C-0D87-4CA6-92BF-4975A43AC719}" = KhalInstallWrapper

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{77B6DD3A-C7D0-479B-9CB1-BD8D42AAB1A2}" = SCRx31 CT-API and  PC/SC  Driver Installer

"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0

"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2

"{86EC42B5-346E-4BAB-948D-58E021EA4BD1}" = ATI Catalyst Control Center

"{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}" = CDDRV_Installer

"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer

"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage

"{92E30924-BF7D-4BE4-A9E7-38C94D739D16}" = Cisco Systems VPN Client 5.0.06.0100

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{ABC62001-AD9F-46DB-8668-9946154D6A07}" = AMD Athlon 64 Processor Driver

"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A00000000001}" = Adobe Reader 6.0.1 - Deutsch

"{ADBE46EE-54E0-4610-B436-D7E93D829100}" = Adobe Version Cue CS2

"{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2

"{B57A484C-B856-4249-892A-093170123000}" = GNATbench for Eclipse 2.3.0 (20090317)

"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0

"{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific

"{CB2174B0-F84A-11D4-ACAB-000000120090}" = GNAT GPL Ada Development Environment 2009

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari

"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Foto Premium 9

"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64

"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager

"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0

"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio

"7-Zip" = 7-Zip 4.65

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop 7.0" = Adobe Photoshop 7.0

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54

"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CDex" = CDex extraction audio

"CNXT_MODEM_PCI_VEN_14F1&DEV_2F00" = FM-56PCI-HSFi-AB

"Delphish" = Delphish

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"ERUNT_is1" = ERUNT 1.1j

"ESDX4800_4200 Benutzerhandbuch" = ESDX4800_4200 Benutzerhandbuch

"ESET Online Scanner" = ESET Online Scanner v3

"FileZilla" = FileZilla (remove only)

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2

"FreePDF_XP" = FreePDF XP (Remove only)

"GSiteCrawler" = GSiteCrawler

"ie8" = Windows Internet Explorer 8

"InfoRapid Suchen & Ersetzen" = InfoRapid Suchen & Ersetzen

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nero - Burning Rom!UninstallKey" = Nero 6

"PictureIt_v9" = Microsoft Picture It! Foto Premium 9

"RealPlayer 6.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Trellian Dictionary_is1" = Trellian Dictionary v1.0

"Trellian LiveUpgrade_is1" = Trellian LiveUpgrade v2.0

"Uninstall_is1" = Uninstall 1.0.0.1

"VLC media player" = VLC media player 0.9.8a

"Winamp" = Winamp (remove only)

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Works2004Setup" = Setup-Start von Microsoft Works 2004

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SwingSet3" = SwingSet3

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 11.11.2009 15:30:26 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 11.11.2009 15:31:01 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:28:50 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:37:17 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:38:09 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:41:59 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:14:15 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:19:32 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung wmplayer.exe, Version 11.0.5721.5145, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 09.12.2009 11:14:47 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung estwm.exe, Version 2.7.0.1, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 09.12.2009 11:14:49 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung estwm.exe, Version 2.7.0.1, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

[ System Events ]

Error - 11.07.2010 10:29:26 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 11.07.2010 10:37:59 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 17.07.2010 07:43:08 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 22.07.2010 09:59:00 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.

 Dies ist bereits 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 16:14:23 | Computer Name = PC | Source = System Error | ID = 1003

Description = Fehlercode 000000f7, 1. Parameter ff5d82b0, 2. Parameter 00006b16,

 3. Parameter ffff94e9, 4. Parameter 00000000.

 

 

< End of report >

Leftis

04.08.2010 21:31

Checkup Log:

Code:

 Results of screen317's Security Check version 0.99.5  

 Windows XP Service Pack 2  

 Out of date service pack!! 

 Internet Explorer 8  
 `````````````````````````````` 
 Antivirus/Firewall Check: 

 Avira AntiVir Personal - Free Antivirus 

 ESET Online Scanner v3   

 Antivirus up to date!  
 ``````````````````````````````` 
 Anti-malware/Other Utilities Check: 

 Malwarebytes' Anti-Malware    

 Java DB 10.5.3.0   

 Java(TM) 6 Update 18  

 Java(TM) 6 Update 4  

 Java(TM) SE Development Kit 6 Update 4 

 Java(TM) SE Development Kit 6 Update 18 

 Out of date Java installed! 

 Adobe Flash Player 10.1.53.64  

Adobe Reader 6.0.1 - Deutsch 
 Out of date Adobe Reader installed! 

 Mozilla Firefox (3.6.6) Firefox Out of Date!  
 ```````````````````````````````` 

Process Check:  
 objlist.exe by Laurent 

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 
 ````````````````````````````````
 DNS Vulnerability Check:

 GREAT! (Not vulnerable to DNS cache poisoning) 
 
 ``````````End of Log````````````

Leftis

04.08.2010 21:31

MBAM log:

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4389
 

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702
 

04.08.2010 20:04:36

mbam-log-2010-08-04 (20-04-36).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 128900

Laufzeit: 7 Minute(n), 9 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Den ESET Online Scanner habe ich vorzeitg abgebrochen, da der wirklich verdammt langsam voran kam (nach 1 Stunde 2%). Sollte ich den noch durchlaufen lassen?

Die Musik kommt nicht mehr, sonst auch keine Auffällgikeiten :).

Larusso

05.08.2010 10:00

Ich schreibe solche Scans nicht zum Spass ;)

Leftis

05.08.2010 17:33

Also habe den ESET Online Scanner jetzt auch durchlaufen lassen, mit dem Resultat:

"No Threats Found"

An dem Ort C:\Programme\Eset\EsetOnlineScanner\log.txt befindet sich aber kein Protokoll...

Larusso

05.08.2010 17:36

Kommt vor.

Schritt 1

Gehe im FireFox auf Extras --> Erweitert -> Update

Stelle sicher das FireFox automatisch nach updates sucht und installiere diese auch.

Schritt 2

Java aktualisieren

Deine Javaversion ist veraltet. Da einige Schädlinge (z. B. Vundo) über Java-Exploits in das System eindringen, muss Java aktualisiert werden und alte Versionen müssen vom System entfernt werden, da die alten Versionen ein Sicherheitsrisiko darstellen. Lade JavaRa von prm753 herunter und entpacke es auf den Desktop. JavaRA ist geeignet für Windows 9x, 2k, XP und Vista (mit deaktivierter Benuterkontensteuerung).

Schließe alle Browserfenster.
Doppelklicke die JavaRa.exe, um das Programm zu starten.
Die Sprache auswählen, nimm Englisch und klicke "Select".
Klicke auf Additional Task, mache Haken bei Remove Useless JRE Files und [b]Remove Sun Download Manager[b].
Klicke auf Go und jeweils auf Ok und schließe das Fenster "Additional Tasks" wieder.
Klicke auf Remove Older Versions, um alte Java-Versionen, die auf dem Rechner installiert sind, zu entfernen.
Klicke auf Yes wenn es verlangt wird. Wenn JavaRa fertig, erscheint eine Notiz, dass ein Logfile erstellt wurde, klicke OK.
Das Logfile wird im Editor geöffnet, bitte speichern und später hier posten.
Kontrolliere in Systemsteuerung => Programme, ob noch Java-Versionen vorhanden sind und deinstalliere diese.
Rechner neu starten.

Downloade nun Java (Java Runtime Environment (JRE) 6 Update XX) von Oracle und installiere es. Vor dem Download musst Du die Lizenzbedingungen akzeptieren, indem Du "Accept License Agreement" aktivierst. Erweiterte Optionen anhaken, Sponsoren-Programm (Toolbar oder ähnliches) ggfs. abwählen.

Schritt 3

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.

Bitte poste in Deiner nächsten Antwort
OTL.txt
Extras.txt
Berichte wie der Rechner läuft

Leftis

06.08.2010 11:09

Firefox habe ich aktualisiert.

JavaRa habe ich ausgeführt, beim Löschen der alten Versionen kam einmal "JavaRa hat ein Problem festgestellt und muss beendet werden". Beim erneuten ausführen kam dann die Meldung, dass keine älteren Versionen existieren. Danach habe ich noch die restlichen aus Systemsteuerung -> Software entfernt. Hier der Log von JavaRa:

Code:

JavaRa 1.15 Removal Log.
 

Report follows after line.
 

------------------------------------
 

The JavaRa removal process was started on Fri Aug 06 11:43:33 2010
 

Found and removed: C:\Programme\Java\jre1.6.0_04
 

Found and removed: C:\Dokumente und Einstellungen\***\Anwendungsdaten\Sun\Java\jre1.6.0_11
 

Found and removed: C:\Dokumente und Einstellungen\***\Anwendungsdaten\Sun\Java\jre1.6.0_13
 

Found and removed: C:\Dokumente und Einstellungen\***\Anwendungsdaten\Sun\Java\jre1.6.0_15
 

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
 

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}
 

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}
 

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610004
 

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610004
 

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610004
 

Found and removed: SOFTWARE\Classes\JavaPlugin.160_04
 

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_04
 

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_04
 

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610004
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610004
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610004
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160040}
 

Found and removed: Software\Classes\JavaPlugin.160_04
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_04
 

Found and removed: Software\JavaSoft\Java2D\1.6.0_04
 

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_04
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
 

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
 

JavaRa 1.15 Removal Log.
 

Report follows after line.
 

------------------------------------
 

The JavaRa removal process was started on Fri Aug 06 11:44:20 2010
 

------------------------------------
 

Finished reporting.
 
 
 

JavaRa 1.15 Removal Log.
 

Report follows after line.
 

------------------------------------
 

The JavaRa removal process was started on Fri Aug 06 11:44:35 2010
 

------------------------------------
 

Finished reporting.

Leftis

06.08.2010 11:11

Und schließlich noch OTL.txt:

Code:

OTL logfile created on: 06.08.2010 12:00:11 - Run 3

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 200,00 Mb Available Physical Memory | 39,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 69,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 62,82 Gb Free Space | 66,24% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,14% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,30 Gb Free Space | 53,12% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 9,92 Gb Free Space | 19,76% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

PRC - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2007.06.26 21:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.05.15 00:22:22 | 000,035,328 | ---- | M] () -- C:\Programme\Winamp\winampa.exe

PRC - [2007.04.23 04:00:00 | 000,692,224 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe

PRC - [2007.04.11 15:32:22 | 000,056,080 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

PRC - [2006.02.28 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.08.06 02:07:30 | 000,061,440 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

PRC - [2005.04.06 17:53:04 | 000,856,064 | ---- | M] (Adobe Sytems Incorporated) -- C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

PRC - [2005.03.08 06:00:00 | 000,098,304 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

PRC - [2004.12.14 03:12:02 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

PRC - [2004.01.07 19:17:10 | 001,367,552 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Programme\ASUS\WLAN Card Utilities\Center.exe

PRC - [2003.10.08 11:41:10 | 000,057,344 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2003.06.17 17:14:40 | 000,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

PRC - [2003.03.19 02:13:00 | 000,004,608 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\system32\carpserv.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

MOD - [2009.07.12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll

MOD - [2009.07.12 02:09:20 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll

MOD - [2007.04.23 04:00:00 | 000,045,568 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\lgscroll.dll

MOD - [2006.02.28 14:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

MOD - [2006.02.28 14:00:00 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010.03.07 18:09:48 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)

SRV - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2005.04.06 17:53:02 | 000,163,840 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe -- (Adobe Version Cue CS2)

SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\trufos.sys -- (Trufos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\profos.sys -- (Profos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdrsdrv.sys -- (BDRsDrv)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdfsdrv.sys -- (BDFsDrv)

DRV - [2009.11.25 12:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.08.23 21:55:52 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.04.15 18:49:28 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.11.16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)

DRV - [2007.11.14 20:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)

DRV - [2007.04.11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)

DRV - [2007.04.11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)

DRV - [2007.04.11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV - [2007.01.18 21:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.08.04 05:10:18 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2003.12.24 13:43:42 | 000,256,512 | R--- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mrv8k51.sys -- (W8100PCI)

DRV - [2003.10.20 11:14:56 | 000,047,100 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\scrccid.sys -- (SCRx31 USB Smart Card Reader)

DRV - [2003.10.09 12:52:08 | 000,475,788 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2003.10.04 06:25:56 | 000,401,152 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)

DRV - [2003.07.02 05:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2003.03.19 02:13:00 | 001,107,072 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2003.03.19 02:13:00 | 000,622,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2003.03.19 02:13:00 | 000,177,024 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)

DRV - [2003.03.19 02:13:00 | 000,022,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)

DRV - [2002.09.09 20:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)

DRV - [2001.08.17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D2 70 D2 C7 08 34 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.faz.de"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {8061ddcf-3632-4287-8d8a-133e219ae838}:0.9.7

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.08.06 11:39:54 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.06 11:57:20 | 000,000,000 | ---D | M]

 

[2008.12.21 15:30:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

[2010.08.06 11:58:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions

[2009.11.10 14:05:45 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}

[2010.04.22 23:13:34 | 000,000,000 | ---D | M] (Live PageRank) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}

[2010.01.07 19:26:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.05.07 14:02:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\firebug@software.joehewitt.com

[2009.04.05 13:41:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\moveplayer@movenetworks.com

[2009.04.12 22:14:24 | 000,000,945 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\searchplugins\youtube-videosuche.xml

[2010.08.06 11:58:19 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.08.06 11:57:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.08.06 11:57:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.08.06 11:39:48 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.08.06 11:39:48 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.08.06 11:39:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.08.06 11:39:48 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.08.06 11:39:48 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.08.04 17:41:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Version Cue CS2] C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated)

O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CARPService] C:\WINDOWS\System32\carpserv.exe (Conexant Systems, Inc.)

O4 - HKLM..\Run: [Control Center] C:\Programme\ASUS\WLAN Card Utilities\Center.exe (ASUSTeK COMPUTER INC.)

O4 - HKLM..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)

O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ATI CATALYST-Infobereich.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{92E30924-BF7D-4BE4-A9E7-38C94D739D16}\Icon3E5562ED7.ico ()

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Logitech-Produktregistrierung.lnk = C:\Programme\Gemeinsame Dateien\LogiShared\eReg\SetPoint\eReg.exe File not found

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.12.20 17:33:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2004.01.20 15:50:52 | 000,020,480 | ---- | M] (TARGA GmbH) - D:\AUTORUN.EXE -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.08.06 11:57:21 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010.08.06 11:57:20 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010.08.06 11:57:20 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010.08.06 11:57:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010.08.06 11:57:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010.08.06 11:52:05 | 000,875,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\jre-6u21-windows-i586-iftw-rv.exe

[2010.08.06 11:42:23 | 000,157,696 | ---- | C] (The RaProducts Team: Paul McLain and Fred de Vries) -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.exe

[2010.08.04 20:16:17 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2010.08.04 20:14:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\final

[2010.08.04 17:27:42 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.08.04 17:27:42 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.08.04 17:27:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.08.04 17:27:41 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.08.04 17:24:40 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.08.04 15:14:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\E-B

[2010.08.03 20:01:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.08.03 19:59:51 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.08.03 19:47:50 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2010.08.03 19:45:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\MFTools

[2010.08.02 19:53:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe

[2010.07.28 20:34:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia

[2010.07.08 23:12:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\11

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.08.06 11:57:03 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010.08.06 11:57:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010.08.06 11:57:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010.08.06 11:57:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010.08.06 11:57:03 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010.08.06 11:54:49 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk

[2010.08.06 11:54:45 | 000,002,343 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[2010.08.06 11:54:29 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.08.06 11:54:08 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.08.06 11:53:59 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.08.06 11:53:57 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys

[2010.08.06 11:52:55 | 006,291,456 | ---- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.dat

[2010.08.06 11:52:55 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini

[2010.08.06 11:52:06 | 000,875,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\jre-6u21-windows-i586-iftw-rv.exe

[2010.08.06 11:41:02 | 000,071,798 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.zip

[2010.08.04 21:40:33 | 000,869,051 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\SecurityCheck.exe

[2010.08.04 20:16:13 | 002,672,312 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 17:42:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.08.04 17:41:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010.08.04 17:23:58 | 003,749,693 | R--- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Combo-Fix.exe

[2010.08.04 15:16:05 | 000,000,512 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-04-10_15-16-05.bak

[2010.08.03 20:00:49 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 20:00:49 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.08.03 19:45:56 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Gmer.zip

[2010.07.11 16:49:25 | 000,172,544 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.08.06 11:42:23 | 000,245,103 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.def

[2010.08.06 11:40:57 | 000,071,798 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.zip

[2010.08.04 21:40:26 | 000,869,051 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\SecurityCheck.exe

[2010.08.04 20:16:02 | 002,672,312 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 17:27:42 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.08.04 17:27:42 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.08.04 17:27:42 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.08.04 17:27:42 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.08.04 17:27:42 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.08.04 17:23:27 | 003,749,693 | R--- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Combo-Fix.exe

[2010.08.04 15:16:05 | 000,000,512 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-04-10_15-16-05.bak

[2010.08.03 20:31:53 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\gmer.exe

[2010.08.03 19:59:51 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 19:59:51 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.06.21 20:47:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2009.08.23 21:56:42 | 000,197,424 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll

[2009.08.23 21:56:34 | 000,193,328 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll

[2009.07.03 16:22:15 | 000,002,943 | ---- | C] () -- C:\WINDOWS\seRapid.INI

[2009.04.15 18:49:28 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2008.12.28 18:24:33 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.12.28 14:19:49 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE DX4200G.ini

[2008.12.28 14:02:37 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2008.12.21 16:12:49 | 000,000,677 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI

[2008.12.21 16:10:19 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

[2008.12.21 15:40:36 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008.12.21 15:30:55 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2006.02.28 14:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

< End of report >

Leftis

06.08.2010 11:12

und Extras.txt:

Code:

OTL Extras logfile created on: 06.08.2010 12:00:11 - Run 3

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 200,00 Mb Available Physical Memory | 39,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 69,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 62,82 Gb Free Space | 66,24% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,14% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,30 Gb Free Space | 53,12% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 9,92 Gb Free Space | 19,76% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Adobe\Adobe GoLive CS2\GoLive.exe" "%1" ()

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Disabled:ICQ Library -- (ICQ, LLC.)

"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation)

"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)

"C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)

"C:\Programme\eclipse\eclipse.exe" = C:\Programme\eclipse\eclipse.exe:*:Enabled:eclipse -- ()

"C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" = C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2 -- (Adobe Systems Incorporated)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2

"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2

"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint

"{314F6D08-A8B7-11D8-8446-0050BA1D384D}" = EPSON Image Clip Palette

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = Logitech Registration

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{46548E80-0407-0000-7E8A-45000F855001}" = Adobe GoLive CS2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{56918C0C-0D87-4CA6-92BF-4975A43AC719}" = KhalInstallWrapper

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{77B6DD3A-C7D0-479B-9CB1-BD8D42AAB1A2}" = SCRx31 CT-API and  PC/SC  Driver Installer

"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0

"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2

"{86EC42B5-346E-4BAB-948D-58E021EA4BD1}" = ATI Catalyst Control Center

"{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}" = CDDRV_Installer

"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer

"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage

"{92E30924-BF7D-4BE4-A9E7-38C94D739D16}" = Cisco Systems VPN Client 5.0.06.0100

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{ABC62001-AD9F-46DB-8668-9946154D6A07}" = AMD Athlon 64 Processor Driver

"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A00000000001}" = Adobe Reader 6.0.1 - Deutsch

"{ADBE46EE-54E0-4610-B436-D7E93D829100}" = Adobe Version Cue CS2

"{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2

"{B57A484C-B856-4249-892A-093170123000}" = GNATbench for Eclipse 2.3.0 (20090317)

"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0

"{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific

"{CB2174B0-F84A-11D4-ACAB-000000120090}" = GNAT GPL Ada Development Environment 2009

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari

"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Foto Premium 9

"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64

"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager

"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0

"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio

"7-Zip" = 7-Zip 4.65

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop 7.0" = Adobe Photoshop 7.0

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54

"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CDex" = CDex extraction audio

"CNXT_MODEM_PCI_VEN_14F1&DEV_2F00" = FM-56PCI-HSFi-AB

"Delphish" = Delphish

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"ERUNT_is1" = ERUNT 1.1j

"ESDX4800_4200 Benutzerhandbuch" = ESDX4800_4200 Benutzerhandbuch

"FileZilla" = FileZilla (remove only)

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2

"FreePDF_XP" = FreePDF XP (Remove only)

"GSiteCrawler" = GSiteCrawler

"ie8" = Windows Internet Explorer 8

"InfoRapid Suchen & Ersetzen" = InfoRapid Suchen & Ersetzen

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nero - Burning Rom!UninstallKey" = Nero 6

"PictureIt_v9" = Microsoft Picture It! Foto Premium 9

"RealPlayer 6.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Trellian Dictionary_is1" = Trellian Dictionary v1.0

"Trellian LiveUpgrade_is1" = Trellian LiveUpgrade v2.0

"Uninstall_is1" = Uninstall 1.0.0.1

"VLC media player" = VLC media player 0.9.8a

"Winamp" = Winamp (remove only)

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Works2004Setup" = Setup-Start von Microsoft Works 2004

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SwingSet3" = SwingSet3

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 11.11.2009 15:30:26 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 11.11.2009 15:31:01 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:28:50 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:37:17 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:38:09 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:41:59 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:14:15 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:19:32 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung wmplayer.exe, Version 11.0.5721.5145, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 09.12.2009 11:14:47 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung estwm.exe, Version 2.7.0.1, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 09.12.2009 11:14:49 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung estwm.exe, Version 2.7.0.1, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

[ System Events ]

Error - 11.07.2010 10:29:26 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 11.07.2010 10:37:59 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 17.07.2010 07:43:08 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 22.07.2010 09:59:00 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.

 Dies ist bereits 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 16:14:23 | Computer Name = PC | Source = System Error | ID = 1003

Description = Fehlercode 000000f7, 1. Parameter ff5d82b0, 2. Parameter 00006b16,

 3. Parameter ffff94e9, 4. Parameter 00000000.

 

 

< End of report >

Computer läuft unauffällig :)

Larusso

06.08.2010 11:27

Schritt 1

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://image.hijackthis.eu/upload/hjt1-021.jpg Textbox.

Code:

:OTL

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
 

:services

:files

:reg

:Commands

[purity]

[emptytemp]

[reboot]

Schliesse bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2

Da mit 13.Juli der Support für Windows XP Sp2 (32bit) endet, installiere Dir bitte WinXP Service Pack 3.

Schritt 3

Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software--> Adobe Reader
und lade dir die neue Version von Hier herunter
Als alternative würde ich dir den schlankeren Foxit Reader empfehlen :)

Schritt 4

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.

Bitte poste in Deiner nächsten Antwort
OTL Fix Log
OTL.txt
Extras.txt

Leftis

07.08.2010 17:27

Die erste OTL log:

Code:

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.

========== SERVICES/DRIVERS ==========

========== FILES ==========

========== REGISTRY ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: ***

->Temp folder emptied: 102034365 bytes

->Temporary Internet Files folder emptied: 9249577 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 88619843 bytes

->Apple Safari cache emptied: 0 bytes

->Opera cache emptied: 0 bytes

->Flash cache emptied: 814 bytes

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 360582 bytes

->Flash cache emptied: 649 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 483 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 191,00 mb

 

 

OTL by OldTimer - Version 3.2.9.1 log created on 08062010_174538
 

Files\Folders moved on Reboot...
 

Registry entries deleted on Reboot...

Leftis

07.08.2010 17:28

Service Pack 3 und Acrobat Reader 9.3.3 installiert:

OTL log

Code:

OTL logfile created on: 07.08.2010 18:02:34 - Run 4

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 47,00 Mb Available Physical Memory | 9,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 53,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 58,64 Gb Free Space | 61,83% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,15% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,94 Gb Free Space | 55,19% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 10,54 Gb Free Space | 20,99% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.08.06 11:39:41 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.06.26 21:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.05.15 00:22:22 | 000,035,328 | ---- | M] () -- C:\Programme\Winamp\winampa.exe

PRC - [2007.04.23 04:00:00 | 000,692,224 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\SetPoint.exe

PRC - [2007.04.11 15:32:22 | 000,056,080 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.exe

PRC - [2005.08.06 02:07:30 | 000,061,440 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe

PRC - [2005.04.06 17:53:04 | 000,856,064 | ---- | M] (Adobe Sytems Incorporated) -- C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

PRC - [2005.03.08 06:00:00 | 000,098,304 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAEE.EXE

PRC - [2004.12.14 03:12:02 | 000,483,328 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe

PRC - [2004.01.07 19:17:10 | 001,367,552 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Programme\ASUS\WLAN Card Utilities\Center.exe

PRC - [2003.10.08 11:41:10 | 000,057,344 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2003.06.17 17:14:40 | 000,050,688 | ---- | M] (Microsoft® Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe

PRC - [2003.03.19 02:13:00 | 000,004,608 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\system32\carpserv.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.08.03 19:46:14 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\***\Desktop\MFTools\OTL.exe

MOD - [2009.07.12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll

MOD - [2009.07.12 02:09:20 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll

MOD - [2008.04.14 07:51:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

MOD - [2007.04.23 04:00:00 | 000,045,568 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\SetPoint\lgscroll.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010.03.07 18:09:48 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)

SRV - [2009.08.23 21:56:36 | 001,528,624 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2009.07.21 14:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2005.04.06 17:53:02 | 000,163,840 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe -- (Adobe Version Cue CS2)

SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\trufos.sys -- (Trufos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\profos.sys -- (Profos)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdrsdrv.sys -- (BDRsDrv)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Softwin\BitDefender10\bdfsdrv.sys -- (BDFsDrv)

DRV - [2009.11.25 12:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.08.23 21:55:52 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.04.15 18:49:28 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.11.16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)

DRV - [2007.11.14 20:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)

DRV - [2007.04.11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)

DRV - [2007.04.11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)

DRV - [2007.04.11 15:32:30 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV - [2007.01.18 21:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.08.04 05:10:18 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2003.12.24 13:43:42 | 000,256,512 | R--- | M] (Marvell Semiconductor, Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mrv8k51.sys -- (W8100PCI)

DRV - [2003.10.20 11:14:56 | 000,047,100 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\scrccid.sys -- (SCRx31 USB Smart Card Reader)

DRV - [2003.10.09 12:52:08 | 000,475,788 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2003.10.04 06:25:56 | 000,401,152 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)

DRV - [2003.07.02 05:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2003.03.19 02:13:00 | 001,107,072 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2003.03.19 02:13:00 | 000,622,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2003.03.19 02:13:00 | 000,177,024 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)

DRV - [2003.03.19 02:13:00 | 000,022,400 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)

DRV - [2002.09.09 20:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)

DRV - [2001.08.17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D2 70 D2 C7 08 34 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.faz.de"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {8061ddcf-3632-4287-8d8a-133e219ae838}:0.9.7

FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.08.06 11:39:54 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.07 17:58:44 | 000,000,000 | ---D | M]

 

[2008.12.21 15:30:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

[2010.08.06 11:58:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions

[2009.11.10 14:05:45 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}

[2010.04.22 23:13:34 | 000,000,000 | ---D | M] (Live PageRank) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}

[2010.01.07 19:26:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010.05.07 14:02:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\firebug@software.joehewitt.com

[2009.04.05 13:41:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\extensions\moveplayer@movenetworks.com

[2009.04.12 22:14:24 | 000,000,945 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\i7wt6jid.default\searchplugins\youtube-videosuche.xml

[2010.08.06 11:58:19 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.08.06 11:57:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.08.06 11:57:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.08.06 11:39:48 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.08.06 11:39:48 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.08.06 11:39:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.08.06 11:39:48 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.08.06 11:39:48 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.08.04 17:41:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Version Cue CS2] C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated)

O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [CARPService] C:\WINDOWS\System32\carpserv.exe (Conexant Systems, Inc.)

O4 - HKLM..\Run: [Control Center] C:\Programme\ASUS\WLAN Card Utilities\Center.exe (ASUSTeK COMPUTER INC.)

O4 - HKLM..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE (SEIKO EPSON CORPORATION)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)

O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ATI CATALYST-Infobereich.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{92E30924-BF7D-4BE4-A9E7-38C94D739D16}\Icon3E5562ED7.ico ()

O4 - Startup: C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Logitech-Produktregistrierung.lnk = C:\Programme\Gemeinsame Dateien\LogiShared\eReg\SetPoint\eReg.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008.12.20 17:33:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2004.01.20 15:50:52 | 000,020,480 | ---- | M] (TARGA GmbH) - D:\AUTORUN.EXE -- [ FAT32 ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.08.07 17:16:54 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch

[2010.08.06 18:53:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood.Tmp

[2010.08.06 18:50:03 | 001,372,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml6.dll

[2010.08.06 18:50:03 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msxml6r.dll

[2010.08.06 18:50:03 | 000,093,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml6r.dll

[2010.08.06 18:50:01 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\irbus.sys

[2010.08.06 18:50:01 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\smtpapi.dll

[2010.08.06 18:50:01 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rwnh.dll

[2010.08.06 18:50:01 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comsdupd.exe

[2010.08.06 18:49:57 | 000,377,984 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ati2dvaa.dll

[2010.08.06 18:49:57 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\azroles.dll

[2010.08.06 18:49:57 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\aaclient.dll

[2010.08.06 18:49:57 | 000,032,768 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativtmxx.dll

[2010.08.06 18:49:57 | 000,023,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativmvxx.ax

[2010.08.06 18:49:57 | 000,009,728 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\ativdaxx.ax

[2010.08.06 18:49:57 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bitsprx4.dll

[2010.08.06 18:49:56 | 000,651,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3ui.dll

[2010.08.06 18:49:56 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3cfg.dll

[2010.08.06 18:49:56 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3msm.dll

[2010.08.06 18:49:56 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dhcpqec.dll

[2010.08.06 18:49:56 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3gpclnt.dll

[2010.08.06 18:49:56 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dimsroam.dll

[2010.08.06 18:49:56 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3api.dll

[2010.08.06 18:49:56 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dot3dlg.dll

[2010.08.06 18:49:55 | 000,184,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapp3hst.dll

[2010.08.06 18:49:55 | 000,182,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapphost.dll

[2010.08.06 18:49:55 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappcfg.dll

[2010.08.06 18:49:55 | 000,095,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappgnui.dll

[2010.08.06 18:49:55 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapqec.dll

[2010.08.06 18:49:55 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eappprxy.dll

[2010.08.06 18:49:55 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\eapolqec.dll

[2010.08.06 18:49:54 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ieencode.dll

[2010.08.06 18:49:54 | 000,032,285 | ---- | C] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\hsfcisp2.dll

[2010.08.06 18:49:53 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\l2gpstore.dll

[2010.08.06 18:49:53 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdpash.dll

[2010.08.06 18:49:53 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdnepr.dll

[2010.08.06 18:49:53 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdiultn.dll

[2010.08.06 18:49:53 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdbhc.dll

[2010.08.06 18:49:52 | 000,397,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmcex.dll

[2010.08.06 18:49:52 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\microsoft.managementconsole.dll

[2010.08.06 18:49:52 | 000,155,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mssha.dll

[2010.08.06 18:49:52 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmcfxcommon.dll

[2010.08.06 18:49:52 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mmcperf.exe

[2010.08.06 18:49:51 | 004,274,816 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nv4_disp.dll

[2010.08.06 18:49:51 | 001,737,856 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\mtxparhd.dll

[2010.08.06 18:49:51 | 000,198,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napmontr.dll

[2010.08.06 18:49:51 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napstat.exe

[2010.08.06 18:49:51 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\onex.dll

[2010.08.06 18:49:51 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msshavmsg.dll

[2010.08.06 18:49:51 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\napipsec.dll

[2010.08.06 18:49:48 | 000,412,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\photometadatahandler.dll

[2010.08.06 18:49:48 | 000,151,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qagent.dll

[2010.08.06 18:49:48 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qutil.dll

[2010.08.06 18:49:48 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\qcliprov.dll

[2010.08.06 18:49:48 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rasqec.dll

[2010.08.06 18:49:47 | 000,397,056 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\s3gnb.dll

[2010.08.06 18:49:47 | 000,290,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\rhttpaa.dll

[2010.08.06 18:49:47 | 000,286,792 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slextspk.dll

[2010.08.06 18:49:47 | 000,188,508 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slgen.dll

[2010.08.06 18:49:47 | 000,073,832 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slcoinst.dll

[2010.08.06 18:49:47 | 000,073,796 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slserv.exe

[2010.08.06 18:49:47 | 000,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\slrundll.exe

[2010.08.06 18:49:47 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\setupn.exe

[2010.08.06 18:49:46 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\tsgqec.dll

[2010.08.06 18:49:46 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vidcap.ax

[2010.08.06 18:49:46 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\verclsid.exe

[2010.08.06 18:49:45 | 000,712,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\windowscodecs.dll

[2010.08.06 18:49:45 | 000,346,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\windowscodecsext.dll

[2010.08.06 18:49:45 | 000,276,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmphoto.dll

[2010.08.06 18:49:45 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wlanapi.dll

[2010.08.06 18:49:43 | 000,032,866 | ---- | C] (Smart Link) -- C:\WINDOWS\slrundll.exe

[2010.08.06 18:49:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas

[2010.08.06 18:49:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de

[2010.08.06 18:49:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits

[2010.08.06 18:44:01 | 000,056,623 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1btxx.sys

[2010.08.06 18:44:01 | 000,043,008 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\drivers\amdagp.sys

[2010.08.06 18:44:01 | 000,012,047 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1pdxx.sys

[2010.08.06 18:44:01 | 000,011,615 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1mdxx.sys

[2010.08.06 18:44:01 | 000,004,255 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv01nt5.dll

[2010.08.06 18:44:01 | 000,003,967 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv02nt5.dll

[2010.08.06 18:44:01 | 000,003,775 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv11nt5.dll

[2010.08.06 18:44:01 | 000,003,711 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv09nt5.dll

[2010.08.06 18:44:01 | 000,003,647 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv07nt5.dll

[2010.08.06 18:44:01 | 000,003,615 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv05nt5.dll

[2010.08.06 18:44:01 | 000,003,135 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\adv08nt5.dll

[2010.08.06 18:44:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic

[2010.08.06 18:44:00 | 000,327,168 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtaa.sys

[2010.08.06 18:44:00 | 000,104,960 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinrvxx.sys

[2010.08.06 18:44:00 | 000,073,216 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atintuxx.sys

[2010.08.06 18:44:00 | 000,063,663 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1rvxx.sys

[2010.08.06 18:44:00 | 000,057,856 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinbtxx.sys

[2010.08.06 18:44:00 | 000,052,224 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinraxx.sys

[2010.08.06 18:44:00 | 000,036,463 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1tuxx.sys

[2010.08.06 18:44:00 | 000,034,735 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xsxx.sys

[2010.08.06 18:44:00 | 000,031,744 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxbxx.sys

[2010.08.06 18:44:00 | 000,030,671 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1raxx.sys

[2010.08.06 18:44:00 | 000,029,455 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xbxx.sys

[2010.08.06 18:44:00 | 000,028,672 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinsnxx.sys

[2010.08.06 18:44:00 | 000,026,367 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1snxx.sys

[2010.08.06 18:44:00 | 000,021,343 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1ttxx.sys

[2010.08.06 18:44:00 | 000,014,336 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinpdxx.sys

[2010.08.06 18:44:00 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinttxx.sys

[2010.08.06 18:44:00 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinmdxx.sys

[2010.08.06 18:43:59 | 000,063,488 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxsxx.sys

[2010.08.06 18:43:59 | 000,036,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthprint.sys

[2010.08.06 18:43:59 | 000,025,471 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv04nt5.dll

[2010.08.06 18:43:59 | 000,021,183 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv01nt5.dll

[2010.08.06 18:43:59 | 000,017,279 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv10nt5.dll

[2010.08.06 18:43:59 | 000,014,143 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv06nt5.dll

[2010.08.06 18:43:59 | 000,011,359 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\atv02nt5.dll

[2010.08.06 18:43:58 | 000,144,384 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\drivers\hdaudbus.sys

[2010.08.06 18:43:58 | 000,015,423 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\ch7xxnt5.dll

[2010.08.06 18:43:57 | 001,309,184 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlstrm.sys

[2010.08.06 18:43:57 | 000,452,736 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\drivers\mtxparhm.sys

[2010.08.06 18:43:57 | 000,180,360 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys

[2010.08.06 18:43:57 | 000,126,686 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys

[2010.08.06 18:43:57 | 000,012,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\mutohpen.sys

[2010.08.06 18:43:56 | 001,897,408 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\drivers\nv4_mini.sys

[2010.08.06 18:43:56 | 000,166,912 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\drivers\s3gnbm.sys

[2010.08.06 18:43:56 | 000,030,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rndismpx.sys

[2010.08.06 18:43:56 | 000,013,776 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\recagent.sys

[2010.08.06 18:43:55 | 000,404,990 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slntamr.sys

[2010.08.06 18:43:55 | 000,129,535 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnt7554.sys

[2010.08.06 18:43:55 | 000,095,424 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnthal.sys

[2010.08.06 18:43:55 | 000,040,960 | ---- | C] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\drivers\sisagp.sys

[2010.08.06 18:43:55 | 000,013,240 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slwdmsup.sys

[2010.08.06 18:43:55 | 000,011,807 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv07nt.sys

[2010.08.06 18:43:55 | 000,011,325 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\vchnt5.dll

[2010.08.06 18:43:55 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\smbali.sys

[2010.08.06 18:43:55 | 000,003,901 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\siint5.dll

[2010.08.06 18:43:54 | 000,025,471 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\watv10nt.sys

[2010.08.06 18:43:54 | 000,022,271 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\watv06nt.sys

[2010.08.06 18:43:54 | 000,011,935 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv11nt.sys

[2010.08.06 18:43:54 | 000,011,871 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv09nt.sys

[2010.08.06 18:43:54 | 000,011,295 | ---- | C] (Intel(R) Corporation) -- C:\WINDOWS\System32\drivers\wadv08nt.sys

[2010.08.06 18:38:30 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$

[2010.08.06 18:03:10 | 328,324,136 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\***\Desktop\WindowsXP-KB936929-SP3-x86-DEU.exe

[2010.08.06 17:45:51 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010.08.06 17:45:38 | 000,000,000 | ---D | C] -- C:\_OTL

[2010.08.06 11:57:21 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010.08.06 11:57:20 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010.08.06 11:57:20 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010.08.06 11:57:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010.08.06 11:57:20 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010.08.06 11:52:05 | 000,875,296 | ---- | C] (Sun Microsystems, Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\jre-6u21-windows-i586-iftw-rv.exe

[2010.08.06 11:42:23 | 000,157,696 | ---- | C] (The RaProducts Team: Paul McLain and Fred de Vries) -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.exe

[2010.08.04 20:16:17 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2010.08.04 20:14:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\final

[2010.08.04 17:27:42 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010.08.04 17:27:42 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010.08.04 17:27:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010.08.04 17:27:41 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010.08.04 17:24:40 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010.08.04 15:14:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\E-B

[2010.08.03 20:01:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.08.03 19:59:51 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT

[2010.08.03 19:47:50 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip

[2010.08.03 19:45:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\MFTools

[2010.08.02 19:53:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe

[2010.07.28 20:34:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia

[2010.07.08 23:12:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\11

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.08.07 17:59:47 | 006,291,456 | ---- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.dat

[2010.08.07 17:55:15 | 215,816,348 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\TempImage.nrg.part

[2010.08.07 17:55:15 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\TempImage.nrg

[2010.08.07 17:21:02 | 000,068,712 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

[2010.08.07 17:20:40 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk

[2010.08.07 17:20:37 | 000,002,343 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[2010.08.07 17:19:01 | 000,383,390 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.08.07 17:19:00 | 000,394,830 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.08.07 17:19:00 | 000,064,796 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.08.07 17:19:00 | 000,053,744 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.08.07 17:18:56 | 000,906,552 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.08.07 17:18:07 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.08.07 17:16:53 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.08.07 17:16:33 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.08.07 17:16:24 | 000,263,824 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.08.07 17:16:23 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys

[2010.08.06 20:26:02 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini

[2010.08.06 18:43:34 | 000,251,712 | RHS- | M] () -- C:\ntldr

[2010.08.06 18:20:46 | 328,324,136 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\***\Desktop\WindowsXP-KB936929-SP3-x86-DEU.exe

[2010.08.06 11:57:03 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010.08.06 11:57:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010.08.06 11:57:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010.08.06 11:57:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010.08.06 11:57:03 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010.08.06 11:52:06 | 000,875,296 | ---- | M] (Sun Microsystems, Inc.) -- C:\Dokumente und Einstellungen\***\Desktop\jre-6u21-windows-i586-iftw-rv.exe

[2010.08.06 11:41:02 | 000,071,798 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.zip

[2010.08.04 21:40:33 | 000,869,051 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\SecurityCheck.exe

[2010.08.04 21:11:13 | 000,042,627 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\gl.rar

[2010.08.04 20:16:13 | 002,672,312 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 17:42:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010.08.04 17:41:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010.08.04 17:23:58 | 003,749,693 | R--- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Combo-Fix.exe

[2010.08.04 15:16:05 | 000,000,512 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-04-10_15-16-05.bak

[2010.08.03 20:00:49 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 20:00:49 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.08.03 19:45:56 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Gmer.zip

[2010.08.03 19:44:39 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\Load.exe

[2010.08.03 15:34:40 | 000,080,384 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

[2010.07.11 16:49:25 | 000,172,544 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp files -> C:\Dokumente und Einstellungen\***\Eigene Dateien\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.08.07 17:55:15 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\TempImage.nrg

[2010.08.07 17:55:03 | 182,491,292 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\TempImage.nrg.part

[2010.08.06 18:43:59 | 000,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod

[2010.08.06 18:43:58 | 000,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty

[2010.08.06 18:43:57 | 000,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img

[2010.08.06 11:42:23 | 000,245,103 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.def

[2010.08.06 11:40:57 | 000,071,798 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\JavaRa.zip

[2010.08.04 21:40:26 | 000,869,051 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\SecurityCheck.exe

[2010.08.04 21:11:06 | 000,042,627 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\gl.rar

[2010.08.04 20:16:02 | 002,672,312 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\esetsmartinstaller_enu.exe

[2010.08.04 17:27:42 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.08.04 17:27:42 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.08.04 17:27:42 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.08.04 17:27:42 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.08.04 17:27:42 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.08.04 17:23:27 | 003,749,693 | R--- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Combo-Fix.exe

[2010.08.04 15:16:05 | 000,000,512 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck_MBR_Backup_08-04-10_15-16-05.bak

[2010.08.03 20:31:53 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\gmer.exe

[2010.08.03 19:59:51 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\NTREGOPT.lnk

[2010.08.03 19:59:51 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\ERUNT.lnk

[2010.08.03 19:45:55 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Gmer.zip

[2010.08.03 19:44:38 | 000,410,626 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\Load.exe

[2010.08.03 15:34:39 | 000,080,384 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\MBRCheck.exe

[2010.06.21 20:47:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2009.08.23 21:56:42 | 000,197,424 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll

[2009.08.23 21:56:34 | 000,193,328 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll

[2009.07.03 16:22:15 | 000,002,943 | ---- | C] () -- C:\WINDOWS\seRapid.INI

[2009.04.15 18:49:28 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2008.12.28 18:24:33 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.12.28 14:19:49 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE DX4200G.ini

[2008.12.28 14:02:37 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2008.12.21 16:12:49 | 000,000,677 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI

[2008.12.21 16:10:19 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

[2008.12.21 15:40:36 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008.12.21 15:30:55 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2003.02.20 18:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

< End of report >

Leftis

07.08.2010 17:28

Und Extras:

Code:

OTL Extras logfile created on: 07.08.2010 18:02:34 - Run 4

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\***\Desktop\MFTools

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,00 Mb Total Physical Memory | 47,00 Mb Available Physical Memory | 9,00% Memory free

1,00 Gb Paging File | 1,00 Gb Available in Paging File | 53,00% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,84 Gb Total Space | 58,64 Gb Free Space | 61,83% Space Free | Partition Type: NTFS

Drive D: | 2,05 Gb Total Space | 1,60 Gb Free Space | 78,15% Space Free | Partition Type: FAT32

Drive E: | 30,69 Gb Total Space | 16,94 Gb Free Space | 55,19% Space Free | Partition Type: FAT32

Drive F: | 50,22 Gb Total Space | 10,54 Gb Free Space | 20,99% Space Free | Partition Type: FAT32

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: PC

Current User Name: ***

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Programme\Adobe\Adobe GoLive CS2\GoLive.exe" "%1" ()

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Disabled:ICQ Library -- (ICQ, LLC.)

"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation)

"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)

"C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Dokumente und Einstellungen\***\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)

"C:\Programme\eclipse\eclipse.exe" = C:\Programme\eclipse\eclipse.exe:*:Enabled:eclipse -- ()

"C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" = C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2 -- (Adobe Systems Incorporated)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2

"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2

"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint

"{314F6D08-A8B7-11D8-8446-0050BA1D384D}" = EPSON Image Clip Palette

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = Logitech Registration

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{46548E80-0407-0000-7E8A-45000F855001}" = Adobe GoLive CS2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{56918C0C-0D87-4CA6-92BF-4975A43AC719}" = KhalInstallWrapper

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{77B6DD3A-C7D0-479B-9CB1-BD8D42AAB1A2}" = SCRx31 CT-API and  PC/SC  Driver Installer

"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0

"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2

"{86EC42B5-346E-4BAB-948D-58E021EA4BD1}" = ATI Catalyst Control Center

"{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}" = CDDRV_Installer

"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer

"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage

"{92E30924-BF7D-4BE4-A9E7-38C94D739D16}" = Cisco Systems VPN Client 5.0.06.0100

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{ABC62001-AD9F-46DB-8668-9946154D6A07}" = AMD Athlon 64 Processor Driver

"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch

"{ADBE46EE-54E0-4610-B436-D7E93D829100}" = Adobe Version Cue CS2

"{B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}" = Adobe Illustrator CS2

"{B57A484C-B856-4249-892A-093170123000}" = GNATbench for Eclipse 2.3.0 (20090317)

"{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0

"{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific

"{CB2174B0-F84A-11D4-ACAB-000000120090}" = GNAT GPL Ada Development Environment 2009

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari

"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Foto Premium 9

"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64

"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager

"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0

"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio

"7-Zip" = 7-Zip 4.65

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Photoshop 7.0" = Adobe Photoshop 7.0

"Adobe SVG Viewer" = Adobe SVG Viewer 3.0

"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54

"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts

"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software

"ATI Display Driver" = ATI Display Driver

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"CDex" = CDex extraction audio

"CNXT_MODEM_PCI_VEN_14F1&DEV_2F00" = FM-56PCI-HSFi-AB

"Delphish" = Delphish

"EPSON Printer and Utilities" = EPSON-Drucker-Software

"EPSON Scanner" = EPSON Scan

"ERUNT_is1" = ERUNT 1.1j

"ESDX4800_4200 Benutzerhandbuch" = ESDX4800_4200 Benutzerhandbuch

"FileZilla" = FileZilla (remove only)

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2

"FreePDF_XP" = FreePDF XP (Remove only)

"GSiteCrawler" = GSiteCrawler

"ie8" = Windows Internet Explorer 8

"InfoRapid Suchen & Ersetzen" = InfoRapid Suchen & Ersetzen

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"Nero - Burning Rom!UninstallKey" = Nero 6

"PictureIt_v9" = Microsoft Picture It! Foto Premium 9

"RealPlayer 6.0" = RealPlayer

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Trellian Dictionary_is1" = Trellian Dictionary v1.0

"Trellian LiveUpgrade_is1" = Trellian LiveUpgrade v2.0

"Uninstall_is1" = Uninstall 1.0.0.1

"VLC media player" = VLC media player 0.9.8a

"Winamp" = Winamp (remove only)

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WinRAR archiver" = WinRAR Archivierer

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Works2004Setup" = Setup-Start von Microsoft Works 2004

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"SwingSet3" = SwingSet3

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 11.11.2009 15:30:26 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 11.11.2009 15:31:01 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:28:50 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:37:17 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:38:09 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 09:41:59 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:14:15 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung WINWORD.EXE, Version 11.0.5604.0, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 15.11.2009 12:19:32 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung wmplayer.exe, Version 11.0.5721.5145, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 09.12.2009 11:14:47 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung estwm.exe, Version 2.7.0.1, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

Error - 09.12.2009 11:14:49 | Computer Name = PC | Source = Application Hang | ID = 1002

Description = Stillstehende Anwendung estwm.exe, Version 2.7.0.1, Stillstandmodul

 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

 

[ System Events ]

Error - 11.07.2010 10:37:59 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 17.07.2010 07:43:08 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 22.07.2010 09:59:00 | Computer Name = PC | Source = Print | ID = 19

Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft Office

 Document Image Writer, Freigabename Drucker2.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.

 Dies ist bereits 1 Mal passiert.

 

Error - 03.08.2010 13:48:25 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 03.08.2010 16:14:23 | Computer Name = PC | Source = System Error | ID = 1003

Description = Fehlercode 000000f7, 1. Parameter ff5d82b0, 2. Parameter 00006b16,

 3. Parameter ffff94e9, 4. Parameter 00000000.

 

Error - 06.08.2010 11:45:42 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Ati HotKey Poller" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

Error - 06.08.2010 11:45:42 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.

 Dies ist bereits 1 Mal passiert.

 

Error - 06.08.2010 11:45:42 | Computer Name = PC | Source = Service Control Manager | ID = 7034

Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits

 1 Mal passiert.

 

 

< End of report >

Larusso

07.08.2010 17:31

Logfile ist sauber :daumenhoc

Hier noch die letzten paar Schritte zur Säuberung Deines Rechners.

Schritt 1

Combofix deinstallieren

Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Start => Ausführen (bei Vista (Windows-Taste + R) => dort reinschreiben ComboFix /uninstall => Enter drücken - damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch auch dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.

Schritt 2

Tool CleanUp

Starte bitte die OTL.exe.
Klicke nun auf den Bereinigung Button. Dies wird die meisten Tools und Logfiles entfernen.
Sollte denoch etwas bestehen bleiben, bitte manuell entfernen sowie den Papierkorb leeren.

Schritt 3

Automatische Updates

Sehen wir nach ob die Updates für Windows sich automatisch downloaden. Das ist der beste Weg um all die Sicherheits- Patches und Fixes zu erhalten.

Windows + R Taste drücken. Kopiere nun folgenden Text in die Kommandozeile

RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

und klicke auf OK.
Stelle sicher das die automatischen Updates aktiviert sind.

Schritt 4

Um Dich für die Zukunft vor weiteren Infizierungen zu schützen empfehle ich Dir noch ein paar Programme.

SpywareBlaster
Ein Tutorial zur Verwendung findest Du Hier
MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
Hinweis: MBAM ersetzt keine Anti- Viren- Software.
Temp File Cleaner
TFC ist ein wirklich starkes Tool zum entfernen von Temp Dateien vom IE und WIndows, leert den Papierkorb und noch viel mehr.
Ausserdem hilft es Deinen Computer zu beschleunigen.
Du kannst Dir TFC ( by OldTimer ) hier downloaden.
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
Halte Dein System aktuell
Ich kann gar nicht oft genug betonen, wie wichtig es ist, dass der PC auf dem aktuellsten Stand der Dinge ist.
Es werden oft genug Sicherheitslücken in Windows eigenen Anwendungen gefunden. Diese "Löcher" gehören entfernt, weil Angreifer diese womöglich nutzen um unauthorisiert auf Dein System zu zugreifen.
Jeden zweiten Dienstag im Monat ist Update Tag. Besuche bitte dazu die Microsoft Update Seite.
Halte Deine Software aktuell
Der einfachste Weg dafür ist der Secunia Online Software.

Schritt 5

Tipps für sicheres Surfen

Das sind meine Vorschläge.
Verwende einen alternativen Browser statt den IE.
Ich empfehle Mozilla Firefox.

Für Firefox gibt es verschiedenste AddOns um sicher durch das WWW zu kommen.

NoScript
Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
AdblockPlus
Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
Es spart ausserdem Downloadkapazität.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Leftis

08.08.2010 14:24

Alles klar, nocript habe ich mir gleich mal installiert wirklich geniales add on.

Also hiermit möchte ich mich mal herzlich bedanken für die Hilfe und die zahlreichen Tipps!

Wirklich toll das System hier im Forum! Nochmals vielen Dank, werde euch weiterempfehlen! :)

Larusso

08.08.2010 17:46

Froh das wir helfen konnten. :abklatsch:

Dieses Thema scheint erledigt und wird aus den Abos gelöscht. Solltest Du das Thema erneut benötigen, bitte eine PN an mich.

Jeder andere möge bitte einen eigenen Thread starten.

Alle Zeitangaben in WEZ +1. Es ist jetzt 20:03 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130