Trojaner-Board - Male Warebyts bleibt bei Scan stehen

OTL Logfile:

Code:

OTL logfile created on: 06.10.2010 12:04:05 - Run 2

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\Dodge Dakota\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1.014,00 Mb Total Physical Memory | 624,00 Mb Available Physical Memory | 61,00% Memory free

2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 71,04 Gb Total Space | 39,77 Gb Free Space | 55,98% Space Free | Partition Type: NTFS

Drive D: | 72,00 Gb Total Space | 69,02 Gb Free Space | 95,86% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: NAME-E7BC767DA5

Current User Name: Dodge Dakota

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.10.05 21:07:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\OTL.exe

PRC - [2010.08.04 14:55:36 | 000,692,317 | ---- | M] ( ) -- C:\Programme\Samsung\FW LiveUpdate\FWManager.exe

PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2010.04.20 14:26:44 | 000,300,912 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SUPBackGround.exe

PRC - [2010.02.22 11:40:22 | 000,207,504 | ---- | M] (Geek Software GmbH) -- C:\Programme\pdf24\pdf24.exe

PRC - [2009.11.10 04:57:54 | 000,099,896 | R--- | M] (HP) -- C:\WINDOWS\system32\HPSIsvc.exe

PRC - [2009.08.04 17:21:58 | 000,030,264 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\HP\HP UT LEDM\bin\hppusg.exe

PRC - [2009.07.29 13:19:00 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe

PRC - [2009.06.24 10:57:04 | 000,136,704 | ---- | M] (HP) -- C:\Programme\HP\HPLaserJetService\HPLaserJetService.exe

PRC - [2009.02.18 09:28:14 | 000,170,520 | R--- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxext.exe

PRC - [2008.10.20 11:32:54 | 002,768,896 | ---- | M] () -- C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

PRC - [2008.10.06 19:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe

PRC - [2008.09.17 14:25:46 | 000,580,200 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2008.05.21 17:44:30 | 000,299,008 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\MagicKBD\PerformanceManager.exe

PRC - [2008.05.20 21:02:08 | 000,372,736 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Programme\Samsung\MagicKBD\MagicKBD.exe

PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008.04.14 14:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\snmp.exe

PRC - [2007.01.30 12:02:00 | 000,303,104 | ---- | M] (FUJIFILM Corporation) -- C:\Programme\FinePixViewer\QuickDCF2.exe

PRC - [2005.04.30 17:02:26 | 000,086,016 | ---- | M] (B.H.A Corporation) -- C:\WINDOWS\system32\bgsvcgen.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.10.06 07:12:50 | 000,036,865 | ---- | M] () -- C:\WINDOWS\system32\msgvbtjn.dll

MOD - [2010.10.05 21:07:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\OTL.exe

MOD - [2008.09.17 14:19:50 | 000,073,728 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll

MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)

SRV - [2010.05.20 20:57:56 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009.11.10 04:57:54 | 000,099,896 | R--- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPSIsvc.exe -- (HPSIService)

SRV - [2009.07.29 13:19:00 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)

SRV - [2009.06.24 10:57:04 | 000,136,704 | ---- | M] (HP) [Auto | Running] -- C:\Programme\HP\HPLaserJetService\HPLaserJetService.exe -- (HP LaserJet Service)

SRV - [2009.04.21 10:09:00 | 000,282,624 | ---- | M] (Marvell) [Auto | Running] -- C:\WINDOWS\system32\yk51x86.dll -- (yksvc)

SRV - [2009.02.09 13:21:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\nwcwks.dll -- (NWCWorkstation)

SRV - [2008.05.13 09:44:00 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)

SRV - [2008.04.14 14:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\snmp.exe -- (SNMP)

SRV - [2008.04.14 14:00:00 | 000,019,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\tcpsvcs.exe -- (LPDSVC)

SRV - [2005.04.30 17:02:26 | 000,086,016 | ---- | M] (B.H.A Corporation) [Auto | Running] -- C:\WINDOWS\system32\bgsvcgen.exe -- (bgsvcgen)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.10.04 08:11:34 | 000,210,816 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\ndis.sys -- (NDIS)

DRV - [2010.03.25 22:21:01 | 004,753,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2009.10.26 09:01:40 | 000,017,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mvusbews.sys -- (mvusbews)

DRV - [2009.04.21 10:09:00 | 000,297,344 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)

DRV - [2008.10.08 08:35:10 | 001,334,432 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)

DRV - [2008.09.23 22:23:58 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMC326.sys -- (VMC326)

DRV - [2008.08.28 11:18:14 | 000,224,736 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)

DRV - [2008.07.29 17:59:08 | 000,879,832 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)

DRV - [2008.07.29 17:59:02 | 000,156,816 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\btwdndis.sys -- (BTWDNDIS)

DRV - [2008.07.27 01:29:54 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)

DRV - [2008.07.27 01:29:36 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)

DRV - [2008.07.27 01:29:28 | 000,539,640 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)

DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008.02.15 14:12:06 | 005,854,752 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)

DRV - [2006.08.01 16:57:24 | 000,019,840 | ---- | M] (Samsung) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SUE_PD.sys -- (SUEPD)

DRV - [2005.10.27 06:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://wyzo-xtr.asksearch.com/?cfg=2-134-0-1XU12

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://www.google.de/

IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWin1.dll (Conduit Ltd.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.selectedEngine: "Ask"

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {4E378227-BF26-4E52-8F76-D2AB4CD7CBE2}:1.9.1

 

 

FF - HKLM\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.05.04 21:23:20 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\extensions\\{4E378227-BF26-4E52-8F76-D2AB4CD7CBE2}: C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\{4E378227-BF26-4E52-8F76-D2AB4CD7CBE2} [2010.10.04 08:13:15 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.10.06 07:10:10 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.17 07:59:41 | 000,000,000 | ---D | M]

 

[2009.10.17 23:27:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Mozilla\Extensions

[2010.10.06 09:50:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Mozilla\Firefox\Profiles\nucbm7om.default\extensions

[2010.04.27 20:47:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Mozilla\Firefox\Profiles\nucbm7om.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010.10.03 12:30:55 | 000,001,757 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Mozilla\Firefox\Profiles\nucbm7om.default\searchplugins\ask.uk.xml

[2009.10.06 18:10:34 | 000,000,876 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Mozilla\Firefox\Profiles\nucbm7om.default\searchplugins\conduit.xml

[2010.10.06 09:50:44 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2009.11.05 22:46:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2010.04.26 15:42:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.30 09:05:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.02.20 22:18:26 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.02.20 22:18:26 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.02.20 22:18:26 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.02.20 22:18:26 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.02.20 22:18:26 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.10.06 07:55:11 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWin1.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\ShellBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\tbWin1.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\tbWin1.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe ()

O4 - HKLM..\Run: [DMHotKey] C:\Programme\Samsung\Easy Display Manager\DMLoader.exe (SAMSUNG Electronics)

O4 - HKLM..\Run: [edcsjh] C:\WINDOWS\System32\msgvbtjn.DLL ()

O4 - HKLM..\Run: [HPUsageTrackingLEDM] C:\Programme\HP\HP UT LEDM\bin\hppusg.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [MagicKeyboard] C:\Programme\Samsung\MagicKBD\PreMKbd.exe ()

O4 - HKLM..\Run: [Name of App] C:\Programme\SAMSUNG\FW LiveUpdate\FWManager.exe ( )

O4 - HKLM..\Run: [PDFPrint] C:\Programme\pdf24\pdf24.exe (Geek Software GmbH)

O4 - HKLM..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [SUPBackground] C:\Programme\Samsung\Samsung Update Plus\SUPBackGround.exe ()

O4 - HKLM..\Run: [uPc+MV0NaaaXms] C:\WINDOWS\System32\rm0lfj.DLL File not found

O4 - HKLM..\Run: [uPc+MV0NanMCxl] C:\WINDOWS\System32\c4xnhah2.DLL File not found

O4 - HKLM..\Run: [uPc+MV0NaQOaXms] C:\WINDOWS\System32\x5b38fp8mf.DLL File not found

O4 - HKLM..\Run: [uPc+MV0NaTeaXms] C:\WINDOWS\System32\tb6zj56smk.DLL File not found

O4 - HKLM..\Run: [uPc+MV0NKPaXms] C:\WINDOWS\System32\c29p1m.DLL File not found

O4 - HKLM..\Run: [uPc+MV0NLdJsiv] C:\WINDOWS\System32\m42hz.DLL File not found

O4 - HKLM..\Run: [uPc+MV0NrRcaXms] C:\WINDOWS\System32\lxnf51zomh.DLL File not found

O4 - HKCU..\Run: [{FB4D92D4-4C4F-82F6-9E51-0B9852CB7ADB}] C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Wiigg\arlo.exe File not found

O4 - HKCU..\Run: [Mtesusobogis] C:\WINDOWS\rapiapa.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NaaaXms] C:\WINDOWS\System32\rm0lfj.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NanMCxl] C:\WINDOWS\System32\c4xnhah2.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NaQOaXms] C:\WINDOWS\System32\x5b38fp8mf.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NaTeaXms] C:\WINDOWS\System32\tb6zj56smk.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NKPaXms] C:\WINDOWS\System32\c29p1m.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NLdJsiv] C:\WINDOWS\System32\m42hz.DLL File not found

O4 - HKCU..\Run: [uPc+MV0NrRcaXms] C:\WINDOWS\System32\lxnf51zomh.DLL File not found

O4 - HKCU..\Run: [Windows Driver Foundation] C:\WINDOWS\System32\winservice.exe File not found

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ExifLauncher2.lnk = C:\Programme\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKCU Winlogon: Shell - (硅汰牯牥攮數DOWS\S) -  File not found

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.02.12 13:57:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{7f7a26dc-d0b0-11df-beb9-001377f5b1dd}\Shell\AutoRun\command - "" = E:\autorun.exe -- File not found

O33 - MountPoints2\{fa3369ac-8a56-11de-bad0-001377f5b1dd}\Shell\AutoRun\command - "" = E:\autorun.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.10.06 09:11:55 | 000,000,000 | ---D | C] -- C:\_OTL

[2010.10.06 07:59:30 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Dodge Dakota\Recent

[2010.10.06 07:10:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Mozilla

[2010.10.06 07:10:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Mozilla

[2010.10.05 21:38:33 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW

[2010.10.05 21:38:20 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\OTL.exe

[2010.10.05 21:05:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010.10.05 17:20:09 | 000,106,496 | -H-- | C] (Microsoft) -- C:\winservice.exe

[2010.10.05 07:49:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia

[2010.10.05 07:48:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe

[2010.10.04 08:13:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\{4E378227-BF26-4E52-8F76-D2AB4CD7CBE2}

[2010.10.04 08:11:15 | 000,106,496 | -H-- | C] (Microsoft) -- C:\Dokumente und Einstellungen\All Users\Dokumente\winadmin-setup.exe

[2010.10.04 08:11:08 | 000,251,640 | -H-- | C] (Microsoft) -- C:\Dokumente und Einstellungen\Dodge Dakota\Eigene DateienWindows 7 Crack 2010.scr

[2010.10.04 08:03:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dodge Dakota\Eigene Dateien\Firstload Ikarus

[2010.10.03 12:30:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\Radical Software Ltd

[2010.09.30 09:05:16 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010.09.30 09:05:16 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010.09.30 09:05:16 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010.09.23 10:21:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dodge Dakota\Eigene Dateien\Bilder Scheiben Jalousie

[2010.09.19 06:32:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\Ixhygo

[2010.09.07 13:02:45 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Vbox

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.10.06 12:05:26 | 000,841,216 | ---- | M] () -- C:\WINDOWS\System32\drivers\telwww.sys

[2010.10.06 11:55:32 | 000,000,431 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\SamsungLiveUpdateConfig.ini

[2010.10.06 11:54:51 | 000,001,096 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010.10.06 11:54:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.10.06 11:54:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.10.06 11:54:24 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys

[2010.10.06 11:53:31 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\ntuser.ini

[2010.10.06 11:53:30 | 004,980,736 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\ntuser.dat

[2010.10.06 11:39:01 | 000,001,100 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010.10.06 08:36:03 | 001,045,736 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.10.06 08:36:03 | 000,450,442 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.10.06 08:36:03 | 000,433,808 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.10.06 08:36:03 | 000,081,298 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.10.06 08:36:03 | 000,068,572 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.10.06 07:56:50 | 000,026,880 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

[2010.10.06 07:12:54 | 000,000,154 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\401859.BAT

[2010.10.06 07:12:50 | 000,036,865 | ---- | M] () -- C:\WINDOWS\System32\msgvbtjn.dll

[2010.10.05 21:33:32 | 000,132,480 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010.10.05 21:07:56 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\OTL.exe

[2010.10.05 21:00:44 | 003,873,401 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\ComboFix.exe

[2010.10.04 08:31:41 | 000,000,143 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\srsf.bat

[2010.10.04 08:11:34 | 000,210,816 | ---- | M] () -- C:\WINDOWS\System32\drivers\ndis.sys

[2010.10.04 08:11:33 | 000,210,816 | ---- | M] () -- C:\WINDOWS\System32\dllcache\ndis.sys

[2010.10.04 08:11:08 | 000,650,240 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\hotfix.exe

[2010.10.04 08:11:08 | 000,251,640 | -H-- | M] (Microsoft) -- C:\Dokumente und Einstellungen\Dodge Dakota\Eigene DateienWindows 7 Crack 2010.scr

[2010.10.04 08:11:05 | 000,106,496 | -H-- | M] (Microsoft) -- C:\winservice.exe

[2010.10.04 08:11:05 | 000,106,496 | -H-- | M] (Microsoft) -- C:\Dokumente und Einstellungen\All Users\Dokumente\winadmin-setup.exe

[2010.10.02 14:00:21 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.09.30 17:02:20 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\CCleaner.lnk

[2010.09.30 15:02:26 | 000,671,116 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Führerschein.pdf

[2010.09.30 15:00:28 | 000,183,798 | ---- | M] () -- C:\WINDOWS\System32\Wshadingxx.bmp

[2010.09.30 15:00:26 | 000,153,174 | ---- | M] () -- C:\WINDOWS\System32\BShadingxx.bmp

[2010.09.30 15:00:23 | 000,076,614 | ---- | M] () -- C:\WINDOWS\System32\AdcgainDone.bmp

[2010.09.30 15:00:22 | 000,076,614 | ---- | M] () -- C:\WINDOWS\System32\AdcgainBefort.bmp

[2010.09.30 14:58:48 | 000,219,624 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Krankheitsbescheinigung.pdf

[2010.09.30 14:57:05 | 000,044,278 | ---- | M] () -- C:\WINDOWS\System32\Autoler.bmp

[2010.09.30 07:41:14 | 000,001,887 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk

[2010.09.29 10:57:41 | 000,023,567 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Ersatzbescheinigung.pdf

[2010.09.29 07:58:37 | 000,029,128 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Familienversicherung.pdf

[2010.09.28 09:19:08 | 000,115,472 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\AHG-Horb1.pdf

[2010.09.25 09:40:00 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk

[2010.09.24 19:53:48 | 000,640,810 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\AHG-Horb.pdf

[2010.09.23 10:32:25 | 000,035,348 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\.recently-used.xbel

[2010.09.21 07:12:45 | 000,111,607 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Pitts Python 003.jpg

[2010.09.21 07:09:13 | 000,104,062 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Miss Wind.jpg

[2010.09.21 07:02:04 | 000,033,280 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\SiegelRaven25_0.jpg

[2010.09.20 17:37:13 | 005,818,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Geschäftsführer.xcf

[2010.09.07 13:01:07 | 000,000,137 | ---- | M] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\default.rss

[2010.09.07 13:01:03 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

 
 ========== Files Created - No Company Name ==========

 

[2010.10.06 07:12:54 | 000,000,154 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\401859.BAT

[2010.10.06 07:12:50 | 000,036,865 | ---- | C] () -- C:\WINDOWS\System32\msgvbtjn.dll

[2010.10.05 22:12:28 | 003,873,401 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\ComboFix.exe

[2010.10.04 08:12:57 | 000,841,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\telwww.sys

[2010.10.04 08:11:12 | 000,650,240 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\hotfix.exe

[2010.10.04 08:11:12 | 000,000,143 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\srsf.bat

[2010.09.30 15:02:08 | 000,671,116 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Führerschein.pdf

[2010.09.30 14:58:28 | 000,219,624 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Krankheitsbescheinigung.pdf

[2010.09.30 07:41:14 | 000,001,887 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk

[2010.09.29 10:57:57 | 000,023,567 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Ersatzbescheinigung.pdf

[2010.09.29 07:58:49 | 000,029,128 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Familienversicherung.pdf

[2010.09.28 09:19:17 | 000,115,472 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\AHG-Horb1.pdf

[2010.09.28 09:17:41 | 000,640,810 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\AHG-Horb.pdf

[2010.09.23 10:32:25 | 000,035,348 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\.recently-used.xbel

[2010.09.21 07:12:45 | 000,111,607 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Pitts Python 003.jpg

[2010.09.21 07:09:13 | 000,104,062 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Miss Wind.jpg

[2010.09.21 07:02:04 | 000,033,280 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\SiegelRaven25_0.jpg

[2010.09.20 17:37:13 | 005,818,933 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Desktop\Geschäftsführer.xcf

[2010.09.07 13:01:07 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\default.rss

[2010.05.14 12:58:54 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\HP1100SMs.dll

[2010.05.14 12:58:52 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\HP1100LM.DLL

[2010.05.14 11:16:07 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mvusbews.dll

[2010.05.14 11:15:31 | 000,284,160 | ---- | C] () -- C:\WINDOWS\System32\mvhlewsi.DLL

[2010.01.17 23:56:29 | 000,000,431 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\SamsungLiveUpdateConfig.ini

[2010.01.17 21:20:26 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2010.01.17 17:57:38 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\test.dll

[2010.01.16 13:55:35 | 000,002,620 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log

[2009.09.27 08:35:02 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009.09.06 12:38:18 | 000,000,846 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Anwendungsdaten\DriveCalculator Preferences

[2009.08.16 13:24:55 | 000,061,440 | ---- | C] () -- C:\Dokumente und Einstellungen\Dodge Dakota\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.08.14 20:13:25 | 000,156,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\btwdndis.sys

[2009.08.14 20:12:48 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Dodge Dakota_KBD.ini

[2009.04.07 11:13:49 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2009.04.01 10:48:16 | 000,053,478 | ---- | C] () -- C:\WINDOWS\mvtcpui.ini

[2009.02.12 21:35:38 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2009.02.12 21:35:18 | 000,210,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\ndis.sys

[2009.02.12 14:10:08 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\MagicKBD.INI

[2009.02.12 14:10:08 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Besitzer_KBD.ini

[2009.02.12 14:10:05 | 000,003,425 | ---- | C] () -- C:\WINDOWS\System32\KBDR.INI

[2009.02.12 14:10:05 | 000,002,741 | ---- | C] () -- C:\WINDOWS\System32\KBDD.INI

[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDO.INI

[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDC.INI

[2009.02.12 14:10:05 | 000,002,606 | ---- | C] () -- C:\WINDOWS\System32\KBDB.INI

[2009.02.12 14:10:05 | 000,002,236 | ---- | C] () -- C:\WINDOWS\System32\KBDQ.INI

[2009.02.12 14:10:05 | 000,001,956 | ---- | C] () -- C:\WINDOWS\System32\KBDE.INI

[2009.02.12 14:10:05 | 000,001,885 | ---- | C] () -- C:\WINDOWS\System32\KBDP.INI

[2009.02.12 14:10:05 | 000,001,857 | ---- | C] () -- C:\WINDOWS\System32\KBDUU.INI

[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDG.INI

[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDA.INI

[2009.02.12 14:10:05 | 000,001,834 | ---- | C] () -- C:\WINDOWS\System32\KBDU.INI

[2009.02.12 14:10:05 | 000,001,819 | ---- | C] () -- C:\WINDOWS\System32\KBDN.INI

[2009.02.12 14:10:05 | 000,001,699 | ---- | C] () -- C:\WINDOWS\System32\KBDT.INI

[2009.02.12 14:10:05 | 000,001,697 | ---- | C] () -- C:\WINDOWS\System32\KBDV.INI

[2009.02.12 14:10:05 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\KBDS.INI

[2009.02.12 14:10:05 | 000,001,476 | ---- | C] () -- C:\WINDOWS\System32\KBDF.INI

[2009.02.12 14:07:50 | 000,000,135 | R--- | C] () -- C:\WINDOWS\System32\lngEng.ini

[2009.02.12 14:07:50 | 000,000,117 | ---- | C] () -- C:\WINDOWS\System32\lngKor.ini

[2009.02.12 14:04:21 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll

[2009.02.12 14:01:47 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS

[2008.09.17 14:20:08 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll

[2005.02.17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest

[2005.02.17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest

[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

< End of report >

--- --- ---

VT Community Sign in ▼ My account ▼ Sign out Signing out... Languages ▼
VirusTotal's website has changed, we need new translations, do you feel like helping the community?
info@virustotal.com
Sign in to VT Community

Safety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.
email
password
Keep me logged in

Sign in
Signing in, please wait...
Login failed, please try again
Forgot your password? Create an account
Edit my profile
View my profile
Inbox
Virus Total
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 1 VT Community user(s) with a total of 3 reputation credit(s) say(s) this sample is malware.
File name:
cea3ba12fd091564cf1ff366574b424f
Submission date:
2010-10-06 18:49:04 (UTC)
Current status:
finished
Result:
25 /43 (58.1%)

VT Community

malware
Safety score: 0.0%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.06.01 2010.10.06 Trojan/Win32.FakeAv
AntiVir 7.10.12.142 2010.10.06 TR/FakeAV.ijv
Antiy-AVL 2.0.3.7 2010.10.06 -
Authentium 5.2.0.5 2010.10.06 -
Avast 4.8.1351.0 2010.10.06 Win32:Malware-gen
Avast5 5.0.594.0 2010.10.06 Win32:Malware-gen
AVG 9.0.0.851 2010.10.06 Generic19.AKWH
BitDefender 7.2 2010.10.06 -
CAT-QuickHeal 11.00 2010.10.05 -
ClamAV 0.96.2.0-git 2010.10.06 -
Comodo 6303 2010.10.06 -
DrWeb 5.0.2.03300 2010.10.06 Trojan.AVKill.2
Emsisoft 5.0.0.50 2010.10.06 Trojan.Win32.FakeAV!IK
eSafe 7.0.17.0 2010.10.06 Win32.FakeAV
eTrust-Vet 36.1.7895 2010.10.06 Win32/FakeAV.PZC
F-Prot 4.6.2.117 2010.10.06 -
F-Secure 9.0.15370.0 2010.10.06 Rogue:W32/FakeAv.C
Fortinet 4.2.249.0 2010.10.06 -
GData 21 2010.10.06 Win32:Malware-gen
Ikarus T3.1.1.90.0 2010.10.06 Trojan.Win32.FakeAV
Jiangmin 13.0.900 2010.10.06 -
K7AntiVirus 9.63.2689 2010.10.06 -
Kaspersky 7.0.0.125 2010.10.06 Trojan.Win32.FakeAv.ijv
McAfee 5.400.0.1158 2010.10.06 Artemis!CEA3BA12FD09
McAfee-GW-Edition 2010.1C 2010.10.06 Artemis!CEA3BA12FD09
Microsoft 1.6201 2010.10.06 Rogue:Win32/FakePAV
NOD32 5510 2010.10.06 a variant of Win32/TrojanDownloader.FakeAlert.BFA
Norman 6.06.07 2010.10.05 -
nProtect 2010-10-06.02 2010.10.06 -
Panda 10.0.2.7 2010.10.06 Trj/CI.A
PCTools 7.0.3.5 2010.10.02 -
Prevx 3.0 2010.10.06 -
Rising 22.67.02.07 2010.09.30 -
Sophos 4.58.0 2010.10.06 Mal/FakeAV-FO
Sunbelt 6998 2010.10.06 Trojan.Win32.Generic.pak!cobra
SUPERAntiSpyware 4.40.0.1006 2010.10.06 Trojan.Agent/Gen-Frauder
Symantec 20101.2.0.161 2010.10.06 Trojan.FakeAV
TheHacker 6.7.0.1.050 2010.10.06 Trojan/FakeAv.ijy
TrendMicro 9.120.0.1004 2010.10.06 TROJ_FAKEAV.BLT
TrendMicro-HouseCall 9.120.0.1004 2010.10.06 TROJ_FAKEAV.BLT
VBA32 3.12.14.1 2010.10.06 -
ViRobot 2010.10.4.4074 2010.10.06 -
VirusBuster 12.67.6.0 2010.10.06 -
Additional information
Show all
MD5 : cea3ba12fd091564cf1ff366574b424f
SHA1 : ff223688d79923838c543860cb07c6318f525fbb
SHA256: 1a65ebe6900f06f8e572cadb1e65e3509c720f729c640800c206cd1edf8cc411
ssdeep: 12288:WKMsow4pHi9EmdyCMTl4Mny46RJxT68yDeCLnFdiytwHfmZB0og8FH:Ewd8iMnCLeSCbr
5B68FH
File size : 650240 bytes
First seen: 2010-10-03 16:59:00
Last seen : 2010-10-06 18:49:04
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
UPX compressed Win32 Executable (38.5%)
Win32 EXE Yoda's Crypter (33.4%)
Win32 Executable Generic (10.7%)
Win32 Dynamic Link Library (generic) (9.5%)
Win16/32 Executable Delphi generic (2.6%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
packers (F-Prot): UPX
packers (Kaspersky): UPX
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x3A8940
timedatestamp....: 0x4CA859A5 (Sun Oct 03 10:23:33 2010)
machinetype......: 0x14C (Intel I386)

[[ 3 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
UPX0, 0x1000, 0x30F000, 0x0, 0.0, d41d8cd98f00b204e9800998ecf8427e
UPX1, 0x310000, 0x99000, 0x98C00, 7.93, 537c78e2cef529e38dbd70243605a490
.rsrc, 0x3A9000, 0x6000, 0x5C00, 5.6, 8c6561674721ccdad37bb4e51bd0fa5f

[[ 13 import(s) ]]
advapi32.dll: RegCloseKey
comctl32.dll: ImageList_Add
gdi32.dll: SaveDC
kernel32.dll: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
msimg32.dll: AlphaBlend
ole32.dll: OleDraw
oleaut32.dll: VariantCopy
shell32.dll: Shell_NotifyIconW
urlmon.dll: URLDownloadToFileA
user32.dll: GetDC
version.dll: VerQueryValueW
winmm.dll: timeGetTime
winspool.drv: OpenPrinterW
ExifTool:
file metadata
CodeSize: 626688
EntryPoint: 0x3a8940
FileSize: 635 kB
FileType: Win32 EXE
ImageVersion: 0.0
InitializedDataSize: 24576
LinkerVersion: 2.25
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 5.0
PEType: PE32
Subsystem: Windows GUI
SubsystemVersion: 5.0
TimeStamp: 2010:10:03 12:23:33+02:00
UninitializedDataSize: 3207168
Symantec reputation:Suspicious.Insight

VT Community

1

User:
jeje
Reputation:
3 credits
Comment date:
2010-10-03 17:15:26 (UTC)
fake AV
Tags: Malware, fakeav

Was this comment helpful? Yes (0) | No (0) | Report abuse Reported as abuseful

User:
jeje
Reputation:
3 credits
Comment date:
2010-10-03 17:15:26 (UTC)
fake AV
Tags: Malware, fakeav

Was this comment helpful? Yes (0) | No (0) | Report abuse Reported as abuseful
Loading...

Prev1Next

Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
You can add basic styles to your comments using the following accepted bbcode tags:

text -- bold
text -- italics
text -- underline
~~text~~ -- strikethrough

Code:

text

- preformatted text

You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.

Goodware
Malware
Spam attachment/link

P2P download
Propagating via IM
Network worm

Drive-by-download

Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.
Preview comment Edit comment
Post comment
Posting comment...
Comment successfully posted

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com - Terms of Service & Privacy Policy