Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   TR/Pincav.afyp Trojan (https://www.trojaner-board.de/92522-tr-pincav-afyp-trojan.html)

kiki82 04.11.2010 19:59
TR/Pincav.afyp Trojan
 
Hallo ins Forum,

ich komme bei der Trojaner-Beseitigung nicht mehr weiter und bitte um Eure Hilfe.

Antivir hatte diese Trojaner gemeldet: TR/Pincav.afyp Trojan, TR/Crypt.XPACK.Gen 3 Trojan. Die Dateien habe ich danach sofort in Quarantäne verschoben.

Malware meldet nun, dass keine Dateien mehr infiziert seien. Dennoch taucht die Warnung TR/Crypt.XPACK.Gen 3 Trojan immer wieder auf und mein Rechner fährt langsamer hoch als sonst.


Viele Grüße,
kiki

cosinus 04.11.2010 21:45
Zitat:
Antivir hatte diese Trojaner gemeldet: TR/Pincav.afyp Trojan, TR/Crypt.XPACK.Gen 3 Trojan. Die Dateien habe ich danach sofort in Quarantäne verschoben.
Immer die genauen Schädlingsnamen und Pfadangaben notieren und posten!

Aus den Regeln:

5. Beschreibe Dein Problem in einigen Sätzen und arbeite diese Anleitung ab Punkt 2. durch
Auch Funde von deiner Sicherheitssoftware bitte im Thema nennen: (z.B. c:\windows\virus.exe)
Fehlen diese Angaben, kann und wird dir hier niemand helfen.

kiki82 04.11.2010 22:21
Hallo Arne,

die Liste an infizierten Dateien ist leider sehr lang und beunruhigt mich sehr. Vor zwei Wochen sowie Ende Juli meldete AntiVir folgende Funde:

TR/Crypt.XPACK.Gen 3 Trojan:
- C:\Dokumente und Einstellungen\...\sipovo566[1].exe
- C:\Dokumente und Einstellungen\Kirsten\907205.exe
- C:\Dokumente und Einstellungen\Kirsten\mhzb.exe

TR/Crypt.XPACK.Gen 2 Trojan:
- C:\Dokumente und Einstellungen\Kirsten\3391.exe
- C:\Dokumente und Einstellungen\Kirsten\bear315[1].exe
- C:\Dokumente und Einstellungen\Kirsten\376742.exe
- C:\Dokumente und Einstellungen\Kirsten\L...\172.exe
- C:\Dokumente und Einstellungen\Kirsten\...\sbeb.exe
- C:\Dokumente und Einstellungen\Kirsten\...\national48[1].exe
- C:\Dokumente und Einstellungen\Kirsten\L...\252.exe

BDS/Oserdi.aev:
- C:\Dokumente und Einstellungen\lasvegas106[1].exe
- C:\Dokumente und Einstellungen\Kirsten\L...\085.exe

TR/Pincav.afyp Trojan:
- C:\Dokumente und Einstellungen\Kirsten\...\6301.exe
- C:\Dokumente und Einstellungen\Kirsten\...\116[1].exe
- C:\Dokumente und Einstellungen\Kirsten\ibisov.exe

Alle entsprechenden Dateien hatte ich damals gleich in Quarantäne verschoben. Malwarebytes und AntiVir melden zwar keine infizierten Dateien mehr, doch habe ich gelesen, dass dies nicht unbedingt bedeuten muss, dass mein Rechner nicht mehr kontaminiert ist.
Kannst Du mir weiterhelfen?
Wie kann ich nun sichergehen, dass alle Trojaner entfernt wurden?

Viele Grüße,
kiki

cosinus 04.11.2010 22:26
Poste bitte auch alle Logs von Malwarebytes. Die findest Du im Programm im Reiter Logdateien.

kiki82 04.11.2010 22:54
Hallo Arne,

okay, dies ist der letzte log von Malwarebytes:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4181

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

04.11.2010 20:54:03
mbam-log-2010-11-04 (20-54-03).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 204585
Laufzeit: 1 Stunde(n), 14 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Viele Grüße,
Kirsten

kiki82 04.11.2010 22:57
Ich habe heute auf hijackthis.de auch mein OTL-logfile analysieren lassen. Dieser stufte folgende Dateien als schädlich ein, die ich darauhin gelöscht habe:

[2010.10.20 15:36:41 | 000,066,560 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll

[2010.10.20 15:36:41 | 000,043,520 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\licmgr10.dll

2010.10.20 15:36:41 | 000,025,600 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll

[2010.10.20 15:36:40 | 000,602,112 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll

[2010.10.20 15:36:40 | 000,184,320 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll

[2010.10.20 15:36:40 | 000,055,296 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll

[2010.10.20 15:36:39 | 000,611,840 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll

[2010.10.20 15:36:38 | 000,916,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll

2010.10.20 15:36:38 | 000,206,848 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll

[2010.10.20 15:36:37 | 001,986,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll

2010.10.20 15:36:37 | 001,469,440 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl

2010.10.20 15:36:36 | 000,743,424 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll

2010.10.20 15:36:36 | 000,173,056 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe

2010.10.20 15:36:35 | 000,387,584 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll

[2010.10.20 15:36:33 | 011,080,192 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll

[2010.10.20 15:36:24 | 000,954,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40.dll

2010.10.20 15:36:24 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll

[2010.10.20 15:36:13 | 000,617,472 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll

[2010.10.20 15:32:47 | 000,590,848 | ---- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcrt4.dll

die Datei [2010.10.20 15:36:36 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe konnte ich nicht löschen.

Viele Grüße,
kiki

cosinus 05.11.2010 01:04
Zitat:
Ich habe heute auf hijackthis.de auch mein OTL-logfile analysieren lassen. Dieser stufte folgende Dateien als schädlich ein, die ich darauhin gelöscht habe:
Was machst Du denn da?? :wtf:
Hijackthis.de ist nur zur Auswertung von HJT-Logs, seit wann soll man da OTL-Logs auswerten können?!
Und warum löscht Du gleich ohne das abzuklären naiv Dateien, die automatische Auswertung hat immer ihre Macken! :balla:

Zitat:
Datenbank Version: 4181
Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.

kiki82 05.11.2010 17:13
Hallo Arne,

das ist dann das Resultat eines Laien, der versucht sich selbst zu helfen:((
Ich kenne mich leider absolut nicht aus und mir konnte auch im Freundeskreis niemand weiterhelfen.

Okay, dann lade ich die neue Version von Malwarebytes herunter & führe den Vollscan durch.

Hoffe, Du hast etwas Geduld und kannst mir helfen..Ich bin Dir für jeden Rat so dankbar!

Viele Grüße,
kiki

kiki82 05.11.2010 19:36
Hallo Arne,

nach dem Update von Malwarebytes habe ich den Vollscan durchgeführt (s.u.).
Es wurde der Schädling "Worm.Palevo" entdeckt und "HKEY_LOCAL_MACHINE/SOFTWARE/Micr" als infiziertes Objekt gemeldet, das ich nach den Anweisungen auf trojanerboard entfernt habe.


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

05.11.2010 19:19:46
mbam-log-2010-11-05 (19-19-46).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 221370
Laufzeit: 1 Stunde(n), 39 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Worm.Palevo) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Viele Grüße,
kiki

cosinus 06.11.2010 15:18
Poste auch die Logs von OTL

kiki82 06.11.2010 15:54
Anbei das aktuelle Logfile von OTL:

OTL Code:OTL Logfile:
Code:
OTL logfile created on: 06.11.2010 15:39:00 - Run 4
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.015,00 Mb Total Physical Memory | 359,00 Mb Available Physical Memory | 35,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 112,99 Gb Free Space | 75,81% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PC295313555299
Current User Name: Kirsten
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\starter4g.exe (4G Systems GmbH & Co. KG)
PRC - C:\WINDOWS\service4g.exe (4G Systems GmbH & Co. KG)
PRC - C:\Programme\XSManager\XSManager.exe (WebToGo Mobiles Internet GmbH)
PRC - C:\Programme\XSManager\WTGService.exe ()
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Skype\Toolbars\Shared\SkypeNames2.exe (Skype Technologies S.A.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Hewlett-Packard\HP QuickSync\QuickSync.exe (Hewlett-Packard)
PRC - C:\Programme\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\HP\HPBTWD.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (XS Stick Service) -- C:\WINDOWS\service4g.exe (4G Systems GmbH & Co. KG)
SRV - (WTGService) -- C:\Programme\XSManager\WTGService.exe ()
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (STacSV) -- c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
SRV - (GameConsoleService) -- C:\Programme\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBCCID) -- C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) -- C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys File not found
DRV - (cmnsusbser) -- C:\WINDOWS\system32\drivers\cmnsusbser.sys (Mobile Connector)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (SysCow) -- C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (iaStor) -- C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (SaibVd32) -- C:\WINDOWS\system32\drivers\SaibVd32.sys (Sonic Solutions)
DRV - (SahdIa32) -- C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions)
DRV - (SaibIa32) -- C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (RSUSBSTOR) -- C:\WINDOWS\system32\drivers\RTS5121.sys (Realtek Semiconductor Corp.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.10.29 11:52:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.10.29 11:52:48 | 000,000,000 | ---D | M]
 
[2010.02.23 16:16:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Extensions
[2010.11.05 19:25:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions
[2010.06.26 12:36:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.29 12:22:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\zotero@chnm.gmu.edu
[2010.11.05 19:25:41 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.01 22:25:36 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.10.21 20:28:02 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.21 20:28:02 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.21 20:28:03 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.21 20:28:03 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.21 20:28:03 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.04.15 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HP] C:\Programme\Hewlett-Packard\HP QuickSync\QuickSync.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP BTW Detect Program] C:\Programme\HP\HPBTWD.exe ()
O4 - HKLM..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe File not found
O4 - HKLM..\Run: [starter4g] C:\WINDOWS\starter4g.exe (4G Systems GmbH & Co. KG)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &AOL Toolbar-Suche - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AOL\ieToolbar\resources\de-DE\local\search.html ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Firestorm High.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Firestorm High.bmp
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\AutoRun\command - "" = D:\MEGA\\sudbina.exe -- File not found
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\explore\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\open\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\AutoRun\command - "" = D:\
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\explore\command - "" = D:\
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\open\command - "" = D:\
O33 - MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\Shell - "" = AutoRun
O33 - MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\Shell\AutoRun\command - "" = D:\autorun.exe -- File not found
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\AutoRun\command - "" = D:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\explore\command - "" = D:\sejo\kalac.exe -- File not found
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\open\command - "" = D:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\Shell - "" = AutoRun
O33 - MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\Shell\AutoRun\command - "" = D:\StartVMCLite.exe -- File not found
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\AutoRun\command - "" = E:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\explore\command - "" = E:\sejo\kalac.exe -- File not found
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\open\command - "" = E:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\AutoRun\command - "" = D:\mirk\okitab.exe -- File not found
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\explore\command - "" = D:\mirk\\okitab.exe -- File not found
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\open\command - "" = D:\mirk\\okitab.exe -- File not found
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\AutoRun\command - "" = D:\MEGA\\sudbina.exe -- File not found
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\explore\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\open\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.06 13:50:59 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010.11.05 17:33:21 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.05 17:06:07 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll
[2010.11.05 17:06:06 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010.11.05 17:06:06 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll
[2010.11.05 17:06:06 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll
[2010.11.05 17:06:05 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll
[2010.11.05 17:06:05 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010.11.05 17:06:04 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll
[2010.11.05 17:06:02 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll
[2010.11.05 17:06:01 | 000,916,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll
[2010.11.05 17:05:59 | 001,986,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
[2010.11.05 17:05:59 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010.11.05 17:05:59 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe
[2010.11.05 17:05:59 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2010.11.05 17:05:57 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2010.11.05 17:05:56 | 011,080,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
[2010.11.03 18:14:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\updater4g
[2010.11.03 18:12:16 | 000,312,488 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\WINDOWS\updater4g.exe
[2010.11.03 18:12:16 | 000,160,424 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\WINDOWS\starter4g.exe
[2010.11.03 18:12:16 | 000,145,064 | R--- | C] (4G Systems GmbH & Co. KG) -- C:\WINDOWS\service4g.exe
[2010.11.03 18:12:15 | 000,118,272 | ---- | C] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_seramd.sys
[2010.11.03 18:12:15 | 000,103,424 | ---- | C] (Mobile Connector) -- C:\WINDOWS\System32\drivers\cmnsusbser.sys
[2010.11.03 18:12:15 | 000,052,128 | ---- | C] (Siano) -- C:\WINDOWS\System32\drivers\smsbda.sys
[2010.11.03 18:12:14 | 000,133,120 | ---- | C] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_netamd.sys
[2010.11.03 18:12:14 | 000,112,640 | ---- | C] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_net32.sys
[2010.11.03 18:12:14 | 000,103,680 | ---- | C] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_ser32.sys
[2010.11.03 18:12:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\XSManager
[2010.11.03 18:12:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\XSManager
[2010.11.03 18:11:59 | 000,000,000 | ---D | C] -- C:\Programme\XSManager
[2010.10.25 13:31:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Desktop\68er international
[2010.10.20 15:36:41 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll
[2010.10.20 15:36:41 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll
[2010.10.20 15:36:40 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll
[2010.10.20 15:36:40 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll
[2010.10.20 15:36:40 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll
[2010.10.20 15:36:39 | 005,957,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2010.10.20 15:36:39 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll
[2010.10.20 15:36:37 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl
[2010.10.20 15:36:37 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2010.10.20 15:36:37 | 001,210,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll
[2010.10.20 15:36:35 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll
[2010.10.20 15:36:24 | 000,954,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc40.dll
[2010.10.20 15:36:24 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc40u.dll
[2010.10.20 15:36:23 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mfc42.dll
[2010.01.26 15:15:44 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010.01.26 15:15:40 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.06 15:44:43 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2010.11.06 14:38:03 | 003,670,016 | -H-- | M] () -- C:\Dokumente und Einstellungen\Kirsten\NTUSER.DAT
[2010.11.06 13:49:04 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.11.06 13:48:59 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.11.06 13:48:57 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
[2010.11.05 23:23:36 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Kirsten\ntuser.ini
[2010.11.05 17:33:24 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.04 21:44:50 | 000,059,904 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\PaperGenerationsofChange20101103.doc
[2010.11.03 19:26:25 | 000,014,336 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\zug.trojaner.doc
[2010.11.03 18:12:05 | 000,001,554 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\XSManager.lnk
[2010.11.03 18:12:01 | 000,103,424 | ---- | M] (Mobile Connector) -- C:\WINDOWS\System32\drivers\cmnsusbser.sys
[2010.11.03 18:12:00 | 000,118,272 | ---- | M] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_seramd.sys
[2010.11.03 18:12:00 | 000,103,680 | ---- | M] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_ser32.sys
[2010.11.03 18:12:00 | 000,101,056 | ---- | M] () -- C:\WINDOWS\System32\drivers\dvb_nova_12mhz_b0.inp
[2010.11.03 18:12:00 | 000,092,456 | ---- | M] () -- C:\WINDOWS\System32\drivers\isdbt_nova_12mhz_b0.inp
[2010.11.03 18:12:00 | 000,079,036 | ---- | M] () -- C:\WINDOWS\System32\drivers\tdmb_nova_12mhz_b0.inp
[2010.11.03 18:12:00 | 000,052,128 | ---- | M] (Siano) -- C:\WINDOWS\System32\drivers\smsbda.sys
[2010.11.03 18:12:00 | 000,000,040 | ---- | M] () -- C:\WINDOWS\System32\drivers\smsbda.cfg
[2010.11.03 18:11:59 | 000,133,120 | ---- | M] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_netamd.sys
[2010.11.03 18:11:59 | 000,112,640 | ---- | M] (C-motech Co.,Ltd.) -- C:\WINDOWS\System32\drivers\cm_net32.sys
[2010.11.02 20:57:04 | 000,026,112 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\PresentationBielefeld.doc
[2010.11.02 19:52:43 | 000,011,264 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GliederungNov2010.doc
[2010.11.02 19:00:50 | 000,027,136 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\nie ma zycia bez swobody.125-138.doc
[2010.11.01 17:58:02 | 001,042,050 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.11.01 17:58:02 | 000,448,396 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.11.01 17:58:02 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.11.01 17:58:02 | 000,080,092 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.11.01 17:58:02 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.11.01 16:05:49 | 000,015,872 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Todo.doc
[2010.11.01 15:38:57 | 000,055,296 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\PaperGenerationsofChange20101028.doc
[2010.11.01 14:34:01 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt 1.doc
[2010.11.01 11:46:50 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.10.29 12:27:26 | 000,051,712 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GrakoTagung2011_2010-10-29.doc
[2010.10.29 12:00:15 | 000,014,336 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\mails.doc
[2010.10.26 16:14:39 | 008,488,190 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\conf_generations_of_change_full_programme.pdf
[2010.10.22 10:36:52 | 000,011,776 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Lit.1968_1989.doc
[2010.10.20 18:29:20 | 000,212,880 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.10.20 16:05:00 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.10.15 14:52:03 | 000,054,272 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Bericht_AuslandsaufenthaltKG.doc
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.03 21:16:41 | 000,059,904 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\PaperGenerationsofChange20101103.doc
[2010.11.03 19:26:20 | 000,014,336 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\zug.trojaner.doc
[2010.11.03 18:12:14 | 000,000,040 | ---- | C] () -- C:\WINDOWS\System32\drivers\smsbda.cfg
[2010.11.03 18:12:13 | 000,101,056 | ---- | C] () -- C:\WINDOWS\System32\drivers\dvb_nova_12mhz_b0.inp
[2010.11.03 18:12:13 | 000,092,456 | ---- | C] () -- C:\WINDOWS\System32\drivers\isdbt_nova_12mhz_b0.inp
[2010.11.03 18:12:13 | 000,079,036 | ---- | C] () -- C:\WINDOWS\System32\drivers\tdmb_nova_12mhz_b0.inp
[2010.11.03 18:12:05 | 000,001,554 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\XSManager.lnk
[2010.11.02 16:51:01 | 000,011,264 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GliederungNov2010.doc
[2010.11.01 16:35:47 | 000,027,136 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\nie ma zycia bez swobody.125-138.doc
[2010.11.01 14:33:59 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt 1.doc
[2010.10.29 12:24:51 | 000,051,712 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GrakoTagung2011_2010-10-29.doc
[2010.10.29 12:00:12 | 000,014,336 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\mails.doc
[2010.10.28 14:08:54 | 000,055,296 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\PaperGenerationsofChange20101028.doc
[2010.10.27 14:01:18 | 000,026,112 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\PresentationBielefeld.doc
[2010.10.26 16:14:38 | 008,488,190 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\conf_generations_of_change_full_programme.pdf
[2010.10.25 12:36:21 | 000,015,872 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Todo.doc
[2010.10.22 10:36:50 | 000,011,776 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Lit.1968_1989.doc
[2010.10.13 16:38:20 | 000,054,272 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Bericht_AuslandsaufenthaltKG.doc
[2010.01.26 15:15:44 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010.01.26 15:15:44 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010.01.26 15:15:43 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009.08.24 09:59:13 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.08.24 09:18:29 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.04.11 00:27:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
< End of report >
--- --- ---

Viele Grüße,
kiki

cosinus 06.11.2010 17:16
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\AutoRun\command - "" = D:\MEGA\\sudbina.exe -- File not found
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\explore\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O33 - MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\Shell\open\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\AutoRun\command - "" = D:\
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\explore\command - "" = D:\
O33 - MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\Shell\open\command - "" = D:\
O33 - MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\Shell - "" = AutoRun
O33 - MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\Shell\AutoRun\command - "" = D:\autorun.exe -- File not found
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\AutoRun\command - "" = D:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\explore\command - "" = D:\sejo\kalac.exe -- File not found
O33 - MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\Shell\open\command - "" = D:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\Shell - "" = AutoRun
O33 - MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\Shell\AutoRun\command - "" = D:\StartVMCLite.exe -- File not found
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\AutoRun\command - "" = E:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\explore\command - "" = E:\sejo\kalac.exe -- File not found
O33 - MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\Shell\open\command - "" = E:\sejo\\kalac.exe -- File not found
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\AutoRun\command - "" = D:\mirk\okitab.exe -- File not found
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\explore\command - "" = D:\mirk\\okitab.exe -- File not found
O33 - MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\Shell\open\command - "" = D:\mirk\\okitab.exe -- File not found
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\AutoRun\command - "" = D:\MEGA\\sudbina.exe -- File not found
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\explore\command - "" = D:\MEGA\\\sudbina.exe -- File not found
O33 - MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\Shell\open\command - "" = D:\MEGA\\\sudbina.exe -- File not found
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

kiki82 06.11.2010 18:05
Okay, habe ich wie beschrieben ausgeführt. Der Rechner wurde dabei neu gestartet.

OTL-Code:
All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
File D:\MEGA\\sudbina.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
File D:\MEGA\\\sudbina.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{101e8cee-0cac-11df-b30c-18a905d08df5}\ not found.
File D:\MEGA\\\sudbina.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
File D:\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
File D:\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50645265-7d58-11df-b3ef-18a905d08df5}\ not found.
File D:\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{517b0981-e76c-11df-b918-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{517b0981-e76c-11df-b918-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{517b0981-e76c-11df-b918-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{517b0981-e76c-11df-b918-18a905d08df5}\ not found.
File D:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
File D:\sejo\\kalac.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
File D:\sejo\kalac.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{521473cd-22f2-11df-aea7-18a905d08df5}\ not found.
File D:\sejo\\kalac.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6cd74f66-c0a3-11df-91a1-18a905d08df5}\ not found.
File D:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
File E:\sejo\\kalac.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
File E:\sejo\kalac.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e075226a-9e3a-11df-866a-18a905d08df5}\ not found.
File E:\sejo\\kalac.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
File D:\mirk\okitab.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
File D:\mirk\\okitab.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eadbb968-4d1d-11df-bac6-18a905d08df5}\ not found.
File D:\mirk\\okitab.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
File D:\MEGA\\sudbina.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
File D:\MEGA\\\sudbina.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efeee0fe-d85b-11df-b4c4-18a905d08df5}\ not found.
File D:\MEGA\\\sudbina.exe not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 321 bytes

User: Kirsten
->Temp folder emptied: 2639093 bytes
->Temporary Internet Files folder emptied: 24261607 bytes
->Java cache emptied: 458450 bytes
->FireFox cache emptied: 103624890 bytes
->Flash cache emptied: 15104 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3403499 bytes
RecycleBin emptied: 372116165 bytes

Total Files Cleaned = 483,00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 11062010_173917

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Viele Grüße,
kiki

cosinus 06.11.2010 18:37
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

kiki82 08.11.2010 18:11
Hallo Arne,

Danke für die Anweisungen; ich habe nun CCleaner sowie Combofix ausgeführt.

Dies ist die Meldung von combofix:

Combofix Logfile:
Code:
ComboFix 10-11-07.01 - Kirsten 08.11.2010  17:37:51.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1015.491 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Kirsten\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((  Dateien erstellt von 2010-10-08 bis 2010-11-08  ))))))))))))))))))))))))))))))
.

2010-11-08 16:14 . 2010-11-08 16:14        --------        d-----w-        c:\programme\CCleaner
2010-11-08 16:12 . 2010-11-08 16:14        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\Temp
2010-11-08 16:12 . 2010-11-08 16:12        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
2010-11-08 16:12 . 2010-11-08 16:17        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\Google
2010-11-08 16:12 . 2010-11-08 16:14        --------        d-----w-        c:\programme\Google
2010-11-06 16:39 . 2010-11-06 16:39        --------        d-----w-        C:\_OTL
2010-11-05 16:33 . 2010-04-29 11:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-05 16:06 . 2010-09-10 05:47        25600        ------w-        c:\windows\system32\dllcache\jsproxy.dll
2010-11-05 16:06 . 2010-09-10 05:47        66560        ------w-        c:\windows\system32\dllcache\mshtmled.dll
2010-11-05 16:06 . 2010-09-10 05:47        602112        ------w-        c:\windows\system32\dllcache\msfeeds.dll
2010-11-05 16:06 . 2010-09-10 05:47        43520        ------w-        c:\windows\system32\dllcache\licmgr10.dll
2010-11-05 16:06 . 2010-09-10 05:47        55296        ------w-        c:\windows\system32\dllcache\msfeedsbs.dll
2010-11-05 16:06 . 2010-09-10 05:47        184320        ------w-        c:\windows\system32\dllcache\iepeers.dll
2010-11-05 16:06 . 2010-09-10 05:47        611840        ------w-        c:\windows\system32\dllcache\mstime.dll
2010-11-05 16:06 . 2010-09-10 05:47        206848        ------w-        c:\windows\system32\dllcache\occache.dll
2010-11-05 16:06 . 2010-09-10 05:47        916480        ------w-        c:\windows\system32\dllcache\wininet.dll
2010-11-05 16:05 . 2010-09-10 05:47        1986560        ------w-        c:\windows\system32\dllcache\iertutil.dll
2010-11-05 16:05 . 2010-09-10 05:47        743424        ------w-        c:\windows\system32\dllcache\iedvtool.dll
2010-11-05 16:05 . 2010-08-26 12:22        173056        ------w-        c:\windows\system32\dllcache\ie4uinit.exe
2010-11-05 16:05 . 2010-09-10 05:47        387584        ------w-        c:\windows\system32\dllcache\iedkcs32.dll
2010-11-05 16:05 . 2010-09-10 05:47        11080192        ------w-        c:\windows\system32\dllcache\ieframe.dll
2010-11-03 17:14 . 2010-11-03 17:14        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\updater4g
2010-11-03 17:12 . 2010-04-30 11:24        312488        ----a-r-        c:\windows\updater4g.exe
2010-11-03 17:12 . 2010-04-30 11:24        160424        ----a-r-        c:\windows\starter4g.exe
2010-11-03 17:12 . 2010-04-30 11:24        145064        ----a-r-        c:\windows\service4g.exe
2010-11-03 17:12 . 2010-11-03 17:12        103424        ----a-w-        c:\windows\system32\drivers\cmnsusbser.sys
2010-11-03 17:12 . 2010-11-03 17:12        52128        ----a-w-        c:\windows\system32\drivers\smsbda.sys
2010-11-03 17:12 . 2010-11-03 17:12        118272        ----a-w-        c:\windows\system32\drivers\cm_seramd.sys
2010-11-03 17:12 . 2010-11-03 17:12        103680        ----a-w-        c:\windows\system32\drivers\cm_ser32.sys
2010-11-03 17:12 . 2010-11-03 17:11        133120        ----a-w-        c:\windows\system32\drivers\cm_netamd.sys
2010-11-03 17:12 . 2010-11-03 17:11        112640        ----a-w-        c:\windows\system32\drivers\cm_net32.sys
2010-11-03 17:12 . 2010-11-04 09:15        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\XSManager
2010-11-03 17:12 . 2010-11-03 17:12        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\XSManager
2010-11-03 17:11 . 2010-11-03 17:12        --------        d-----w-        c:\programme\XSManager
2010-10-20 14:32 . 2010-08-16 08:44        590848        ----a-w-        c:\windows\system32\rpcrt4.dll

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 10:22 . 2010-09-18 10:22        974848        ----a-w-        c:\windows\system32\mfc42u.dll
2010-09-01 11:50 . 2010-09-01 11:50        285824        ----a-w-        c:\windows\system32\atmfd.dll
2010-09-01 07:54 . 2010-09-01 07:54        1852928        ----a-w-        c:\windows\system32\win32k.sys
2010-08-27 08:01 . 2010-08-27 08:01        119808        ----a-w-        c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2010-08-27 05:57        99840        ----a-w-        c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-08-27 01:43        5632        ------w-        c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2010-08-26 13:39        357248        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-08-17 13:17 . 2010-08-17 13:17        58880        ----a-w-        c:\windows\system32\spoolsv.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2010-02-22 26101032]
"ISUSPM"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"HP BTW Detect Program"="c:\programme\HP\HPBTWD.exe" [2009-03-30 319488]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"SysTrayApp"="c:\programme\IDT\WDM\sttray.exe" [2009-06-29 458844]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"WirelessAssistant"="c:\programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-01-11 246504]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"starter4g"="c:\windows\starter4g.exe" [2010-04-30 160424]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\dokumente und einstellungen\Kirsten\Startmen\Programme\Autostart\
OpenOffice.org 3.2.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [24.08.2009 09:34 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [24.08.2009 09:34 15856]
R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [01.07.2009 22:10 103792]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [24.08.2009 09:34 25584]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [02.06.2009 18:05 457200]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programme\Avira\AntiVir Desktop\sched.exe [27.02.2010 21:46 108289]
R2 BOTService;BOTService;c:\programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe [09.07.2009 03:08 199152]
R2 WTGService;WTGService;c:\programme\XSManager\WTGService.exe [03.11.2010 18:12 329168]
R2 XS Stick Service;XS Stick Service;c:\windows\service4g.exe [03.11.2010 18:12 145064]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [24.08.2009 09:21 113664]
R3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\drivers\cmnsusbser.sys [03.11.2010 18:12 103424]
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [31.03.2009 21:11 39424]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [08.11.2010 17:12 136176]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [24.08.2009 09:19 160256]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - GUPDATE
.
Inhalt des "geplante Tasks" Ordners

2010-11-08 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\programme\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]

2010-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-11-08 16:12]

2010-11-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-11-08 16:12]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE: &AOL Toolbar-Suche - c:\dokumente und einstellungen\All Users\Anwendungsdaten\AOL\ieToolbar\resources\de-DE\local\search.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: {54E894E4-FF1D-4357-861C-F6D8943BD593} = 10.74.83.22 193.254.160.1
FF - ProfilePath - c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\
FF - component: c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-11-08 17:48
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'explorer.exe'(1320)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2010-11-08  17:59:03
ComboFix-quarantined-files.txt  2010-11-08 16:58

Vor Suchlauf: 10 Verzeichnis(se), 120.999.079.936 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 121.053.200.384 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 5E2D80711CA5204740DF60AE8F26C1F4
--- --- ---


Viele Grüße,
kiki

kiki82 08.11.2010 21:36
Hallo Arne,

mein Rechner meldete soeben, dass Windows Systemwiederherstellung und Roxio Back on Track (war auf meinem HP mini100c installiert) nicht parallel laufen können.
Es wurde geraten, die Windows Systemwiederherstellung zu deaktivieren. Ist das richtig?

Viele Grüße,
kiki

cosinus 09.11.2010 01:38
Ja war so ok. Weiter gehts:

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.


Code:
File::
c:\windows\updater4g.exe
c:\windows\starter4g.exe
c:\windows\service4g.exe
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

kiki82 09.11.2010 11:05
Hallo Arne,

Danke zunächst für Deine Hilfe & die ganzen Schritt-für-Schritt-Anweisungen!
Ich habe alles ausgeführt, wie Du es beschrieben hast. Nach dem Neustart des Computers meldete Combofix zunächst, es würde eine Logdatei erstellen.
Doch kurz darauf ist mein Rechner wieder neu gestartet. Es erschien dann die Windows-Meldung, dass "das System nach einem schwerwiegenden Fehler wieder ausgeführt" wird.
Ich poste Dir hier mal die Fehlermeldung:

Problemsignatur:
BCCode : 1000008e BCP1 : 80000004 BCP2 : 8054BDF4 BCP3 : 9B35B594
BCP4 : 00000000 OSVer : 5_1_2600 SP : 3_0 Product : 768_1

Problembericht: enthaltene Dateien
C:\DOKUME~1\Kirsten\LOKALE~1\Temp\WER00c3.dir00\Mini110910-01.dmp
C:\DOKUME~1\Kirsten\LOKALE~1\Temp\WER00c3.dir00\sysdata.xml


Das Logfile von Combofix habe ich danach unter C:\\Combofix.txt abgerufen:

ComboFix 10-11-07.01 - Kirsten 09.11.2010 10:14:40.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.1015.249 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Kirsten\Desktop\cofi.exe
Benutzte Befehlsschalter :: C:\Dokumente und Einstellungen\Kirsten\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\service4g.exe"
"c:\windows\starter4g.exe"
"c:\windows\updater4g.exe"
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\service4g.exe
c:\windows\starter4g.exe
c:\windows\updater4g.exe

.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XS_Stick_Service
-------\Service_XS Stick Service


((((((((((((((((((((((( Dateien erstellt von 2010-10-09 bis 2010-11-09 ))))))))))))))))))))))))))))))
.

Viele Grüße,
kiki

cosinus 10.11.2010 07:56
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

kiki82 10.11.2010 11:45
Hi Arne,

gestern abend hat Avira leider schon wieder vor einem Virus gewarnt. Es wurde der Worm\Rbot.655092 in folgender Datei entdeckt:
C:\\Qoobox\...\updater4g.exe.vir.
Die Datei habe ich danach zunächst in Quarantäne verschoben.
Anschließend habe ich meinen Rechner ein weiteres Mal mit Malwarebytes und Antivir gescannt; beide Scans waren unauffällig.

Soll ich trotzdem mit den Schritten fortfahren? Oder nochmal Ccleaner durchlaufen lassen?

Viele Grüße,
kiki

cosinus 10.11.2010 11:51
Zitat:
Es wurde der Worm\Rbot.655092 in folgender Datei entdeckt:
C:\\Qoobox\...\updater4g.exe.vir.
Qoobox ist der Quarantäne/Backup Ordner von combofix. Was da gefunden wird bitte ignorieren, Schädlinge da drin sind isoliert und können so dem System nicht mehr schaden!
Mach jetzt die anderen Logs.

kiki82 10.11.2010 12:03
Okay! Danke für die Info zu Qoobox!
Ich setze mich jetzt an die nächsten Logs.

Viele Grüße,
kiki

kiki82 12.11.2010 01:03
Hi Arne,

der Scan von GMER hat ziemlich lange gedauert; hier kommen nun die Logs.

GMER:

GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2010-11-12 00:13:38
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.13.0
Running: wbhqtxmy.exe; Driver: C:\DOKUME~1\Kirsten\LOKALE~1\Temp\fftorfow.sys


---- System - GMER 1.0.15 ----

SSDT            A38CED36                                                                            ZwCreateKey
SSDT            A38CED2C                                                                            ZwCreateThread
SSDT            A38CED3B                                                                            ZwDeleteKey
SSDT            A38CED45                                                                            ZwDeleteValueKey
SSDT            A38CED4A                                                                            ZwLoadKey
SSDT            A38CED18                                                                            ZwOpenProcess
SSDT            A38CED1D                                                                            ZwOpenThread
SSDT            A38CED54                                                                            ZwReplaceKey
SSDT            A38CED4F                                                                            ZwRestoreKey
SSDT            A38CED40                                                                            ZwSetValueKey
SSDT            A38CED27                                                                            ZwTerminateProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                            wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                            wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                              SaibIa32.sys (Disk Filter Driver/Sonic Solutions)
AttachedDevice  \FileSystem\Fastfat \Fat                                                            fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout  15
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota    10000
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                  yes
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                 
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout  90
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota    10000

---- EOF - GMER 1.0.15 ----
--- --- ---



OSAM:
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 00:55:06 on 12.11.2010

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.12

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"BackOnTrack Instant Restore Idle.job" - "Sonic Solutions" - C:\Programme\Roxio\BackOnTrack\Instant Restore\RstIdle.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"hpBat.cpl" - ? - C:\WINDOWS\system32\hpBat.cpl  (File found, but it contains no detailed information)
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"hpBat.CPL" - ? - C:\Programme\Hewlett-Packard\HP BatteryCheck\hpBat.CPL  (File not found)

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Kirsten\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"fftorfow" (fftorfow) - ? - C:\DOKUME~1\Kirsten\LOKALE~1\Temp\fftorfow.sys  (Hidden registry entry, rootkit activity | File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Realtek IR Driver" (Rts516xIR) - ? - C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys  (File not found)
"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys  (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"SysCow" (SysCow) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\syscow32x.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "AOL Toolbar" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{DE9C389F-3316-41A7-809B-AA305ED9D922} "AOL Toolbar" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} "AOL Toolbar BHO" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\desktop.ini
"OpenOffice.org 3.2.lnk" - ? - C:\Programme\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM" - "Macrovision Corporation" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
"Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"HP BTW Detect Program" - ? - C:\Programme\HP\HPBTWD.exe
"starter4g" - ? - C:\WINDOWS\starter4g.exe  (File not found)
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"WirelessAssistant" - "Hewlett-Packard" - C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Scheduler" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"BOTService" (BOTService) - "Sonic Solutions" - C:\Programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe
"GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Programme\HP Games\HP Game Console\GameConsoleService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Roxio SAIB Service" (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - ? - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"WTGService" (WTGService) - ? - C:\Programme\XSManager\WTGService.exe  (File found, but it contains no detailed information)

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru


und MBRCheck:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 129):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xF7A88000 \WINDOWS\system32\KDCOM.DLL
0xF7998000 \WINDOWS\system32\BOOTVID.dll
0xF7458000 ACPI.sys
0xF7A8A000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7447000 pci.sys
0xF7588000 isapnp.sys
0xF799C000 compbatt.sys
0xF79A0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7B50000 pciide.sys
0xF7808000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7A8C000 aliide.sys
0xF7A8E000 viaide.sys
0xF7A90000 intelide.sys
0xF7598000 MountMgr.sys
0xF7428000 ftdisk.sys
0xF79A4000 ACPIEC.sys
0xF7B51000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7810000 PartMgr.sys
0xF75A8000 VolSnap.sys
0xF734E000 iaStor.sys
0xF75B8000 disk.sys
0xF75C8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF732E000 fltMgr.sys
0xF7316000 syscow32x.sys
0xF75D8000 PxHelp20.sys
0xF72FF000 KSecDD.sys
0xF7272000 Ntfs.sys
0xF7245000 NDIS.sys
0xF7818000 SaibIa32.sys
0xF75E8000 SahdIa32.sys
0xF722B000 Mup.sys
0xF77B8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF5A74000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xF5A60000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF5A38000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF588D000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
0xF77D8000 \SystemRoot\system32\DRIVERS\l1c51x86.sys
0xF78A8000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF5869000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78B0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF77E8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78B8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF5838000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7AC2000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF77F8000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xF57BC000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF78C0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF715B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7A40000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7C4F000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7628000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF69C2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF57A5000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7638000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7648000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78C8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5794000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7658000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78D0000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78D8000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7668000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7AC4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5771000 \SystemRoot\system32\DRIVERS\ks.sys
0xF5713000 \SystemRoot\system32\DRIVERS\update.sys
0xF69B2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF609A000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xA81E9000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xA24AF000 \SystemRoot\system32\drivers\sthda.sys
0xA248B000 \SystemRoot\system32\drivers\portcls.sys
0xA81D9000 \SystemRoot\system32\drivers\drmk.sys
0xA246F000 \SystemRoot\system32\drivers\AESTAud.sys
0xA80F4000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7B3E000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xA39DF000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B40000 \SystemRoot\System32\Drivers\Beep.SYS
0xA4731000 \SystemRoot\System32\drivers\vga.sys
0xF7B42000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B44000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xA2239000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0xA81B9000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xA4729000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0xA4721000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA4719000 \SystemRoot\System32\Drivers\Npfs.SYS
0xA80F0000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA2226000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA21CD000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA21A5000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA217F000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA215D000 \SystemRoot\System32\drivers\afd.sys
0xA81A9000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA4711000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xA8199000 \SystemRoot\System32\Drivers\SaibVd32.sys
0xA2132000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA20C2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA4814000 \SystemRoot\System32\Drivers\Fips.SYS
0xA20A6000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7B4E000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0x9D278000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9B71C000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x9C5B9000 \SystemRoot\System32\drivers\Dxapi.sys
0x9D395000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0x9B980000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0x9B708000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9C040000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9B6CB000 \SystemRoot\system32\drivers\wdmaud.sys
0xF604A000 \SystemRoot\system32\drivers\sysaudio.sys
0x9B508000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0x9B3E8000 \SystemRoot\system32\DRIVERS\srv.sys
0x9AF0D000 \SystemRoot\system32\drivers\kmixer.sys
0xF7AC8000 \SystemRoot\system32\drivers\splitter.sys
0x9AD8C000 \SystemRoot\System32\Drivers\HTTP.sys
0x9C7A5000 \SystemRoot\System32\Drivers\Cdfs.SYS
0x9B5A9000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x9A8C6000 \SystemRoot\System32\Drivers\Fastfat.SYS
0x9A8AE000 \??\C:\DOKUME~1\Kirsten\LOKALE~1\Temp\fftorfow.sys
0x9D3A5000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x9A894000 \SystemRoot\system32\DRIVERS\cmnsusbser.sys
0xA26D9000 \SystemRoot\System32\Drivers\Modem.SYS
0xA26A9000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
768 C:\WINDOWS\system32\smss.exe
816 csrss.exe
840 C:\WINDOWS\system32\winlogon.exe
884 C:\WINDOWS\system32\services.exe
896 C:\WINDOWS\system32\lsass.exe
1068 C:\WINDOWS\system32\svchost.exe
1148 svchost.exe
1188 C:\Programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe
1200 C:\WINDOWS\system32\svchost.exe
1384 svchost.exe
1452 svchost.exe
1684 C:\WINDOWS\system32\spoolsv.exe
1728 C:\Programme\IDT\WDM\stacsv.exe
488 C:\WINDOWS\explorer.exe
584 C:\Programme\Avira\AntiVir Desktop\sched.exe
2032 svchost.exe
280 C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
308 C:\Programme\Avira\AntiVir Desktop\avguard.exe
384 C:\Programme\Java\jre6\bin\jqs.exe
688 C:\WINDOWS\system32\svchost.exe
1012 C:\Programme\XSManager\WTGService.exe
1084 C:\WINDOWS\system32\igfxtray.exe
1360 C:\WINDOWS\system32\hkcmd.exe
1372 C:\WINDOWS\system32\igfxpers.exe
1408 C:\Programme\HP\HPBTWD.exe
1424 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
1440 C:\Programme\IDT\WDM\sttray.exe
1496 C:\WINDOWS\system32\AESTFltr.exe
1540 C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
1548 C:\WINDOWS\system32\igfxsrvc.exe
1724 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
1752 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
2056 C:\Programme\Skype\Phone\Skype.exe
2092 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
2144 C:\WINDOWS\system32\ctfmon.exe
2268 C:\Programme\OpenOffice.org 3\program\soffice.exe
2356 C:\Programme\OpenOffice.org 3\program\soffice.bin
3048 C:\Programme\Hewlett-Packard\Shared\hpqWmiEx.exe
3296 C:\WINDOWS\system32\wbem\wmiapsrv.exe
3324 wmiprvse.exe
3372 alg.exe
3508 C:\Programme\Hewlett-Packard\Shared\HpqToaster.exe
3596 C:\WINDOWS\system32\wuauclt.exe
3888 C:\Programme\XSManager\XSManager.exe
3652 C:\Programme\Mozilla Firefox\firefox.exe
3292 C:\Programme\Skype\Toolbars\Shared\SkypeNames2.exe
3492 C:\Programme\Mozilla Firefox\plugin-container.exe
752 C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: WDCWD1600BEVT-60ZCT1, Rev: 13.01A13

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!


Viele Grüße,
kiki

cosinus 12.11.2010 06:07
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

kiki82 12.11.2010 13:59
Hi Arne,

Danke!! Wäre so froh, wenn mein Rechner wieder in Ordnung kommt- und ich keine Panik mehr vor Trojanern etc. haben muss!

Hier kommt zunächst das Log von Malwarebytes:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5098

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12.11.2010 12:57:40
mbam-log-2010-11-12 (12-57-40).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 223095
Laufzeit: 1 Stunde(n), 23 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Das Log von SASW schicke ich später.

Viele Grüße,
kiki

kiki82 12.11.2010 16:05
Hi Arne,

dies ist das Log con SASW:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 11/12/2010 at 03:45 PM

Application Version : 4.45.1000

Core Rules Database Version : 5850
Trace Rules Database Version: 3662

Scan type : Complete Scan
Total Scan Time : 01:33:35

Memory items scanned : 644
Memory threats detected : 0
Registry items scanned : 6437
Registry threats detected : 0
File items scanned : 85811
File threats detected : 7

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\Kirsten\Cookies\kirsten@perf.overture[1].txt
C:\Dokumente und Einstellungen\Kirsten\Cookies\kirsten@2o7[2].txt
adserv.quality-channel.de [ C:\System Rollback Data\Restore\Archive\00000035\00000034\0\Target\Dokumente und Einstellungen\Kirsten\ANWENDUNGSDATEN\Macromedia\Flash Player\#SharedObjects\3CPK9TXV ]
cdn5.specificclick.net [ C:\System Rollback Data\Restore\Archive\00000035\00000034\0\Target\Dokumente und Einstellungen\Kirsten\ANWENDUNGSDATEN\Macromedia\Flash Player\#SharedObjects\3CPK9TXV ]
imagesrv.adition.com [ C:\System Rollback Data\Restore\Archive\00000035\00000034\0\Target\Dokumente und Einstellungen\Kirsten\ANWENDUNGSDATEN\Macromedia\Flash Player\#SharedObjects\3CPK9TXV ]
serving-sys.com [ C:\System Rollback Data\Restore\Archive\00000035\00000034\0\Target\Dokumente und Einstellungen\Kirsten\ANWENDUNGSDATEN\Macromedia\Flash Player\#SharedObjects\3CPK9TXV ]
www.ardmediathek.de [ C:\System Rollback Data\Restore\Archive\00000035\00000034\0\Target\Dokumente und Einstellungen\Kirsten\ANWENDUNGSDATEN\Macromedia\Flash Player\#SharedObjects\3CPK9TXV ]

Viele Grüße,
kiki

cosinus 12.11.2010 16:15
Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

kiki82 15.11.2010 01:09
Hallo Arne,

Malwarebytes und Antivir haben keine Viren o.ä. mehr gefunden! Tausend Dank für Deine Hilfe!!!
Nur mein Rechner fährt immer noch langsam hoch, dabei wird der Bildschirm kurz schwarz und die Taskleiste erscheint dann ein zweites Mal. Ist dennoch alles okay? Oder kann das auch auf ein Virus hindeuten?

Schöne Grüße,
kiki

cosinus 15.11.2010 05:21
Wie kann denn die Taskleiste ein 2. Mal erscheinen? Meinst du was anderes mit Taskleiste als das was ich meine? Beschreib mal genauer.
Und natürlich könnte irgendwo immer noch was Bösartiges stecken auch wenn alle Logs nun ok sind. Das ist das Restrisiko einer jeden Bereinigung.

kiki82 18.11.2010 19:24
Hi Arne,

ich meine die Startleiste, die am Bildschirmrand unten erscheint und Startmenü sowie Batterieanzeige etc. enhält.

Gut, dann ich versuch nochmal die Probleme beim Hochfahren des Computers zu beschreiben:

Bevor AntiVir den Trojaner meldete fuhr der Computer schneller hoch und die Taskleiste erschien ohne Verzögerung.
Jetzt sieht anfangs auch alles normal aus, d.h. alle Dokumente auf dem Desktop und auch die Startleiste sind bereits auf dem Bildschirm zu sehen. Doch kurze Zeit später wird der Hintergrund für kurze Zeit komplett schwarz und anschließend wird die Startleiste quasi erneut, aber sehr langsam aufgebaut.

Viele Grüße,
kiki

cosinus 18.11.2010 19:36
Das war die ganze Prozedur schon so durch, also direkt nach dem AntiVir-Fund oder erst nach einen "meiner" Schritte?

kiki82 18.11.2010 19:45
Direkt nach dem AntiVir- Fund, also bereits vor dem Durchführen Deiner "Schritte".

Viele Grüße,
kiki

cosinus 18.11.2010 20:14
Kannst du AntiVir mal vorübergehend deinstallieren, Rechner neustarten und beobachten ob das immer noch so auftaucht?

kiki82 22.11.2010 12:49
Hi Arne,

nachdem ich AntiVir deinstaliert habe, wurde der Bildschirm nach dem Hochfahren erneut für einen kurzen Moment schwarz.
Aber die Taskleiste erschien nicht mehr verzögert.

Schönen Gruß,
kiki

cosinus 22.11.2010 17:04
Ok, lags wohl an AntiVir. Als Alternative kannst du auch das nutzen => http://www.microsoft.com/security_essentials/

Ansonsten noch Probleme oder weitere Funde?

kiki82 30.11.2010 12:27
Hallo Arne,

sorry für die späte Antwort.
In der Zwischenzeit hatte ich keine weiteren Funde. Dann sollte soweit alles in Ordnung sein, oder?
Werde mir wohl Kaspersky Internet Security 2011 zulegen, um meinen Computer in Zukunft noch besser zu schützen.

Viele Grüße,
kiki

cosinus 30.11.2010 19:52
Zitat:
Werde mir wohl Kaspersky Internet Security 2011 zulegen, um meinen Computer in Zukunft noch besser zu schützen.
Mach das nicht. Eine Internet Security Suite ist kontraproduktiv!!

Lies einfach mal hier, ich denke dann sollte es etwas klarer werden:

Die Vertrauensbrecher c't Editorial über Internet Security Suites und warum sie idR nichts taugen
Oberthal online: Personal Firewalls: Sinnvoll oder sinnfrei?
personal firewalls ? Wiki ? ubuntuusers.de
NT-Dienste sicher konfigurieren und abschalten (Windows 2000/XP) - www.ntsvcfg.de
microsoft.public.de.security.heimanwender FAQ

Dann wirst Du feststellen, dass es einfach nur unnötig ist, sich das System mit einer weiteren "Schutzkomponente" zu verhunzen... :rolleyes:

Malwarebefall vermeiden kannst Du sowieso nur, wenn Du selbst Dein verhalten in den Griff bekommst => Kompromittierung unvermeidbar?

kiki82 02.12.2010 21:13
Hi Arne,

vielen Dank für den Tipp & die ganzen Links!
Dabei frage ich mich wirklich, wie ich mir die Trojaner eingefangen habe. Denn das Internet nutze ich vor allem um Mails zu schreiben, Online-Zeitung zu lesen oder für meine Arbeit zu recherchieren.

Na, dann hoff ich mal, mit regelmäßigen Antivirus-Checks und "kontrolliertem" Surfen passiert mir das nicht nochmal.

Schöne Grüße,
kiki

kiki82 08.12.2010 13:52
Hi Arne,

kannst Du mir bitte nochmal helfen?
Auf meinem Rechner wurden neue Trojaner entdeckt:((
Dabei habe ich vorsichtig gesurft und keine Dateien heruntergeladen. Frage mich wirklich, wie sich die Trojaner immer wieder einschleichen. Und warum habe ich das nicht bemerkt?


Gestern hat Malwarebytes Trojaner in folgenden Dateien entdeckt. Danach habe ich alle in Quarantäne verschoben.


Trojan.DNSChanger:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07EC0ADC-8A48-43FE-8341-D9D7C698892E}\DhcpNameServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{76E7AEAD-198B-4AFC-B507-76050BA527EC}\DhcpNameServer

Trojan.Dropper:
c:\dokumente und einstellungen\Kirsten\lokale einstellungen\Temp\0.4442943182359632.exe
c:\system rollback data\Restore\Current\50390\10\Target\WINDOWS\system32\spool\prtprocs\w32x86\xMYW3u7.dll

Trojan.Alureon.Gen:
c:\system rollback data\Restore\Current\50390\10\Target\WINDOWS\system32\spool\prtprocs\w32x86\Y17oCEI9.dll


Seit gestern wird auch meine Internetverbindung (über einen Surf-Stick) immer wieder unterbrochen und kurz nach dem Hochfahren des Rechners erscheint die Fehlermeldung: Generic Host Process for Win32 Services hat ein Problem festgestellt und muss beendet werden. Die Taskleiste verändert sich komplett; anderes Schriftbild, auch die Datum- und Uhrzeitangabe sind anders aus.

Die Trojaner machen mir große Sorgen. Das sieht nicht gut aus, oder??

Anbei die Meldungen von Malwarebytes; nach der ersten Trojaner-Beseitigung hatte ich einen zweiten Suchdurchlauf gestartet:


Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5264

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08.12.2010 00:46:57
mbam-log-2010-12-08 (00-46-57).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 131163
Laufzeit: 6 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07EC0ADC-8A48-43FE-8341-D9D7C698892E}\DhcpNameServer (Trojan.DNSChanger) -> Bad: (93.188.163.192,93.188.160.112) Good: () -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{76E7AEAD-198B-4AFC-B507-76050BA527EC}\DhcpNameServer (Trojan.DNSChanger) -> Bad: (93.188.163.192,93.188.160.112) Good: () -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\Kirsten\lokale einstellungen\Temp\0.4442943182359632.exe (Trojan.Dropper) -> Quarantined and deleted successfully.




Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5264

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08.12.2010 02:12:14
mbam-log-2010-12-08 (02-12-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 218354
Laufzeit: 1 Stunde(n), 20 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\system rollback data\Restore\Current\50390\10\Target\WINDOWS\system32\spool\prtprocs\w32x86\xMYW3u7.dll (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system rollback data\Restore\Current\50390\10\Target\WINDOWS\system32\spool\prtprocs\w32x86\Y17oCEI9.dll (Trojan.Alureon.Gen) -> Quarantined and deleted successfully.

Antispyware meldet außer Tracking Cookies keine weiteren Funde.

Wie soll ich vorgehen? Wieder OTL und GMER posten?

Schöne Grüße,
kiki

cosinus 08.12.2010 13:57
Am selben Rechner oder ist das ein anderer?

kiki82 08.12.2010 16:09
Hi Arne,

am selben Rechner.

Viele Grüße,
kiki

kiki82 08.12.2010 17:54
Hi Arne,

AntiVir hat inzwischen zwei versteckte Objekte gefunden:

HKEY_USERS\S-1-5-21-2219577811-1329296693-4104837356-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\savedlegacysettings
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\RNG\seed
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.

Ich schicke Dir hier schonmal die OTL Logs- falls Du mal draufschauen kannst und sie für die Diagnose brauchst.

OTL Logfile:OTL Logfile:
Code:
OTL Extras logfile created on: 08.12.2010 13:56:21 - Run 5
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.015,00 Mb Total Physical Memory | 445,00 Mb Available Physical Memory | 44,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 112,06 Gb Free Space | 75,19% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PC295313555299
Current User Name: Kirsten
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Programme\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe" = C:\Programme\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03B2DFF6-584E-44A6-8DFB-EDEB3C64FD31}" = GoGear SA1VBExxA Device Manager
"{0517F875-BBB2-4812-A63E-733B33CEF215}" = Roxio Instant Restore
"{10385C4F-A6B2-4913-975D-6828928222EC}" = HP User Guides 0165
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2B682751-E749-441C-A4B3-1F538E26E56E}" = Roxio Instant Restore Recovery Disk
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}" = Roxio BackOnTrack
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam-50
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54CC7901-804D-4155-B353-21F0CC9112AB}" = HP Wireless Assistant
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows-Sicherungsprogramm
"{87A83C6F-F53C-448A-B078-FF00E3EAEB29}" = Roxio Disaster Recovery
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = USB2.0 Card Reader Software
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E623BB3F-F7ED-4148-BEB5-A0D1DB28B4DE}" = Media Converter for Philips
"{EEA95E6C-6847-49BE-83C9-ED92D8E18983}" = HP QuickSync
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Toolbar" = AOL Toolbar 5.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Broadcom 802.11b Network Adapter" = Broadcom 802.11-WLAN-Adapter
"CCleaner" = CCleaner
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MSNINST" = MSN
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.0.5
"WildTangent hp Master Uninstall" = HP Games
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR
"XSManager" = XSManager
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ONLINE FUCHS" = ONLINE FUCHS
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.12.2010 19:48:25 | Computer Name = PC295313555299 | Source = RstLogonComponent | ID = 0
Description =
 
Error - 07.12.2010 19:50:32 | Computer Name = PC295313555299 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung svchost.exe, Version 5.1.2600.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001a624b.
 
Error - 07.12.2010 19:57:19 | Computer Name = PC295313555299 | Source = RstIdle | ID = 0
Description =
 
Error - 07.12.2010 21:13:51 | Computer Name = PC295313555299 | Source = RstLogonComponent | ID = 0
Description =
 
Error - 07.12.2010 21:15:55 | Computer Name = PC295313555299 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung svchost.exe, Version 5.1.2600.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001a624b.
 
Error - 08.12.2010 06:57:36 | Computer Name = PC295313555299 | Source = RstLogonComponent | ID = 0
Description =
 
Error - 08.12.2010 06:59:36 | Computer Name = PC295313555299 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung svchost.exe, Version 5.1.2600.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001a624b.
 
Error - 08.12.2010 08:46:53 | Computer Name = PC295313555299 | Source = RstLogonComponent | ID = 0
Description =
 
Error - 08.12.2010 08:48:53 | Computer Name = PC295313555299 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung svchost.exe, Version 5.1.2600.5512, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x001a624b.
 
Error - 08.12.2010 08:49:28 | Computer Name = PC295313555299 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung xsmanager.exe, Version 1.0.0.1, fehlgeschlagenes
 Modul mfc42u.dll, Version 6.2.8073.0, Fehleradresse 0x0000239d.
 
[ System Events ]
Error - 07.12.2010 20:50:42 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
Error - 07.12.2010 21:00:24 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
Error - 07.12.2010 21:10:29 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
Error - 07.12.2010 21:14:41 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  AliIde  IntelIde  PCIIde  ViaIde
 
Error - 08.12.2010 07:29:32 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
Error - 08.12.2010 07:36:33 | Computer Name = PC295313555299 | Source = DCOM | ID = 10010
Description = Der Server "{BA126AE5-2166-11D1-B1D0-00805FC1270E}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 08.12.2010 08:30:04 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
Error - 08.12.2010 08:39:49 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
Error - 08.12.2010 08:56:43 | Computer Name = PC295313555299 | Source = DCOM | ID = 10010
Description = Der Server "{BA126AE5-2166-11D1-B1D0-00805FC1270E}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 08.12.2010 08:59:19 | Computer Name = PC295313555299 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "Windows-Verwaltungsinstrumentation" Korrekturmaßnahmen (Starten Sie
 den Dienst neu.) durchzuführen, ist fehlgeschlagen. Fehler:  %%1056
 
 
< End of report >
--- --- ---
OTL Logfile:
Code:
OTL logfile created on: 08.12.2010 13:56:20 - Run 5
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.015,00 Mb Total Physical Memory | 445,00 Mb Available Physical Memory | 44,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 112,06 Gb Free Space | 75,19% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PC295313555299
Current User Name: Kirsten
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe (Philips)
PRC - C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\XSManager\WTGService.exe ()
PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
PRC - C:\Programme\HP\HPBTWD.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (WTGService) -- C:\Programme\XSManager\WTGService.exe ()
SRV - (ACDaemon) -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (STacSV) -- c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
SRV - (GameConsoleService) -- C:\Programme\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBCCID) -- C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) -- C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys File not found
DRV - (catchme) -- C:\DOKUME~1\Kirsten\LOKALE~1\Temp\catchme.sys File not found
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (cmnsusbser) -- C:\WINDOWS\system32\drivers\cmnsusbser.sys (Mobile Connector)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (SysCow) -- C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (iaStor) -- C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (SaibVd32) -- C:\WINDOWS\system32\drivers\SaibVd32.sys (Sonic Solutions)
DRV - (SahdIa32) -- C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions)
DRV - (SaibIa32) -- C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions)
DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (RSUSBSTOR) -- C:\WINDOWS\system32\drivers\RTS5121.sys (Realtek Semiconductor Corp.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B728AB94-9BC7-49b7-B76A-422BB31B2FD0}:2.0.0.8
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010.11.22 17:30:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.10.29 11:52:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.10.29 11:52:48 | 000,000,000 | ---D | M]
 
[2010.02.23 16:16:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Extensions
[2010.12.07 17:01:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions
[2010.06.26 12:36:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.29 12:22:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\zotero@chnm.gmu.edu
[2010.12.07 17:01:39 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.01 22:25:36 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.10.21 20:28:02 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.21 20:28:02 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.21 20:28:03 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.21 20:28:03 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.21 20:28:03 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.11.09 10:28:59 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HP BTW Detect Program] C:\Programme\HP\HPBTWD.exe ()
O4 - HKLM..\Run: [starter4g] C:\WINDOWS\starter4g.exe File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Philips GoGear SA1VBExxA Device Manager.lnk = C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe (Philips)
O4 - Startup: C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar-Suche - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AOL\ieToolbar\resources\de-DE\local\search.html ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\crypt32chain: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\cryptnet: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\cscdll: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\dimsntfy: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\ScCertProp: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\Schedule: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\sclgntfy: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\SensLogn: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\termsrv: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\wlballoon: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Firestorm High.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Firestorm High.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.08 00:38:04 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.08 00:37:56 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.12.07 23:45:11 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Kirsten\Recent
[2010.12.05 19:36:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Planung.BerlinFeb2011
[2010.11.22 23:04:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.11.22 19:22:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\maxxim
[2010.11.22 17:31:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\ArcSoft
[2010.11.22 17:31:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\ArcSoft
[2010.11.22 17:31:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ArcSoft
[2010.11.22 17:30:39 | 001,645,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\gdiplus.dll
[2010.11.22 17:30:39 | 000,499,712 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll
[2010.11.22 17:30:39 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll
[2010.11.22 17:30:39 | 000,245,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\unicows.dll
[2010.11.22 17:30:39 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\ArcSoft
[2010.11.22 17:30:39 | 000,000,000 | ---D | C] -- C:\Programme\ArcSoft
[2010.11.22 17:29:08 | 000,000,000 | ---D | C] -- C:\Programme\Philips
[2010.11.22 17:28:44 | 000,000,000 | ---D | C] -- C:\temp
[2010.11.22 12:39:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Avira
[2010.11.22 12:33:26 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010.11.22 12:33:22 | 000,126,856 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.11.22 12:33:22 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2010.11.22 12:33:22 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010.11.22 12:33:19 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2010.11.22 12:33:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2010.11.12 16:36:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Eigene Dateien
[2010.11.12 14:03:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\SUPERAntiSpyware.com
[2010.11.12 14:03:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
[2010.11.12 14:03:17 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2010.11.12 00:49:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\WinRAR
[2010.11.12 00:48:54 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR
[2010.11.09 10:38:52 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.11.09 10:30:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010.11.09 10:12:44 | 000,000,000 | ---D | C] -- C:\cofi
[2010.11.08 23:17:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.11.08 17:52:14 | 000,000,000 | ---D | C] -- C:\Programme\temp
[2010.11.08 17:35:38 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.11.08 17:32:50 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.11.08 17:32:50 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.11.08 17:32:50 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.11.08 17:32:50 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.11.08 17:32:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.11.08 17:31:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.11.08 17:14:41 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.11.08 17:12:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\Temp
[2010.11.08 17:12:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.11.08 17:12:33 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.11.08 17:12:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\Google
[2010.01.26 15:15:44 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010.01.26 15:15:40 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.08 13:56:09 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.12.08 13:46:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.12.08 13:46:38 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.08 13:45:46 | 003,932,160 | -H-- | M] () -- C:\Dokumente und Einstellungen\Kirsten\NTUSER.DAT
[2010.12.08 13:45:46 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Kirsten\ntuser.ini
[2010.12.08 13:42:59 | 000,031,744 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\fehlermeldung.doc
[2010.12.08 02:22:09 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.08 00:57:50 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2010.12.08 00:38:05 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.06 22:49:09 | 000,881,783 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.rdf
[2010.12.06 22:47:05 | 000,103,424 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\RuchSpoleczenstwaAlternatywnego.doc
[2010.12.06 22:29:40 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\usa.wichtig.doc
[2010.12.06 19:39:10 | 000,050,176 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Presentation.Washington.doc
[2010.12.06 13:46:49 | 000,325,632 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\walendziak.doc
[2010.12.06 11:30:16 | 000,030,720 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\HistoriaRuchPomaranczowaAltern.doc
[2010.12.05 23:22:02 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.03 20:31:30 | 000,012,800 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\DA_Thesen.doc
[2010.12.01 22:00:42 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\SB.Funktion.doc
[2010.12.01 14:10:31 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Dt.PolenInstitut.doc
[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.11.28 19:12:06 | 000,013,312 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit.tipps.doc
[2010.11.23 15:36:26 | 000,010,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit. bios.doc
[2010.11.22 17:31:08 | 000,001,978 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Internet Video Downloader.lnk
[2010.11.22 17:31:07 | 000,001,841 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Media Converter for Philips.lnk
[2010.11.22 17:29:08 | 000,000,867 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Philips GoGear SA1VBExxA Device Manager.lnk
[2010.11.22 17:29:08 | 000,000,839 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Philips GoGear SA1VBExxA Device Manager.lnk
[2010.11.22 12:43:01 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010.11.22 12:33:40 | 000,001,671 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk
[2010.11.20 17:21:43 | 000,448,970 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.11.20 17:21:43 | 000,432,690 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.11.20 17:21:43 | 000,080,488 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.11.20 17:21:43 | 000,067,646 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.11.20 17:21:42 | 001,042,050 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.11.12 14:03:23 | 000,001,642 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.11.12 00:56:26 | 000,080,384 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck.exe
[2010.11.12 00:44:42 | 000,000,881 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Verknüpfung mit osam_autorun_manager_5_0_portable(3).lnk
[2010.11.10 13:52:45 | 000,000,741 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Verknüpfung mit wbhqtxmy.lnk
[2010.11.10 11:50:40 | 000,017,920 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\CfPNarrativekulturellerIdentität.doc
[2010.11.09 10:29:06 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.11.09 10:28:59 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.11.08 17:35:42 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010.11.08 17:28:11 | 000,031,142 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101108_172748.reg
[2010.11.08 17:14:58 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Google Chrome.lnk
[2010.11.08 17:14:50 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
 
========== Files Created - No Company Name ==========
 
[2010.12.08 13:42:58 | 000,031,744 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\fehlermeldung.doc
[2010.12.08 00:38:05 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.06 22:36:28 | 000,103,424 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\RuchSpoleczenstwaAlternatywnego.doc
[2010.12.06 22:29:38 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\usa.wichtig.doc
[2010.12.06 19:39:10 | 000,050,176 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Presentation.Washington.doc
[2010.12.06 13:40:53 | 000,325,632 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\walendziak.doc
[2010.12.06 11:29:37 | 000,030,720 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\HistoriaRuchPomaranczowaAltern.doc
[2010.12.03 20:31:28 | 000,012,800 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\DA_Thesen.doc
[2010.12.01 22:00:40 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\SB.Funktion.doc
[2010.12.01 14:10:14 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Dt.PolenInstitut.doc
[2010.11.28 19:11:58 | 000,013,312 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit.tipps.doc
[2010.11.23 15:36:24 | 000,010,752 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit. bios.doc
[2010.11.22 17:31:08 | 000,001,978 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Internet Video Downloader.lnk
[2010.11.22 17:31:07 | 000,001,841 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Media Converter for Philips.lnk
[2010.11.22 17:29:08 | 000,000,867 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Philips GoGear SA1VBExxA Device Manager.lnk
[2010.11.22 17:29:08 | 000,000,839 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Philips GoGear SA1VBExxA Device Manager.lnk
[2010.11.22 12:33:40 | 000,001,671 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Avira AntiVir Control Center.lnk
[2010.11.12 14:03:23 | 000,001,642 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.11.12 00:56:26 | 000,080,384 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck.exe
[2010.11.12 00:44:42 | 000,000,881 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Verknüpfung mit osam_autorun_manager_5_0_portable(3).lnk
[2010.11.10 13:52:45 | 000,000,741 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Verknüpfung mit wbhqtxmy.lnk
[2010.11.10 11:50:37 | 000,017,920 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\CfPNarrativekulturellerIdentität.doc
[2010.11.08 17:35:42 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010.11.08 17:35:39 | 000,262,448 | RHS- | C] () -- C:\cmldr
[2010.11.08 17:32:50 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.11.08 17:32:50 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.11.08 17:32:50 | 000,088,576 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.11.08 17:32:50 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.11.08 17:32:50 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.11.08 17:27:51 | 000,031,142 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101108_172748.reg
[2010.11.08 17:14:58 | 000,001,777 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\Google Chrome.lnk
[2010.11.08 17:14:50 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2010.11.08 17:12:43 | 000,001,090 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.11.08 17:12:42 | 000,001,086 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.01.26 15:15:44 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010.01.26 15:15:44 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010.01.26 15:15:43 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009.08.24 09:59:13 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.08.24 09:18:29 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.04.11 00:27:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
< End of report >
--- --- ---

Viele Grüße,
kiki

cosinus 08.12.2010 20:20
Mach nochmal nen Durchgang mit CF, die cofi neu runterladen:

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

kiki82 14.12.2010 12:37
Hi Arne,

sorry für die späte Antwort. Mein Rechner hat sich beim ersten Durchlauf aufgehängt. Und danach gabs so viel Stress an der Uni. Ich versuche combofix jetzt einfach nochmal.

Viele Grüße,
kiki

kiki82 14.12.2010 15:43
Hi Arne,

hier kommt das Log von Combofix (das ich leider nur im reduzierten Modus ausführen konnte).

Log Combofix:

Combofix Logfile:
Code:
ComboFix 10-12-07.06 - Kirsten 14.12.2010  14:58:18.3.2 - x86
ausgeführt von:: c:\dokumente und einstellungen\Kirsten\Desktop\cofi.exe
.
- REDUZIERTER FUNKTIONALITÄTSMODUS -
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\windows\service4g.exe
c:\windows\starter4g.exe
c:\windows\updater4g.exe

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XS_Stick_Service
-------\Service_XS Stick Service


(((((((((((((((((((((((  Dateien erstellt von 2010-11-14 bis 2010-12-14  ))))))))))))))))))))))))))))))
.

2010-12-07 23:38 . 2010-11-29 16:42        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-07 23:37 . 2010-11-29 16:42        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-11-22 22:04 . 2010-12-08 13:23        --------        d-----w-        c:\windows\system32\NtmsData
2010-11-22 16:31 . 2010-11-22 16:31        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\ArcSoft
2010-11-22 16:31 . 2010-11-22 16:31        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\ArcSoft
2010-11-22 16:31 . 2010-11-22 16:32        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ArcSoft
2010-11-22 16:30 . 2010-11-22 16:30        --------        d-----w-        c:\programme\Gemeinsame Dateien\ArcSoft
2010-11-22 16:30 . 2010-11-22 16:30        --------        d-----w-        c:\programme\ArcSoft
2010-11-22 16:30 . 2005-04-27 15:36        245408        ----a-w-        c:\windows\system32\unicows.dll
2010-11-22 16:30 . 2004-05-04 10:53        1645320        ----a-w-        c:\windows\system32\gdiplus.dll
2010-11-22 16:30 . 2003-03-18 21:14        499712        ----a-r-        c:\windows\system32\msvcp71.dll
2010-11-22 16:30 . 2003-02-21 03:42        348160        ----a-w-        c:\windows\system32\msvcr71.dll
2010-11-22 16:30 . 2001-09-05 03:18        77824        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Engine\6\Intel 32\ctor.dll
2010-11-22 16:30 . 2001-09-05 03:18        225280        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\IScript\iscript.dll
2010-11-22 16:30 . 2001-09-05 03:14        176128        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Engine\6\Intel 32\iuser.dll
2010-11-22 16:30 . 2001-09-05 03:13        32768        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Engine\6\Intel 32\objectps.dll
2010-11-22 16:30 . 2002-07-25 15:07        614532        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\Engine\6\Intel 32\IKernel.exe
2010-11-22 16:29 . 2010-11-22 16:29        --------        d-----w-        c:\programme\Philips
2010-11-22 16:28 . 2010-11-22 16:32        --------        d-----w-        C:\temp
2010-11-22 11:43 . 2010-11-22 11:43        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Startmenü
2010-11-22 11:39 . 2010-11-22 11:39        --------        d-----w-        c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\Avira
2010-11-22 11:33 . 2010-08-02 15:09        126856        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2010-11-22 11:33 . 2010-06-17 14:27        45416        ----a-w-        c:\windows\system32\drivers\avgntdd.sys
2010-11-22 11:33 . 2010-06-17 14:27        22360        ----a-w-        c:\windows\system32\drivers\avgntmgr.sys
2010-11-22 11:33 . 2010-11-22 11:33        --------        d-----w-        c:\programme\Avira
2010-11-22 11:33 . 2010-11-22 11:33        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-22 11:43 . 2010-02-27 20:46        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2010-11-03 17:12 . 2010-11-03 17:12        103424        ----a-w-        c:\windows\system32\drivers\cmnsusbser.sys
2010-11-03 17:12 . 2010-11-03 17:12        52128        ----a-w-        c:\windows\system32\drivers\smsbda.sys
2010-11-03 17:12 . 2010-11-03 17:12        118272        ----a-w-        c:\windows\system32\drivers\cm_seramd.sys
2010-11-03 17:12 . 2010-11-03 17:12        103680        ----a-w-        c:\windows\system32\drivers\cm_ser32.sys
2010-11-03 17:11 . 2010-11-03 17:12        133120        ----a-w-        c:\windows\system32\drivers\cm_netamd.sys
2010-11-03 17:11 . 2010-11-03 17:12        112640        ----a-w-        c:\windows\system32\drivers\cm_net32.sys
2010-09-18 10:22 . 2010-09-18 10:22        974848        ----a-w-        c:\windows\system32\mfc42u.dll
2010-09-18 06:52 . 2010-10-20 14:36        954368        ----a-w-        c:\windows\system32\mfc40.dll
2010-09-18 06:52 . 2010-10-20 14:36        953856        ----a-w-        c:\windows\system32\mfc40u.dll
2010-09-18 06:52 . 2010-10-20 14:36        974848        ----a-w-        c:\windows\system32\mfc42.dll
.

------- Sigcheck -------

[7] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\atapi.sys
[7] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys

[7] 2008-04-15 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\asyncmac.sys
[7] 2008-04-15 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys

[7] 2008-04-15 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\ERDNT\cache\beep.sys
[7] 2008-04-15 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

[7] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\kbdclass.sys
[7] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys

[7] 2008-04-15 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ndis.sys
[7] 2008-04-15 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys

[7] 2008-04-15 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ntfs.sys
[7] 2008-04-15 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys

[7] 2008-04-15 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\ERDNT\cache\null.sys
[7] 2008-04-15 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\ERDNT\cache\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-15 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys

[7] 2008-04-15 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\browser.dll
[7] 2008-04-15 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll

[7] 2008-04-15 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\lsass.exe
[7] 2008-04-15 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe

[7] 2008-04-15 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\netman.dll
[7] 2008-04-15 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll

[7] 2008-04-15 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\windows\ERDNT\cache\qmgr.dll
[7] 2008-04-15 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll

[7] 2009-02-09 . D3D765E8455A961AE567B408F767D4F9 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
[7] 2009-02-09 . 3127AFBF2C1ED0AB14A1BBB7AAECB85B . 401408 . . [5.1.2600.5755] . . c:\windows\ERDNT\cache\rpcss.dll
[7] 2009-02-09 . 3127AFBF2C1ED0AB14A1BBB7AAECB85B . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[7] 2009-02-09 . 3127AFBF2C1ED0AB14A1BBB7AAECB85B . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[7] 2008-04-15 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll

[7] 2009-02-09 . A3EDBE9053889FB24AB22492472B39DC . 111104 . . [5.1.2600.5755] . . c:\windows\ERDNT\cache\services.exe
[7] 2009-02-09 . A3EDBE9053889FB24AB22492472B39DC . 111104 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[7] 2009-02-09 . A3EDBE9053889FB24AB22492472B39DC . 111104 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[7] 2009-02-09 . F0A7D59AF279326528715B206669B86C . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[7] 2008-04-15 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe

[7] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\ERDNT\cache\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe
[7] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
[7] 2008-04-15 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe

[7] 2008-04-15 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\winlogon.exe
[7] 2008-04-15 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[7] 2010-08-23 . 1438703F3D9FFE111DA3869E4F3EEE73 . 617472 . . [5.82] . . c:\windows\ERDNT\cache\comctl32.dll
[7] 2010-08-23 . 1438703F3D9FFE111DA3869E4F3EEE73 . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[7] 2010-08-23 . 2B6ADE29F8D00EEFA5FA2250CBE094AD . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[7] 2008-04-15 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll
[7] 2008-04-15 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2008-04-15 . 3C93CE6C6985C55952B7BE6673E9FD15 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

[7] 2008-04-15 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\cryptsvc.dll
[7] 2008-04-15 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll

[7] 2008-07-07 20:26 . AF4F6B5739D18CA7972AB53E091CBC74 . 253952 . . [2001.12.4414.706] . . c:\windows\ERDNT\cache\es.dll
[7] 2008-07-07 20:26 . AF4F6B5739D18CA7972AB53E091CBC74 . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[7] 2008-07-07 20:26 . AF4F6B5739D18CA7972AB53E091CBC74 . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[7] 2008-07-07 20:23 . ADA7241C16F3F42C7F210539FAD5F3AA . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
[7] 2008-04-15 12:00 . 0F3EDAEE1EF97CF3DB2BE23A7289B78C . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll

[7] 2008-04-15 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\imm32.dll
[7] 2008-04-15 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll

[7] 2009-03-21 . B055C64AABC1A3E3DE57EC8025CAD283 . 1063424 . . [5.1.2600.5781] . . c:\windows\ERDNT\cache\kernel32.dll
[7] 2009-03-21 . B055C64AABC1A3E3DE57EC8025CAD283 . 1063424 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[7] 2009-03-21 . B055C64AABC1A3E3DE57EC8025CAD283 . 1063424 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[7] 2009-03-21 . 3EB703BFC2ED26A3D8ACB8626AB2C006 . 1065472 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[7] 2008-04-15 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB959426$\kernel32.dll

[7] 2008-04-15 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\linkinfo.dll
[7] 2008-04-15 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll

[7] 2008-04-15 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\lpk.dll
[7] 2008-04-15 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll

[7] 2010-09-10 . 2EE27CDF8C897B5ABE5D86D1C03F1066 . 5957120 . . [8.00.6001.18975] . . c:\windows\ERDNT\cache\mshtml.dll
[7] 2010-09-10 . 2EE27CDF8C897B5ABE5D86D1C03F1066 . 5957120 . . [8.00.6001.18975] . . c:\windows\system32\mshtml.dll
[7] 2010-09-10 . 2EE27CDF8C897B5ABE5D86D1C03F1066 . 5957120 . . [8.00.6001.18975] . . c:\windows\system32\dllcache\mshtml.dll
[7] 2010-09-10 . FC277C347BBAAE912A5B0748B3504483 . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
[7] 2010-06-24 . 7CF74ED1A2C05369C67531E7855742CF . 5954560 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\mshtml.dll
[7] 2010-06-24 . AC2E0BBFA7C01FD7CBF858C764B745DE . 5951488 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\mshtml.dll
[7] 2010-05-06 . 91A9BB7F22F7D21E9C07E995C4E31F74 . 5950976 . . [8.00.6001.18928] . . c:\windows\ie8updates\KB2183461-IE8\mshtml.dll
[7] 2010-05-06 . A0091E83B21A4C2627D1DD1A64C1B4B9 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll
[7] 2010-02-25 . 2127D9862937DBD40882B9417DEB1837 . 5944832 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\mshtml.dll
[7] 2010-02-25 . 0A164AB476D7835335220D7A2AE5578B . 5946880 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\mshtml.dll
[7] 2009-12-21 . A947E6258FB5FBD0E5F58DA9541D7BE3 . 5942784 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\mshtml.dll
[7] 2009-12-21 . DDAAECF8E188A0E2DB93842A7D193641 . 5945856 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\mshtml.dll
[7] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB978207-IE8\mshtml.dll
[7] 2008-04-15 . 72AE55A9FFBC60650339CB12E35C7DD5 . 3066880 . . [6.00.2900.5512] . . c:\windows\ie8\mshtml.dll

[7] 2008-04-15 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\windows\ERDNT\cache\msvcrt.dll
[7] 2008-04-15 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[7] 2008-04-15 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[7] 2008-04-15 . C536AAD8A71608FE33CD956214EDD366 . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll

[-] 2008-06-20 . ACD8BD448A74F344D46FCAF21BAB92AF . 247296 . . [5.1.2600.5625] . . c:\windows\ERDNT\cache\mswsock.dll
[-] 2008-06-20 . ACD8BD448A74F344D46FCAF21BAB92AF . 247296 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . ACD8BD448A74F344D46FCAF21BAB92AF . 247296 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
[-] 2008-06-20 . 4AA50627B01C0E9C6B4C6BD3AF648F12 . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-04-15 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\mswsock.dll

[7] 2008-04-15 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\netlogon.dll
[7] 2008-04-15 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll

[7] 2008-04-15 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\windows\ERDNT\cache\powrprof.dll
[7] 2008-04-15 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll

[7] 2008-04-15 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\scecli.dll
[7] 2008-04-15 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll

[7] 2008-04-15 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\sfc.dll
[7] 2008-04-15 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll

[7] 2008-04-15 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\svchost.exe
[7] 2008-04-15 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe

[7] 2008-04-15 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\tapisrv.dll
[7] 2008-04-15 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll

[7] 2008-04-15 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\user32.dll
[7] 2008-04-15 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[7] 2008-04-15 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\userinit.exe
[7] 2008-04-15 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe

[7] 2010-09-10 . 41E62E6AA4D4C03322467FB0D2D29967 . 916480 . . [8.00.6001.18968] . . c:\windows\ERDNT\cache\wininet.dll
[7] 2010-09-10 . 41E62E6AA4D4C03322467FB0D2D29967 . 916480 . . [8.00.6001.18968] . . c:\windows\system32\wininet.dll
[7] 2010-09-10 . 41E62E6AA4D4C03322467FB0D2D29967 . 916480 . . [8.00.6001.18968] . . c:\windows\system32\dllcache\wininet.dll
[7] 2010-09-10 . 7B7028B726053782DD9B98B729515567 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
[7] 2010-06-24 . 1ACB8E6FAD2A8690CBB41D3229A2B27D . 919040 . . [8.00.6001.23037] . . c:\windows\$hf_mig$\KB2183461-IE8\SP3QFE\wininet.dll
[7] 2010-06-24 . 5AC0C1733D8C3DE781002F45A678E0FC . 916480 . . [8.00.6001.18939] . . c:\windows\ie8updates\KB2360131-IE8\wininet.dll
[7] 2010-05-06 . 12C5EEBBC10DB644B44131EE3ECBC430 . 916480 . . [8.00.6001.18923] . . c:\windows\ie8updates\KB2183461-IE8\wininet.dll
[7] 2010-05-06 . B5B9887088B8168D52CB28020CF05498 . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
[7] 2010-02-25 . 7857131DA01250E02BEE64F1163F6159 . 916480 . . [8.00.6001.18904] . . c:\windows\ie8updates\KB982381-IE8\wininet.dll
[7] 2010-02-25 . 3C41EB3A0EC8E2606B6C906993E11C29 . 919040 . . [8.00.6001.22995] . . c:\windows\$hf_mig$\KB980182-IE8\SP3QFE\wininet.dll
[7] 2009-12-21 . F2A70583964128530B7E86B1A13023A7 . 916480 . . [8.00.6001.18876] . . c:\windows\ie8updates\KB980182-IE8\wininet.dll
[7] 2009-12-21 . 5E3A3EB3BC5849BE4D5FE2B5F1869783 . 916480 . . [8.00.6001.22967] . . c:\windows\$hf_mig$\KB978207-IE8\SP3QFE\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB978207-IE8\wininet.dll
[7] 2008-04-15 . B4AEE98A48917B274FACFB78BBE0BC84 . 671744 . . [6.00.2900.5512] . . c:\windows\ie8\wininet.dll

[7] 2008-04-15 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ws2_32.dll
[7] 2008-04-15 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll

[7] 2008-04-15 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ws2help.dll
[7] 2008-04-15 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

[7] 2008-04-15 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[7] 2008-04-15 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\ERDNT\cache\explorer.exe

[7] 2010-07-16 . B28AF7976F2D8109C0DC2CF2460BEDC2 . 1288192 . . [5.1.2600.6010] . . c:\windows\ERDNT\cache\ole32.dll
[7] 2010-07-16 . B28AF7976F2D8109C0DC2CF2460BEDC2 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\ole32.dll
[7] 2010-07-16 . B28AF7976F2D8109C0DC2CF2460BEDC2 . 1288192 . . [5.1.2600.6010] . . c:\windows\system32\dllcache\ole32.dll
[7] 2010-07-16 . B3D7633CF83B09042A49810A7A72ADED . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
[7] 2008-04-15 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB979687$\ole32.dll

[7] 2010-04-16 . 45954AFB7AE6E29B23C56B830C820A11 . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[7] 2010-04-16 . 45954AFB7AE6E29B23C56B830C820A11 . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[7] 2010-04-16 . EB2AD9C7DADE6C63F5F933881BA2A430 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
[7] 2008-04-15 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\windows\$NtUninstallKB981322$\usp10.dll

[7] 2008-04-15 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\srsvc.dll
[7] 2008-04-15 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[7] 2008-04-15 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\wscntfy.exe
[7] 2008-04-15 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe

[7] 2008-04-15 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\xmlprov.dll
[7] 2008-04-15 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll

[7] 2008-04-15 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\eventlog.dll
[7] 2008-04-15 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll

[-] 2008-04-15 . 5251425B86EA4A3532B8BB8D14044E61 . 1571840 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\sfcfiles.dll
[-] 2008-04-15 . 5251425B86EA4A3532B8BB8D14044E61 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[7] 2008-04-15 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ctfmon.exe
[7] 2008-04-15 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[7] 2008-04-15 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\windows\ERDNT\cache\shsvcs.dll
[7] 2008-04-15 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\windows\system32\shsvcs.dll

[7] 2008-04-15 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\regsvc.dll
[7] 2008-04-15 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll

[7] 2008-04-15 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\schedsvc.dll
[7] 2008-04-15 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll

[7] 2008-04-15 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ssdpsrv.dll
[7] 2008-04-15 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll

[7] 2008-04-15 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\termsrv.dll
[7] 2008-04-15 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll

[7] 2008-04-15 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\windows\ERDNT\cache\acpiec.sys
[7] 2008-04-15 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[7] 2008-04-13 20:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ERDNT\cache\aec.sys
[7] 2008-04-13 20:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys

[7] 2008-04-14 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\AGP440.SYS
[7] 2008-04-14 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\AGP440.SYS

[7] 2008-04-15 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\ip6fw.sys
[7] 2008-04-15 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys

[7] 2010-09-18 07:18 . 4891FCDAE77486BFB56999AA217651FA . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[7] 2010-09-18 06:52 . 1614669828A32BCD06E1BE6F334BB888 . 953856 . . [4.1.6151] . . c:\windows\ERDNT\cache\mfc40u.dll
[7] 2010-09-18 06:52 . 1614669828A32BCD06E1BE6F334BB888 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[7] 2008-04-15 12:00 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll

[7] 2008-04-15 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\msgsvc.dll
[7] 2008-04-15 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll

[7] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\ERDNT\cache\mspmsnsv.dll
[7] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[7] 2010-04-28 . 4EACA49489EB3C4A2E83C5546EB5884C . 2069248 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[7] 2010-04-28 . 989290FBD9A7E90CD8B8E9C96817804D . 2069120 . . [5.1.2600.5973] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[7] 2010-04-28 . 989290FBD9A7E90CD8B8E9C96817804D . 2069120 . . [5.1.2600.5973] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2010-04-28 . 6D8D53C3EE866AB72AC73A68808E7371 . 2027008 . . [5.1.2600.5973] . . c:\windows\ERDNT\cache\ntkrnlpa.exe
[7] 2010-04-28 . 6D8D53C3EE866AB72AC73A68808E7371 . 2027008 . . [5.1.2600.5973] . . c:\windows\system32\ntkrnlpa.exe
[7] 2010-02-16 . 1DFCBCFD1C9016C051BE6D7243459CCA . 2027008 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntkrnlpa.exe
[7] 2010-02-16 . CEE28C8C47E52F185F9F8F3A2E31880C . 2069248 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe
[7] 2009-12-10 . 2E72317A93EF61138E43DCF7CD423EDF . 2068480 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165-v2\SP3QFE\ntkrnlpa.exe
[7] 2009-12-09 . 1143EBE276EA80A88942A21613078088 . 2026496 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe
[7] 2009-08-04 . C50ED62BB5CDC5AD4F3985ED39C6AE87 . 2068480 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[7] 2009-08-04 . 1FF1F43613BA7510A5A975ED034EB8E0 . 2026496 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165-v2$\ntkrnlpa.exe
[7] 2009-02-09 . 1F9DA92672B8B5720C5FB1E87D8F249F . 2068480 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-04-15 . FEFB3BDA35CF469809B0C89AB6833AFC . 2026496 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe

[7] 2008-04-15 12:00 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\windows\ERDNT\cache\ntmssvc.dll
[7] 2008-04-15 12:00 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll

[7] 2008-04-15 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\upnphost.dll
[7] 2008-04-15 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll

[7] 2008-04-15 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\windows\ERDNT\cache\dsound.dll
[7] 2008-04-15 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll

[-] 2008-04-15 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\windows\ERDNT\cache\d3d9.dll
[-] 2008-04-15 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll

[7] 2008-04-15 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\windows\ERDNT\cache\ddraw.dll
[7] 2008-04-15 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll

[7] 2008-04-15 12:00 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\olepro32.dll
[7] 2008-04-15 12:00 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll

[7] 2008-04-15 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\perfctrs.dll
[7] 2008-04-15 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll

[7] 2008-04-15 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\version.dll
[7] 2008-04-15 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll

[7] 2010-04-28 . FE9DA2C577DF69771B31183EF5684BE8 . 2192256 . . [5.1.2600.5973] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[7] 2010-04-28 . FE9DA2C577DF69771B31183EF5684BE8 . 2192256 . . [5.1.2600.5973] . . c:\windows\system32\dllcache\ntoskrnl.exe
[7] 2010-04-28 . 490911C4B913989D4958543FED2C8F21 . 2148864 . . [5.1.2600.5973] . . c:\windows\ERDNT\cache\ntoskrnl.exe
[7] 2010-04-28 . 490911C4B913989D4958543FED2C8F21 . 2148864 . . [5.1.2600.5973] . . c:\windows\system32\ntoskrnl.exe
[7] 2010-04-28 . 6AF2E8CEB03F7CB3B8183359563DBB87 . 2192384 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[7] 2010-02-16 . E1BD0FAFF2C1D0A825CBA97DCF0DDDAE . 2148864 . . [5.1.2600.5938] . . c:\windows\$NtUninstallKB981852$\ntoskrnl.exe
[7] 2010-02-16 . 4456016C2FF1A8CCCAC8309C9B76E2F5 . 2192384 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe
[7] 2009-12-10 . A97847B2D30F4A299B35239D26BAD948 . 2191616 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165-v2\SP3QFE\ntoskrnl.exe
[7] 2009-12-09 . D4128AA197DD8F3120FC80008AB66CF7 . 2147840 . . [5.1.2600.5913] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe
[7] 2009-08-04 . 96D6882D49438D58B0DE0F7E8C8D241B . 2147840 . . [5.1.2600.5857] . . c:\windows\$NtUninstallKB977165-v2$\ntoskrnl.exe
[7] 2009-08-04 . 4B86421F2D85D9A4ECB06885C40B8EEB . 2191616 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[7] 2009-02-10 . D3453310FC92736E674FFDC6E3F455B7 . 2191488 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2008-04-15 . 88077F757C6C793C33408D878B6E0F76 . 2147840 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB971486$\ntoskrnl.exe

[7] 2008-04-15 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\ERDNT\cache\srsvc.dll
[7] 2008-04-15 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[7] 2008-04-15 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll

[7] 2008-04-15 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
.
(((((((((((((((((((((((((((((  SnapShot@2010-11-08_16.48.53  )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 23:02 . 2009-07-11 23:02        51008              c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        59728              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        42832              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        43344              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        61264              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        62800              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        61760              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        61776              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        53568              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        63296              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        36688              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        35648              c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05        59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05        59904              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
+ 2010-12-14 13:48 . 2010-12-14 13:48        16384              c:\windows\temp\Perflib_Perfdata_32c.dat
+ 2009-04-10 22:57 . 2010-11-20 16:21        67646              c:\windows\system32\perfc009.dat
- 2009-04-10 22:57 . 2010-11-06 16:39        67646              c:\windows\system32\perfc009.dat
- 2009-04-10 22:57 . 2010-11-06 16:39        80488              c:\windows\system32\perfc007.dat
+ 2009-04-10 22:57 . 2010-11-20 16:21        80488              c:\windows\system32\perfc007.dat
- 2010-02-27 20:46 . 2009-05-11 08:12        28520              c:\windows\system32\drivers\ssmdrv.sys
+ 2010-11-22 11:33 . 2010-06-17 14:27        28520              c:\windows\system32\drivers\ssmdrv.sys
+ 2010-11-08 22:17 . 2010-11-08 22:17        21504              c:\windows\Installer\28aeb73.msi
+ 2009-07-11 23:02 . 2009-07-11 23:02        653120              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        569664              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05        225280              c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        159032              c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
+ 2009-04-10 22:57 . 2010-11-20 16:21        432690              c:\windows\system32\perfh009.dat
- 2009-04-10 22:57 . 2010-11-06 16:39        432690              c:\windows\system32\perfh009.dat
+ 2009-04-10 22:57 . 2010-11-20 16:21        448970              c:\windows\system32\perfh007.dat
- 2009-04-10 22:57 . 2010-11-06 16:39        448970              c:\windows\system32\perfh007.dat
+ 2010-11-22 11:32 . 2010-11-22 11:32        219648              c:\windows\Installer\e1212.msi
+ 2009-07-11 23:02 . 2009-07-11 23:02        3780424              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02        3765048              c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2010-02-22 26101032]
"ISUSPM"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-10-25 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"HP BTW Detect Program"="c:\programme\HP\HPBTWD.exe" [2009-03-30 319488]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2009-01-16 1418536]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-07-06 737280]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"WirelessAssistant"="c:\programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-01-11 246504]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"ArcSoft Connection Service"="c:\programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

c:\dokumente und einstellungen\Kirsten\Startmen\Programme\Autostart\
OpenOffice.org 3.2.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Philips GoGear SA1VBExxA Device Manager.lnk - c:\programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe [2010-11-22 1611120]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\Hewlett-Packard\\HP QuickSync\\jre\\bin\\javaw.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

R2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [2010-11-08 136176]
R3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\DRIVERS\cmnsusbser.sys [2010-11-03 103424]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys [2008-11-22 160256]
R3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
S0 SahdIa32;HDD Filter Driver;c:\windows\System32\Drivers\SahdIa32.sys [2009-06-01 21488]
S0 SaibIa32;Volume Filter Driver;c:\windows\System32\Drivers\SaibIa32.sys [2009-06-01 15856]
S0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [2009-07-01 103792]
S1 SaibVd32;Virtual Disk Driver;c:\windows\system32\Drivers\SaibVd32.sys [2009-06-01 25584]
S1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2009-06-02 457200]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [2010-08-02 135336]
S2 BOTService;BOTService;c:\programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2009-07-09 199152]
S2 WTGService;WTGService;c:\programme\XSManager\WTGService.exe [2010-04-12 329168]
S3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-04-21 113664]
S3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1c51x86.sys [2009-03-31 39424]

.
Inhalt des "geplante Tasks" Ordners

2010-12-13 c:\windows\Tasks\BackOnTrack Instant Restore Idle.job
- c:\programme\Roxio\BackOnTrack\Instant Restore\RstIdle.exe [2009-07-09 02:09]

2010-12-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-11-08 16:12]

2010-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-11-08 16:12]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE: &AOL Toolbar-Suche - c:\dokumente und einstellungen\All Users\Anwendungsdaten\AOL\ieToolbar\resources\de-DE\local\search.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\
FF - component: c:\programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox\components\nsURLRecordEx.dll
FF - component: c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\programme\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Extension: Zotero: zotero@chnm.gmu.edu - c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\zotero@chnm.gmu.edu
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\dokumente und einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Extension: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Extension: Internet Video Downloader: {B728AB94-9BC7-49b7-B76A-422BB31B2FD0} - c:\programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray.exe
SafeBoot-Wdf01000.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-12-14 15:03
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD16 rev.13.0 -> Harddisk0\DR0 -> \Device\Ide\iaStor0

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys SahdIa32.sys >>UNKNOWN [0x85132EC5]<<
c:\dokume~1\Kirsten\LOKALE~1\Temp\catchme.sys 
c:\windows\system32\drivers\SahdIa32.sys Sonic Solutions
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x81aaa872; SUB DWORD [EBP-0x4], 0x81aaa12e; PUSH EDI; CALL 0xffffffffffffdf33;  }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x86574AB8]
3 CLASSPNP[0xF75C8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x86574020]
5 SahdIa32[0xF75E9939] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x86575028]
[0x85AE1CA8] -> IRP_MJ_CREATE -> 0x85132EC5
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0;  }
detected disk devices:
\Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskWDC_WD1600BEVT-60ZCT1___________________13.01A13#4&9cf173c&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\iaStor DriverStartIo -> 0x85132AEA
user & kernel MBR OK
sectors 312581806 (+255): user != kernel
Warning: possible TDL3 rootkit infection !

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
@DACL=(02 0000)
@="Microsoft-Datenträgerkontingent"
"NoMachinePolicy"=dword:00000000
"NoUserPolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"RequiresSuccessfulRegistry"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000000
"DllName"=expand:"dskquota.dll"
"ProcessGroupPolicy"="ProcessGroupPolicy"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
@DACL=(02 0000)
@="Internet Explorer Zonemapping"
"DllName"="c:\\WINDOWS\\system32\\iedkcs32.dll"
"ProcessGroupPolicy"="ProcessGroupPolicyForZoneMap"
"NoGPOListChanges"=dword:00000001
"RequiresSucessfulRegistry"=dword:00000001
"DisplayName"="@c:\\WINDOWS\\system32\\iedkcs32.dll.mui,-3051"
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}]
@DACL=(02 0000)
@SACL=
@="Internet Explorer User Accelerators"
"DisplayName"="@c:\\WINDOWS\\system32\\iedkcs32.dll.mui,-3051"
"DllName"="c:\\WINDOWS\\system32\\iedkcs32.dll"
"NoGPOListChanges"=dword:00000001
"ProcessGroupPolicy"="ProcessGroupPolicyForActivities"
"ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx"
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
@DACL=(02 0000)
"ProcessGroupPolicy"="SceProcessSecurityPolicyGPO"
"GenerateGroupPolicy"="SceGenerateGroupPolicy"
"ExtensionRsopPlanningDebugLevel"=dword:00000001
"ProcessGroupPolicyEx"="SceProcessSecurityPolicyGPOEx"
"ExtensionDebugLevel"=dword:00000001
"DllName"=expand:"scecli.dll"
@="Security"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000001
"MaxNoGPOListChangesInterval"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
@DACL=(02 0000)
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"ProcessGroupPolicy"="ProcessGroupPolicy"
"DllName"="c:\\WINDOWS\\system32\\iedkcs32.dll"
@="Internet Explorer Branding"
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000001
"NoMachinePolicy"=dword:00000001
"DisplayName"="@c:\\WINDOWS\\system32\\iedkcs32.dll.mui,-3014"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
@DACL=(02 0000)
"ProcessGroupPolicy"="SceProcessEFSRecoveryGPO"
"DllName"=expand:"scecli.dll"
@="EFS recovery"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}]
@DACL=(02 0000)
@="802.3 Group Policy"
"DisplayName"=expand:"@dot3gpclnt.dll,-100"
"ProcessGroupPolicyEx"="ProcessLANPolicyEx"
"GenerateGroupPolicy"="GenerateLANPolicy"
"DllName"=expand:"dot3gpclnt.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
@DACL=(02 0000)
@="Microsoft Offline Files"
"DllName"=expand:"%SystemRoot%\\System32\\cscui.dll"
"EnableAsynchronousProcessing"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000000
"NoMachinePolicy"=dword:00000000
"NoSlowLink"=dword:00000000
"NoUserPolicy"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
@DACL=(02 0000)
@="Softwareinstallation"
"DllName"=expand:"appmgmts.dll"
"ProcessGroupPolicyEx"="ProcessGroupPolicyObjectsEx"
"GenerateGroupPolicy"="GenerateGroupPolicy"
"NoBackgroundPolicy"=dword:00000000
"RequiresSucessfulRegistry"=dword:00000000
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"EventSources"=multi:"(Application Management,Application)\00(MsiInstaller,Application)\00\00"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}]
@DACL=(02 0000)
@SACL=
@="Internet Explorer Machine Accelerators"
"DisplayName"="@c:\\WINDOWS\\system32\\iedkcs32.dll.mui,-3051"
"DllName"="c:\\WINDOWS\\system32\\iedkcs32.dll"
"NoGPOListChanges"=dword:00000001
"ProcessGroupPolicy"="ProcessGroupPolicyForActivities"
"ProcessGroupPolicyEx"="ProcessGroupPolicyForActivitiesEx"
"RequiresSuccessfulRegistry"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
@DACL=(02 0000)
"DllName"="c:\\Programme\\SUPERAntiSpyware\\SASWINLO.DLL"
"Logon"="SABWINLOLogon"
"Logoff"="SABWINLOLogoff"
"Startup"="SABWINLOStartup"
"Shutdown"="SABWINLOShutdown"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=expand:"crypt32.dll"
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=expand:"cryptnet.dll"
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
@DACL=(02 0000)
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
@DACL=(02 0000)
"Asynchronous"=dword:00000001
"DllName"=expand:"%SystemRoot%\\System32\\dimsntfy.dll"
"Startup"="WlDimsStartup"
"Shutdown"="WlDimsShutdown"
"Logon"="WlDimsLogon"
"Logoff"="WlDimsLogoff"
"StartShell"="WlDimsStartShell"
"Lock"="WlDimsLock"
"Unlock"="WlDimsUnlock"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@DACL=(02 0000)
@SACL=
@=""
"DLLName"="igfxdev.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
@DACL=(02 0000)
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"DllName"=expand:"wlnotify.dll"
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
@DACL=(02 0000)
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=expand:"sclgntfy.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
@DACL=(02 0000)
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
@DACL=(02 0000)
"Asynchronous"=dword:00000000
"DllName"=expand:"wlnotify.dll"
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
@DACL=(02 0000)
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList]
@DACL=(02 0000)
"Hilfeassistent"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"HelpAssistant"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'explorer.exe'(1816)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2010-12-14  15:21:37
ComboFix-quarantined-files.txt  2010-12-14 14:21
ComboFix2.txt  2010-11-08 16:59

Vor Suchlauf: 15 Verzeichnis(se), 119.740.334.080 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 119.726.301.184 Bytes frei

- - End Of File - - 42E40CD97E06E0682D27C558BA455972
--- --- ---

Viele Grüße,
kiki

cosinus 14.12.2010 15:57
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

kiki82 15.12.2010 01:23
Hallo Arne,

erstmal vielen lieben Dank, dass Du mir weiterhilfst!

Hier kommen die Logs von Osam und MBRCheck; GMER ist leider abgestürzt.

Osam Log:
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:45:39 on 14.12.2010

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.12

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"BackOnTrack Instant Restore Idle.job" - "Sonic Solutions" - C:\Programme\Roxio\BackOnTrack\Instant Restore\RstIdle.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"hpBat.cpl" - ? - C:\WINDOWS\system32\hpBat.cpl  (File found, but it contains no detailed information)
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"hpBat.CPL" - ? - C:\Programme\Hewlett-Packard\HP BatteryCheck\hpBat.CPL  (File not found)

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Kirsten\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Realtek IR Driver" (Rts516xIR) - ? - C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys  (File not found)
"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys  (File not found)
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"SysCow" (SysCow) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\syscow32x.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "AOL Toolbar" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{DE9C389F-3316-41A7-809B-AA305ED9D922} "AOL Toolbar" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} "AOL Toolbar BHO" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
{11222041-111B-46E3-BD29-EFB2449479B1} "IEPlugin Class" - "ArcSoft, Inc." - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Philips GoGear SA1VBExxA Device Manager.lnk" - "Philips" - C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\desktop.ini
"OpenOffice.org 3.2.lnk" - ? - C:\Programme\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM" - "Macrovision Corporation" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
"Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ArcSoft Connection Service" - "ArcSoft Inc." - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"HP BTW Detect Program" - ? - C:\Programme\HP\HPBTWD.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"WirelessAssistant" - "Hewlett-Packard" - C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"BOTService" (BOTService) - "Sonic Solutions" - C:\Programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe
"GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Programme\HP Games\HP Game Console\GameConsoleService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Roxio SAIB Service" (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - ? - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"WTGService" (WTGService) - ? - C:\Programme\XSManager\WTGService.exe  (File found, but it contains no detailed information)

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{B587E2B1-4D59-4e7e-AED9-22B9DF11D053} "802.3 Group Policy" - "Microsoft Corporation" - C:\WINDOWS\system32\dot3gpclnt.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} "EFS recovery" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} "Internet Explorer Branding" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} "Internet Explorer Machine Accelerators" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{7B849a69-220F-451E-B3FE-2CB811AF94AE} "Internet Explorer User Accelerators" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} "Internet Explorer Zonemapping" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{C631DF4C-088F-4156-B058-4375F0853CD8} "Microsoft Offline Files" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{3610eda5-77ef-11d2-8dc5-00c04fa31a66} "Microsoft-Datenträgerkontingent" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquota.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{827D319E-6EAC-11D2-A4EA-00C04F79F83A} "Security" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (Hidden registry entry, rootkit activity | File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL  (Hidden registry entry, rootkit activity)
"crypt32chain" - "Microsoft Corporation" - C:\WINDOWS\system32\crypt32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"cryptnet" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptnet.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"cscdll" - "Microsoft Corporation" - C:\WINDOWS\system32\cscdll.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"dimsntfy" - "Microsoft Corporation" - C:\WINDOWS\System32\dimsntfy.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"igfxcui" - "Intel Corporation" - C:\WINDOWS\system32\igfxdev.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ScCertProp" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Schedule" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"sclgntfy" - "Microsoft Corporation" - C:\WINDOWS\system32\sclgntfy.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"SensLogn" - "Microsoft Corporation" - C:\WINDOWS\system32\WlNotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"termsrv" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"wlballoon" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBRCheck Log:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x00000004

Kernel Drivers (total 123):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xF7A88000 \WINDOWS\system32\KDCOM.DLL
0xF7998000 \WINDOWS\system32\BOOTVID.dll
0xF7458000 ACPI.sys
0xF7A8A000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7447000 pci.sys
0xF7588000 isapnp.sys
0xF799C000 compbatt.sys
0xF79A0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7B50000 pciide.sys
0xF7808000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7A8C000 aliide.sys
0xF7A8E000 viaide.sys
0xF7A90000 intelide.sys
0xF7598000 MountMgr.sys
0xF7428000 ftdisk.sys
0xF79A4000 ACPIEC.sys
0xF7B51000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7810000 PartMgr.sys
0xF75A8000 VolSnap.sys
0xF734E000 iaStor.sys
0xF75B8000 disk.sys
0xF75C8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF732E000 fltMgr.sys
0xF7316000 syscow32x.sys
0xF7304000 sr.sys
0xF75D8000 PxHelp20.sys
0xF72ED000 KSecDD.sys
0xF7260000 Ntfs.sys
0xF7233000 NDIS.sys
0xF7818000 SaibIa32.sys
0xF75E8000 SahdIa32.sys
0xF7219000 Mup.sys
0xF77E8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF5F72000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xF5F5E000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF5F36000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF5D8B000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
0xF77F8000 \SystemRoot\system32\DRIVERS\l1c51x86.sys
0xF78A8000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF5D67000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78B0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7628000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78B8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF5D36000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7AC6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7638000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xF5CBA000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF78C0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF714D000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7149000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7CA1000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7648000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7A40000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF5CA3000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7658000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7668000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78C8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5C92000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7678000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78D0000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78D8000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7688000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7AC8000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5C6F000 \SystemRoot\system32\DRIVERS\ks.sys
0xF5C11000 \SystemRoot\system32\DRIVERS\update.sys
0xF6EB8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7698000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xA9281000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xA7CD8000 \SystemRoot\system32\drivers\sthda.sys
0xA7CB4000 \SystemRoot\system32\drivers\portcls.sys
0xA9271000 \SystemRoot\system32\drivers\drmk.sys
0xA7C98000 \SystemRoot\system32\drivers\AESTAud.sys
0xF71F1000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7B46000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x9FE82000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B48000 \SystemRoot\System32\Drivers\Beep.SYS
0xA35FD000 \SystemRoot\System32\drivers\vga.sys
0xF7B4A000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B4C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xA35F5000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA35ED000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF71ED000 \SystemRoot\system32\DRIVERS\rasacd.sys
0x9D4AF000 \SystemRoot\system32\DRIVERS\ipsec.sys
0x9D456000 \SystemRoot\system32\DRIVERS\tcpip.sys
0x9D406000 \SystemRoot\system32\DRIVERS\netbt.sys
0x9D3E0000 \SystemRoot\system32\DRIVERS\ipnat.sys
0x9D3BE000 \SystemRoot\System32\drivers\afd.sys
0x9D210000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0xA3877000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xA35E5000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0xA3867000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA35D5000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x9D1EE000 \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
0xA35CD000 \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
0xA3857000 \SystemRoot\System32\Drivers\SaibVd32.sys
0x9D1C3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x9D153000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA00AF000 \SystemRoot\System32\Drivers\Fips.SYS
0x9D130000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7AF0000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0x97731000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9624D000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x98160000 \SystemRoot\System32\drivers\Dxapi.sys
0x97B4E000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C63000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0x96238000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9665E000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x961FB000 \SystemRoot\system32\drivers\wdmaud.sys
0x96996000 \SystemRoot\system32\drivers\sysaudio.sys
0x96060000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0x95CE8000 \SystemRoot\system32\DRIVERS\srv.sys
0x9599D000 \SystemRoot\system32\drivers\kmixer.sys
0x97BDD000 \SystemRoot\system32\drivers\splitter.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 51):
0 System Idle Process
4 System
764 C:\WINDOWS\system32\smss.exe
812 csrss.exe
836 C:\WINDOWS\system32\winlogon.exe
880 C:\WINDOWS\system32\services.exe
892 C:\WINDOWS\system32\lsass.exe
1064 C:\WINDOWS\system32\svchost.exe
1160 svchost.exe
1216 C:\Programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe
1380 svchost.exe
1428 svchost.exe
1472 C:\WINDOWS\explorer.exe
1812 C:\Programme\IDT\WDM\stacsv.exe
516 C:\Programme\Avira\AntiVir Desktop\sched.exe
644 svchost.exe
724 C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
168 C:\WINDOWS\system32\igfxtray.exe
1012 C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
1008 C:\WINDOWS\system32\hkcmd.exe
1092 C:\WINDOWS\system32\igfxpers.exe
1100 C:\Programme\HP\HPBTWD.exe
1084 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
1308 C:\WINDOWS\system32\AESTFltr.exe
1352 C:\Programme\Avira\AntiVir Desktop\avguard.exe
1368 C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
1376 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
1392 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
1296 C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
1412 C:\Programme\Skype\Phone\Skype.exe
1444 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
1552 C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
1620 C:\WINDOWS\system32\ctfmon.exe
1500 C:\WINDOWS\system32\igfxsrvc.exe
1908 C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe
1988 C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ArcCon.ac
208 C:\Programme\Java\jre6\bin\jqs.exe
224 C:\Programme\Google\Update\GoogleUpdate.exe
244 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
252 C:\Programme\OpenOffice.org 3\program\soffice.exe
540 C:\WINDOWS\system32\svchost.exe
436 C:\Programme\OpenOffice.org 3\program\soffice.bin
1548 C:\Programme\XSManager\WTGService.exe
3072 C:\Programme\Hewlett-Packard\Shared\hpqWmiEx.exe
3296 C:\WINDOWS\system32\wbem\wmiapsrv.exe
3392 alg.exe
3568 C:\Programme\Hewlett-Packard\Shared\HpqToaster.exe
2244 C:\WINDOWS\system32\spoolsv.exe
1240 C:\Programme\Avira\AntiVir Desktop\avcenter.exe
692 C:\Programme\Avira\AntiVir Desktop\avwsc.exe
2820 C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: WDCWD1600BEVT-60ZCT1, Rev: 13.01A13

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

Viele Grüße,
kiki

cosinus 15.12.2010 12:00
Ok. Probier combofix bitte mit einer neu heruntergeladenen cofi.exe nochmal aus.

kiki82 17.12.2010 11:04
Hallo Arne,

Combofix habe ich neu heruntergeladen und gestartet. Das Programm lief sehr lange- mehr als 12 Stunden und meldete, dass nach infizierten Dateien gesucht wird. Als ich zur Uni musste, habe ich den Rechner weiterlaufen lassen, um Combofix nicht zu unterbrechen.
Danach lief er im Ruhemodus und hat sich schließlich aufgehangen. Es erschien die Nachricht, dass nur PCxy oder ein Administrator die Computersperre aufheben kann. Ich drückte auf Enter, doch dann tat sich gar nichts mehr. Ich musste schließlich warten, bis die Batterie leer war, um ihn neu starten zu können.
Soll ich es nochmal mit Combofix versuchen?

Viele Grüße,
kiki

cosinus 17.12.2010 11:08
Nee lass CF jetzt weg.
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

kiki82 17.12.2010 12:41
Hallo Arne,

okay, habe ich durchgeführt. Anbei poste ich Dir die Logs.

OSAM Logfile:
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 11:37:45 on 17.12.2010

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.12

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"BackOnTrack Instant Restore Idle.job" - "Sonic Solutions" - C:\Programme\Roxio\BackOnTrack\Instant Restore\RstIdle.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"hpBat.cpl" - ? - C:\WINDOWS\system32\hpBat.cpl  (File found, but it contains no detailed information)
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"hpBat.CPL" - ? - C:\Programme\Hewlett-Packard\HP BatteryCheck\hpBat.CPL  (File not found)

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Kirsten\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Realtek IR Driver" (Rts516xIR) - ? - C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys  (File not found)
"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys  (File not found)
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"SysCow" (SysCow) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\syscow32x.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "AOL Toolbar" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{DE9C389F-3316-41A7-809B-AA305ED9D922} "AOL Toolbar" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} "AOL Toolbar BHO" - "AOL LLC" - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll
{11222041-111B-46E3-BD29-EFB2449479B1} "IEPlugin Class" - "ArcSoft, Inc." - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Philips GoGear SA1VBExxA Device Manager.lnk" - "Philips" - C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\desktop.ini
"OpenOffice.org 3.2.lnk" - ? - C:\Programme\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM" - "Macrovision Corporation" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
"Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ArcSoft Connection Service" - "ArcSoft Inc." - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"HP BTW Detect Program" - ? - C:\Programme\HP\HPBTWD.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"WirelessAssistant" - "Hewlett-Packard" - C:\Programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"BOTService" (BOTService) - "Sonic Solutions" - C:\Programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe
"GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Programme\HP Games\HP Game Console\GameConsoleService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Roxio SAIB Service" (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - ? - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"WTGService" (WTGService) - ? - C:\Programme\XSManager\WTGService.exe  (File found, but it contains no detailed information)

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{B587E2B1-4D59-4e7e-AED9-22B9DF11D053} "802.3 Group Policy" - "Microsoft Corporation" - C:\WINDOWS\system32\dot3gpclnt.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} "EFS recovery" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} "Internet Explorer Branding" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D} "Internet Explorer Machine Accelerators" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{7B849a69-220F-451E-B3FE-2CB811AF94AE} "Internet Explorer User Accelerators" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} "Internet Explorer Zonemapping" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{C631DF4C-088F-4156-B058-4375F0853CD8} "Microsoft Offline Files" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{3610eda5-77ef-11d2-8dc5-00c04fa31a66} "Microsoft-Datenträgerkontingent" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquota.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{827D319E-6EAC-11D2-A4EA-00C04F79F83A} "Security" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (Hidden registry entry, rootkit activity | File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL  (Hidden registry entry, rootkit activity)
"crypt32chain" - "Microsoft Corporation" - C:\WINDOWS\system32\crypt32.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"cryptnet" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptnet.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"cscdll" - "Microsoft Corporation" - C:\WINDOWS\system32\cscdll.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"dimsntfy" - "Microsoft Corporation" - C:\WINDOWS\System32\dimsntfy.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"igfxcui" - "Intel Corporation" - C:\WINDOWS\system32\igfxdev.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"ScCertProp" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Schedule" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"sclgntfy" - "Microsoft Corporation" - C:\WINDOWS\system32\sclgntfy.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"SensLogn" - "Microsoft Corporation" - C:\WINDOWS\system32\WlNotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"termsrv" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"wlballoon" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll  (Hidden registry entry, rootkit activity | File signed by Microsoft)

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru


GMER Logfile:
GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2010-12-17 12:19:31
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\iaStor0 WDC_WD16 rev.13.0
Running: wbhqtxmy.exe; Driver: C:\DOKUME~1\Kirsten\LOKALE~1\Temp\fftorfow.sys


---- System - GMER 1.0.15 ----

SSDT            F7CA1EBE                                                                                                                                                ZwCreateKey
SSDT            F7CA1EB4                                                                                                                                                ZwCreateThread
SSDT            F7CA1EC3                                                                                                                                                ZwDeleteKey
SSDT            F7CA1ECD                                                                                                                                                ZwDeleteValueKey
SSDT            F7CA1ED2                                                                                                                                                ZwLoadKey
SSDT            F7CA1EA0                                                                                                                                                ZwOpenProcess
SSDT            F7CA1EA5                                                                                                                                                ZwOpenThread
SSDT            F7CA1EDC                                                                                                                                                ZwReplaceKey
SSDT            F7CA1ED7                                                                                                                                                ZwRestoreKey
SSDT            F7CA1EC8                                                                                                                                                ZwSetValueKey
SSDT            \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com)                                                ZwTerminateProcess [0x9DBFB620]

---- Kernel code sections - GMER 1.0.15 ----

.rsrc          C:\WINDOWS\System32\drivers\afd.sys                                                                                                                      entry point in ".rsrc" section [0x9DC32C94]

---- Devices - GMER 1.0.15 ----

Device                                                                                                                                                                  Ntfs.sys (NT File System Driver/Microsoft Corporation)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                                  wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                                  wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                                                  SaibIa32.sys (Disk Filter Driver/Sonic Solutions)

Device          \Driver\iaStor -> DriverStartIo \Device\Ide\iaStor0                                                                                                      85162AEA
Device                                                                                                                                                                  mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device          \Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskWDC_WD1600BEVT-60ZCT1___________________13.01A13#4&9cf173c&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}  device not found

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout                                                                      15
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                                                                          10000
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                                                                                        yes
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                                                                                     
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout                                                                      90
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota                                                                        10000
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs                                                                      1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@                                          Microsoft-Datentr?gerkontingent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@NoMachinePolicy                          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@NoUserPolicy                              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@NoSlowLink                                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@NoBackgroundPolicy                        1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@PerUserLocalSettings                      0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@RequiresSuccessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@EnableAsynchronousProcessing              0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@DllName                                  dskquota.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}@ProcessGroupPolicy                        ProcessGroupPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@                                          Internet Explorer Zonemapping
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@DllName                                  C:\WINDOWS\system32\iedkcs32.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@ProcessGroupPolicy                        ProcessGroupPolicyForZoneMap
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@RequiresSucessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@DisplayName                              @C:\WINDOWS\system32\iedkcs32.dll.mui,-3051
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}@RequiresSuccessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@                                          Internet Explorer User Accelerators
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@DisplayName                              @C:\WINDOWS\system32\iedkcs32.dll.mui,-3051
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@DllName                                  C:\WINDOWS\system32\iedkcs32.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@ProcessGroupPolicy                        ProcessGroupPolicyForActivities
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@ProcessGroupPolicyEx                      ProcessGroupPolicyForActivitiesEx
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}@RequiresSuccessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@ProcessGroupPolicy                        SceProcessSecurityPolicyGPO
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@GenerateGroupPolicy                      SceGenerateGroupPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@ExtensionRsopPlanningDebugLevel          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@ProcessGroupPolicyEx                      SceProcessSecurityPolicyGPOEx
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@ExtensionDebugLevel                      1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@DllName                                  scecli.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@                                          Security
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@NoUserPolicy                              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@EnableAsynchronousProcessing              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}@MaxNoGPOListChangesInterval              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@ProcessGroupPolicyEx                      ProcessGroupPolicyEx
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@GenerateGroupPolicy                      GenerateGroupPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@ProcessGroupPolicy                        ProcessGroupPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@DllName                                  C:\WINDOWS\system32\iedkcs32.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@                                          Internet Explorer Branding
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@NoSlowLink                                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@NoBackgroundPolicy                        0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@NoMachinePolicy                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}@DisplayName                              @C:\WINDOWS\system32\iedkcs32.dll.mui,-3014
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}@ProcessGroupPolicy                        SceProcessEFSRecoveryGPO
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}@DllName                                  scecli.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}@                                          EFS recovery
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}@NoUserPolicy                              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}@RequiresSuccessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@                                          802.3 Group Policy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@DisplayName                              @dot3gpclnt.dll,-100
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@ProcessGroupPolicyEx                      ProcessLANPolicyEx
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@GenerateGroupPolicy                      GenerateLANPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@DllName                                  dot3gpclnt.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@NoUserPolicy                              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@                                          Microsoft Offline Files
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@DllName                                  %SystemRoot%\System32\cscui.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@EnableAsynchronousProcessing              0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@NoBackgroundPolicy                        0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@NoGPOListChanges                          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@NoMachinePolicy                          0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@NoSlowLink                                0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@NoUserPolicy                              1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@PerUserLocalSettings                      0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@ProcessGroupPolicy                        ProcessGroupPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}@RequiresSuccessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@                                          Softwareinstallation
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@DllName                                  appmgmts.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@ProcessGroupPolicyEx                      ProcessGroupPolicyObjectsEx
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@GenerateGroupPolicy                      GenerateGroupPolicy
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@NoBackgroundPolicy                        0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@RequiresSucessfulRegistry                0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@NoSlowLink                                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@PerUserLocalSettings                      1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}@EventSources                              (Application Management,Application)?(MsiInstaller,Application)?
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@                                          Internet Explorer Machine Accelerators
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@DisplayName                              @C:\WINDOWS\system32\iedkcs32.dll.mui,-3051
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@DllName                                  C:\WINDOWS\system32\iedkcs32.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@NoGPOListChanges                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@ProcessGroupPolicy                        ProcessGroupPolicyForActivities
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@ProcessGroupPolicyEx                      ProcessGroupPolicyForActivitiesEx
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}@RequiresSuccessfulRegistry                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@DllName                                                                  C:\Programme\SUPERAntiSpyware\SASWINLO.DLL
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@Logon                                                                    SABWINLOLogon
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@Logoff                                                                    SABWINLOLogoff
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@Startup                                                                  SABWINLOStartup
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@Shutdown                                                                  SABWINLOShutdown
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@Asynchronous                                                              0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon@Impersonate                                                              0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain@Asynchronous                                                              0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain@Impersonate                                                              0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain@DllName                                                                  crypt32.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain@Logoff                                                                    ChainWlxLogoffEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet@Asynchronous                                                                  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet@Impersonate                                                                  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet@DllName                                                                      cryptnet.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet@Logoff                                                                        CryptnetWlxLogoffEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@DLLName                                                                        cscdll.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@Logon                                                                          WinlogonLogonEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@Logoff                                                                          WinlogonLogoffEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@ScreenSaver                                                                    WinlogonScreenSaverEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@Startup                                                                        WinlogonStartupEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@Shutdown                                                                        WinlogonShutdownEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@StartShell                                                                      WinlogonStartShellEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@Impersonate                                                                    0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll@Asynchronous                                                                    1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Asynchronous                                                                  1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@DllName                                                                      %SystemRoot%\System32\dimsntfy.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Startup                                                                      WlDimsStartup
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Shutdown                                                                      WlDimsShutdown
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Logon                                                                        WlDimsLogon
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Logoff                                                                        WlDimsLogoff
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@StartShell                                                                    WlDimsStartShell
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Lock                                                                          WlDimsLock
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy@Unlock                                                                        WlDimsUnlock
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@                                                                             
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@DLLName                                                                        igfxdev.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@Asynchronous                                                                  1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@Impersonate                                                                    1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@Unlock                                                                        WinlogonUnlockEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@DLLName                                                                    wlnotify.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Logon                                                                      SCardStartCertProp
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Logoff                                                                      SCardStopCertProp
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Lock                                                                        SCardSuspendCertProp
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Unlock                                                                      SCardResumeCertProp
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Enabled                                                                    1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Impersonate                                                                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp@Asynchronous                                                                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule@Asynchronous                                                                  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule@DllName                                                                      wlnotify.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule@Impersonate                                                                  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule@StartShell                                                                    SchedStartShell
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule@Logoff                                                                        SchedEventLogOff
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy@Logoff                                                                        WLEventLogoff
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy@Impersonate                                                                  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy@Asynchronous                                                                  1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy@DllName                                                                      sclgntfy.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@DLLName                                                                      WlNotify.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Lock                                                                          SensLockEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Logon                                                                        SensLogonEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Logoff                                                                        SensLogoffEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Safe                                                                          1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@MaxWait                                                                      600
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@StartScreenSaver                                                              SensStartScreenSaverEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@StopScreenSaver                                                              SensStopScreenSaverEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Startup                                                                      SensStartupEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Shutdown                                                                      SensShutdownEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@StartShell                                                                    SensStartShellEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@PostShell                                                                    SensPostShellEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Disconnect                                                                    SensDisconnectEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Reconnect                                                                    SensReconnectEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Unlock                                                                        SensUnlockEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Impersonate                                                                  1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn@Asynchronous                                                                  1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Asynchronous                                                                  0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@DllName                                                                        wlnotify.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Impersonate                                                                    0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Logoff                                                                        TSEventLogoff
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Logon                                                                          TSEventLogon
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@PostShell                                                                      TSEventPostShell
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Shutdown                                                                      TSEventShutdown
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@StartShell                                                                    TSEventStartShell
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Startup                                                                        TSEventStartup
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@MaxWait                                                                        600
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Reconnect                                                                      TSEventReconnect
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv@Disconnect                                                                    TSEventDisconnect
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon@DLLName                                                                      wlnotify.dll
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon@Logon                                                                        RegisterTicketExpiredNotificationEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon@Logoff                                                                      UnregisterTicketExpiredNotificationEvent
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon@Impersonate                                                                  1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon@Asynchronous                                                                1
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@Hilfeassistent                                                      0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@TsInternetUser                                                      0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@SQLAgentCmdExec                                                      0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@NetShowServices                                                      0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@HelpAssistant                                                        0
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@IWAM_                                                                65536
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@IUSR_                                                                65536
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@VUSR_                                                                65536

---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0                                                                                                                                    sectors 312581552 (+254): rootkit-like behavior;

---- Files - GMER 1.0.15 ----

File            C:\WINDOWS\System32\drivers\afd.sys                                                                                                                      suspicious modification; TDL3                                      <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----
--- --- ---

MBR Check Logfile:
  CE0000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF78C8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF714D000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7149000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7BD6000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7658000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7A40000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF5CC9000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7668000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7678000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78D0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5CB8000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7688000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78D8000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78E0000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF65BE000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7ACA000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5C95000 \SystemRoot\system32\DRIVERS\ks.sys
0xF5C37000 \SystemRoot\system32\DRIVERS\update.sys
0xF6EDE000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF65AE000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xA9281000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xA7C3B000 \SystemRoot\system32\drivers\sthda.sys
0xA7739000 \SystemRoot\system32\drivers\portcls.sys
0xA9201000 \SystemRoot\system32\drivers\drmk.sys
0xA5D2D000 \SystemRoot\system32\drivers\AESTAud.sys
0x9DD0F000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0xA3E28000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xA3790000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0xF71F5000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7B3C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xA013D000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B3E000 \SystemRoot\System32\Drivers\Beep.SYS
0xA3778000 \SystemRoot\System32\drivers\vga.sys
0xF7B40000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B42000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xA3770000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA3768000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF71F1000 \SystemRoot\system32\DRIVERS\rasacd.sys
0x9DCDC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0x9DC83000 \SystemRoot\system32\DRIVERS\tcpip.sys
0x9DC5D000 \SystemRoot\system32\DRIVERS\ipnat.sys
0x9DC35000 \SystemRoot\system32\DRIVERS\netbt.sys
0x9DC13000 \SystemRoot\System32\drivers\afd.sys
0xA3E08000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA3758000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x9DBF1000 \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
0x9FDE7000 \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
0xA3DF8000 \SystemRoot\System32\Drivers\SaibVd32.sys
0x9DBC6000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x9DB56000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA011D000 \SystemRoot\System32\Drivers\Fips.SYS
0x9DB33000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x9FD6A000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0x977C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x96BB1000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x980E1000 \SystemRoot\System32\drivers\Dxapi.sys
0x97A1E000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BC7000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0x96B9C000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xF7A7C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x96B5F000 \SystemRoot\system32\drivers\wdmaud.sys
0xA00AD000 \SystemRoot\system32\drivers\sysaudio.sys
0x969C4000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0x965FC000 \SystemRoot\system32\DRIVERS\srv.sys
0x96021000 \SystemRoot\System32\Drivers\Cdfs.SYS
0x966A4000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x95D15000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 46):
0 System Idle Process
4 System
764 C:\WINDOWS\system32\smss.exe
812 csrss.exe
836 C:\WINDOWS\system32\winlogon.exe
880 C:\WINDOWS\system32\services.exe
892 C:\WINDOWS\system32\lsass.exe
1068 C:\WINDOWS\system32\svchost.exe
1160 svchost.exe
1216 C:\Programme\Roxio\BackOnTrack\Instant Restore\BOTService.exe
1396 svchost.exe
1432 svchost.exe
1476 C:\WINDOWS\explorer.exe
1808 C:\Programme\IDT\WDM\stacsv.exe
608 C:\Programme\Avira\AntiVir Desktop\sched.exe
664 svchost.exe
680 C:\WINDOWS\system32\igfxtray.exe
688 C:\WINDOWS\system32\hkcmd.exe
696 C:\WINDOWS\system32\igfxpers.exe
704 C:\Programme\HP\HPBTWD.exe
712 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
720 C:\WINDOWS\system32\AESTFltr.exe
1100 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
1332 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
1288 C:\Programme\Skype\Phone\Skype.exe
1532 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
1544 C:\WINDOWS\system32\igfxsrvc.exe
1560 C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
1764 C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
1832 C:\WINDOWS\system32\ctfmon.exe
1896 C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
1908 C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe
1956 C:\Programme\Avira\AntiVir Desktop\avguard.exe
284 C:\Programme\OpenOffice.org 3\program\soffice.exe
368 C:\Programme\Java\jre6\bin\jqs.exe
384 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
396 C:\Programme\OpenOffice.org 3\program\soffice.bin
412 C:\Programme\Google\Update\GoogleUpdate.exe
1132 C:\WINDOWS\system32\svchost.exe
2088 C:\Programme\XSManager\WTGService.exe
2960 C:\Programme\Hewlett-Packard\Shared\hpqWmiEx.exe
3960 C:\WINDOWS\system32\wbem\wmiapsrv.exe
444 alg.exe
228 C:\WINDOWS\system32\spoolsv.exe
2724 C:\WINDOWS\system32\svchost.exe
4024 C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck (1).exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: WDCWD1600BEVT-60ZCT1, Rev: 13.01A13

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

Hoffe sehr, dass mein Rechner bald wieder normal läuft und sich die Viren etc. entfernen lassen. Danke auf jeden Fall für Deine Unterstützung!!

Viele Grüße,
kiki

cosinus 17.12.2010 13:32
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

kiki82 17.12.2010 17:33
Hallo Arne,

okay; habe beides aktualisiert und die Scans durchgeführt.
Antispyware hat einen Tracking Cookie entdeckt; Malwarebytes meldete keine infizierten Dateien.
Das sieht ja erstmal okay aus. Ich werde nun beobachten, ob noch Probleme mit der Internetverbindung oder der Taskleiste auftreten.

Anbei das Log von Malwarebytes:

Malwarebytes Logfile:
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5342

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

17.12.2010 15:25:04
mbam-log-2010-12-17 (15-25-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 221138
Laufzeit: 1 Stunde(n), 23 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Viele Grüße,
kiki

cosinus 19.12.2010 14:58
Sieht ok aus.
Noch Probleme oder weitere Funde in der Zwischenzeit?

kiki82 22.12.2010 01:32
Hallo Arne,

nein, es gab keine weiteren Funde.
Aber einige Minuten nach dem Hochfahren des Computers verändert sich immer noch die Taskleiste, u.a. Uhrzeit und Schriftbild. Diese Änderungen sind erst nach den letzten Virusmeldungen aufgetreten.
Soll ich nochmal andere Programme durchlaufen lassen, die Rootkits entfernen wie z.B. Blacklight?

Viele Grüße,
kiki

cosinus 22.12.2010 09:56
Zitat:
verändert sich immer noch die Taskleiste, u.a. Uhrzeit und Schriftbild. Diese Änderungen sind erst nach den letzten Virusmeldungen aufgetreten.
Wie genau sehen die Änderungen aus? Altbackenes Design?

kiki82 22.12.2010 12:19
Hallo Arne,

ja, genau.
Also anfangs sieht die Taskleiste noch normal aus; Uhrzeit und Wochentag erscheinen im bekannten Schriftbild und die Leiste ist durchgängig dunkelgrau. Doch nach einigen Minuten sieht es so aus, als ob sich eine weitere Taskleiste "daraufsetzt". Die Farbgebung ist dann nicht mehr einheitlich; die Mitte der Leiste ist anschließend hellgrau und die Taskleiste sieht dadurch wie unterbrochen aus.
Wenn ich das Startmenü anklicke, erscheint mein Benutzername in einem ganz anderen Schriftbild als sonst.

Viele Grüße,
kiki

cosinus 22.12.2010 12:35
Mach mal einen Screenshot davon...

kiki82 23.12.2010 20:59
Hallo Arne,

okay; ich habe einen Screenshot gemacht und ihn als Paint-Dokument abgespeichert. Aber wie ich kann ihn Dir posten? Sorry, habe leider keine Ahnung.

Viele Grüße,
kiki

cosinus 23.12.2010 21:13
Speicher es bitte als png Datei ab. Datei kannst du bei saved.im hochladen und hier verlinken

kiki82 23.12.2010 22:53
Hi Arne,

okay, Danke! Dies ist der link: hxxp://saved.im/mty1mzexamd3/screenshot.html.

Hier sieht die Taskleiste noch nicht ganz so schräg aus; aber normalerweise ist der Start-Button grün und das Datum erscheint unter dem Wochentag.
Nach einiger Zeit ändert sich ab und an die Leiste erneut; sie ist dann hellgrau und mein Benutzername wechselt in ein kursives Schriftbild.
Das ist heute aber noch nicht aufgetreten, deswegen konnte ich davon keinen Screenshot machen; sonst schicke ich Dir das nochmal als link.

Viele Grüße,
kiki

cosinus 23.12.2010 23:00
Die Leiste wird von ganz allein grau und doppelt so breit? :balla:

kiki82 24.12.2010 16:10
Hallo Arne,

nein; die Breite der Leiste habe ich selbst so eingestellt.

Wie gesagt, einige Minuten nach dem Hochfahren des Computers erscheint die Leiste noch einmal und verändert sich merkwürdig, ohne dass ich irgendetwas mache! Normalerweise ist der Start-Button grün, die Leiste komplett dunkelgrau und wenn ich das Starmenü anklicke, erscheint ganz oben mein Name neben einem kleinen Bild.
Danach: ist dieses Bild verschwunden, der Name ist kursiv und die Leiste ist heller als sonst.

Na, erstmal schöne Weihnachten.

Viele Grüße,
k.

cosinus 25.12.2010 00:51
Mach nochmal frische OTL-Logs:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

kiki82 26.12.2010 12:33
Hallo Arne,

Danke, dass Du dir das weiterhin anschaust!!
Die OTL-Logs poste ich Dir später.
Hier noch ein Link zum aktuellen Screenshot: hxxp://saved.im/mty1nja4annv/screenshot2.html
So sieht es momentan aus, wenn ich auf den Startbutton klicke. Das hat sich erst einige Minuten nach dem Hochfahren so verändert. Normalerweise erscheint mein Name nicht kursiv und daneben ist normalerweise ein kleines Bild; das ist jetzt verschwunden.

Viele Grüße,
k.

kiki82 26.12.2010 14:34
Hi Arne,

hier kommt das Logfile von OTL:

OTL Logfile:OTL Logfile:
Code:
OTL logfile created on: 26.12.2010 13:38:57 - Run 6
OTL by OldTimer - Version 3.2.18.0    Folder = C:\Dokumente und Einstellungen\Kirsten\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.015,00 Mb Total Physical Memory | 588,00 Mb Available Physical Memory | 58,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 108,98 Gb Free Space | 73,12% Space Free | Partition Type: NTFS
 
Computer Name: PC295313555299 | User Name: Kirsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe (Philips)
PRC - C:\Programme\XSManager\WTGService.exe ()
PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
PRC - C:\Programme\HP\HPBTWD.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WTGService) -- C:\Programme\XSManager\WTGService.exe ()
SRV - (ACDaemon) -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (STacSV) -- c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
SRV - (GameConsoleService) -- C:\Programme\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBCCID) -- C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) -- C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys File not found
DRV - (catchme) -- C:\DOKUME~1\Kirsten\LOKALE~1\Temp\catchme.sys File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (cmnsusbser) -- C:\WINDOWS\system32\drivers\cmnsusbser.sys (Mobile Connector)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (SysCow) -- C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (iaStor) -- C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (SaibVd32) -- C:\WINDOWS\system32\drivers\SaibVd32.sys (Sonic Solutions)
DRV - (SahdIa32) -- C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions)
DRV - (SaibIa32) -- C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions)
DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (RSUSBSTOR) -- C:\WINDOWS\system32\drivers\RTS5121.sys (Realtek Semiconductor Corp.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B728AB94-9BC7-49b7-B76A-422BB31B2FD0}:2.0.0.8
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010.11.22 17:30:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.12.17 13:57:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.17 13:57:07 | 000,000,000 | ---D | M]
 
[2010.02.23 16:16:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Extensions
[2010.12.26 12:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions
[2010.06.26 12:36:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.29 12:22:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\zotero@chnm.gmu.edu
[2010.12.26 12:22:46 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.01 22:25:36 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.10.21 20:28:02 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.21 20:28:02 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.21 20:28:03 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.21 20:28:03 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.21 20:28:03 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.11.09 10:28:59 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HP BTW Detect Program] C:\Programme\HP\HPBTWD.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Philips GoGear SA1VBExxA Device Manager.lnk = C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe (Philips)
O4 - Startup: C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar-Suche - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AOL\ieToolbar\resources\de-DE\local\search.html ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\crypt32chain: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\cryptnet: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\cscdll: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\dimsntfy: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\ScCertProp: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\Schedule: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\sclgntfy: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\SensLogn: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\termsrv: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\wlballoon: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Firestorm High.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Firestorm High.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.26 12:19:53 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe
[2010.12.15 12:55:35 | 000,000,000 | --SD | C] -- C:\Cofi
[2010.12.15 12:11:58 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.12.08 21:19:39 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Kirsten\Recent
[2010.12.08 00:38:04 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.08 00:37:56 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.01.26 15:15:44 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010.01.26 15:15:40 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.26 12:24:20 | 000,072,437 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot2.PNG
[2010.12.26 12:19:57 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe
[2010.12.26 12:03:18 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2010.12.26 12:00:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.12.26 11:59:59 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.26 11:42:29 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.12.24 00:22:01 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.23 23:22:03 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.23 22:44:41 | 000,608,892 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot.PNG
[2010.12.23 20:59:55 | 000,013,824 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GrakoJan.doc
[2010.12.23 12:26:00 | 001,843,254 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt.bmp
[2010.12.20 22:51:40 | 000,162,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.ris
[2010.12.20 22:14:58 | 000,943,779 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.rdf
[2010.12.20 12:10:40 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.12.17 11:27:20 | 000,088,064 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\trojboard.doc
[2010.12.17 11:22:23 | 000,080,384 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck (1).exe
[2010.12.15 12:13:04 | 003,989,876 | R--- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Cofi.exe
[2010.12.08 18:24:30 | 000,000,258 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182427.reg
[2010.12.08 18:23:25 | 000,003,840 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182251.reg
[2010.12.08 00:38:05 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.03 20:31:30 | 000,012,800 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\DA_Thesen.doc
[2010.12.01 22:00:42 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\SB.Funktion.doc
[2010.12.01 14:10:31 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Dt.PolenInstitut.doc
[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.11.28 19:12:06 | 000,013,312 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit.tipps.doc
 
========== Files Created - No Company Name ==========
 
[2010.12.26 12:24:20 | 000,072,437 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot2.PNG
[2010.12.23 22:44:41 | 000,608,892 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot.PNG
[2010.12.23 20:09:52 | 000,013,824 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GrakoJan.doc
[2010.12.23 12:25:59 | 001,843,254 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt.bmp
[2010.12.20 22:51:29 | 000,162,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.ris
[2010.12.17 11:27:16 | 000,088,064 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\trojboard.doc
[2010.12.17 11:22:36 | 000,080,384 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck (1).exe
[2010.12.15 12:12:30 | 003,989,876 | R--- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Cofi.exe
[2010.12.08 18:24:29 | 000,000,258 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182427.reg
[2010.12.08 18:22:57 | 000,003,840 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182251.reg
[2010.12.08 00:38:05 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.03 20:31:28 | 000,012,800 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\DA_Thesen.doc
[2010.12.01 22:00:40 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\SB.Funktion.doc
[2010.12.01 14:10:14 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Dt.PolenInstitut.doc
[2010.11.28 19:11:58 | 000,013,312 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit.tipps.doc
[2010.04.29 15:51:12 | 000,008,192 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.26 15:18:47 | 000,029,559 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HPWALog.txt
[2010.01.26 15:15:44 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010.01.26 15:15:44 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010.01.26 15:15:43 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009.08.24 09:59:13 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.08.24 09:18:29 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.04.11 00:27:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009.04.10 23:49:16 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
 
========== LOP Check ==========
 
[2009.08.24 09:35:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Uninstall
[2009.08.24 09:57:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WildTangent
[2010.09.16 22:10:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\ONLINE FUCHS
[2010.02.23 16:06:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\OpenOffice.org
[2010.11.23 20:00:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\XSManager
[2010.12.26 12:03:18 | 000,000,274 | ---- | M] () -- C:\WINDOWS\Tasks\BackOnTrack Instant Restore Idle.job
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---


Wünsch Dir noch einen schönen 2. Weihnachtstag!

Viele Grüße,
kiki

kiki82 26.12.2010 15:05
Upps, entschuldige, das war nicht vollständig. Hier die beiden aktuellen Logs.

OTL Logfile:OTL Logfile:
Code:
OTL logfile created on: 26.12.2010 14:55:53 - Run 7
OTL by OldTimer - Version 3.2.18.0    Folder = C:\Dokumente und Einstellungen\Kirsten\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.015,00 Mb Total Physical Memory | 565,00 Mb Available Physical Memory | 56,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 78,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 108,97 Gb Free Space | 73,12% Space Free | Partition Type: NTFS
 
Computer Name: PC295313555299 | User Name: Kirsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe (Philips)
PRC - C:\Programme\XSManager\XSManager.exe (WebToGo Mobiles Internet GmbH)
PRC - C:\Programme\XSManager\WTGService.exe ()
PRC - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
PRC - C:\Programme\HP\HPBTWD.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\dinput.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (WTGService) -- C:\Programme\XSManager\WTGService.exe ()
SRV - (ACDaemon) -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (STacSV) -- c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- C:\Programme\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
SRV - (GameConsoleService) -- C:\Programme\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBCCID) -- C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) -- C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys File not found
DRV - (catchme) -- C:\DOKUME~1\Kirsten\LOKALE~1\Temp\catchme.sys File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (cmnsusbser) -- C:\WINDOWS\system32\drivers\cmnsusbser.sys (Mobile Connector)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (SysCow) -- C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (iaStor) -- C:\WINDOWS\System32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (SaibVd32) -- C:\WINDOWS\system32\drivers\SaibVd32.sys (Sonic Solutions)
DRV - (SahdIa32) -- C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions)
DRV - (SaibIa32) -- C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions)
DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (RSUSBSTOR) -- C:\WINDOWS\system32\drivers\RTS5121.sys (Realtek Semiconductor Corp.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_DE&c=94&bd=Pavilion&pf=cnnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: zotero@chnm.gmu.edu:2.0.9
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B728AB94-9BC7-49b7-B76A-422BB31B2FD0}:2.0.0.8
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010.11.22 17:30:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.12.17 13:57:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.17 13:57:07 | 000,000,000 | ---D | M]
 
[2010.02.23 16:16:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Extensions
[2010.12.26 12:22:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions
[2010.06.26 12:36:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.29 12:22:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Kirsten\Anwendungsdaten\Mozilla\Firefox\Profiles\j34jflrb.default\extensions\zotero@chnm.gmu.edu
[2010.12.26 12:22:46 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.01 22:25:36 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.10.21 20:28:02 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.21 20:28:02 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.21 20:28:03 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.21 20:28:03 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.21 20:28:03 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.11.09 10:28:59 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HP BTW Detect Program] C:\Programme\HP\HPBTWD.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Philips GoGear SA1VBExxA Device Manager.lnk = C:\Programme\Philips\GoGear SA1VBExxA Device Manager\GoGear_SA1VBExxA_DeviceManager.exe (Philips)
O4 - Startup: C:\Dokumente und Einstellungen\Kirsten\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar-Suche - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AOL\ieToolbar\resources\de-DE\local\search.html ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\crypt32chain: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\cryptnet: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\cscdll: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\dimsntfy: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\ScCertProp: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\Schedule: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\sclgntfy: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\SensLogn: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\termsrv: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O20 - Winlogon\Notify\wlballoon: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Firestorm High.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Firestorm High.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.26 12:19:53 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe
[2010.12.15 12:55:35 | 000,000,000 | --SD | C] -- C:\Cofi
[2010.12.15 12:11:58 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.12.08 21:19:39 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Kirsten\Recent
[2010.12.08 00:38:04 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.12.08 00:37:56 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.01.26 15:15:44 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2010.01.26 15:15:40 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.26 14:46:05 | 000,026,112 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt 1.doc
[2010.12.26 12:24:20 | 000,072,437 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot2.PNG
[2010.12.26 12:19:57 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Kirsten\Desktop\OTL.exe
[2010.12.26 12:03:18 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2010.12.26 12:00:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.12.26 11:59:59 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.26 11:42:29 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.12.24 00:22:01 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.23 23:22:03 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.23 22:44:41 | 000,608,892 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot.PNG
[2010.12.23 20:59:55 | 000,013,824 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GrakoJan.doc
[2010.12.23 12:26:00 | 001,843,254 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt.bmp
[2010.12.20 22:51:40 | 000,162,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.ris
[2010.12.20 22:14:58 | 000,943,779 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.rdf
[2010.12.20 12:10:40 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.12.17 11:27:20 | 000,088,064 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\trojboard.doc
[2010.12.17 11:22:23 | 000,080,384 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck (1).exe
[2010.12.15 12:13:04 | 003,989,876 | R--- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Cofi.exe
[2010.12.08 18:24:30 | 000,000,258 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182427.reg
[2010.12.08 18:23:25 | 000,003,840 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182251.reg
[2010.12.08 00:38:05 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.03 20:31:30 | 000,012,800 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\DA_Thesen.doc
[2010.12.01 22:00:42 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\SB.Funktion.doc
[2010.12.01 14:10:31 | 000,009,216 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Dt.PolenInstitut.doc
[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.11.28 19:12:06 | 000,013,312 | ---- | M] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit.tipps.doc
 
========== Files Created - No Company Name ==========
 
[2010.12.26 14:46:03 | 000,026,112 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt 1.doc
[2010.12.26 12:24:20 | 000,072,437 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot2.PNG
[2010.12.23 22:44:41 | 000,608,892 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Screenshot.PNG
[2010.12.23 20:09:52 | 000,013,824 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\GrakoJan.doc
[2010.12.23 12:25:59 | 001,843,254 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Unbenannt.bmp
[2010.12.20 22:51:29 | 000,162,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Meine Bibliothek.ris
[2010.12.17 11:27:16 | 000,088,064 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\trojboard.doc
[2010.12.17 11:22:36 | 000,080,384 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\MBRCheck (1).exe
[2010.12.15 12:12:30 | 003,989,876 | R--- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Cofi.exe
[2010.12.08 18:24:29 | 000,000,258 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182427.reg
[2010.12.08 18:22:57 | 000,003,840 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\cc_20101208_182251.reg
[2010.12.08 00:38:05 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.03 20:31:28 | 000,012,800 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\DA_Thesen.doc
[2010.12.01 22:00:40 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Eigene Dateien\SB.Funktion.doc
[2010.12.01 14:10:14 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\Dt.PolenInstitut.doc
[2010.11.28 19:11:58 | 000,013,312 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Desktop\lit.tipps.doc
[2010.04.29 15:51:12 | 000,008,192 | ---- | C] () -- C:\Dokumente und Einstellungen\Kirsten\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.26 15:18:47 | 000,044,831 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HPWALog.txt
[2010.01.26 15:15:44 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2010.01.26 15:15:44 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2010.01.26 15:15:43 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009.08.24 09:59:13 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.08.24 09:18:29 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.04.11 00:27:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009.04.10 23:49:16 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

< End of report >
--- --- ---


OTL-Logfile:OTL Logfile:
Code:
OTL Extras logfile created on: 26.12.2010 14:55:53 - Run 7
OTL by OldTimer - Version 3.2.18.0    Folder = C:\Dokumente und Einstellungen\Kirsten\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.015,00 Mb Total Physical Memory | 565,00 Mb Available Physical Memory | 56,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 78,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 108,97 Gb Free Space | 73,12% Space Free | Partition Type: NTFS
 
Computer Name: PC295313555299 | User Name: Kirsten | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe" = C:\Programme\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03B2DFF6-584E-44A6-8DFB-EDEB3C64FD31}" = GoGear SA1VBExxA Device Manager
"{0517F875-BBB2-4812-A63E-733B33CEF215}" = Roxio Instant Restore
"{10385C4F-A6B2-4913-975D-6828928222EC}" = HP User Guides 0165
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2B682751-E749-441C-A4B3-1F538E26E56E}" = Roxio Instant Restore Recovery Disk
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}" = Roxio BackOnTrack
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam-50
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54CC7901-804D-4155-B353-21F0CC9112AB}" = HP Wireless Assistant
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows-Sicherungsprogramm
"{87A83C6F-F53C-448A-B078-FF00E3EAEB29}" = Roxio Disaster Recovery
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = USB2.0 Card Reader Software
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E623BB3F-F7ED-4148-BEB5-A0D1DB28B4DE}" = Media Converter for Philips
"{EEA95E6C-6847-49BE-83C9-ED92D8E18983}" = HP QuickSync
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Toolbar" = AOL Toolbar 5.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Broadcom 802.11b Network Adapter" = Broadcom 802.11-WLAN-Adapter
"CCleaner" = CCleaner
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSNINST" = MSN
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.0.5
"WildTangent hp Master Uninstall" = HP Games
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR
"XSManager" = XSManager
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ONLINE FUCHS" = ONLINE FUCHS
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---

Viele Grüße,
k

cosinus 26.12.2010 19:37
Ich seh da höchstens nur überflüssige Einträge. Evtl. hat nur dein Benutzerprofil einen Schuss, kann vorkommen, auch bei nicht infizierten Rechnern. Erstell dir mal ein neuen Benutzerkonto über Systemsteuerung oder in XP Start, ausführen control userpasswords2 eintippen und ausführen - da einen neuen Benutzer mit Passwort anlegen. Log dich aus und mit dem neuen Benutzer ein. Gib dem neuen Benutzer ruhig Adminrechte, aber normalerweise sollte der Benutzer, mit dem man ständig am Rechner dran ist, keine Adminrechte haben!!

kiki82 26.12.2010 21:33
Hallo Arne,

ganz lieben Dank, dass Du die Logs ausgewertet hast!!
Oh..gut! Dann liegt`s bitte, bitte nur am Benutzerprofil. Denn sonst würd ich total verzweifeln :killpc:
Okay, werde ein neues Profil einrichten und Dir dann kurz melden, ob die Änderungen an der Taskleiste immer noch auftreten.

Schönen Abend & viele Grüße,
k

cosinus 27.12.2010 10:31
Naja was heißt "nur" :balla:
Wenn es defekt ist müsstest du mit einem komplett neuen anfangen, d.h. alle benutzerspezifischen Einstellungen in Programmen etc müssen neu gemacht werden. Auch Daten aus Eigene Dateien oder Bilder müssen auf dem defekten ins neue Profil kopiert werden. Das ist fast wie format c :D nur dass man sich das Neuinstallieren von Windows und das Installieren der Programme danach erspart, mit einem neuen Profil hat man auch viel Fummelarbeit, aber was will man sonst machen wenn das bisher genutze Defekt ist und man weiß nicht an welcher Stelle http://cheesebuerger.de/images/smilie/konfus/a050.gif

kiki82 29.12.2010 14:58
Hallo Arne,

oh.. das habe ich mir einfacher vorgestellt :confused:
Hilft ja nichts..da muss ich wohl durch! Danke für Deinen Support!!
Ich kopiere jetzt nochmal alle Daten aus den Ordnern Eigene Dateien/ Eigene Bilder auf einen USB-Stick und erstelle das neue Profil. Eine Neuinstallation wäre ziemlich aufwendig; denn ich habe kein CD-ROM Laufwerk. Und von Computern, wie Du siehst, Null Ahnung!

Viele Grüße,
kiki


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:59 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24