Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Falsche Webseite gezeigt- komische Weiterleitung (https://www.trojaner-board.de/96270-falsche-webseite-gezeigt-komische-weiterleitung.html)

Dery 05.03.2011 01:09
Falsche Webseite gezeigt- komische Weiterleitung
 
Wenn ich in google valerie-bistro.vipphoto.ch eingebe und dann anklicke, erscheint hxxp://www.sta-duesseldorf.nrw.de/
Dasselbe passiert, wenn ich es in meinem Counter bei einer meiner Domain in Verweisende Domain mache.

Auf anderen PCs ( meine und fremde) werden die Seiten ganz normal aufgerufen, also ohne Weiterleitung auf
hxxp://www.sta-duesseldorf.nrw.de/
Was kann es sein?

Also jetzt habe ich festgestellt es passiert nur bei IE - hier kommt hxxp://www.sta-duesseldorf.nrw.de/
Bei Verwendung von Mozilla Firefox werden die Seiten ganz normal gezeigt.
Das Betrifft nur ein bestimmnten PC.

Bei anderen PC werden die Seiten im IE und Mozilla richtig aufgerufen.

cosinus 07.03.2011 18:35
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

Dery 10.03.2011 19:56
OTL Logfile:
Code:
OTL Extras logfile created on: 10.3.2011 19:38:22 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Dery\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000405 | Country: Tschechische Republik | Language: CSY | Date Format: d.M.yyyy
 
1*015,00 Mb Total Physical Memory | 399,00 Mb Available Physical Memory | 39,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 52,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66,77 Gb Total Space | 30,60 Gb Free Space | 45,82% Space Free | Partition Type: NTFS
Drive D: | 6,20 Gb Total Space | 0,80 Gb Free Space | 12,90% Space Free | Partition Type: NTFS
Drive E: | 1,55 Gb Total Space | 1,29 Gb Free Space | 83,16% Space Free | Partition Type: NTFS
Drive F: | 4,38 Gb Total Space | 4,19 Gb Free Space | 95,78% Space Free | Partition Type: UDF
 
Computer Name: Dery-PC | User Name: Dery | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 360 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{197FA988-770D-4DC0-BD4F-00F2C1463F33}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{2C3C3232-FFB9-4310-B6D2-420FC4A4E160}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{47E7BAE7-AC08-4BA6-8F4C-3C3B6822BACB}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6AF96449-2063-440A-8D3E-142C48C8D54D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{705A5C1D-FD32-48F6-8BED-FB2858513572}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{92017CE3-14EF-476D-BF51-E785FADB390E}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{CE852A01-6B43-4054-955E-EF9211CF15F3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FDAC7EDA-3076-400E-B93C-F442D307C673}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C67C573-9C79-4F8E-B8CB-D90D22498920}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{20963985-0BA9-44BD-A9F3-E998A9ED5408}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{2CB56535-681A-4864-A718-C2466026C246}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{527331F3-1EF3-4EB6-BA49-DF1E98B16890}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{528A7E72-B0F1-4008-BA51-D79D078A5013}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{5713DDAC-F149-4D6F-9566-14F673834BF3}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{6CFCA493-2A86-4DA3-894F-D3753923EC66}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{8193666E-D59D-43F1-8F5C-30061F23ED55}" = protocol=6 | dir=in | app=c:\program files\mirabyte\superhtml 8.0 web studio\shtml8.exe |
"{930D92C8-6FC2-49F3-B29F-9C728F386170}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{94BBC0C8-EFDC-46BE-987B-050241EB8E1F}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{A5E92612-478C-4113-B964-B854FB672D8B}" = protocol=17 | dir=in | app=c:\program files\mirabyte\superhtml 8.0 web studio\shtml8.exe |
"{AFFCDFC8-06C7-4212-8AEB-F027C7153D95}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{D0C9EBDF-EC78-4BB1-BEFE-5555558EEC0A}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{D9A5AF8D-2C70-4D13-9FD9-D5519B82BA28}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe |
"{E36F5D40-8E61-4266-A605-674D6BD6FF32}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe |
"{F53E38F4-CC1B-452C-BEC4-0E836A7D982B}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe |
"TCP Query User{3CAD9BE9-AC55-4C17-8668-0374688ACF0E}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"TCP Query User{53B30E75-3844-46F7-AC78-A714BC577A59}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{F4C751B9-992D-48A1-94E2-1A498310169C}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{88ED829B-6087-4DD0-AA18-10DAABDC8028}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{C13177F0-BC2E-4FB7-9E52-2235FC488ACF}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{E456DF4B-F7BA-4856-9B5B-A92904F5C1C0}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{03B1BBDC-7FAA-4A03-9988-A85428BAD382}" = Sun ODF Plugin for Microsoft Office 3.0
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}" = Uniblue RegistryBooster
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{19789B73-7489-4EE0-8040-6C4DD5C1AF52}" = SuperHTML Web Studio
"{1D5EB783-25F8-495B-8B01-DE6D1BFBB8B4}" = VideoCam Suite 3.0
"{1E0D8F69-A6AB-4934-9B2D-159D9F97BA4A}" = ParetoLogic DriverCure
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21E62565-8639-457C-B64C-A3FF0A8B4D80}" = HP Active Support Library
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{2907F3FC-067B-4903-949B-6856737CB277}" = HP MULTIPLE MODEM INSTALLER for VISTA
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3293C06B-003F-4027-8380-FFD79E38167D}" = Tony Hawk's American Wasteland
"{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.10 C1
"{355FADAF-55C4-4E08-88D4-A86C4CA6930C}" = HP Wireless Assistant
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3912A629-0020-0005-3131-2FBA74D4DF0A}" = InterVideo WinDVD
"{3F9F7336-6DF8-476F-ABF6-C70A17FAF619}" = ST Wiederherstellungs- & Sicherungsprogramme
"{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater
"{521F72F4-FFE4-4959-AA88-EED06125211F}" = HP Notebook Accessories Product Tour
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5D97A4A7-C274-4B63-86D9-07A33435F505}" = InterVideo DVD Check
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{70CEFEBA-F757-4DBE-8A21-027C326137CE}" = Application Installer 4.00.B10
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACFE14D-6A85-4F24-89AF-5F537E5CF423}" = HP Credential Manager for ProtectTools
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 E4
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = HP Integrated Module with Bluetooth wireless technology 6.0.1.3100
"{A5A70E61-FEAB-4CEC-977C-BE0EF8DC05AB}" = PC Connectivity Solution
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5761811-28F3-4257-B537-815C5EEF472C}" = Vodafone Mobile Connect Lite
"{BBE5C83E-4DC5-494F-8A23-3AAE242E94C2}" = HP Easy Setup - Frontend
"{C8A10AA2-9905-46A4-B2D6-D4986DD6221D}" = HP BIOS Configuration for ProtectTools
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe  1.4.124.1
"{E220724C-C477-4BD7-91D2-CABB0F475140}" = HP User Guide 0045
"{E4DDBA93-769B-49D8-BA33-8814E45ED0C1}" = HP Help and Support
"{E58CC698-443D-43E9-89BF-BC91885EEC54}" = Essential System Updates for Microsoft Windows Vista
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0779413-6026-4BC6-97B4-DE8D9CADAFEC}" = MSN Toolbar
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F1FDAA01-988C-423F-AC12-0D8F333943FD}" = Nokia Connectivity Cable Driver
"{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}" = HP Easy Setup - Core
"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = ASL_HS_Installer32
"{FF46E334-6F35-49C3-B60A-034969BE25AB}" = Vista Default Settings
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVS Registry Cleaner 1.1_is1" = AVS Registry Cleaner version 1.1
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.2
"CCleaner" = CCleaner (remove only)
"Core FTP LE 2.1" = Core FTP LE 2.1
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"Half-Life" = Half-Life
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"ICQToolbar" = ICQ Toolbar
"ImageConverter Plus_is1" = ImageConverter Plus 8.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)
"Security Task Manager" = Security Task Manager 1.7g
"Sierra Utilities" = Sierra Utilities
"SpeedSim" = SpeedSim
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uniblue RegistryBooster" = Uniblue RegistryBooster
"Yahoo! Companion" = Yahoo! Toolbar mit Pop-Up-Blocker
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 30.1.2011 16:07:52 | Computer Name = Dery-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.18999, Zeitstempel
 0x4ccf92fb, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x0000c73c,  Prozess-ID 0xee0, Anwendungsstartzeit
 01cbc0b0b5de20c6.
 
Error - 1.2.2011 14:54:33 | Computer Name = Dery-PC | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 7.2.0.3525 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 9b4  Anfangszeit: 01cbc24139bd5e49  Zeitpunkt der Beendigung:
 42
 
Error - 3.2.2011 15:17:16 | Computer Name = Dery-PC | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 7.2.0.3525 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: c28  Anfangszeit: 01cbc3d6a2fc8826  Zeitpunkt der Beendigung:
 78
 
Error - 22.2.2011 7:20:44 | Computer Name = Dery-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe_ProfSvc, Version 6.0.6001.18000,
 Zeitstempel 0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel
 0x4cb73436, Ausnahmecode 0xc0000005, Fehleroffset 0x00067917,  Prozess-ID 0x438,
Anwendungsstartzeit 01cbd1d6e7f1ed61.
 
Error - 22.2.2011 7:21:25 | Computer Name = Dery-PC | Source = SDWinSec.exe | ID = 0
Description =
 
Error - 25.2.2011 10:58:01 | Computer Name = Dery-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.19019, Zeitstempel
 0x4d0c3d4c, fehlerhaftes Modul SHELL32.dll, Version 6.0.6002.18393, Zeitstempel
 0x4d39b5c7, Ausnahmecode 0xc0000005, Fehleroffset 0x00088faa,  Prozess-ID 0x9cc,
Anwendungsstartzeit 01cbd4bdd3bd08eb.
 
Error - 26.2.2011 7:10:57 | Computer Name = Dery-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung hl.Exe, Version 1.0.1.0, Zeitstempel 0x3749e58a,
 fehlerhaftes Modul sw.dll_unloaded, Version 0.0.0.0, Zeitstempel 0x37386b38, Ausnahmecode
 0xc0000005, Fehleroffset 0x086a44f7,  Prozess-ID 0xc40, Anwendungsstartzeit 01cbd5a3a5929640.
 
Error - 27.2.2011 13:39:07 | Computer Name = Dery-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 8.0.6001.19019 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 3b4  Anfangszeit: 01cbd6a42c11c5f0  Zeitpunkt
 der Beendigung: 62
 
Error - 28.2.2011 11:20:52 | Computer Name = Dery-PC | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 7.2.0.3525 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: efc  Anfangszeit: 01cbd75aa0cc1841  Zeitpunkt der Beendigung:
 16
 
Error - 1.3.2011 15:35:29 | Computer Name = Dery-PC | Source = EventSystem | ID = 4609
Description =
 
[ Credential Manager Events ]
Error - 26.2.2011 13:42:27 | Computer Name = Dery-PC | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.  Benutzer:
 Dery@Dery-PC  Client-GUID: {Password}  Fehler: 0xC516020B  Client-Host: localhost

Client-Adresse:
 127.0.0.1  Authentifizierungsstelle: HP  Server-Host: localhost  Protokoll: HTTP
 
Error - 26.2.2011 13:42:27 | Computer Name = Dery-PC | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Dery@Dery-PC
Anmeldeinformationen:
 Kennwort  Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 26.2.2011 13:42:28 | Computer Name = Dery-PC | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.  Benutzer:
 Dery@Dery-PC  Client-GUID: {Password}  Fehler: 0xC516020B  Client-Host: localhost

Client-Adresse:
 127.0.0.1  Authentifizierungsstelle: HP  Server-Host: localhost  Protokoll: HTTP
 
Error - 26.2.2011 13:42:28 | Computer Name = Dery-PC | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Dery@Dery-PC
Anmeldeinformationen:
 Kennwort  Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 26.2.2011 13:42:30 | Computer Name = Dery-PC | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.  Benutzer:
 Dery@Dery-PC  Client-GUID: {Password}  Fehler: 0xC516020B  Client-Host: localhost

Client-Adresse:
 127.0.0.1  Authentifizierungsstelle: HP  Server-Host: localhost  Protokoll: HTTP
 
Error - 26.2.2011 13:42:30 | Computer Name = Dery-PC | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Dery@Dery-PC
Anmeldeinformationen:
 Kennwort  Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 26.2.2011 13:42:31 | Computer Name = Dery-PC | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.  Benutzer:
 Dery@Dery-PC  Client-GUID: {Password}  Fehler: 0xC516020B  Client-Host: localhost

Client-Adresse:
 127.0.0.1  Authentifizierungsstelle: HP  Server-Host: localhost  Protokoll: HTTP
 
Error - 26.2.2011 13:42:31 | Computer Name = Dery-PC | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Dery@Dery-PC
Anmeldeinformationen:
 Kennwort  Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
Error - 26.2.2011 13:45:01 | Computer Name = Dery-PC | Source = AuthServer | ID = 100811779
Description = The system failed to authenticate the submitted user credentials.  Benutzer:
 Dery@Dery-PC  Client-GUID: {Password}  Fehler: 0xC516020B  Client-Host: localhost

Client-Adresse:
 127.0.0.1  Authentifizierungsstelle: HP  Server-Host: localhost  Protokoll: HTTP
 
Error - 26.2.2011 13:45:01 | Computer Name = Dery-PC | Source = AuthWiz | ID = 100796068
Description = The submitted credentials were rejected.    Benutzer: Dery@Dery-PC
Anmeldeinformationen:
 Kennwort  Fehler: (0xC516020B) Anmeldung fehlgeschlagen.  Überprüfen Sie, ob Benutzername
 und Domäne korrekt sind, und geben Sie Ihr Kennwort erneut ein.  Bei Kennwörtern
 wird die Groß- und Kleinschreibung beachtet.  Stellen Sie sicher, dass die Feststelltaste
 nicht aktiviert ist.
 
[ System Events ]
Error - 6.3.2011 3:08:16 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 6.3.2011 13:36:39 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 6.3.2011 14:09:52 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 6.3.2011 14:14:48 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7022
Description =
 
Error - 6.3.2011 14:25:45 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 7.3.2011 3:29:24 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 7.3.2011 5:55:19 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 8.3.2011 12:50:48 | Computer Name = Dery-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 08.03.2011 um 17:48:38 unerwartet heruntergefahren.
 
Error - 8.3.2011 12:51:11 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 8.3.2011 16:34:12 | Computer Name = Dery-PC | Source = Service Control Manager | ID = 7011
Description =
 
 
< End of report >
--- --- ---


OTL Logfile:
Code:
OTL logfile created on: 10.3.2011 19:38:14 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Dery\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000405 | Country: Tschechische Republik | Language: CSY | Date Format: d.M.yyyy
 
1*015,00 Mb Total Physical Memory | 399,00 Mb Available Physical Memory | 39,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 52,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66,77 Gb Total Space | 30,60 Gb Free Space | 45,82% Space Free | Partition Type: NTFS
Drive D: | 6,20 Gb Total Space | 0,80 Gb Free Space | 12,90% Space Free | Partition Type: NTFS
Drive E: | 1,55 Gb Total Space | 1,29 Gb Free Space | 83,16% Space Free | Partition Type: NTFS
Drive F: | 4,38 Gb Total Space | 4,19 Gb Free Space | 95,78% Space Free | Partition Type: UDF
 
Computer Name: Dery-PC | User Name: Dery | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 360 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Dery\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited)
PRC - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\ParetoLogic\DriverCure\DriverCure.exe (ParetoLogic)
PRC - C:\Programme\Common Files\Panasonic\VideoCam Suite AutoStart\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\WINDOWS\System32\iashost.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\bgsvcgen.exe (B.H.A Corporation)
PRC - C:\WINDOWS\System32\agrsmsvc.exe (Agere Systems)
PRC - c:\Programme\Hewlett-Packard\IAM\Bin\asghost.exe (Cognizance Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Dery\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (bgsvcgen) -- C:\Windows\System32\bgsvcgen.exe (B.H.A Corporation)
SRV - (AgereModemAudio) -- C:\WINDOWS\System32\agrsmsvc.exe (Agere Systems)
SRV - (ASBroker) -- c:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Cognizance Corporation)
SRV - (AddFiltr) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Hewlett-Packard Development Company, L.P.)
SRV - (ASChannel) -- c:\Programme\Hewlett-Packard\IAM\Bin\ASChnl.dll (Cognizance Corporation)
SRV - (IDriverT) -- c:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (UsbserFilt) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (avgntflt) -- C:\WINDOWS\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) -- C:\WINDOWS\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (AgereSoftModem) -- C:\WINDOWS\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (eabfiltr) -- C:\WINDOWS\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (NETw3v32) Intel(R) -- C:\WINDOWS\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (TPM) -- C:\WINDOWS\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (R300) -- C:\WINDOWS\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) -- C:\WINDOWS\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (WimFltr) -- C:\WINDOWS\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (PersonalSecureDrive) -- C:\Windows\System32\drivers\psd.sys (Infineon Technologies AG)
DRV - (HBtnKey) -- C:\WINDOWS\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (cdrbsdrv) -- C:\Windows\System32\drivers\cdrbsdrv.sys (B.H.A Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.05 08:21:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.05 08:21:22 | 000,000,000 | ---D | M]
 
[2011.03.05 08:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dery\AppData\Roaming\mozilla\Extensions
[2011.03.10 19:21:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dery\AppData\Roaming\mozilla\Firefox\Profiles\8olgh73a.default\extensions
[2011.03.10 19:21:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Dery\AppData\Roaming\mozilla\Firefox\Profiles\8olgh73a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.03.05 08:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.03.03 19:06:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.03 19:06:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.03 19:06:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.03 19:06:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.03 19:06:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.08.20 18:38:42 | 000,260,839 | R--- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.1001-search.info
O1 - Hosts: 127.0.0.1        1001-search.info
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.123topsearch.com
O1 - Hosts: 127.0.0.1        123topsearch.com
O1 - Hosts: 127.0.0.1        www.132.com
O1 - Hosts: 127.0.0.1        132.com
O1 - Hosts: 127.0.0.1        www.136136.net
O1 - Hosts: 9058 more lines...
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Programme\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 360 Days ==========
 
[2011.03.09 08:19:17 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011.03.09 08:19:16 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2011.03.09 08:19:16 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2011.03.09 08:19:16 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll
[2011.03.05 19:03:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2011.03.05 19:02:55 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2011.03.05 08:21:56 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\Mozilla
[2011.03.05 08:21:55 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Mozilla
[2011.03.05 08:21:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.03.05 08:21:21 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011.03.05 00:03:18 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Malwarebytes
[2011.03.05 00:03:07 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.03.05 00:03:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.03.05 00:03:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.03.05 00:03:01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.03.05 00:03:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.03.04 23:38:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
[2011.03.04 23:38:36 | 000,000,000 | ---D | C] -- C:\Programme\Uniblue
[2011.03.04 23:38:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2011.03.04 23:38:15 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\PackageAware
[2011.02.27 20:34:59 | 000,038,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2011.02.27 20:31:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Nokia
[2011.02.27 20:22:43 | 000,000,000 | ---D | C] -- C:\Programme\DIFX
[2011.02.27 20:22:40 | 000,018,816 | ---- | C] (Nokia) -- C:\Windows\System32\drivers\pccsmcfd.sys
[2011.02.27 20:21:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.02.27 20:21:16 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2011.02.27 20:16:48 | 000,092,672 | ---- | C] (Nokia) -- C:\Windows\System32\nmwcdcls.dll
[2011.02.27 20:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2011.02.27 20:15:30 | 000,000,000 | ---D | C] -- C:\Programme\Nokia
[2011.02.27 20:15:30 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Nokia
[2011.02.27 20:13:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Installations
[2011.02.26 11:52:56 | 001,022,976 | ---- | C] (Cendant Software) -- C:\Windows\System32\SierraNW.dll
[2011.02.26 11:52:56 | 000,231,936 | ---- | C] (Cendant Software) -- C:\Windows\System32\SNWValid.dll
[2011.02.26 11:52:51 | 000,000,000 | ---D | C] -- C:\Programme\Sierra On-Line
[2011.02.26 11:52:51 | 000,000,000 | ---D | C] -- C:\SIERRA
[2011.02.26 11:51:34 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[2011.02.09 13:56:06 | 002,039,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.02.09 13:56:02 | 003,602,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011.02.09 13:56:01 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011.02.09 13:55:20 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.02.09 13:55:20 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.02.09 13:53:43 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011.02.09 13:53:43 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.02.09 13:53:42 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.02.09 13:53:42 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.02.09 13:53:42 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.02.09 13:53:42 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.02.09 13:53:42 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.02.09 13:53:42 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011.02.09 13:53:41 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.02.09 13:53:41 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011.02.09 13:53:41 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011.02.09 13:53:41 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011.02.09 13:53:41 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011.02.09 13:53:41 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.02.09 13:53:41 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.02.09 13:53:41 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.02.09 13:53:41 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.01.12 15:58:09 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2011.01.12 15:58:05 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2010.12.30 22:15:06 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\mirabyte
[2010.12.30 22:14:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SuperHTML 8.0 Web Studio
[2010.12.30 22:13:56 | 000,000,000 | ---D | C] -- C:\Programme\mirabyte
[2010.12.30 22:09:09 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Wise Installation Wizard
[2010.12.16 07:33:53 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.12.16 07:33:18 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.12.16 07:33:17 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.12.16 07:33:17 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.12.16 07:33:09 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.12.16 07:33:06 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010.10.29 07:27:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Panasonic
[2010.10.29 07:27:06 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\Panasonic
[2010.10.23 18:45:18 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\Chat Republic Games
[2010.10.23 15:32:18 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aspyr Media, Inc
[2010.10.23 15:21:15 | 000,000,000 | ---D | C] -- C:\Programme\Aspyr Media, Inc
[2010.10.14 23:17:45 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.10.14 23:16:17 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.10.14 23:14:58 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.10.14 23:14:24 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.10.14 23:14:23 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.10.14 22:50:28 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.10.14 22:38:05 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.09.24 19:09:17 | 000,033,408 | ---- | C] (B.H.A Corporation) -- C:\Windows\System32\drivers\cdrbsdrv.sys
[2010.09.24 19:09:15 | 000,145,504 | ---- | C] (B.H.A Corporation) -- C:\Windows\System32\bgsvcgen.exe
[2010.09.24 19:09:15 | 000,059,488 | ---- | C] (B.H.A Corporation) -- C:\Windows\System32\GenSvcInst.exe
[2010.09.24 19:09:05 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Panasonic
[2010.09.24 19:08:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panasonic
[2010.09.24 19:08:37 | 000,000,000 | ---D | C] -- C:\Programme\Panasonic
[2010.09.24 19:08:18 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Synchronization Services
[2010.09.24 19:08:18 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SQL Server Compact Edition
[2010.09.15 19:21:12 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.08.12 09:20:45 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010.08.12 09:20:12 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010.07.08 21:01:01 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2010.07.08 21:01:01 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2010.07.08 21:01:01 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2010.06.09 08:04:17 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010.06.05 22:31:12 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\ImageConverter Plus
[2010.06.05 22:31:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImageConverter Plus
[2010.06.05 22:31:09 | 001,706,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gdiplus.dll
[2010.06.05 22:31:06 | 000,000,000 | ---D | C] -- C:\Users\Dery\Documents\Image Converter Plus
[2010.06.05 22:31:05 | 000,180,224 | ---- | C] (fCoder Group International) -- C:\Windows\System32\cnvshell.dll
[2010.06.05 22:30:58 | 000,000,000 | ---D | C] -- C:\Programme\ImageConverter Plus
[2010.06.04 21:04:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2010.06.04 21:03:28 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2010.04.14 22:15:11 | 000,420,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010.04.14 22:12:07 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2010.04.14 22:12:07 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[6 C:\Users\Dery\Documents\*.tmp files -> C:\Users\Dery\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 360 Days ==========
 
[2011.03.10 19:42:35 | 000,000,396 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EE8B0A0E-0C2D-4843-BE8F-41F13F8893A2}.job
[2011.03.10 18:50:45 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.03.10 18:50:45 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.03.10 18:50:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.03.10 10:33:53 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\DriverCure_sch_73662D7B-1447-11DE-887A-0017A4E32380.job
[2011.03.09 22:00:27 | 000,000,448 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2011.03.09 22:00:27 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2011.03.08 22:46:10 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.08 17:51:18 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2011.03.07 10:37:22 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.03.05 08:21:26 | 000,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.03.04 23:39:17 | 000,001,841 | ---- | M] () -- C:\Users\Public\Desktop\Uniblue RegistryBooster.lnk
[2011.02.27 20:36:25 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.02.27 20:36:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.02.27 20:15:37 | 000,001,995 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Software Updater.lnk
[2011.02.27 08:32:02 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2011.02.26 11:54:38 | 000,000,342 | ---- | M] () -- C:\Windows\SIERRA.INI
[2011.02.26 11:50:48 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011.02.26 11:50:48 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011.02.22 12:22:33 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\DriverCure.job
[2011.02.10 23:03:21 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2011.02.09 22:26:01 | 000,310,480 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.02.02 17:11:20 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2011.01.08 09:47:50 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.01.08 07:28:49 | 000,292,352 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.01.07 20:44:51 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2011.01.06 13:30:42 | 000,595,506 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.01.06 13:30:41 | 000,628,448 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.01.06 13:30:41 | 000,127,056 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.01.06 13:30:41 | 000,104,940 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.12.31 14:57:01 | 002,039,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.12.30 22:14:13 | 000,000,283 | ---- | M] () -- C:\Windows\{19789B73-7489-4EE0-8040-6C4DD5C1AF52}_WiseFW.ini
[2010.12.29 19:28:45 | 000,153,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll
[2010.12.29 19:26:47 | 000,177,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2010.12.28 16:55:03 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.12.20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.12.18 07:23:39 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.12.18 07:23:11 | 000,602,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.12.18 07:23:11 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.12.18 07:22:41 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010.12.18 07:22:33 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.12.18 07:22:27 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.12.18 07:22:11 | 000,164,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.12.18 07:22:11 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.12.18 07:22:11 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.12.18 07:22:11 | 000,055,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.12.18 07:22:10 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.12.18 07:22:06 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.12.18 06:25:26 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.12.18 05:48:39 | 000,133,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.12.18 05:48:23 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.12.18 05:47:42 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.12.18 05:47:11 | 001,638,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.12.14 15:49:23 | 001,169,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
[2010.11.04 19:56:07 | 000,345,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.11.04 19:55:38 | 000,352,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.11.04 19:55:38 | 000,270,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.10.28 14:20:12 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.10.18 14:37:35 | 000,081,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.10.15 15:08:12 | 003,602,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010.10.15 15:08:12 | 003,550,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010.09.24 19:09:25 | 000,001,951 | ---- | M] () -- C:\Users\Public\Desktop\VideoCam Suite 3.0.lnk
[2010.09.24 19:09:05 | 000,002,031 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VideoCam Suite.lnk
[2010.09.13 14:56:41 | 008,147,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.09.06 17:19:06 | 000,017,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.08.31 16:46:37 | 000,954,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.08.31 16:46:37 | 000,954,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.08.26 17:37:45 | 000,157,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.08.20 17:05:07 | 000,867,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.07.31 14:53:24 | 004,581,351 | ---- | M] () -- C:\Users\Dery\Documents\Markus-Christof Beroun 2010.jpg
[2010.07.25 06:37:42 | 000,000,948 | ---- | M] () -- C:\Users\Public\Desktop\ParetoLogic DriverCure.lnk
[2010.06.18 18:31:29 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010.06.16 16:30:44 | 000,072,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010.06.05 23:36:55 | 000,005,112 | ---- | M] () -- C:\Users\Dery\Documents\EHA Logo JPG (2)
[2010.06.05 22:49:18 | 000,005,112 | ---- | M] () -- C:\Users\Dery\Documents\EHA Logo JPG (1)
[2010.06.05 22:48:36 | 000,005,112 | ---- | M] () -- C:\Users\Dery\Documents\EHA Logo JPG
[2010.06.05 22:31:11 | 000,000,788 | ---- | M] () -- C:\Users\Dery\Desktop\ImageConverter Plus.lnk
[2010.06.05 22:10:31 | 001,862,326 | ---- | M] () -- C:\Users\Dery\Documents\elite_logo.tif
[2010.05.27 21:08:17 | 000,081,920 | ---- | M] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010.05.23 22:14:11 | 000,015,182 | ---- | M] () -- C:\Users\Dery\Documents\35103J.jpg
[2010.05.23 11:16:10 | 000,198,807 | ---- | M] () -- C:\Users\Dery\Documents\Visitenkarte s Logo EHA -deutsch.jpg
[2010.05.04 20:13:07 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.04.05 18:02:42 | 000,317,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.04.05 18:01:01 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010.04.03 21:36:05 | 000,062,276 | ---- | M] () -- C:\Users\Dery\Documents\Plakat1.pdf
[2010.03.23 09:52:05 | 000,000,104 | ---- | M] () -- C:\Users\Dery\Documents\Computer - Verknüpfung.lnk
[2010.03.19 14:55:45 | 000,007,680 | ---- | M] () -- C:\Users\Dery\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[6 C:\Users\Dery\Documents\*.tmp files -> C:\Users\Dery\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.03.05 08:21:26 | 000,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.03.05 00:03:08 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.04 23:39:27 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\RegistryBooster.job
[2011.03.04 23:38:37 | 000,001,841 | ---- | C] () -- C:\Users\Public\Desktop\Uniblue RegistryBooster.lnk
[2011.02.27 20:36:25 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.02.27 20:36:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.02.27 20:35:14 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2011.02.27 20:15:37 | 000,001,995 | ---- | C] () -- C:\Users\Public\Desktop\Nokia Software Updater.lnk
[2011.02.26 11:51:39 | 000,000,342 | ---- | C] () -- C:\Windows\SIERRA.INI
[2011.02.26 11:50:48 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011.02.26 11:50:48 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011.02.22 12:26:23 | 000,000,396 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{EE8B0A0E-0C2D-4843-BE8F-41F13F8893A2}.job
[2011.01.07 20:44:51 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2010.12.30 22:13:31 | 000,000,283 | ---- | C] () -- C:\Windows\{19789B73-7489-4EE0-8040-6C4DD5C1AF52}_WiseFW.ini
[2010.10.02 08:23:39 | 004,581,351 | ---- | C] () -- C:\Users\Dery\Documents\Markus-Christof Beroun 2010.jpg
[2010.09.24 19:09:25 | 000,001,951 | ---- | C] () -- C:\Users\Public\Desktop\VideoCam Suite 3.0.lnk
[2010.09.24 19:09:05 | 000,002,031 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VideoCam Suite.lnk
[2010.07.25 06:38:02 | 000,000,448 | ---- | C] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2010.06.05 23:36:55 | 000,005,112 | ---- | C] () -- C:\Users\Dery\Documents\EHA Logo JPG (2)
[2010.06.05 22:49:18 | 000,005,112 | ---- | C] () -- C:\Users\Dery\Documents\EHA Logo JPG (1)
[2010.06.05 22:48:36 | 000,005,112 | ---- | C] () -- C:\Users\Dery\Documents\EHA Logo JPG
[2010.06.05 22:31:11 | 000,000,788 | ---- | C] () -- C:\Users\Dery\Desktop\ImageConverter Plus.lnk
[2010.05.23 22:15:06 | 000,015,182 | ---- | C] () -- C:\Users\Dery\Documents\35103J.jpg
[2010.05.23 11:17:25 | 000,198,807 | ---- | C] () -- C:\Users\Dery\Documents\Visitenkarte s Logo EHA -deutsch.jpg
[2010.04.11 21:00:50 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 8.lnk
[2010.04.11 21:00:50 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2010.04.03 21:36:03 | 000,062,276 | ---- | C] () -- C:\Users\Dery\Documents\Plakat1.pdf
[2010.03.23 09:52:05 | 000,000,104 | ---- | C] () -- C:\Users\Dery\Documents\Computer - Verknüpfung.lnk
[2009.11.23 09:51:08 | 000,000,680 | ---- | C] () -- C:\Users\Dery\AppData\Local\d3d9caps.dat
[2009.08.24 22:27:20 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.24 22:27:20 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.08.24 22:26:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.10.23 18:26:54 | 000,000,095 | ---- | C] () -- C:\Users\Dery\AppData\Local\fusioncache.dat
[2008.05.11 12:42:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.04.29 18:59:55 | 000,007,680 | ---- | C] () -- C:\Users\Dery\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.26 18:59:47 | 000,001,471 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.04.26 18:59:47 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.04.25 19:45:32 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008.04.25 19:45:32 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008.04.25 19:45:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008.04.25 19:45:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008.04.25 19:45:32 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008.04.25 19:45:32 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2006.12.18 22:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1151.dll
[2006.12.18 22:07:48 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2006.12.18 22:07:46 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.12.18 22:07:44 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2006.11.28 21:11:30 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006.11.09 17:42:33 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2006.11.09 17:42:05 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.03 16:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.11.02 16:38:05 | 000,628,448 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:38:05 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:38:05 | 000,127,056 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:38:05 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:44:53 | 000,310,480 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 11:33:01 | 000,595,506 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,104,940 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.09.18 23:02:40 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006.09.18 23:02:40 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006.03.09 11:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2001.11.14 11:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[1999.01.22 19:46:56 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
[1998.05.07 02:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll
 
========== Files - Unicode (All) ==========
[2009.04.15 19:30:09 | 000,012,213 | ---- | M] ()(C:\Users\Dery\Documents\15.04 09 ????????????+online+(russisch).odt) -- C:\Users\Dery\Documents\15.04 09 Бронирование+online+(russisch).odt
[2009.04.15 19:30:07 | 000,012,213 | ---- | C] ()(C:\Users\Dery\Documents\15.04 09 ????????????+online+(russisch).odt) -- C:\Users\Dery\Documents\15.04 09 Бронирование+online+(russisch).odt
[2009.03.26 23:25:53 | 000,012,054 | ---- | M] ()(C:\Users\Dery\Documents\?????+??????????!.odt) -- C:\Users\Dery\Documents\Добро+пожаловать!.odt
[2009.03.26 23:25:52 | 000,012,054 | ---- | C] ()(C:\Users\Dery\Documents\?????+??????????!.odt) -- C:\Users\Dery\Documents\Добро+пожаловать!.odt
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 981 bytes -> C:\Users\Dery\Documents\Re_ [Ticket_2009071667000512] Reseller-ID_,olichn.eml:OECustomProperty
@Alternate Data Stream - 64 bytes -> C:\Users\Dery\Documents\3-video.mpeg:TOC.WMV

< End of report >
--- --- ---
[code]

Code:
www.malwarebytes.org

Datenbank Version: 5993

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

9.3.2011 0:37:47
mbam-log-2011-03-09 (00-37-47).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 282549
Laufzeit: 1 Stunde(n), 49 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Ich hoffe das hilft weiter.

cosinus 10.03.2011 20:10
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle davon posten. Du findest diese im Reiter Logdateien in Malwarebytes.

Dery 10.03.2011 20:33
Es gibt noch dieses Log vom 5.3.
Sonst sind keine Einträge im Reiter Logdateien

Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5956

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

5.3.2011 0:15:23
mbam-log-2011-03-05 (00-15-23).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 145403
Laufzeit: 11 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 11.03.2011 09:16
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Dery 12.03.2011 09:03
OTL Logfile:
Code:
OTL logfile created on: 12.3.2011 8:49:41 - Run 2
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Dery\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000405 | Country: Tschechische Republik | Language: CSY | Date Format: d.M.yyyy
 
1*015,00 Mb Total Physical Memory | 314,00 Mb Available Physical Memory | 31,00% Memory free:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
:Commands
[purity]
[resethosts]
[emptytemp]

2,00 Gb Paging File | 1,00 Gb Available in Paging File | 51,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66,77 Gb Total Space | 30,62 Gb Free Space | 45,85% Space Free | Partition Type: NTFS
Drive D: | 6,20 Gb Total Space | 0,80 Gb Free Space | 12,90% Space Free | Partition Type: NTFS
Drive E: | 1,55 Gb Total Space | 1,29 Gb Free Space | 83,16% Space Free | Partition Type: NTFS
Drive F: | 4,38 Gb Total Space | 4,19 Gb Free Space | 95,78% Space Free | Partition Type: UDF
 
Computer Name: Dery-PC | User Name: Dery | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Dery\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\System32\Macromed\Flash\FlashUtil10m_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Programme\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited)
PRC - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Panasonic\VideoCam Suite AutoStart\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\WINDOWS\System32\iashost.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\bgsvcgen.exe (B.H.A Corporation)
PRC - C:\WINDOWS\System32\agrsmsvc.exe (Agere Systems)
PRC - c:\Programme\Hewlett-Packard\IAM\Bin\asghost.exe (Cognizance Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Dery\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (bgsvcgen) -- C:\Windows\System32\bgsvcgen.exe (B.H.A Corporation)
SRV - (AgereModemAudio) -- C:\WINDOWS\System32\agrsmsvc.exe (Agere Systems)
SRV - (ASBroker) -- c:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Cognizance Corporation)
SRV - (AddFiltr) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Hewlett-Packard Development Company, L.P.)
SRV - (ASChannel) -- c:\Programme\Hewlett-Packard\IAM\Bin\ASChnl.dll (Cognizance Corporation)
SRV - (IDriverT) -- c:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (UsbserFilt) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (avgntflt) -- C:\WINDOWS\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) -- C:\WINDOWS\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (AgereSoftModem) -- C:\WINDOWS\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (eabfiltr) -- C:\WINDOWS\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (NETw3v32) Intel(R) -- C:\WINDOWS\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (TPM) -- C:\WINDOWS\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (R300) -- C:\WINDOWS\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) -- C:\WINDOWS\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (WimFltr) -- C:\WINDOWS\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (PersonalSecureDrive) -- C:\Windows\System32\drivers\psd.sys (Infineon Technologies AG)
DRV - (HBtnKey) -- C:\WINDOWS\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (cdrbsdrv) -- C:\Windows\System32\drivers\cdrbsdrv.sys (B.H.A Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.05 08:21:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.05 08:21:22 | 000,000,000 | ---D | M]
 
[2011.03.05 08:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dery\AppData\Roaming\mozilla\Extensions
[2011.03.11 22:49:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dery\AppData\Roaming\mozilla\Firefox\Profiles\8olgh73a.default\extensions
[2011.03.10 19:21:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Dery\AppData\Roaming\mozilla\Firefox\Profiles\8olgh73a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.03.05 08:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.03.03 19:06:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.03 19:06:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.03 19:06:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.03 19:06:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.03 19:06:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.08.20 18:38:42 | 000,260,839 | R--- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.1001-search.info
O1 - Hosts: 127.0.0.1        1001-search.info
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.123topsearch.com
O1 - Hosts: 127.0.0.1        123topsearch.com
O1 - Hosts: 127.0.0.1        www.132.com
O1 - Hosts: 127.0.0.1        132.com
O1 - Hosts: 127.0.0.1        www.136136.net
O1 - Hosts: 9058 more lines...
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Programme\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.03.09 08:19:17 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011.03.09 08:19:16 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2011.03.09 08:19:16 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2011.03.09 08:19:16 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll
[2011.03.05 19:03:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2011.03.05 19:02:55 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2011.03.05 08:21:56 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\Mozilla
[2011.03.05 08:21:55 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Mozilla
[2011.03.05 08:21:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.03.05 08:21:21 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011.03.05 00:03:18 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Malwarebytes
[2011.03.05 00:03:07 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.03.05 00:03:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.03.05 00:03:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.03.05 00:03:01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.03.05 00:03:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.03.04 23:38:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
[2011.03.04 23:38:36 | 000,000,000 | ---D | C] -- C:\Programme\Uniblue
[2011.03.04 23:38:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2011.03.04 23:38:15 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\PackageAware
[2011.02.27 20:34:59 | 000,038,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2011.02.27 20:31:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Nokia
[2011.02.27 20:22:43 | 000,000,000 | ---D | C] -- C:\Programme\DIFX
[2011.02.27 20:22:40 | 000,018,816 | ---- | C] (Nokia) -- C:\Windows\System32\drivers\pccsmcfd.sys
[2011.02.27 20:21:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.02.27 20:21:16 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2011.02.27 20:16:48 | 000,092,672 | ---- | C] (Nokia) -- C:\Windows\System32\nmwcdcls.dll
[2011.02.27 20:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2011.02.27 20:15:30 | 000,000,000 | ---D | C] -- C:\Programme\Nokia
[2011.02.27 20:15:30 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Nokia
[2011.02.27 20:13:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Installations
[2011.02.26 11:52:56 | 001,022,976 | ---- | C] (Cendant Software) -- C:\Windows\System32\SierraNW.dll
[2011.02.26 11:52:56 | 000,231,936 | ---- | C] (Cendant Software) -- C:\Windows\System32\SNWValid.dll
[2011.02.26 11:52:51 | 000,000,000 | ---D | C] -- C:\Programme\Sierra On-Line
[2011.02.26 11:52:51 | 000,000,000 | ---D | C] -- C:\SIERRA
[2011.02.26 11:51:34 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[6 C:\Users\Dery\Documents\*.tmp files -> C:\Users\Dery\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.03.12 08:52:33 | 000,000,396 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EE8B0A0E-0C2D-4843-BE8F-41F13F8893A2}.job
[2011.03.12 08:40:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.03.11 23:25:44 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.03.11 23:25:44 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.03.11 21:26:08 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2011.03.11 21:08:21 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.03.11 20:56:49 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2011.03.11 20:56:48 | 000,000,448 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2011.03.10 23:24:04 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\DriverCure_sch_73662D7B-1447-11DE-887A-0017A4E32380.job
[2011.03.08 22:46:10 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.05 08:21:26 | 000,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.03.04 23:39:17 | 000,001,841 | ---- | M] () -- C:\Users\Public\Desktop\Uniblue RegistryBooster.lnk
[2011.02.27 20:36:25 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.02.27 20:36:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.02.27 20:15:37 | 000,001,995 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Software Updater.lnk
[2011.02.27 08:32:02 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2011.02.26 11:54:38 | 000,000,342 | ---- | M] () -- C:\Windows\SIERRA.INI
[2011.02.26 11:50:48 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011.02.26 11:50:48 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011.02.22 12:22:33 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\DriverCure.job
[2011.02.10 23:03:21 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk
[6 C:\Users\Dery\Documents\*.tmp files -> C:\Users\Dery\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.03.05 08:21:26 | 000,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.03.05 00:03:08 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.04 23:39:27 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\RegistryBooster.job
[2011.03.04 23:38:37 | 000,001,841 | ---- | C] () -- C:\Users\Public\Desktop\Uniblue RegistryBooster.lnk
[2011.02.27 20:36:25 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.02.27 20:36:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.02.27 20:35:14 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2011.02.27 20:15:37 | 000,001,995 | ---- | C] () -- C:\Users\Public\Desktop\Nokia Software Updater.lnk
[2011.02.26 11:51:39 | 000,000,342 | ---- | C] () -- C:\Windows\SIERRA.INI
[2011.02.26 11:50:48 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011.02.26 11:50:48 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011.02.22 12:26:23 | 000,000,396 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{EE8B0A0E-0C2D-4843-BE8F-41F13F8893A2}.job
[2010.12.30 22:13:31 | 000,000,283 | ---- | C] () -- C:\Windows\{19789B73-7489-4EE0-8040-6C4DD5C1AF52}_WiseFW.ini
[2009.11.23 09:51:08 | 000,000,680 | ---- | C] () -- C:\Users\Dery\AppData\Local\d3d9caps.dat
[2009.08.24 22:27:20 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.24 22:27:20 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.08.24 22:26:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.10.23 18:26:54 | 000,000,095 | ---- | C] () -- C:\Users\Dery\AppData\Local\fusioncache.dat
[2008.05.11 12:42:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.04.29 18:59:55 | 000,007,680 | ---- | C] () -- C:\Users\Dery\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.26 18:59:47 | 000,001,471 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.04.26 18:59:47 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.04.25 19:45:32 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008.04.25 19:45:32 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008.04.25 19:45:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008.04.25 19:45:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008.04.25 19:45:32 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008.04.25 19:45:32 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2006.12.18 22:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1151.dll
[2006.12.18 22:07:48 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2006.12.18 22:07:46 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.12.18 22:07:44 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2006.11.28 21:11:30 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006.11.09 17:42:33 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2006.11.09 17:42:05 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.03 16:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.11.02 16:38:05 | 000,628,448 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:38:05 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:38:05 | 000,127,056 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:38:05 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:44:53 | 000,310,480 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 11:33:01 | 000,595,506 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,104,940 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.09.18 23:02:40 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006.09.18 23:02:40 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006.03.09 11:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2001.11.14 11:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[1999.01.22 19:46:56 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
[1998.05.07 02:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll
 
========== Custom Scans ==========
 
 
< :OTL >
 
< O32 - HKLM CDRom: AutoRun - 1 >
 
< O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ] >
 
< O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun >
 
< O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a >
 
< O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun >
 
< O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe >
 
< O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun >
 
< O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe >
 
< O33 - MountPoints2\G\Shell - "" = AutoRun >
 
< O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe >
 
< :Commands >
 
< [purity] >
 
< [resethosts] >
 
< [emptytemp] >
 
========== Files - Unicode (All) ==========
[2009.04.15 19:30:09 | 000,012,213 | ---- | M] ()(C:\Users\Dery\Documents\15.04 09 ????????????+online+(russisch).odt) -- C:\Users\Dery\Documents\15.04 09 Бронирование+online+(russisch).odt
[2009.04.15 19:30:07 | 000,012,213 | ---- | C] ()(C:\Users\Dery\Documents\15.04 09 ????????????+online+(russisch).odt) -- C:\Users\Dery\Documents\15.04 09 Бронирование+online+(russisch).odt
[2009.03.26 23:25:53 | 000,012,054 | ---- | M] ()(C:\Users\Dery\Documents\?????+??????????!.odt) -- C:\Users\Dery\Documents\Добро+пожаловать!.odt
[2009.03.26 23:25:52 | 000,012,054 | ---- | C] ()(C:\Users\Dery\Documents\?????+??????????!.odt) -- C:\Users\Dery\Documents\Добро+пожаловать!.odt
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 981 bytes -> C:\Users\Dery\Documents\Re_ [Ticket_2009071667000512] Reseller-ID_,olichn.eml:OECustomProperty
@Alternate Data Stream - 64 bytes -> C:\Users\Dery\Documents\3-video.mpeg:TOC.WMV

< End of report >
--- --- ---
Hoffentlich paßt

cosinus 12.03.2011 12:35
In dem Log hast du irgendwie alles durcheinandergeworfen. Bitte prüfen...

Dery 12.03.2011 20:27
OTL Logfile:
Code:
OTL logfile created on: 12.3.2011 20:08:04 - Run 3
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Users\Dery\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000405 | Country: Tschechische Republik | Language: CSY | Date Format: d.M.yyyy
 
1*015,00 Mb Total Physical Memory | 96,00 Mb Available Physical Memory | 9,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 49,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66,77 Gb Total Space | 30,60 Gb Free Space | 45,83% Space Free | Partition Type: NTFS
Drive D: | 6,20 Gb Total Space | 0,80 Gb Free Space | 12,90% Space Free | Partition Type: NTFS
Drive E: | 1,55 Gb Total Space | 1,29 Gb Free Space | 83,16% Space Free | Partition Type: NTFS
Drive F: | 4,38 Gb Total Space | 4,19 Gb Free Space | 95,78% Space Free | Partition Type: UDF
 
Computer Name: Dery-PC | User Name: Dery | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Dery\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\System32\Macromed\Flash\FlashUtil10m_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited)
PRC - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Panasonic\VideoCam Suite AutoStart\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\WINDOWS\System32\iashost.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\bgsvcgen.exe (B.H.A Corporation)
PRC - C:\WINDOWS\System32\agrsmsvc.exe (Agere Systems)
PRC - c:\Programme\Hewlett-Packard\IAM\Bin\asghost.exe (Cognizance Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Dery\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (bgsvcgen) -- C:\Windows\System32\bgsvcgen.exe (B.H.A Corporation)
SRV - (AgereModemAudio) -- C:\WINDOWS\System32\agrsmsvc.exe (Agere Systems)
SRV - (ASBroker) -- c:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Cognizance Corporation)
SRV - (AddFiltr) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe (Hewlett-Packard Development Company, L.P.)
SRV - (ASChannel) -- c:\Programme\Hewlett-Packard\IAM\Bin\ASChnl.dll (Cognizance Corporation)
SRV - (IDriverT) -- c:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (UsbserFilt) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (avgntflt) -- C:\WINDOWS\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) -- C:\WINDOWS\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (AgereSoftModem) -- C:\WINDOWS\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (eabfiltr) -- C:\WINDOWS\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (NETw3v32) Intel(R) -- C:\WINDOWS\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (TPM) -- C:\WINDOWS\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (R300) -- C:\WINDOWS\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) -- C:\WINDOWS\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (WimFltr) -- C:\WINDOWS\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (PersonalSecureDrive) -- C:\Windows\System32\drivers\psd.sys (Infineon Technologies AG)
DRV - (HBtnKey) -- C:\WINDOWS\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (cdrbsdrv) -- C:\Windows\System32\drivers\cdrbsdrv.sys (B.H.A Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.05 08:21:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.05 08:21:22 | 000,000,000 | ---D | M]
 
[2011.03.05 08:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dery\AppData\Roaming\mozilla\Extensions
[2011.03.11 22:49:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dery\AppData\Roaming\mozilla\Firefox\Profiles\8olgh73a.default\extensions
[2011.03.10 19:21:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Dery\AppData\Roaming\mozilla\Firefox\Profiles\8olgh73a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.03.05 08:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.03.03 19:06:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.03.03 19:06:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.03 19:06:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.03.03 19:06:04 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.03.03 19:06:04 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.08.20 18:38:42 | 000,260,839 | R--- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.1001-search.info
O1 - Hosts: 127.0.0.1        1001-search.info
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.123topsearch.com
O1 - Hosts: 127.0.0.1        123topsearch.com
O1 - Hosts: 127.0.0.1        www.132.com
O1 - Hosts: 127.0.0.1        132.com
O1 - Hosts: 127.0.0.1        www.136136.net
O1 - Hosts: 9058 more lines...
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Programme\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Programme\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun
O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.03.09 08:19:17 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011.03.09 08:19:16 | 000,322,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll
[2011.03.09 08:19:16 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2011.03.09 08:19:16 | 000,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbeio.dll
[2011.03.05 19:03:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2011.03.05 19:02:55 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2011.03.05 08:21:56 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\Mozilla
[2011.03.05 08:21:55 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Mozilla
[2011.03.05 08:21:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2011.03.05 08:21:21 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2011.03.05 00:03:18 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Roaming\Malwarebytes
[2011.03.05 00:03:07 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.03.05 00:03:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.03.05 00:03:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.03.05 00:03:01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.03.05 00:03:01 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.03.04 23:38:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
[2011.03.04 23:38:36 | 000,000,000 | ---D | C] -- C:\Programme\Uniblue
[2011.03.04 23:38:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
[2011.03.04 23:38:15 | 000,000,000 | ---D | C] -- C:\Users\Dery\AppData\Local\PackageAware
[2011.02.27 20:34:59 | 000,038,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2011.02.27 20:31:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Nokia
[2011.02.27 20:22:43 | 000,000,000 | ---D | C] -- C:\Programme\DIFX
[2011.02.27 20:22:40 | 000,018,816 | ---- | C] (Nokia) -- C:\Windows\System32\drivers\pccsmcfd.sys
[2011.02.27 20:21:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.02.27 20:21:16 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2011.02.27 20:16:48 | 000,092,672 | ---- | C] (Nokia) -- C:\Windows\System32\nmwcdcls.dll
[2011.02.27 20:15:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nokia
[2011.02.27 20:15:30 | 000,000,000 | ---D | C] -- C:\Programme\Nokia
[2011.02.27 20:15:30 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Nokia
[2011.02.27 20:13:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Installations
[2011.02.26 11:52:56 | 001,022,976 | ---- | C] (Cendant Software) -- C:\Windows\System32\SierraNW.dll
[2011.02.26 11:52:56 | 000,231,936 | ---- | C] (Cendant Software) -- C:\Windows\System32\SNWValid.dll
[2011.02.26 11:52:51 | 000,000,000 | ---D | C] -- C:\Programme\Sierra On-Line
[2011.02.26 11:52:51 | 000,000,000 | ---D | C] -- C:\SIERRA
[2011.02.26 11:51:34 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[6 C:\Users\Dery\Documents\*.tmp files -> C:\Users\Dery\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.03.12 20:17:01 | 000,000,396 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EE8B0A0E-0C2D-4843-BE8F-41F13F8893A2}.job
[2011.03.12 19:40:08 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2011.03.12 19:40:06 | 000,000,448 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2011.03.12 19:40:00 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.03.12 19:40:00 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.03.12 19:39:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.03.12 16:55:27 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job
[2011.03.12 15:10:59 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.03.12 10:21:31 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\DriverCure_sch_73662D7B-1447-11DE-887A-0017A4E32380.job
[2011.03.08 22:46:10 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.05 08:21:26 | 000,001,724 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.03.04 23:39:17 | 000,001,841 | ---- | M] () -- C:\Users\Public\Desktop\Uniblue RegistryBooster.lnk
[2011.02.27 20:36:25 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.02.27 20:36:23 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.02.27 20:15:37 | 000,001,995 | ---- | M] () -- C:\Users\Public\Desktop\Nokia Software Updater.lnk
[2011.02.27 08:32:02 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2011.02.26 11:54:38 | 000,000,342 | ---- | M] () -- C:\Windows\SIERRA.INI
[2011.02.26 11:50:48 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011.02.26 11:50:48 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011.02.22 12:22:33 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\DriverCure.job
[2011.02.10 23:03:21 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk
[6 C:\Users\Dery\Documents\*.tmp files -> C:\Users\Dery\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.03.05 08:21:26 | 000,001,724 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.03.05 00:03:08 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.04 23:39:27 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\RegistryBooster.job
[2011.03.04 23:38:37 | 000,001,841 | ---- | C] () -- C:\Users\Public\Desktop\Uniblue RegistryBooster.lnk
[2011.02.27 20:36:25 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2011.02.27 20:36:23 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2011.02.27 20:35:14 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2011.02.27 20:15:37 | 000,001,995 | ---- | C] () -- C:\Users\Public\Desktop\Nokia Software Updater.lnk
[2011.02.26 11:51:39 | 000,000,342 | ---- | C] () -- C:\Windows\SIERRA.INI
[2011.02.26 11:50:48 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011.02.26 11:50:48 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011.02.22 12:26:23 | 000,000,396 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{EE8B0A0E-0C2D-4843-BE8F-41F13F8893A2}.job
[2010.12.30 22:13:31 | 000,000,283 | ---- | C] () -- C:\Windows\{19789B73-7489-4EE0-8040-6C4DD5C1AF52}_WiseFW.ini
[2009.11.23 09:51:08 | 000,000,680 | ---- | C] () -- C:\Users\Dery\AppData\Local\d3d9caps.dat
[2009.08.24 22:27:20 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.24 22:27:20 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.08.24 22:26:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.10.23 18:26:54 | 000,000,095 | ---- | C] () -- C:\Users\Dery\AppData\Local\fusioncache.dat
[2008.05.11 12:42:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.04.29 18:59:55 | 000,007,680 | ---- | C] () -- C:\Users\Dery\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.26 18:59:47 | 000,001,471 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.04.26 18:59:47 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.04.25 19:45:32 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008.04.25 19:45:32 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008.04.25 19:45:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008.04.25 19:45:32 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008.04.25 19:45:32 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008.04.25 19:45:32 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2006.12.18 22:07:48 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1151.dll
[2006.12.18 22:07:48 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2006.12.18 22:07:46 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.12.18 22:07:44 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2006.11.28 21:11:30 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006.11.09 17:42:33 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2006.11.09 17:42:05 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.03 16:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.11.02 16:38:05 | 000,628,448 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:38:05 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:38:05 | 000,127,056 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:38:05 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:44:53 | 000,310,480 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 11:33:01 | 000,595,506 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,104,940 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.09.18 23:02:40 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006.09.18 23:02:40 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006.03.09 11:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2001.11.14 11:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[1999.01.22 19:46:56 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
[1998.05.07 02:10:00 | 000,069,632 | R--- | C] () -- C:\Windows\System32\ODMA32.dll
 
========== Custom Scans ==========
 
 
< :OTL >
 
< O32 - HKLM CDRom: AutoRun - 1 >
 
< O32 - AutoRun File - [2004.04.30 16:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ] >
 
< O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell - "" = AutoRun >
 
< O33 - MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a >
 
< O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun >
 
< O33 - MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = G:\StartVMCLite.exe >
 
< O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell - "" = AutoRun >
 
< O33 - MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\Shell\AutoRun\command - "" = H:\StartVMCLite.exe >
 
< O33 - MountPoints2\G\Shell - "" = AutoRun >
 
< O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\StartVMCLite.exe >
 
< :Commands >
 
< [purity] >
 
< [resethosts] >
 
< [emptytemp] >
 
========== Files - Unicode (All) ==========
[2009.04.15 19:30:09 | 000,012,213 | ---- | M] ()(C:\Users\Dery\Documents\15.04 09 ????????????+online+(russisch).odt) -- C:\Users\Dery\Documents\15.04 09 Бронирование+online+(russisch).odt
[2009.04.15 19:30:07 | 000,012,213 | ---- | C] ()(C:\Users\Dery\Documents\15.04 09 ????????????+online+(russisch).odt) -- C:\Users\Dery\Documents\15.04 09 Бронирование+online+(russisch).odt
[2009.03.26 23:25:53 | 000,012,054 | ---- | M] ()(C:\Users\Dery\Documents\?????+??????????!.odt) -- C:\Users\Dery\Documents\Добро+пожаловать!.odt
[2009.03.26 23:25:52 | 000,012,054 | ---- | C] ()(C:\Users\Dery\Documents\?????+??????????!.odt) -- C:\Users\Dery\Documents\Добро+пожаловать!.odt
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 981 bytes -> C:\Users\Dery\Documents\Re_ [Ticket_2009071667000512] Reseller-ID_,olichn.eml:OECustomProperty
@Alternate Data Stream - 64 bytes -> C:\Users\Dery\Documents\3-video.mpeg:TOC.WMV

< End of report >
--- --- ---

Hoffentlich ist es jetzt o.k.
Also die Seite valerie-bistro.vipphoto.ch kommt nicht mehr auf meine Seite
Dafür kommt logistique.li und es passiert das gleiche.

cosinus 13.03.2011 14:03
Das ist nicht das Log vom Fixen!!

Dery 15.03.2011 21:11
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. D:\Autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{265cfb14-ef62-11dd-8b2c-0017a4e32380}\ not found.
File H:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fdfd743f-1ea7-11dd-9716-0017a4e32380}\ not found.
File G:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fdfd746e-1ea7-11dd-9716-0017a4e32380}\ not found.
File H:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\StartVMCLite.exe not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Dery
->Temp folder emptied: 533498 bytes
->Temporary Internet Files folder emptied: 78801761 bytes
->Java cache emptied: 5184264 bytes
->FireFox cache emptied: 43529792 bytes
->Flash cache emptied: 7004 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 528366 bytes
RecycleBin emptied: 119937 bytes

Total Files Cleaned = 123,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 03152011_210137

Files\Folders moved on Reboot...
File move failed. D:\Autorun.inf scheduled to be moved on reboot.
File\Folder C:\Users\Dery\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NRSQ6X2F(7)\cial=rectangle&adsize=310x120&params[1].styles=hp_promobox_html%2Chp_promobox_img&pageview=ng_outer&pageview=vi_first_time&tile=9334830950503814012345678910ab not found!
File\Folder C:\Users\Dery\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NRSQ6X2F(7)\epage&site=freemail&special=rectangle&category=homepage&adsize=300x250&adsize=310x170&pageview=loggedin&pageview=no_ tprof&pg=m&pa=52&pp=D__85570&Params[1].htm not found!
File\Folder C:\Users\Dery\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\L7GX8LXG(6)\ial=top&adsize=468x60&content=webde&pageview=ng_outer&adsize=728x90&pageview=loggedin&pageview=no_tprof&pg=m&pa=52&p p=D__85570&pn=3B&si=1z9oB.1lq28L.25rW9y[1] not found!
File\Folder C:\Users\Dery\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\L7GX8LXG(6)\ial=top&adsize=468x60&content=webde&pageview=ng_outer&adsize=728x90&pageview=loggedin&pageview=no_tprof&pg=m&pa=52&p p=D__85570&pn=3B&si=1z9oB.1lq28L.25rW9y[2] not found!

Registry entries deleted on Reboot...

----------------------------------
Also hoffentlich paßt jetzt.....:)

cosinus 15.03.2011 21:25
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Dery 16.03.2011 00:31
Hi,
ich habe combofix installiert, aber ich bringe es nicht zum Laufen. Es durchsucht nicht....und ich habe leider keine Ahnung warum....

Gruß
Dery

cosinus 16.03.2011 10:29
Starte den Rechner neu, lade cf neu runter wieder als cofi.exe und probier es bitte nochmal.

Dery 16.03.2011 23:07
Combofix Logfile:
Code:
ComboFix 11-03-16.01 - Dery 16.03.2011  22:37:37.1.1 - x86
Microsoft® Windows Vista™ Home Basic  6.0.6002.2.1252.49.1031.18.1015.319 [GMT 1:00]
ausgeführt von:: c:\users\Dery\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
D:\Autorun.inf
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-02-16 bis 2011-03-16  ))))))))))))))))))))))))))))))
.
.
2011-03-16 21:46 . 2011-03-16 21:53        --------        d-----w-        c:\users\Dery\AppData\Local\temp
2011-03-16 21:46 . 2011-03-16 21:46        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-03-15 20:01 . 2011-03-15 20:01        --------        d-----w-        C:\_OTL
2011-03-15 13:26 . 2011-02-11 06:54        5943120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{44F6E55C-9FB7-4FD5-94DE-21355D4518AA}\mpengine.dll
2011-03-15 00:14 . 2011-03-15 00:14        --------        d-----w-        c:\users\Dery\AppData\Roaming\Avira
2011-03-09 07:19 . 2010-12-29 18:28        429056        ----a-w-        c:\windows\system32\EncDec.dll
2011-03-09 07:19 . 2010-12-29 18:28        322560        ----a-w-        c:\windows\system32\sbe.dll
2011-03-09 07:19 . 2010-12-29 18:28        153088        ----a-w-        c:\windows\system32\sbeio.dll
2011-03-09 07:19 . 2010-12-29 18:26        177664        ----a-w-        c:\windows\system32\mpg2splt.ax
2011-03-09 07:19 . 2010-12-17 15:45        2067968        ----a-w-        c:\windows\system32\mstscax.dll
2011-03-09 07:19 . 2010-12-17 13:54        677888        ----a-w-        c:\windows\system32\mstsc.exe
2011-03-05 18:03 . 2011-03-05 18:04        --------        d-----w-        c:\programdata\Norton
2011-03-05 07:21 . 2011-03-05 07:21        --------        d-----w-        c:\users\Dery\AppData\Local\Mozilla
2011-03-04 23:03 . 2011-03-04 23:03        --------        d-----w-        c:\users\Dery\AppData\Roaming\Malwarebytes
2011-03-04 23:03 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-04 23:03 . 2011-03-04 23:03        --------        d-----w-        c:\programdata\Malwarebytes
2011-03-04 23:03 . 2011-03-08 21:46        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-03-04 23:03 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-03-04 22:38 . 2011-03-04 22:38        --------        dc-h--w-        c:\programdata\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
2011-03-04 22:38 . 2011-03-04 22:38        --------        d-----w-        c:\program files\Uniblue
2011-03-04 22:38 . 2011-03-04 22:38        --------        d-----w-        c:\users\Dery\AppData\Local\PackageAware
2011-02-27 19:34 . 2009-07-14 17:45        445008        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys
2011-02-27 19:34 . 2009-07-14 17:45        38480        ----a-w-        c:\windows\system32\drivers\WdfLdr.sys
2011-02-27 19:31 . 2011-02-27 19:31        --------        d-----w-        c:\programdata\Nokia
2011-02-27 19:22 . 2011-02-27 19:22        --------        d-----w-        c:\program files\DIFX
2011-02-27 19:22 . 2008-08-26 09:26        18816        ----a-w-        c:\windows\system32\drivers\pccsmcfd.sys
2011-02-27 19:21 . 2011-02-27 19:22        --------        dc----w-        c:\windows\system32\DRVSTORE
2011-02-27 19:21 . 2011-02-27 19:21        --------        d-----w-        c:\program files\PC Connectivity Solution
2011-02-27 19:16 . 2010-02-26 13:32        92672        ----a-w-        c:\windows\system32\nmwcdcls.dll
2011-02-27 19:15 . 2011-02-27 19:16        --------        d-----w-        c:\program files\Nokia
2011-02-27 19:15 . 2011-02-27 19:15        --------        d-----w-        c:\program files\Common Files\Nokia
2011-02-27 19:13 . 2011-02-27 19:13        --------        d-----w-        c:\programdata\Installations
2011-02-26 10:52 . 1999-05-19 17:39        231936        ----a-w-        c:\windows\system32\SNWValid.dll
2011-02-26 10:52 . 1999-05-19 17:39        1022976        ----a-w-        c:\windows\system32\SierraNW.dll
2011-02-26 10:52 . 2011-02-26 10:54        --------        d-----w-        C:\SIERRA
2011-02-26 10:52 . 2011-02-26 10:52        --------        d-----w-        c:\program files\Sierra On-Line
2011-02-26 10:51 . 1998-10-21 17:43        328704        ----a-w-        c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 16:11 . 2009-10-02 18:27        222080        ------w-        c:\windows\system32\MpSigStub.exe
2011-01-10 13:23 . 2009-06-22 05:13        135096        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2011-01-10 13:23 . 2009-06-22 05:13        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2011-01-08 08:47 . 2011-02-09 12:55        34304        ----a-w-        c:\windows\system32\atmlib.dll
2011-01-08 06:28 . 2011-02-09 12:55        292352        ----a-w-        c:\windows\system32\atmfd.dll
2010-12-31 13:57 . 2011-02-09 12:56        2039808        ----a-w-        c:\windows\system32\win32k.sys
2010-12-28 15:55 . 2011-01-12 14:58        413696        ----a-w-        c:\windows\system32\odbc32.dll
2010-12-18 06:27 . 2011-02-09 12:53        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-12-18 06:22 . 2011-02-09 12:53        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2010-12-18 06:22 . 2011-02-09 12:53        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2010-12-18 06:22 . 2011-02-09 12:53        109056        ----a-w-        c:\windows\system32\iesysprep.dll
2010-12-18 06:22 . 2011-02-09 12:53        71680        ----a-w-        c:\windows\system32\iesetup.dll
2010-12-18 05:25 . 2011-02-09 12:53        385024        ----a-w-        c:\windows\system32\html.iec
2010-12-18 04:48 . 2011-02-09 12:53        133632        ----a-w-        c:\windows\system32\ieUnatt.exe
2010-12-18 04:47 . 2011-02-09 12:53        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ7.0\ICQ.exe" [2011-01-05 133432]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-01-21 67456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
VideoCam Suite.lnk - c:\program files\Common Files\Panasonic\VideoCam Suite AutoStart\VideoCamSuiteAutoStart.exe [2010-9-24 349600]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-15 136176]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
S1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\System32\drivers\psd.sys [2006-09-28 32000]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-01-10 135336]
S2 ASBroker;Anmeldesitzungsbroker;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 ASChannel;Lokaler Verbindungskanal;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
bthsvcs        REG_MULTI_SZ          BthServ
Cognizance        REG_MULTI_SZ          ASBroker ASChannel
.
Inhalt des "geplante Tasks" Ordners
.
2011-03-15 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-28 20:57]
.
2011-03-13 c:\windows\Tasks\DriverCure_sch_73662D7B-1447-11DE-887A-0017A4E32380.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-28 20:57]
.
2011-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-15 20:36]
.
2011-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-15 20:36]
.
2011-03-16 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-21 05:36]
.
2011-03-16 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2010-04-06 21:30]
.
2011-03-12 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-21 05:36]
.
2011-03-16 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
.
2011-03-16 c:\windows\Tasks\User_Feed_Synchronization-{1FA8790F-BF54-4C89-ADF4-1F10FFEEB08B}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Dery\AppData\Roaming\Mozilla\Firefox\Profiles\8olgh73a.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
.
.
.
**************************************************************************
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien:
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3228)
c:\program files\Hewlett-Packard\IAM\bin\ItClient.dll
c:\windows\system32\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\bgsvcgen.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\iashost.exe
c:\program files\Hewlett-Packard\IAM\bin\asghost.exe
c:\windows\system32\conime.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-03-16  22:59:26 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-03-16 21:58
.
Vor Suchlauf: 13 Verzeichnis(se), 34*906*976*256 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 34*447*548*416 Bytes frei
.
- - End Of File - - 83E0D37293B42E75C774FE3A06432993
--- --- ---

-------------------------------------
Geschafft :)

Gruß
Dery

cosinus 17.03.2011 09:18
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Dery 17.03.2011 12:22
2011/03/17 12:12:37.0237 3736 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/17 12:12:37.0892 3736 ================================================================================
2011/03/17 12:12:37.0892 3736 SystemInfo:
2011/03/17 12:12:37.0892 3736
2011/03/17 12:12:37.0892 3736 OS Version: 6.0.6002 ServicePack: 2.0
2011/03/17 12:12:37.0892 3736 Product type: Workstation
2011/03/17 12:12:37.0892 3736 ComputerName: Dery-PC
2011/03/17 12:12:37.0892 3736 UserName: Dery
2011/03/17 12:12:37.0892 3736 Windows directory: C:\Windows
2011/03/17 12:12:37.0892 3736 System windows directory: C:\Windows
2011/03/17 12:12:37.0892 3736 Processor architecture: Intel x86
2011/03/17 12:12:37.0892 3736 Number of processors: 1
2011/03/17 12:12:37.0892 3736 Page size: 0x1000
2011/03/17 12:12:37.0892 3736 Boot type: Normal boot
2011/03/17 12:12:37.0892 3736 ================================================================================
2011/03/17 12:12:38.0797 3736 Initialize success
2011/03/17 12:12:47.0814 1320 ================================================================================
2011/03/17 12:12:47.0814 1320 Scan started
2011/03/17 12:12:47.0814 1320 Mode: Manual;
2011/03/17 12:12:47.0814 1320 ================================================================================
2011/03/17 12:12:50.0887 1320 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/03/17 12:12:51.0012 1320 ADIHdAudAddService (89216a0586b840693c06b13dd9f220b7) C:\Windows\system32\drivers\ADIHdAud.sys
2011/03/17 12:12:51.0199 1320 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/03/17 12:12:51.0277 1320 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/03/17 12:12:51.0324 1320 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/03/17 12:12:51.0371 1320 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/03/17 12:12:51.0573 1320 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/03/17 12:12:51.0714 1320 AgereSoftModem (2e3abaacbf547abbb5e73a504a56d05a) C:\Windows\system32\DRIVERS\AGRSM.sys
2011/03/17 12:12:51.0901 1320 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/03/17 12:12:51.0995 1320 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/17 12:12:52.0041 1320 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/03/17 12:12:52.0088 1320 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/03/17 12:12:52.0151 1320 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/03/17 12:12:52.0322 1320 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/03/17 12:12:52.0369 1320 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\DRIVERS\amdk8.sys
2011/03/17 12:12:52.0525 1320 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/03/17 12:12:52.0697 1320 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/03/17 12:12:52.0837 1320 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/17 12:12:52.0962 1320 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/03/17 12:12:53.0118 1320 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/03/17 12:12:53.0274 1320 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/03/17 12:12:53.0336 1320 avipbb (da39805e2bad99d37fce9477dd94e7f2) C:\Windows\system32\DRIVERS\avipbb.sys
2011/03/17 12:12:53.0430 1320 b57nd60x (8e287eb3a52fd30c999482c576f4a61b) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/03/17 12:12:53.0601 1320 BCM43XV (509f672686af40f95859fde67108449b) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/03/17 12:12:53.0648 1320 BCM43XX (509f672686af40f95859fde67108449b) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/03/17 12:12:53.0726 1320 bcm4sbxp (08015d34f6fdd0b355805bad978497c3) C:\Windows\system32\DRIVERS\bcm4sbxp.sys
2011/03/17 12:12:53.0804 1320 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/17 12:12:54.0038 1320 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/17 12:12:54.0132 1320 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/17 12:12:54.0179 1320 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/17 12:12:54.0272 1320 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/17 12:12:54.0381 1320 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/17 12:12:54.0413 1320 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/17 12:12:54.0459 1320 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/17 12:12:54.0506 1320 BthEnum (064fbc56921051de1075495d628b815f) C:\Windows\system32\DRIVERS\BthEnum.sys
2011/03/17 12:12:54.0584 1320 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/17 12:12:54.0678 1320 BthPan (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys
2011/03/17 12:12:54.0787 1320 BTHPORT (b24757d9154cca035e1bbd3db92966d7) C:\Windows\system32\Drivers\BTHport.sys
2011/03/17 12:12:54.0849 1320 BTHUSB (d42cf5f0c7635b3f1578810fe34d9e41) C:\Windows\system32\Drivers\BTHUSB.sys
2011/03/17 12:12:55.0021 1320 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/17 12:12:55.0115 1320 cdrbsdrv (e0042bd5bef17a6a3ef1df576bde24d1) C:\Windows\system32\drivers\cdrbsdrv.sys
2011/03/17 12:12:55.0224 1320 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/17 12:12:55.0317 1320 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/03/17 12:12:55.0395 1320 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/03/17 12:12:55.0567 1320 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/03/17 12:12:55.0629 1320 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/03/17 12:12:55.0707 1320 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/03/17 12:12:55.0770 1320 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/03/17 12:12:55.0817 1320 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/03/17 12:12:55.0973 1320 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/03/17 12:12:56.0113 1320 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/03/17 12:12:56.0238 1320 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/17 12:12:56.0363 1320 DXGKrnl (fb85f7f69e9b109820409243f578cc4d) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/17 12:12:56.0503 1320 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/17 12:12:56.0581 1320 eabfiltr (e88b0cfcecf745211bba87f44f85d0dd) C:\Windows\system32\DRIVERS\eabfiltr.sys
2011/03/17 12:12:56.0737 1320 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/03/17 12:12:56.0862 1320 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/03/17 12:12:57.0002 1320 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/03/17 12:12:57.0111 1320 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/03/17 12:12:57.0189 1320 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/17 12:12:57.0267 1320 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/17 12:12:57.0314 1320 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/17 12:12:57.0392 1320 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/17 12:12:57.0470 1320 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/03/17 12:12:57.0548 1320 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/17 12:12:57.0611 1320 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/17 12:12:57.0782 1320 HBtnKey (de15777902a5d9121857d155873a1d1b) C:\Windows\system32\DRIVERS\cpqbttn.sys
2011/03/17 12:12:57.0876 1320 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/03/17 12:12:57.0954 1320 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/17 12:12:58.0079 1320 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/17 12:12:58.0141 1320 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/03/17 12:12:58.0188 1320 HidUsb (3c64042b95e583b366ba4e5d2450235e) C:\Windows\system32\drivers\hidusb.sys
2011/03/17 12:12:58.0281 1320 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/03/17 12:12:58.0359 1320 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/03/17 12:12:58.0500 1320 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/03/17 12:12:58.0609 1320 HTTP (0eeeca26c8d4bde2a4664db058a81937) C:\Windows\system32\drivers\HTTP.sys
2011/03/17 12:12:58.0734 1320 hwdatacard (4e370a583e78b614918c8f2cd5b733ef) C:\Windows\system32\DRIVERS\ewusbmdm.sys
2011/03/17 12:12:58.0796 1320 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/03/17 12:12:58.0921 1320 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/17 12:12:59.0124 1320 ialm (a4fba5b34e69e46315a7c5223a470a17) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/03/17 12:12:59.0249 1320 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/03/17 12:12:59.0451 1320 igfx (a4fba5b34e69e46315a7c5223a470a17) C:\Windows\system32\DRIVERS\igdkmd32.sys
2011/03/17 12:12:59.0545 1320 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/17 12:12:59.0654 1320 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/17 12:12:59.0717 1320 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/17 12:12:59.0795 1320 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/17 12:12:59.0919 1320 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/17 12:13:00.0044 1320 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/17 12:13:00.0091 1320 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/17 12:13:00.0138 1320 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/03/17 12:13:00.0231 1320 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/17 12:13:00.0341 1320 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/17 12:13:00.0387 1320 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/17 12:13:00.0434 1320 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/17 12:13:00.0543 1320 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/17 12:13:00.0621 1320 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/17 12:13:00.0793 1320 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/17 12:13:00.0871 1320 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/17 12:13:00.0949 1320 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/17 12:13:00.0996 1320 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/17 12:13:01.0058 1320 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/17 12:13:01.0152 1320 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/03/17 12:13:01.0214 1320 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/17 12:13:01.0292 1320 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/17 12:13:01.0339 1320 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/17 12:13:01.0401 1320 mouhid (a3a6dff7e9e757db3df51a833bc28885) C:\Windows\system32\drivers\mouhid.sys
2011/03/17 12:13:01.0511 1320 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/17 12:13:01.0573 1320 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/03/17 12:13:01.0682 1320 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/17 12:13:01.0745 1320 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/17 12:13:01.0854 1320 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/03/17 12:13:01.0916 1320 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/17 12:13:01.0994 1320 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/17 12:13:02.0041 1320 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/17 12:13:02.0103 1320 msahci (5457dcfa7c0da43522f4d9d4049c1472) C:\Windows\system32\drivers\msahci.sys
2011/03/17 12:13:02.0213 1320 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/03/17 12:13:02.0275 1320 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/17 12:13:02.0384 1320 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/17 12:13:02.0447 1320 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/17 12:13:02.0493 1320 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/17 12:13:02.0618 1320 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/17 12:13:02.0681 1320 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/03/17 12:13:02.0774 1320 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/17 12:13:02.0821 1320 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/17 12:13:02.0868 1320 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/03/17 12:13:02.0977 1320 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/17 12:13:03.0102 1320 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/03/17 12:13:03.0180 1320 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/17 12:13:03.0305 1320 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/17 12:13:03.0367 1320 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/17 12:13:03.0414 1320 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/17 12:13:03.0476 1320 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/17 12:13:03.0539 1320 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/03/17 12:13:03.0773 1320 NETw3v32 (acc6170d80c69e50145b370023b64ed3) C:\Windows\system32\DRIVERS\NETw3v32.sys
2011/03/17 12:13:03.0897 1320 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/17 12:13:04.0053 1320 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\Windows\system32\drivers\ccdcmb.sys
2011/03/17 12:13:04.0116 1320 nmwcdc (3859c69a77793180548802dac9f34a38) C:\Windows\system32\drivers\ccdcmbo.sys
2011/03/17 12:13:04.0256 1320 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/03/17 12:13:04.0584 1320 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/17 12:13:04.0958 1320 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/03/17 12:13:05.0130 1320 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/17 12:13:05.0192 1320 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/17 12:13:05.0239 1320 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/03/17 12:13:05.0270 1320 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/03/17 12:13:05.0317 1320 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/03/17 12:13:05.0535 1320 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/03/17 12:13:05.0613 1320 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\DRIVERS\parport.sys
2011/03/17 12:13:05.0660 1320 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/03/17 12:13:05.0707 1320 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\DRIVERS\parvdm.sys
2011/03/17 12:13:05.0894 1320 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys
2011/03/17 12:13:05.0957 1320 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/03/17 12:13:06.0066 1320 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/03/17 12:13:06.0237 1320 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/03/17 12:13:06.0347 1320 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/17 12:13:06.0456 1320 PersonalSecureDrive (e5de9f28c583c93339dd628447693468) C:\Windows\System32\drivers\psd.sys
2011/03/17 12:13:06.0643 1320 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/17 12:13:06.0705 1320 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/03/17 12:13:06.0815 1320 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/17 12:13:06.0877 1320 PxHelp20 (feffcfdc528764a04c8ed63d5fa6e711) C:\Windows\system32\Drivers\PxHelp20.sys
2011/03/17 12:13:07.0002 1320 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/03/17 12:13:07.0095 1320 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/17 12:13:07.0173 1320 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/17 12:13:07.0361 1320 R300 (e642b131fb74caf4bb8a014f31113142) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/03/17 12:13:07.0548 1320 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/17 12:13:07.0626 1320 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/17 12:13:07.0704 1320 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/17 12:13:07.0782 1320 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/17 12:13:07.0907 1320 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/17 12:13:07.0969 1320 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/17 12:13:08.0031 1320 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/03/17 12:13:08.0078 1320 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/17 12:13:08.0156 1320 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/03/17 12:13:08.0312 1320 RFCOMM (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys
2011/03/17 12:13:08.0390 1320 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/17 12:13:08.0484 1320 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/17 12:13:08.0609 1320 sdbus (4339a2585708c7d9b0c0ce5aad3dd6ff) C:\Windows\system32\DRIVERS\sdbus.sys
2011/03/17 12:13:08.0655 1320 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/17 12:13:08.0780 1320 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/03/17 12:13:08.0827 1320 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/03/17 12:13:08.0874 1320 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/17 12:13:08.0999 1320 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/03/17 12:13:09.0108 1320 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/17 12:13:09.0155 1320 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/17 12:13:09.0186 1320 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/17 12:13:09.0248 1320 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/03/17 12:13:09.0295 1320 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/03/17 12:13:09.0373 1320 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/03/17 12:13:09.0513 1320 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/03/17 12:13:09.0591 1320 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/17 12:13:09.0654 1320 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/03/17 12:13:09.0716 1320 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/17 12:13:09.0825 1320 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/17 12:13:09.0935 1320 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/03/17 12:13:10.0044 1320 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/17 12:13:10.0122 1320 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/17 12:13:10.0231 1320 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/17 12:13:10.0278 1320 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/17 12:13:10.0325 1320 SynTP (81cf7aa63bb3cca31e1d1944c0a45fc7) C:\Windows\system32\DRIVERS\SynTP.sys
2011/03/17 12:13:10.0512 1320 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2011/03/17 12:13:10.0652 1320 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/17 12:13:10.0715 1320 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/17 12:13:10.0761 1320 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/17 12:13:10.0824 1320 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/17 12:13:10.0886 1320 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/17 12:13:11.0011 1320 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/17 12:13:11.0105 1320 TPM (6d9ad3534a9cf7e4b86c6eae8bc335f6) C:\Windows\system32\drivers\tpm.sys
2011/03/17 12:13:11.0198 1320 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/17 12:13:11.0276 1320 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/17 12:13:11.0401 1320 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/17 12:13:11.0479 1320 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/03/17 12:13:11.0541 1320 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/17 12:13:11.0666 1320 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/17 12:13:11.0791 1320 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/03/17 12:13:11.0853 1320 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/17 12:13:11.0900 1320 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/17 12:13:11.0963 1320 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/17 12:13:12.0119 1320 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\Windows\system32\DRIVERS\usbser_lowerflt.sys
2011/03/17 12:13:12.0197 1320 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/17 12:13:12.0259 1320 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/03/17 12:13:12.0353 1320 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/17 12:13:12.0477 1320 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/17 12:13:12.0524 1320 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\DRIVERS\usbohci.sys
2011/03/17 12:13:12.0602 1320 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2011/03/17 12:13:12.0649 1320 usbser (d575246188f63de0accf6eac5fb59e6a) C:\Windows\system32\DRIVERS\usbser.sys
2011/03/17 12:13:12.0711 1320 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys
2011/03/17 12:13:12.0821 1320 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/17 12:13:12.0883 1320 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/17 12:13:12.0961 1320 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/17 12:13:13.0008 1320 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/17 12:13:13.0055 1320 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/03/17 12:13:13.0179 1320 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/03/17 12:13:13.0226 1320 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/03/17 12:13:13.0289 1320 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/17 12:13:13.0351 1320 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/03/17 12:13:13.0429 1320 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/03/17 12:13:13.0554 1320 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/03/17 12:13:13.0632 1320 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/17 12:13:13.0694 1320 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/17 12:13:13.0710 1320 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/17 12:13:13.0788 1320 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/03/17 12:13:13.0850 1320 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/17 12:13:14.0100 1320 WimFltr (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\Windows\system32\DRIVERS\wimfltr.sys
2011/03/17 12:13:14.0178 1320 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/03/17 12:13:14.0318 1320 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/03/17 12:13:14.0537 1320 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/03/17 12:13:14.0615 1320 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/17 12:13:14.0739 1320 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/17 12:13:15.0161 1320 ================================================================================
2011/03/17 12:13:15.0161 1320 Scan finished
2011/03/17 12:13:15.0161 1320

------------------------------------------------------------------
Gruß

Dery

cosinus 17.03.2011 12:57
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Dery 18.03.2011 08:31
Hi ich habe Probleme : GMER ist auch als Anhang zu groß
und OSAM kann ich nicht öffnen.

Gruß
Dery

cosinus 18.03.2011 13:07
Logs zippen und hier anhängen.
Zum Entpacken von OSAM musst du WinRAR oder 7zip verwenden.

Dery 18.03.2011 20:59
Hi, also GMER habe ich geschafft aber der OSAM kann ich nach wie vor nicht öffnen.

Ich bekomme die Meldung : könnte nicht gestartet werden, weil osam_qui.dlll nicht gefunden wurde. Neuinstallation der Anwendung könnte das Problem beheben.

Neuinstallation habe ich aber durgeführt. Ich kann es trotzdem nicht öffnen und bekomme ich die gleiche Meldung und noch dazu: Autorun Manager funktioniert nicht mehr

Gruß
Uli

cosinus 18.03.2011 21:23
Für OSAM musst du Virenscanner v.a. McAfee deaktivieren. Notfalls deinstallieren.

Dery 18.03.2011 21:45
Hi,

Mc Afee habe ich nicht. AntiVir :)

Gruß
Dery

cosinus 18.03.2011 22:12
Ebendrum. Deinstallieren, notfalls, sagte ich ja schon :rofl:

Dery 18.03.2011 22:49
Hi Cosinus,

also mit OSAM brauche ich noch ein bißchen, es funktioniert einfach nicht.

Aber das Problem ist gelöst. Wenn ich die Seiten aufrufe, kommt keine Statsanwaltschaft mehr, sondern die normale Seite.

Wo war es das Problem:))

Machen wir trotzdem weiter ?

Gruß
Dery

cosinus 19.03.2011 13:21
Probier mal das hier => File-Upload.net - osam.zip

Dery 22.03.2011 12:28
Hi,

also der letzte Link habe mich auch nicht weiter gebracht. Ich habe alles nochmal versucht aber komme mit dem OSAM nicht zurecht.

cosinus 22.03.2011 14:47
Wenn du die Fehlermeldung nicht postest kommen wir nicht weiter.
Wie ich bereits gepostet habe, brauchst du zum Entpacken WinRAR oder 7zip.
Außerdem muss der Virenscanner deaktiviert werden. Wenn das immer noch nicht geht, musst du den Virenscanner deinstallieren.


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:37 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130