Hallo liebe Helfer!

Ich wurde von meiner Bekannten um Hilfe gebeten, weil deren Online-Banking Konto von der Bank gesperrt wurde, aufgrund des Verdachts auf eine Infektion des Systems.

Das System läuft an sich stabil, die CPU-Auslastung ist normal, stutzig machte mich, dass scheinbar kein Antivirenprogramm installiert war (meine Bekannte konnte nicht sagen, warum).

Ich habe mit der ct' Desinfect CD 2011 mal Avira laufen lassen und der hat einiges gefunden.

TR/Crypt.EPACK.Gen2
TR/Luser.B
TR/Spy.SpyEyes.isk
TR/Diple.qrr
TR/Diple.rtc
TR/Diple.rrp
TR/VBKrypt.drff
APPL/HideWindows.31232

In den folgenden Postings werde ich folgende Logfiles posten:

1. ct' Desinfect 2011 Avira
2. defogger
3. OTL
4. Extras
5. Gmer

Ich danke schon vorab herzlichst für kommende Unterstützung und hoffe, dass wir das gemeinsam in den Griff bekommen!

hohlespferd


edit: Habe das Hijackthis-Log wieder entfernt, da es hier ja offenbar nicht erwünscht ist.

1. ct' Desinfect 2011 Avira

Avira / Linux Version 1.9.152.0
Copyright (c) 2010 by Avira GmbH
All rights reserved.

engine set:         8.2.5.24
VDF Version:        7.11.10.73 

key file:           /AntiVir/hbedv.key
registered user:    c't-Desinfec't
serial number:      2212657803
key expires:        Apr 15 2012

Scan start time: Mi 22 Jun 2011 18:36:01 CEST
Command line: /AntiVir/scancl --recursion --allfiles --scaninarchive --heurlevel=3 --log=/tmp/avira.log --defaultaction=ignore --log=/tmp/avira.log /media/Boot 

auto excluding /sys from scanning (is a special fs)
auto excluding /proc from scanning (is a special fs)
WARNING: [Config file '/AntiVir/scancl.conf' is missing] Initialization
WARNING: [Unexpected end of file] /media/Boot/Dokumente und Einstellungen/Besitzer/Anwendungsdaten/TuneUp Software/TuneUp Utilities/WinStyler/BootScreens/Blue_Planet.tbs
WARNING: [Unexpected end of file] /media/Boot/Dokumente und Einstellungen/Besitzer/Anwendungsdaten/TuneUp Software/TuneUp Utilities/WinStyler/BootScreens/Evolution.tbs
WARNING: [Unexpected end of file] /media/Boot/Dokumente und Einstellungen/Besitzer/Anwendungsdaten/TuneUp Software/TuneUp Utilities/WinStyler/BootScreens/_default.tbs
WARNING: [Unexpected end of file] /media/Boot/Dokumente und Einstellungen/Besitzer/Anwendungsdaten/TuneUp Software/TuneUp Utilities/WinStyler/IconPacks/cryo64levit2.tip
WARNING: [Unexpected end of file] /media/Boot/Dokumente und Einstellungen/Besitzer/Anwendungsdaten/TuneUp Software/TuneUp Utilities/WinStyler/LogonScreens/_default.tls
WARNING: [Error reading file] /media/Boot/Dokumente und Einstellungen/Besitzer/Lokale Einstellungen/Anwendungsdaten/Opera/Opera/cache/g_007B/opr0A67B.tmp
WARNING: [File is encrypted] /media/Boot/Programme/ICQ6.5/ConfigFiles/TopSearches.7z
WARNING: [File is encrypted] /media/Boot/Programme/ICQ6.5/ConfigFiles/TopSearchesDe.7z
WARNING: [Archive is invalid or corrupt] /media/Boot/Programme/WinRAR/rarnew.dat
 ALERT: [TR/Crypt.EPACK.Gen2] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP520/A0134174.exe <<< Is the Trojan horse TR/Crypt.EPACK.Gen2
 ALERT: [TR/Crypt.EPACK.Gen2] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP521/A0134272.exe <<< Is the Trojan horse TR/Crypt.EPACK.Gen2
 ALERT: [TR/Crypt.EPACK.Gen2] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP521/A0134300.exe <<< Is the Trojan horse TR/Crypt.EPACK.Gen2
 ALERT: [TR/Luser.B] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP526/A0134673.exe <<< Is the Trojan horse TR/Luser.B
 ALERT: [TR/Spy.SpyEyes.isk] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP528/A0134991.exe <<< Is the Trojan horse TR/Spy.SpyEyes.isk
WARNING: [Error reading file] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP528/A0135017.exe
 ALERT: [TR/Diple.qrr] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP528/A0135062.exe <<< Is the Trojan horse TR/Diple.qrr
 ALERT: [TR/Diple.rtc] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP530/A0135155.exe <<< Is the Trojan horse TR/Diple.rtc
 ALERT: [TR/Diple.rrp] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP530/A0135176.exe <<< Is the Trojan horse TR/Diple.rrp
 ALERT: [TR/VBKrypt.drff] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP530/A0135181.exe <<< Is the Trojan horse TR/VBKrypt.drff
 ALERT: [TR/VBKrypt.drff] /media/Boot/System Volume Information/_restore{C4425E07-5F22-4352-8246-93AC87D4F294}/RP530/A0135187.exe <<< Is the Trojan horse TR/VBKrypt.drff
WARNING: [Bad compressed data] /media/Boot/WINDOWS/SoftwareDistribution/Download/5dda4b08a568cf2b359381c35e779e5e/BITA.tmp
 ALERT: [APPL/HideWindows.31232] /media/Boot/WINDOWS/system32/cmdow.exe <<< Contains signature of the application APPL/HideWindows.31232
 ALERT: [TR/Spy.SpyEyes.isk] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/GLUJW1UV/maph[1].exe <<< Is the Trojan horse TR/Spy.SpyEyes.isk
 ALERT: [TR/Crypt.EPACK.Gen2] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/IPI34X2V/mapc[1].exe <<< Is the Trojan horse TR/Crypt.EPACK.Gen2
 ALERT: [TR/Crypt.EPACK.Gen2] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/IPI34X2V/mapd[1].exe <<< Is the Trojan horse TR/Crypt.EPACK.Gen2
 ALERT: [TR/Luser.B] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/IPI34X2V/mapg[1].exe <<< Is the Trojan horse TR/Luser.B
 ALERT: [TR/Diple.qrr] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/S5YR49M3/mapj[1].exe <<< Is the Trojan horse TR/Diple.qrr
 ALERT: [TR/Diple.rtc] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/S5YR49M3/mapk[1].exe <<< Is the Trojan horse TR/Diple.rtc
 ALERT: [TR/Diple.rrp] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/S5YR49M3/mapl[1].exe <<< Is the Trojan horse TR/Diple.rrp
 ALERT: [TR/VBKrypt.drff] /media/Boot/WINDOWS/system32/config/systemprofile/Lokale Einstellungen/Temporary Internet Files/Content.IE5/S5YR49M3/mapm[1].exe <<< Is the Trojan horse TR/VBKrypt.drff
WARNING: [Unexpected end of file] /media/Boot/WINDOWS/system32/Macromed/Flash/uninstall_activeX.exe
                                                                                

Statistics :                
Directories............... : 8113
Archives.................. : 14691
Files..................... : 202214
Infected.............. : 19
Ignored........... : 19
Warnings.............. : 12
Suspicious............ : 0
Infections................ : 19
Time...................... : 00:19:19
         

2. Hijackthis
Entfernt.

2. Defogger

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:52 on 22/06/2011 (Besitzer)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

3. OTL

OTL logfile created on: 22.06.2011 19:58:06 - Run 1
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Dokumente und Einstellungen\Besitzer\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,62 Gb Available Physical Memory | 81,49% Memory free
3,85 Gb Paging File | 3,64 Gb Available in Paging File | 94,56% Paging File free
Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 22,96 Gb Free Space | 58,77% Space Free | Partition Type: NTFS
Drive D: | 193,82 Gb Total Space | 96,23 Gb Free Space | 49,65% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: Besitzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.22 19:44:57 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe
PRC - [2007.07.25 16:50:26 | 000,079,136 | ---- | M] (Hewlett-Packard Company) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.01.11 14:26:56 | 000,063,112 | ---- | M] (CANON INC.) -- C:\WINDOWS\system32\CNAB4RPK.EXE
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.22 19:44:57 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe
MOD - [2006.08.25 08:46:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (NMIndexingService)
SRV - File not found [Disabled | Stopped] --  -- (HidServ)
SRV - File not found [On_Demand | Stopped] --  -- (AppMgmt)
SRV - [2008.11.04 02:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007.12.21 11:54:54 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2007.07.25 16:50:26 | 000,079,136 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.08.17 23:50:42 | 000,118,272 | ---- | M] (TuneUp Software GmbH) [Disabled | Stopped] -- C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe -- (TUWinStylerThemeSvc)
SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2009.02.06 16:56:10 | 000,024,616 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2009.02.06 16:56:10 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2007.08.22 18:45:18 | 004,608,000 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.04.24 12:33:46 | 000,100,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125mgmt.sys -- (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM)
DRV - [2007.04.24 12:33:46 | 000,098,696 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125obex.sys -- (s125obex)
DRV - [2007.04.24 12:33:44 | 000,108,680 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125mdm.sys -- (s125mdm)
DRV - [2007.04.24 12:33:42 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125mdfl.sys -- (s125mdfl)
DRV - [2007.04.24 12:33:34 | 000,083,336 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s125bus.sys -- (s125bus) Sony Ericsson Device 125 driver (WDM)
DRV - [2006.08.18 11:10:24 | 000,061,504 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\K320bus.sys -- (K320bus) Sony Ericsson K320 driver (WDM)
DRV - [2006.08.14 15:09:48 | 000,083,200 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2005.03.04 05:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004.08.03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2003.05.09 09:55:02 | 000,089,749 | ---- | M] (Silicon Image, Inc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\si3112r.sys -- (si3112r)
DRV - [2003.02.12 06:37:48 | 000,009,600 | ---- | M] (Silicon Image, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SiWinAcc.sys -- (SiWinAcc)
DRV - [2001.08.17 14:57:46 | 000,065,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s3legacy.sys -- (s3legacy)
DRV - [2001.08.17 13:12:02 | 000,063,208 | ---- | M] (Intel Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dc21x4.sys -- (DC21x4)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/start_ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.web.de/start_ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Programme\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..network.proxy.type: 2
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components [2011.06.07 19:56:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2011.06.12 11:21:04 | 000,000,000 | ---D | M]
 
[2010.03.31 10:48:31 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\Extensions
[2011.06.22 19:55:26 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\hb1w0h2b.default\extensions
[2010.11.04 16:10:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\hb1w0h2b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.22 19:55:26 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\hb1w0h2b.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
File not found (No name found) -- 
[2009.05.06 16:16:53 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Programme\Internet Explorer\qipsearchbar.dll (qip.ru)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1187254480977 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187254475870 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.185.161 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O27 - HKLM IFEO\userinit.exe: Debugger - C:\WINDOWS\system32\srvrgdef.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.08.16 00:24:01 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{f35192c8-ed1a-11dd-819a-001966497fcd}\Shell - "" = AutoRun
O33 - MountPoints2\{f35192c8-ed1a-11dd-819a-001966497fcd}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f35192c8-ed1a-11dd-819a-001966497fcd}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - Microsoft NetShow Player
ActiveX: {222FB945-258A-4734-84EA-99E5B4EF4E00} - WEB.DE Browser Add-on
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {507E953C-3D3A-4CD3-8A96-5F0B455F2E3A} - WEB.DE Browser Toolbar
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A477E148-6951-4E85-BB46-32845F242F0F} - WEB.DE Update
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {ECD292A0-0347-4244-8C24-5DBCE990FB40} - Hotfix for Microsoft .NET Framework 3.0 (KB932471)
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: >{B227B712-06C7-4F19-97A9-90E04DB8208E} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: Microsoft Base Smart Card Crypto Provider Package - 
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "TUWinStylerThemeSvc"
MsConfig - Services: "JavaQuickStarterService"
MsConfig - Services: "Creative Service for CDROM Access"
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Photo Loader resident.lnk - C:\Programme\CASIO\Photo Loader\Plauto.exe - (CASIO COMPUTER CO.,LTD.)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig - StartUpReg: CTSyncU.exe - hkey= - key= - C:\Programme\Creative\Sync Manager Unicode\CTSyncU.exe ()
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programme\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\qttask.exe (Apple Computer, Inc.)
MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
MsConfig - StartUpReg: Sony Ericsson PC Suite - hkey= - key= - D:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: SweetIM - hkey= - key= - C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
MsConfig - StartUpReg: WEB.DE_WEB.DE MultiMessenger - hkey= - key= -  File not found
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Programme\Winamp\winampa.exe ()
MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16620634377289728)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.22 19:55:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Desktop\logfiles
[2011.06.22 19:44:57 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe
[2011.06.20 22:00:33 | 000,000,000 | ---D | C] -- D:\Desinfect Logs
[2011.06.16 21:56:13 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\ODBC
[2011.06.12 11:26:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Temp
[2011.06.12 11:20:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Besitzer\Eigene Dateien
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.22 19:55:18 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.06.22 19:54:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.06.22 19:52:55 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\defogger_reenable
[2011.06.22 19:45:54 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\vlozg2tx.exe
[2011.06.22 19:44:57 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Besitzer\Desktop\OTL.exe
[2011.06.22 19:44:16 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\Defogger.exe
[2011.06.22 19:40:02 | 001,402,880 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\HiJackThis.msi
[2011.06.17 17:17:22 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011.06.12 11:21:04 | 000,001,718 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader X.lnk
[2011.06.09 16:47:38 | 000,002,503 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\Microsoft Office Word 2007.lnk
[2011.06.08 20:45:38 | 000,034,328 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\Familienclantreffenvorlandungsbescheid!.rtf
[2011.05.26 22:58:37 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2011.05.25 19:25:15 | 000,047,104 | ---- | M] () -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.22 19:52:55 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\defogger_reenable
[2011.06.22 19:45:54 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\vlozg2tx.exe
[2011.06.22 19:44:16 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\Defogger.exe
[2011.06.22 19:40:02 | 001,402,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\HiJackThis.msi
[2011.06.12 11:21:04 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader X.lnk
[2011.06.12 11:21:04 | 000,001,718 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader X.lnk
[2011.06.08 18:41:41 | 000,034,328 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Desktop\Familienclantreffenvorlandungsbescheid!.rtf
[2010.09.08 15:58:10 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.05.01 12:55:17 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010.03.31 10:48:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.06.24 16:16:02 | 000,000,394 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2009.06.09 19:09:28 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2009.02.07 13:36:20 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2008.07.23 17:41:16 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\BH_DATA110VC8.dll
[2008.01.27 13:15:51 | 000,001,751 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2008.01.22 16:40:41 | 000,047,104 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.12.27 19:38:02 | 000,000,029 | ---- | C] () -- C:\WINDOWS\Battle.ini
[2007.12.22 19:14:02 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2007.12.18 21:27:53 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.12.15 12:45:57 | 000,004,706 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2007.12.15 12:45:56 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007.12.15 12:41:05 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2007.12.15 12:40:16 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4859.dll
[2007.11.15 22:27:40 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\dnt27VC8.dll
[2007.11.15 22:25:28 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\dntvmc27VC8.dll
[2007.11.15 22:25:12 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dntvm27VC8.dll
[2007.11.13 10:39:30 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\FKStampPainter20.dll
[2007.11.09 16:18:10 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\LXPrnUtil10.dll
[2007.08.16 18:16:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2007.08.16 10:29:24 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007.08.16 01:15:24 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007.08.16 01:14:22 | 000,162,728 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007.08.16 00:28:01 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007.08.16 00:20:08 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007.08.16 00:08:48 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\cmdow.exe
[2007.08.16 00:08:48 | 000,000,862 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2007.08.16 00:08:30 | 000,459,152 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2007.08.16 00:08:30 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2007.08.16 00:08:30 | 000,084,524 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2007.08.16 00:08:30 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2007.08.16 00:08:09 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2007.08.16 00:08:08 | 000,441,260 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2007.08.16 00:08:08 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2007.08.16 00:08:07 | 000,071,196 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2007.08.16 00:08:07 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2007.08.16 00:08:06 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2007.08.16 00:08:04 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2007.08.16 00:08:02 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007.08.16 00:07:57 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2007.08.16 00:07:57 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2007.08.16 00:07:43 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2007.08.16 00:07:36 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2007.08.16 00:07:34 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\srvrgdef.exe
[2007.01.16 17:00:00 | 000,003,572 | ---- | C] () -- C:\WINDOWS\System32\CNAB4UN.INI
[2007.01.16 17:00:00 | 000,000,990 | ---- | C] () -- C:\WINDOWS\System32\CNAB4INA.DAT
[2005.11.09 13:13:48 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\dnt27VC7.dll
[2005.11.09 13:11:46 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dntvmc27VC7.dll
[2005.11.09 13:11:30 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\dntvm27VC7.dll
[2005.03.27 17:00:00 | 000,000,992 | ---- | C] () -- C:\WINDOWS\System32\CNAC17E9.DAT
 
========== LOP Check ==========
 
[2010.02.17 23:46:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2009.02.06 18:22:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
[2010.02.01 19:30:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010.11.03 17:34:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IEConfiguration1und1
[2011.05.14 09:50:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2007.12.17 10:12:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2009.02.07 13:36:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
[2009.10.02 10:52:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM
[2010.07.12 16:23:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.07.30 19:24:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2007.12.21 11:55:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2011.05.14 09:48:26 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{F3DEEB92-FBD8-4F2C-9EC9-25D8A125202A}
[2008.07.01 21:51:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\ICQ
[2008.06.03 13:24:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Leadertech
[2010.02.18 01:43:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Lexware
[2009.02.06 18:07:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\MyPhoneExplorer
[2007.12.20 22:18:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Opera
[2008.12.09 19:49:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\QIP
[2009.11.12 10:49:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\TeamViewer
[2009.02.06 17:12:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Teleca
[2007.12.21 11:55:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\TuneUp Software
[2009.01.23 17:55:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\WEB.DE
[2011.06.17 17:17:22 | 000,000,398 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.06.22 19:37:33 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2007.08.16 00:29:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2007.12.15 12:41:12 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.05.15 10:38:25 | 000,000,000 | R--D | M] -- C:\Programme
[2007.12.15 15:57:24 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2008.01.26 21:51:35 | 000,000,000 | ---D | M] -- C:\spoolerlogs
[2007.12.15 12:57:14 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.04.28 17:56:52 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2004.08.04 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\explorer.exe
[2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2004.08.04 14:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\I386\REGEDIT.EXE
[2004.08.04 14:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\regedit.exe
[2004.08.04 14:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\system32\dllcache\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2004.08.04 14:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2004.08.04 14:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-16 19:58:13
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:1520CB7BD81C1607
@Alternate Data Stream - 229 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FF81EB0

< End of report >
         

4. Extras

OTL Extras logfile created on: 22.06.2011 19:58:06 - Run 1
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Dokumente und Einstellungen\Besitzer\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,62 Gb Available Physical Memory | 81,49% Memory free
3,85 Gb Paging File | 3,64 Gb Available in Paging File | 94,56% Paging File free
Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 22,96 Gb Free Space | 58,77% Space Free | Partition Type: NTFS
Drive D: | 193,82 Gb Total Space | 96,23 Gb Free Space | 49,65% Space Free | Partition Type: NTFS
 
Computer Name: *** | User Name: Besitzer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Programme\Opera\Opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Programme\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Programme\Opera\Opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe" = C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup
"C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\Nero Web\SetupXu.exe" = C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\Nero Web\SetupXu.exe:*:Enabled:Nero ProductSetup
"C:\Programme\QIP\qip.exe" = C:\Programme\QIP\qip.exe:*:Enabled:Quiet Internet Pager -- (The Author of QIP)
"C:\WINDOWS\system32\CNAB4RPK.EXE" = C:\WINDOWS\system32\CNAB4RPK.EXE:*:Enabled:Canon LBP2900 RPC Server Process -- (CANON INC.)
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6
"D:\Programme\Sony Ericsson\Update Service\Update Service.exe" = D:\Programme\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service -- ()
"D:\Programme\ADAC\ACCF2008_1\ADAC_Browser.exe" = D:\Programme\ADAC\ACCF2008_1\ADAC_Browser.exe:*:Enabled:ADAC_Browser
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{04A6A912-A6DB-4EF2-99FF-6D6199BA3C8C}" = SweetIM for Messenger 2.6
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 16
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.010.00
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows-Journal-Viewer
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{501BADCD-F8F7-44CB-AC3F-6ED25C1A28B5}" = iTunes
"{544FB392-069D-4BA5-9DC7-FFD47230AEE5}" = Photohands 1.0G
"{569C24E9-1D28-4738-99EF-6BEC75DC5F6A}" = Creative ZEN Vision W
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 2.3G
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{868D7896-99D4-4513-BC62-2B3AD3E24926}" = TuneUp Utilities 2006
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{929408E6-D265-4174-805F-81D1D914E2A4}" = QuickTime
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}" = Google Earth
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X (10.0.1) - Deutsch
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe  1.8.15.1
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BC63A4AC-435D-4AAD-9881-D0ED60804D1A}" = Lexware buchhalter Aktualisierung Februar 2008, Version 13.10
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E98371BD-6C0D-463E-B004-E6303F9A34A7}" = Lexware buchhalter 2008
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"{FE688026-1C8C-4E50-889D-4B6607CADC24}" = Lexware buchhalter 2008
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player
"AudibleManager" = AudibleManager
"Canon LBP2900" = Canon LBP2900
"CCleaner" = CCleaner (remove only)
"Creative Removable Disk Manager" = Creative-Manager für Wechseldatenträger
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch (DeCSS-frei)
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"InstallShield_{501BADCD-F8F7-44CB-AC3F-6ED25C1A28B5}" = iTunes
"InstallShield_{929408E6-D265-4174-805F-81D1D914E2A4}" = QuickTime
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MPE" = MyPhoneExplorer
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Opera 11.11.2109" = Opera 11.11
"QIP 8070 Jeak Edition" = QIP 8070 Jeak Edition
"QIP2005" = QIP 2005 Uninstall
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"SysInfo" = Creative-Systeminformationen
"TVgenial" = TVgenial
"Update Service" = Update Service
"VLC media player" = VLC media player 0.9.8a
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR Archivierer
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZENcast Organizer" = ZENcast Organizer
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP 2005" = QIP 2005 8095
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 03.04.2011 10:44:05 | Computer Name = *** | Source = ESENT | ID = 439
Description = wuauclt (1064) Die Shadowkopfzeile für Datei C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
 konnte nicht geschrieben werden. Fehler -1808.
 
Error - 03.04.2011 10:44:05 | Computer Name = *** | Source = ESENT | ID = 482
Description = wuauclt (1224) Versuch, in Datei "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb"
 bei Offset 0 (0x0000000000000000) für 8192 (0x00002000) Bytes zu schreiben, ist
 mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem 
Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation.
 Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss 
aus einer vorherigen Sicherung wiederhergestellt werden.
 
Error - 03.04.2011 10:44:05 | Computer Name = *** | Source = ESENT | ID = 439
Description = wuauclt (1224) Die Shadowkopfzeile für Datei C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
 konnte nicht geschrieben werden. Fehler -1808.
 
Error - 03.04.2011 10:44:05 | Computer Name = *** | Source = ESENT | ID = 482
Description = wuauclt (512) Versuch, in Datei "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb"
 bei Offset 0 (0x0000000000000000) für 8192 (0x00002000) Bytes zu schreiben, ist
 mit Systemfehler 112 (0x00000070): "Es steht nicht genug Speicherplatz auf dem 
Datenträger zur Verfügung. " fehlgeschlagen. Fehler -1808 (0xfffff8f0) bei Schreiboperation.
 Wenn dieser Zustand andauert, ist die Datei möglicherweise beschädigt und muss 
aus einer vorherigen Sicherung wiederhergestellt werden.
 
Error - 03.04.2011 10:44:05 | Computer Name = *** | Source = ESENT | ID = 439
Description = wuauclt (512) Die Shadowkopfzeile für Datei C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb
 konnte nicht geschrieben werden. Fehler -1808.
 
Error - 03.04.2011 10:45:53 | Computer Name = *** | Source = MsiInstaller | ID = 11711
Description = Produkt: Lexware Elster -- Fehler 1711. Beim Versuch, Installationsinformationen
 auf die Festplatte zu schreiben, ist ein Fehler aufgetreten. Überprüfen Sie, ob
 genügend Plattenspeicher verfügbar ist, und klicken Sie auf "Wiederholen". Oder
 klicken Sie auf "Abbrechen", um die Installation zu abzubrechen.
 
Error - 03.04.2011 10:46:18 | Computer Name = *** | Source = MsiInstaller | ID = 11601
Description = Produkt: Lexware Elster -- Festplatte voll: Nicht genügend freier 
Speicher auf der Festplatte -- Laufwerk: "C:"; benötigter Speicher: -572 KB; verfügbarer
 Speicher: 16 KB. Geben Sie einigen Festplattenspeicher frei und wiederholen Sie
 den Vorgang.
 
Error - 03.04.2011 10:52:24 | Computer Name = *** | Source = Userenv | ID = 1512
Description = Die Registrierungsdatei konnte nicht entladen werden. Der für die 
Registrierung verwendete Arbeitsspeicher wurde nicht freigegeben. Dies wird oft 
durch Dienste verursacht, die unter einem Benutzerkonto ausgeführt werden. Versuchen
 Sie die Dienste entweder unter dem Konto "LocalService" oder "NetworkService" auszuführen.
 Wenden Sie sich an den Netzwerkadministrator, wenn das Problem weiterhin besteht.
       Details - Es steht nicht genug Speicherplatz auf dem Datenträger zur Verfügung.
 
 
Error - 03.04.2011 12:10:25 | Computer Name = *** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger
 zur Verfügung.  .
 
Error - 03.04.2011 12:10:25 | Computer Name = *** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Es steht nicht genug Speicherplatz auf dem Datenträger
 zur Verfügung.  .
 
[ OSession Events ]
Error - 27.01.2009 15:37:51 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 9135
 seconds with 1260 seconds of active time.  This session ended with a crash.
 
Error - 12.04.2009 08:05:09 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 4899
 seconds with 1080 seconds of active time.  This session ended with a crash.
 
Error - 26.10.2009 11:49:30 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 208
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 24.04.2010 06:28:50 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session 
lasted 1639 seconds with 1380 seconds of active time.  This session ended with a
 crash.
 
[ System Events ]
Error - 22.06.2011 13:37:42 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
Error - 22.06.2011 13:37:43 | Computer Name = *** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
   %%126
 
 
< End of report >
         

5. GMER

GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-22 21:01:24
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-5 SAMSUNG_HD250HJ rev.FH100-05
Running: vlozg2tx.exe; Driver: C:\DOKUME~1\Besitzer\LOKALE~1\Temp\kxtcrpow.sys


---- User code sections - GMER 1.0.15 ----

.text  C:\WINDOWS\system32\winlogon.exe[692] ntdll.dll!NtSetValueKey         7C91DDCE 5 Bytes  JMP 018E5038 
.text  C:\WINDOWS\Explorer.EXE[1816] kernel32.dll!CreateProcessW             7C802332 5 Bytes  JMP 012D11D8 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetReadFile            408C654B 5 Bytes  JMP 012CFE20 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!HttpQueryInfoA              408C878D 5 Bytes  JMP 012D0074 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetCloseHandle         408C9088 5 Bytes  JMP 012D00D0 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetQueryDataAvailable  408CBF7F 5 Bytes  JMP 012CFAC4 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!HttpOpenRequestA            408CD508 5 Bytes  JMP 012CD9FC 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetConnectA            408CDEAE 5 Bytes  JMP 012CD708 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!HttpSendRequestW            408CFABE 5 Bytes  JMP 012CF0C8 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetOpenA               408DD690 5 Bytes  JMP 012CD6B4 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!HttpSendRequestA            408DEE89 5 Bytes  JMP 012CEA08 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetReadFileExW         408E3349 5 Bytes  JMP 012D000C 
.text  C:\WINDOWS\Explorer.EXE[1816] WININET.dll!InternetReadFileExA         408E3381 5 Bytes  JMP 012CFFA4 

---- EOF - GMER 1.0.15 ----
         

Hier gehts weiter => http://www.trojaner-board.de/100673-...-gesperrt.html