Hallo!

Zuerst zum Threadtitel: Ist die Reihenfolge der für mich offensichtlichen Probleme.
- Zuerst kamen die wirren Meldungen von XP 2012 Antivirus, nach u.a. Regfix+Malwareybytes war davon erstmal nichts "direkt" zu spüren bzw sehen
- Die automatischen Updates waren jedoch noch deaktiviert. Durch Vorgehen wie in diesem Thread bis zum Schritt ComboFix habe ich das auch soweit zumindest für meinen unerfahrenen Blick beheben können.
- Bei erneuter Nutzung heute vermeldet Malwarebytes unregelmäßig alle paar Minuten Folgendes:

Successfully blocked access to a potentially malicious website: 79.135.134.68
Type: Outgoing

...bzw die IP-Adressen wechseln, 83.128.48.62 war auch öfter dabei. Holland und Latvia sagt mir google u.a.


Schon bei den Punkten 1 und 2 wollte ich mich melden, aber ich dachte, ich werde durch eigenes Nachlesen noch irgendwie selbst damit fertig - gerade vor der Nutzung von ComboFix ohne Instruktion wird ja eigentlich gewarnt, bitte nicht hauen.
Jedenfalls hat mich die zuletzt genannte Malwarebytes-Lösung dann endlich dazu gebracht, hier professionelle Hilfe zu erbitten, da ich nun mit meinem Latein am Ende bin.



Noch etwas genauer: Ist der schon etwas ältere Laptop meiner Freundin mit Grundeinstellungen auf Bulgarisch (siehe z.B. im OTL-Log, also nicht wundern). Im Urlaub vor 8 Tagen eingefangen und ich habe dort nur an einem anderen ausländischen PC Folgendes auf die Schnelle ergooglet:
hxxp://www.myantispyware.com/2011/06/11/how-to-remove-xp-antivirus-2012-virus/

RKill wie bei der hier auf trojaner-board.de genannten Lösung habe ich dementsprechend erst ein paar Tage später bei einem erneuten Versuch angewendet, zuerst war es außerdem nur ein Quick Scan mit Malwarebytes.

TDSSKiller hatte ich auch mal laufen (wie gesagt, wie im oben verlinkten Thread hier in diesem Forum mit genau dem gleichen Updates-Problem), dabei wurde sptd.sys genannt. RKill wiederum hatte vorher wmiapsrv.exe gestoppt.


Wie auch immer, hier mal die bisherigen Logs - OTL habe ich leider erst eben ausgeführt bzw nicht wie in sonstigen Reihenfolgen genannt schon vorher.


Reihenfolge:

1. MBAM 16.08. (Anleitung von der oben verlinkten anderen Seite)
2. MBAM 18.08. (als mir das Update-Problem aufgefallen ist)
3. MBAM 20.08. (Aus dem Urlaub zurückgekehrt und festgestellt, dass hier auf dem Board noch von RKill die Rede war, also nochmal neu ausgeführt)
4. TDSSKiller im Anschluss
5. Danach ComboFix (Hoffe wie gesagt, speziell das war kein No-Go ohne klare Anweisung)
6. Zuletzt noch OTL von heute

OTL logfile created on: 24.8.2011 г. 20:53:51 - Run 1
OTL by OldTimer - Version 3.2.26.5     Folder = C:\Documents and Settings\Irina\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000402 | Country: Bulgaria | Language: BGR | Date Format: dd.M.yyyy 'г.'
 
893.98 Mb Total Physical Memory | 204.27 Mb Available Physical Memory | 22.85% Memory free
2.12 Gb Paging File | 1.32 Gb Available in Paging File | 62.21% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 20.00 Gb Total Space | 2.18 Gb Free Space | 10.90% Space Free | Partition Type: NTFS
Drive D: | 54.53 Gb Total Space | 4.04 Gb Free Space | 7.41% Space Free | Partition Type: NTFS
Drive E: | 4.33 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: IRINANOTEBOOK | User Name: Irina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\Irina\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\system32\rpcnet.exe (Absolute Software Corp.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
PRC - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files\USB Disk Win98 Driver\Res.exe (ali)
PRC - C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
PRC - C:\Program Files\Logitech\Video\FxSvr2.exe (Labtec Inc.)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
PRC - C:\Program Files\Winamp\winampa.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Mozilla Firefox\js3250.dll ()
MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5d25670d\mscorlib.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_86ea65c1\system.drawing.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_8ebbcc6b\system.xml.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_92400843\system.windows.forms.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_2306fa5b\system.dll ()
MOD - c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll ()
MOD - c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll ()
MOD - c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll ()
MOD - c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll ()
MOD - c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll ()
MOD - c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\WINDOWS\system32\preflib.dll ()
MOD - C:\WINDOWS\system32\bcm1xsup.dll ()
MOD - C:\Program Files\Dell\QuickSet\dadkeyb.dll ()
MOD - C:\Program Files\Dell\QuickSet\preflibcl.dll ()
MOD - C:\Program Files\Winamp\winampa.exe ()
MOD - C:\WINDOWS\system32\prnmnt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (rpcnet) Remote Procedure Call (RPC) -- C:\WINDOWS\system32\rpcnet.exe (Absolute Software Corp.)
SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (NICCONFIGSVC) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Dell Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (ewusbnet) -- C:\WINDOWS\system32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbdev) -- C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (BCMWLNPF) -- C:\WINDOWS\system32\drivers\BCMWLNPF.SYS (CACE Technologies)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (bvrp_pci) -- C:\WINDOWS\system32\drivers\bvrp_pci.sys ()
DRV - (APPDRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (PID_0928) Labtec WebCam(PID_0928) -- C:\WINDOWS\system32\drivers\LV561AV.SYS (Labtec Inc.)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.)
DRV - (STIrUsb) -- C:\WINDOWS\system32\drivers\irstusb.sys (SigmaTel, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.bg/
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/firefox"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: enroller@infonotary.com:0.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\WINDOWS\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Documents and Settings\Irina\Application Data\Facebook\npfbplugin_1_0_1.dll ( )
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\Irina\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.17 09:18:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.17 09:18:29 | 000,000,000 | ---D | M]
 
[2008.09.09 22:31:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Irina\Application Data\Mozilla\Extensions
[2011.08.24 19:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions
[2011.08.18 00:22:24 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.08.18 00:22:27 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.18 00:22:21 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.08 20:39:04 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.08.17 18:04:38 | 000,000,000 | ---D | M] (InfoNotary Certificate Enroller) -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions\enroller@infonotary.com
[2010.07.10 20:45:43 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\extensions\firefox@tvunetworks.com
[2011.08.22 21:35:20 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-1.xml
[2009.02.05 01:30:14 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-10.xml
[2009.03.20 17:48:38 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-11.xml
[2009.03.28 15:21:39 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-12.xml
[2009.04.22 16:29:38 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-13.xml
[2009.04.29 01:20:39 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-14.xml
[2009.06.12 19:47:25 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-15.xml
[2009.07.23 23:06:51 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-16.xml
[2009.08.05 13:51:15 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-17.xml
[2009.09.12 01:48:55 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-18.xml
[2009.10.30 04:49:04 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-19.xml
[2008.03.29 23:03:33 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-2.xml
[2009.12.17 01:53:13 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-20.xml
[2010.01.06 23:58:45 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-21.xml
[2008.04.17 12:44:39 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-3.xml
[2008.07.02 16:03:24 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-4.xml
[2008.07.17 00:20:55 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-5.xml
[2008.09.09 22:31:38 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-6.xml
[2008.10.07 00:10:24 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-7.xml
[2008.11.20 12:15:55 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-8.xml
[2008.12.19 16:30:36 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin-9.xml
[2009.07.13 16:12:02 | 000,000,944 | ---- | M] () -- C:\Documents and Settings\Irina\Application Data\Mozilla\Firefox\Profiles\f46khkdq.default\searchplugins\icqplugin.xml
[2011.08.24 19:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011.01.03 22:16:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.05.12 20:54:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.08.21 01:28:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2009.07.02 11:15:08 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009.04.12 17:49:53 | 000,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
 
O1 HOSTS File: ([2011.08.21 01:04:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - No CLSID value found.
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Foxit Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Foxit Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Labtec Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.exe (ali)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] c:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\Irina\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Irina\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (ICQ, LLC.)
O15 - HKCU\..Trusted Domains:   ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: e-fibank.bg ([]https in Trusted sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab (Microsoft Genuine Advantage Self Support Tool)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} hxxp://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {46A70B4B-61D5-4D95-820D-895C3F9D6109} hxxp://repository.infonotary.com/updates/inpki-x86.cab (Enroller Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190123338999 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} https://e-fibank.bg/EBank/CAPICOM/capicom.cab (Settings Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 () - file:///C:/DOCUME~1/Irina/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Irina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Irina\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.09.18 14:25:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.24 20:53:04 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Irina\Desktop\OTL.exe
[2011.08.22 20:40:47 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011.08.22 19:39:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Irina\Application Data\Avira
[2011.08.22 19:36:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avira
[2011.08.22 19:35:56 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2011.08.22 19:35:52 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011.08.22 19:35:51 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011.08.22 19:35:51 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2011.08.22 19:35:51 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2011.08.22 19:35:49 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.08.22 19:35:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2011.08.21 01:28:22 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.08.21 01:28:22 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.08.21 01:28:22 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.08.21 00:54:54 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.08.21 00:50:49 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011.08.21 00:50:49 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011.08.21 00:50:49 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011.08.21 00:50:49 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011.08.21 00:50:35 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Irina\Start Menu\Programs\Administrative Tools
[2011.08.21 00:49:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.08.21 00:42:48 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.08.16 20:08:06 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011.08.16 20:08:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011.08.16 19:43:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Irina\Application Data\Malwarebytes
[2011.08.16 19:43:19 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.08.16 19:43:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.08.16 19:43:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011.08.16 19:43:15 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.08.16 19:43:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.08.16 17:40:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011.08.10 12:07:12 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011.08.10 12:07:05 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011.08.03 13:57:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Irina\Application Data\DVDVideoSoft
[2008.01.14 21:20:53 | 000,318,904 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wmpfirefoxplugin.exe
[2008.01.14 21:03:35 | 025,755,448 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wmp11-windowsxp-x86-enu.exe
[2007.10.22 22:50:08 | 000,594,880 | ---- | C] (Sharman Networks Ltd) -- C:\Program Files\kazaa_setup.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Irina\Desktop\*.tmp files -> C:\Documents and Settings\Irina\Desktop\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.24 20:32:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Irina\Desktop\OTL.exe
[2011.08.24 19:42:14 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011.08.24 19:42:03 | 000,444,170 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.08.24 19:42:03 | 000,073,046 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.08.24 19:37:39 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.24 19:37:26 | 000,017,408 | ---- | M] () -- C:\WINDOWS\System32\rpcnetp.exe
[2011.08.24 19:37:24 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\WINDOWS\System32\rpcnet.dll
[2011.08.24 19:37:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.22 23:53:09 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.08.22 23:52:04 | 000,034,816 | ---- | M] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.22 23:41:22 | 000,000,155 | ---- | M] () -- C:\WINDOWS\winamp.ini
[2011.08.22 21:58:36 | 000,000,723 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2011.08.22 19:36:18 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2011.08.21 01:04:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011.08.21 00:55:00 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011.08.20 22:43:22 | 000,000,012 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\ReminderNextRun
[2011.08.16 19:37:32 | 000,013,842 | -HS- | M] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\7152l45i3512y8ge8k
[2011.08.16 19:37:32 | 000,013,842 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\7152l45i3512y8ge8k
[2011.08.16 18:43:25 | 000,013,834 | -HS- | M] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\875504503
[2011.08.15 00:07:54 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.08.11 23:17:09 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Irina\Desktop\*.tmp files -> C:\Documents and Settings\Irina\Desktop\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.22 19:36:18 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2011.08.21 00:55:00 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011.08.21 00:54:56 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011.08.21 00:50:49 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011.08.21 00:50:49 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011.08.21 00:50:49 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011.08.21 00:50:49 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011.08.21 00:50:49 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011.08.16 18:43:24 | 000,013,834 | -HS- | C] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\875504503
[2011.08.16 17:25:49 | 000,013,842 | -HS- | C] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\7152l45i3512y8ge8k
[2011.08.16 17:25:49 | 000,013,842 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\7152l45i3512y8ge8k
[2011.07.18 23:16:36 | 000,000,012 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ReminderNextRun
[2011.01.07 00:27:16 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.10.29 23:06:26 | 000,006,812 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2010.10.29 23:03:42 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\InstMed.exe
[2010.03.12 21:45:44 | 000,000,016 | ---- | C] () -- C:\WINDOWS\popcinfot.dat
[2010.03.12 21:45:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\popcreg.dat
[2009.11.23 17:49:38 | 000,000,050 | ---- | C] () -- C:\WINDOWS\SW_Win2146X32.DLL
[2009.11.23 17:49:27 | 001,720,320 | ---- | C] () -- C:\WINDOWS\System32\beconvlib.dll
[2009.11.23 17:49:27 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\bprgcomm.dll
[2009.11.23 17:49:27 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\CSVSpecialProcessing.dll
[2009.11.23 17:49:26 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\SII_PDF.dll
[2009.11.23 17:49:26 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\SARzilla.dll
[2009.11.23 17:49:26 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\DVM.dll
[2009.11.23 17:49:26 | 000,000,530 | ---- | C] () -- C:\WINDOWS\System32\tx15_ic.ini
[2009.11.23 17:49:25 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\RegisterExe.exe
[2009.09.06 23:42:22 | 000,000,147 | ---- | C] () -- C:\WINDOWS\sapshortcut.ini
[2009.08.03 14:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2009.06.08 13:57:46 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\rpcnetp.dll
[2009.06.08 13:57:15 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\rpcnetp.exe
[2009.05.18 18:54:43 | 000,050,644 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009.01.21 22:51:04 | 000,000,015 | ---- | C] () -- C:\WINDOWS\ver001.dat
[2009.01.21 22:46:39 | 000,000,800 | ---- | C] () -- C:\WINDOWS\SUPERLEX.INI
[2008.11.14 15:04:40 | 000,002,828 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2008.11.14 15:04:40 | 000,000,008 | RHS- | C] () -- C:\WINDOWS\System32\66AC9C4CF9.sys
[2008.10.19 01:36:13 | 000,000,079 | ---- | C] () -- C:\WINDOWS\skypetrance.ini
[2008.05.11 00:53:13 | 000,000,048 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008.05.10 16:50:42 | 000,001,019 | ---- | C] () -- C:\WINDOWS\saplogon.ini
[2008.05.10 16:36:33 | 003,203,072 | ---- | C] () -- C:\WINDOWS\System32\lcppn201.dll
[2008.05.10 16:36:33 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\nlsxdsgn.dll
[2008.05.10 16:34:12 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2008.05.10 16:34:12 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2008.05.10 16:34:12 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2008.05.10 16:34:12 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2008.05.10 16:34:12 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2008.05.10 16:34:06 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\vtssm32.dll
[2008.03.10 23:15:13 | 000,004,868 | ---- | C] () -- C:\WINDOWS\wdict32.INI
[2008.03.10 23:15:04 | 000,005,007 | ---- | C] () -- C:\WINDOWS\wtran32.INI
[2008.03.04 18:52:34 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2008.02.27 13:18:18 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008.01.18 00:43:33 | 000,000,099 | ---- | C] () -- C:\WINDOWS\dinksmallwood.ini
[2008.01.18 00:26:34 | 000,000,114 | ---- | C] () -- C:\WINDOWS\cncscore.ini
[2008.01.14 23:38:03 | 000,000,128 | ---- | C] () -- C:\WINDOWS\poolemup.ini
[2007.11.24 19:42:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2007.11.01 23:09:53 | 000,001,763 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007.10.31 09:39:54 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2007.10.23 00:41:15 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat
[2007.10.22 17:37:28 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\newdll.dll
[2007.09.21 23:28:19 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.09.21 22:27:23 | 000,002,513 | ---- | C] () -- C:\Program Files\Microsoft Photo Editor.lnk
[2007.09.19 22:26:50 | 000,034,816 | ---- | C] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.09.19 21:35:39 | 000,001,156 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2007.09.19 18:04:39 | 000,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2007.09.19 18:02:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007.09.19 18:01:11 | 001,138,688 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007.09.19 18:01:11 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007.09.19 18:01:09 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007.09.19 18:00:55 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007.09.18 17:12:37 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007.09.18 17:11:21 | 000,267,800 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007.09.18 16:36:45 | 000,000,723 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2007.09.18 16:29:14 | 000,000,748 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.09.18 15:42:57 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Irina\Local Settings\Application Data\fusioncache.dat
[2007.09.18 15:08:10 | 000,005,652 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2007.09.18 14:54:30 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2007.09.18 14:49:31 | 000,133,246 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2007.09.18 14:40:24 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2007.09.18 14:40:24 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE
[2007.09.18 14:40:23 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll
[2007.09.18 14:28:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007.09.18 14:22:09 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007.09.18 12:46:00 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\kbdBF.dll
[2007.05.17 13:58:10 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2004.08.02 13:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002.03.21 11:51:52 | 000,503,808 | R--- | C] () -- C:\WINDOWS\System32\lt_xtrans.dll
[2002.03.21 11:51:52 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\MrSIDD.dll
[2002.03.21 11:51:52 | 000,163,840 | R--- | C] () -- C:\WINDOWS\System32\lt_common.dll
[2002.03.21 11:51:52 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lt_trans.dll
[2002.03.21 11:51:52 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\lt_meta.dll
[2002.03.21 11:51:52 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\lt_encrypt.dll
[2002.03.21 11:51:52 | 000,020,480 | R--- | C] () -- C:\WINDOWS\System32\lt_messagetext.dll
[2002.03.20 20:01:06 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2002.03.20 20:00:20 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
[2001.10.28 01:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\prnmnt.dll
[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001.08.23 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001.08.23 14:00:00 | 000,444,170 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001.08.23 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001.08.23 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001.08.23 14:00:00 | 000,073,046 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001.08.23 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001.08.23 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001.08.23 14:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2001.08.23 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[1999.01.27 13:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997.06.13 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F8662B30

< End of report >
         

Die Datei "neu.zip" enthält die genannten Logs.

Hmm, oben scheint mein Link zu dem alten Thread hier im Board beim Posten verloren gegangen zu sein oder eine direkte URL-Verlinkung im Hintergrund wird hier automatisch unterbunden.

Bei

- Die automatischen Updates waren jedoch noch deaktiviert. Durch Vorgehen wie in diesem Thread bis zum Schritt ComboFix habe ich das auch soweit zumindest für meinen unerfahrenen Blick beheben können.

meinte ich jedenfalls:
hxxp://www.trojaner-board.de/99105-xp-antipsy-virus-2011-a.html

Hmm, hat keiner eine Idee?