Doppelter Befall (Bundespolizei und Abnow.com)

DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 1.6.0_29
Run by Rainer at 17:25:00 on 2012-03-27
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2037.1280 [GMT 2:00]
.
AV: Norman Security Suite *Enabled/Updated* {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
.
============== Running Processes ===============
.
C:\Programme\Emsisoft Anti-Malware\a2service.exe
C:\Programme\Norman\Npm\Bin\elogsvc.exe
C:\Programme\Norman\Ngs\Bin\Nnf.exe
C:\Programme\Norman\Ngs\Bin\Nprosec.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Programme\Norman\Npm\Bin\Zanda.exe
C:\Programme\Norman\npm\bin\nvoy.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Programme\Bonjour\mDNSResponder.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
C:\Programme\Freemake\CaptureLib\CaptureLibService.exe
C:\Programme\Mail.Ru\Guard\GuardMailRu.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Programme\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\Dokumente und Einstellungen\Rainer\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Programme\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Norman\Npm\Bin\ZLH.EXE
C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\Programme\Norman\Npm\Bin\scheduler.exe
C:\Programme\Norman\Npm\Bin\Njeeves.exe
C:\Programme\Norman\Nvc\Bin\nvcoas.exe
C:\Programme\Norman\Nvc\bin\nhs.exe
C:\Programme\Norman\Nvc\Bin\cclaw.exe
C:\WINDOWS\system32\ntvdm.exe
\\.\globalroot\SystemRoot\system32\svchost.exe -k netsvcs
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = 
uSearch Page = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://start.facemoods.com/?a=make&s={searchTerms}&f=4
mWinlogon: Userinit=userinit.exe,
uWinlogon: Shell=c:\dokumente und einstellungen\rainer\lokale einstellungen\anwendungsdaten\4478682a\X
BHO: Complitly: {0fb6a909-6086-458f-bd92-1f8ee10042a0} - c:\dokumente und einstellungen\rainer\anwendungsdaten\complitly\Complitly.dll
BHO: Shopping Assistant Plugin: {1631550f-191d-4826-b069-d9439253d926} - c:\programme\pricegong\2.5.4\PriceGongIE.dll
BHO: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programme\gemeinsame dateien\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Community Smartbar Engine: {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll
BHO: DataMngr: {9d717f81-9148-4f12-8568-69135f087db0} - c:\progra~1\wi371a~1\datamngr\BROWSE~1.DLL
BHO: DealPly: {a6174f27-1fff-e1d6-a93f-ba48ad5dd448} - c:\programme\dealply\DealPlyIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Yontoo: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\programme\yontoo layers runtime\YontooIEClient.dll
TB: Community Smart Bar: {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll
TB: {09900DE8-1DCA-443F-9243-26FF581438AF} - No File
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil11e_Plugin.exe -update plugin
mRun: [Norman ZANDA] "c:\programme\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH
mRun: [Ulead AutoDetector v2] c:\programme\gemeinsame dateien\ulead systems\autodetector\monitor.exe
mRun: [Ocs_SM] c:\dokumente und einstellungen\rainer\anwendungsdaten\ocs\sm\SearchAnonymizer.exe
mRun: [Adobe ARM] "c:\programme\gemeinsame dateien\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\programme\gemeinsame dateien\apple\apple application support\APSDaemon.exe"
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
mRun: [Malwarebytes' Anti-Malware] "c:\programme\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Web-Suche - c:\programme\sweetim\toolbars\internet explorer\resources\menuext.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe
IE: {722FE9B2-6895-42D9-9984-F4CB26616023} - {722FE9B2-6895-42D9-9984-F4CB26616023} - c:\programme\data becker\pdf genie 3.0\pdfshell.dll
LSP: mswsock.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1286800746168
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 83.169.184.161 83.169.184.225
TCP: Interfaces\{63AD3236-F05E-4448-9A93-61C46E9B4FBE} : DhcpNameServer = 83.169.184.161 83.169.184.225
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\wi371a~1\datamngr\datamngr.dll c:\progra~1\wi371a~1\datamngr\IEBHO.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\dokumente und einstellungen\rainer\anwendungsdaten\mozilla\firefox\profiles\y53dx2c0.rainer\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://de.wikipedia.org/wiki/Benutzer:Rainer_Lippert
FF - prefs.js: keyword.URL - hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:7317400059&cof=FORID:11&sa=Search&siteurl=search.linkury.com&q=
FF - plugin: c:\programme\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\programme\canon\mycamera download plugin\NPCIG.dll
FF - plugin: c:\programme\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\google\picasa3\npPicasa3.dll
FF - plugin: c:\programme\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\programme\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\programme\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\programme\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programme\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\programme\mozilla firefox\plugins\npdeployJava1.dll
.
---- FIREFOX POLICIES ----
.
FF - user.js: extentions.y2layers.installId - 5b6eccc5-236b-4d4d-8dd5-6326c37596fc
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,BestVideoDownloader,
.
============= SERVICES / DRIVERS ===============
.
R0 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2011-6-1 47040]
R1 NGS;Norman General Security Driver;c:\programme\norman\ngs\bin\ngs.sys [2010-10-11 26744]
R1 NPROSEC;Norman Security driver;c:\programme\norman\ngs\bin\nprosec.sys [2010-10-11 91136]
R2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\programme\emsisoft anti-malware\a2service.exe [2011-6-4 3029208]
R2 ACEDRV08;ACEDRV08;c:\windows\system32\drivers\ACEDRV08.sys [2011-1-9 108768]
R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\programme\adobe\elements 9 organizer\PhotoshopElementsFileAgent.exe [2010-9-30 169408]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-14 14336]
R2 drhard;drhard;c:\windows\system32\drivers\drhard.sys [2010-10-16 23600]
R2 Freemake Improver;Freemake Improver;c:\dokumente und einstellungen\all users\anwendungsdaten\freemake\freemakeutilsservice\FreemakeUtilsService.exe [2011-11-26 74752]
R2 FreemakeVideoCapture;FreemakeVideoCapture;c:\programme\freemake\capturelib\CaptureLibService.exe [2011-11-26 8704]
R2 Guard.Mail.ru;Guard.Mail.ru;c:\programme\mail.ru\guard\GuardMailRu.exe [2011-10-7 1482960]
R2 MBAMService;MBAMService;c:\programme\malwarebytes' anti-malware\mbamservice.exe [2011-1-29 652360]
R2 Ndiskio;Ndiskio;c:\programme\norman\nse\bin\ndiskio.sys [2011-6-1 22880]
R2 NHS;Norman Hash Server;c:\programme\norman\nvc\bin\nhs.exe [2012-2-27 871264]
R2 NNFSVC;Norman Network Filtering service;c:\programme\norman\ngs\bin\nnf.exe [2010-10-11 231216]
R2 Norman ZANDA;Norman ZANDA;c:\programme\norman\npm\bin\zanda.exe [2010-1-14 431320]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2011-2-11 35088]
R2 NPROSECSVC;Norman Security service;c:\programme\norman\ngs\bin\nprosec.exe [2010-10-11 90144]
R2 nregsec;Norman Registry Security driver;c:\programme\norman\ngs\bin\nregsec.sys [2010-10-11 61496]
R2 NVOY;Norman Resource Provider;c:\programme\norman\npm\bin\nvoy.exe [2010-10-11 100936]
R2 SearchAnonymizer;SearchAnonymizer;c:\dokumente und einstellungen\rainer\anwendungsdaten\ocs\sm\SearchAnonymizerHelper.exe [2011-9-2 40960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-1-29 20464]
R3 nvcoas;Norman Virus Control on-access component;c:\programme\norman\nvc\bin\nvcoas.exe [2011-6-1 276984]
R3 Scheduler;Norman Scheduler Service;c:\programme\norman\npm\bin\scheduler.exe [2010-10-11 99312]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\programme\google\update\GoogleUpdate.exe [2010-10-19 136176]
S3 a2acc;a2acc;c:\programme\emsisoft anti-malware\a2accx86.sys [2011-6-4 73728]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-10-11 1691480]
S3 cpuz134;cpuz134;c:\programme\cpuid\pc wizard 2010\pcwiz_x32.sys [2011-1-7 20328]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\google\update\GoogleUpdate.exe [2010-10-19 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 nsesvc;Norman Scanner Engine Service;c:\programme\norman\nse\bin\nsesvc.exe [2011-6-1 288072]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [2012-1-18 17920]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [2012-1-18 60544]
S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [2012-1-18 14848]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336]
S3 WPEServ;WPEServ;c:\programme\gemeinsame dateien\wpe\wpeserv.exe [2010-10-18 323584]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-03-27 13:21:12	0	--sha-w-	c:\windows\system32\dds_log_ad13.cmd
2012-03-27 13:19:49	--------	d-sh--w-	c:\dokumente und einstellungen\rainer\lokale einstellungen\anwendungsdaten\4478682a
2012-03-26 15:30:18	--------	d-----w-	c:\windows\system32\wbem\repository\FS
2012-03-26 15:30:18	--------	d-----w-	c:\windows\system32\wbem\Repository
2012-03-23 17:54:04	--------	d-----w-	C:\WeatherLink
2012-03-22 19:12:12	4435968	----a-w-	c:\windows\system32\GPhotos.scr
2012-03-21 18:19:44	--------	d-----w-	c:\programme\CCleaner
2012-03-21 14:38:01	--------	d-----w-	c:\windows\system32\UAs
2012-03-20 13:36:26	--------	d-----w-	c:\windows\system32\11002
2012-03-18 17:53:40	--------	d-----w-	c:\windows\system32\11001
2012-03-18 17:03:31	592824	----a-w-	c:\programme\mozilla firefox\gkmedias.dll
2012-03-18 17:03:30	44472	----a-w-	c:\programme\mozilla firefox\mozglue.dll
2012-03-16 18:22:28	--------	d-----w-	c:\windows\system32\10017
2012-03-16 18:22:01	--------	d-----w-	c:\windows\system32\kock
2012-03-13 20:09:07	--------	d-----w-	c:\programme\FoxTabFLVPlayer
2012-02-29 07:06:25	--------	d-----w-	c:\programme\Sunrays
.
==================== Find3M  ====================
.
2012-02-15 10:15:43	47040	----a-w-	c:\windows\system32\drivers\nvcw32mf.sys
2012-02-03 09:57:08	1860224	----a-w-	c:\windows\system32\win32k.sys
2012-01-11 19:06:33	3072	------w-	c:\windows\system32\iacenc.dll
2012-01-09 16:20:20	139784	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2008-12-09 15:23:13	53752	--sh--r-	c:\windows\system32\appconf32.exe
.
============= FINISH: 17:25:44,82 ===============