Guten Tag, liebe User,

ich benötige Untertützung - bin mit meinem Latein am Ende.

also, ich habe Mcafee Inernetscurity Abo installiert. Soweit sogut.
Habe mitbekommen, dass scans Freitags automtisch starten. Schon schlimm genug, dass man sowas erst alles selber herausfinden muss. ES ist seit März ein TRojaner in der Quarantäne, ich weiß nicht, was ich da jetzt machen muss, geschweige denn wie, einer von McAfee meinte, wenn mal was in der Quarantäne ist, wird es automatisch nach 14 TAgen gelöscht - stimmt ja gar nicht. Habe bei scan immer keine Hinweise bekommen -also alles ok, laut McAfee. Was mache ich jetzt?? der trojaner heißt generic dropper und ist , wie gesagt, in Quarantäne. Kann mir jemand erklären oder helfen???

Kundendienst ist dort ........

hallo und

kannst du einen Bericht bei McAfee finden?
Einen Log was McAfee gefunden wurde?
das wäre sehr hilfreich und das dann bitte hier posten


dann arbeite bitte alle Anleitungen in meiner Signatur ab
(Anleitung-ZHPDiag Anleitung-MBAM
Anleitung-rsit
Anleitung-CCleaner)

und poste bitte alle Logfiles dann wird sich jemand um dein Problem kümmern

hi, danke, dass Du Dich annimmst. Also ich zeige mal was sich finde:

einmal die Meldung von mcafee

und dann habe den angegebenen Pfad mal auf meinem PC verfogt, diese Datei finde ich dort natürlich nicht mehr. Das sind, wie ich das sehe, spam-Mails.

dann habe ich gestern noch mal einen weiteren Scan mit Malwarebytes gemacht:
Malwarebytes' Anti-Malware 1.36
Datenbank Version: 2098
Windows 6.0.6001 Service Pack 1

09.05.2009 17:36:32
mbam-log-2009-05-09 (17-36-32).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|F:\|)
Durchsuchte Objekte: 213702
Laufzeit: 3 hour(s), 44 minute(s), 42 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.


hier ist noch was gefunden worden, was mcafee nicht gefundne hat (Rogue.Installer).

scan im abgesichertem Modus hat auch keine besonderen Ereignisse gemeldet.

Wo finde ich die Quarantäne von McAffe???

Keine Ahnung -

Danke schon mal

nein nein ich werde mich nicht annehmen
das macht jemand anderes
ich wollte nur dass in der Zeit wo niemand hilft du alle Informationen lieferst damit man dir best möglichst helfen kann. Aber du solltest die Anleitung in der Reihenfolge abarbeiten und nicht bei Punkt 2 beginnen!

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gerstmann at 2009-05-10 16:20:47
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 91 GB (76%) free of 120 GB
Total RAM: 3293 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:20:51, on 10.05.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Gerstmann\RSIT.exe
C:\Program Files\trend micro\Gerstmann.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/707-44556-9400-3/4 (file missing)
O9 - Extra button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: Notebook Performance Tuning Service (TEMPRO) (TemproMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TemproSvc.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

. Teil:

=====Scheduled tasks folder======

C:\Windows\tasks\1-Klick-Wartung.job
C:\Windows\tasks\McDefragTask.job
C:\Windows\tasks\McQcTask.job
C:\Windows\tasks\User_Feed_Synchronization-{B47F2009-BE50-4429-B9AB-AEAA1FB695C4}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\PROGRA~1\mcafee\msk\mskapbho.dll [2009-01-09 246800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll [2009-03-25 62784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-02-22 251504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2009-02-22 657904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-01-29 145424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll [2009-02-22 522224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-02-22 251504]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2009-01-29 145424]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-21 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"RestrictWelcomeCenter"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-05-10 12:04:40 ----D---- C:\Users\Gerstmann\AppData\Roaming\McAfee
2009-05-09 19:14:53 ----A---- C:\Windows\ntbtlog.txt
2009-05-09 17:47:41 ----D---- C:\rsit
2009-05-09 17:47:41 ----D---- C:\Program Files\trend micro
2009-05-09 15:35:35 ----D---- C:\Windows\system32\URTTEMP
2009-05-09 13:50:37 ----D---- C:\Users\Gerstmann\AppData\Roaming\Malwarebytes
2009-05-09 13:50:31 ----D---- C:\ProgramData\Malwarebytes
2009-05-09 13:50:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-05-04 23:03:28 ----D---- C:\Program Files\Jasc Software Inc
2009-05-04 22:41:51 ----D---- C:\Program Files\7-Zip
2009-05-04 21:54:01 ----D---- C:\Users\Gerstmann\AppData\Roaming\Jasc
2009-04-29 20:22:53 ----D---- C:\Users\Gerstmann\AppData\Roaming\WinRAR
2009-04-29 20:22:09 ----D---- C:\Program Files\WinRAR
2009-04-28 23:08:10 ----A---- C:\Windows\system32\mshtmler.dll
2009-04-28 23:08:10 ----A---- C:\Windows\system32\mshtmled.dll
2009-04-28 23:08:10 ----A---- C:\Windows\system32\ieui.dll
2009-04-28 23:08:10 ----A---- C:\Windows\system32\icardie.dll
2009-04-28 23:08:10 ----A---- C:\Windows\system32\admparse.dll
2009-04-28 23:08:09 ----A---- C:\Windows\system32\msls31.dll
2009-04-28 23:08:09 ----A---- C:\Windows\system32\jsproxy.dll
2009-04-28 23:08:09 ----A---- C:\Windows\system32\iernonce.dll
2009-04-28 23:08:09 ----A---- C:\Windows\system32\corpol.dll
2009-04-28 23:08:08 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-04-28 23:08:08 ----A---- C:\Windows\system32\imgutil.dll
2009-04-28 23:08:08 ----A---- C:\Windows\system32\iepeers.dll
2009-04-28 23:08:08 ----A---- C:\Windows\system32\ieakeng.dll
2009-04-28 23:08:08 ----A---- C:\Windows\system32\dxtrans.dll
2009-04-28 23:08:08 ----A---- C:\Windows\system32\dxtmsft.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\webcheck.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\occache.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\msrating.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\licmgr10.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\inseng.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\iesetup.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\ieakui.dll
2009-04-28 23:08:07 ----A---- C:\Windows\system32\ieaksie.dll
2009-04-28 23:08:06 ----A---- C:\Windows\system32\WinFXDocObj.exe
2009-04-28 23:08:06 ----A---- C:\Windows\system32\wextract.exe
2009-04-28 23:08:06 ----A---- C:\Windows\system32\pngfilt.dll
2009-04-28 23:08:06 ----A---- C:\Windows\system32\mstime.dll
2009-04-28 23:08:06 ----A---- C:\Windows\system32\msfeedssync.exe
2009-04-28 23:08:06 ----A---- C:\Windows\system32\msfeeds.dll
2009-04-28 23:08:06 ----A---- C:\Windows\system32\advpack.dll
2009-04-28 23:08:05 ----A---- C:\Windows\system32\vbscript.dll
2009-04-28 23:08:05 ----A---- C:\Windows\system32\jscript.dll
2009-04-28 23:08:05 ----A---- C:\Windows\system32\ieapfltr.dll
2009-04-28 23:08:04 ----A---- C:\Windows\system32\url.dll
2009-04-28 23:08:04 ----A---- C:\Windows\system32\iedkcs32.dll
2009-04-28 23:08:03 ----A---- C:\Windows\system32\mshta.exe
2009-04-28 23:08:03 ----A---- C:\Windows\system32\iexpress.exe
2009-04-28 23:08:02 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2009-04-28 23:08:02 ----A---- C:\Windows\system32\SetDepNx.exe
2009-04-28 23:08:02 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2009-04-28 23:08:02 ----A---- C:\Windows\system32\PDMSetup.exe
2009-04-28 23:08:02 ----A---- C:\Windows\system32\ieUnatt.exe
2009-04-28 23:08:02 ----A---- C:\Windows\system32\iesysprep.dll
2009-04-28 23:08:02 ----A---- C:\Windows\system32\iertutil.dll
2009-04-28 23:08:02 ----A---- C:\Windows\system32\ie4uinit.exe
2009-04-28 23:08:01 ----A---- C:\Windows\system32\wininet.dll
2009-04-28 23:08:01 ----A---- C:\Windows\system32\urlmon.dll
2009-04-28 23:08:00 ----A---- C:\Windows\system32\ieframe.dll
2009-04-28 23:07:59 ----A---- C:\Windows\system32\mshtml.dll
2009-04-21 20:26:47 ----D---- C:\Program Files\FMPatcher
2009-04-19 15:50:52 ----D---- C:\Plugins
2009-04-17 23:27:36 ----D---- C:\Users\Gerstmann\AppData\Roaming\Windows Live Writer
2009-04-15 13:22:01 ----D---- C:\Users\Gerstmann\AppData\Roaming\vlc
2009-04-15 11:45:24 ----A---- C:\Windows\system32\winhttp.dll
2009-04-15 11:45:21 ----A---- C:\Windows\system32\xolehlp.dll
2009-04-15 11:45:21 ----A---- C:\Windows\system32\msdtcprx.dll
2009-04-15 11:45:13 ----A---- C:\Windows\system32\rpcss.dll
2009-04-15 11:45:12 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-04-15 11:45:12 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-04-15 11:45:11 ----A---- C:\Windows\system32\sdohlp.dll
2009-04-15 11:45:11 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-04-15 11:45:11 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-04-15 11:45:11 ----A---- C:\Windows\system32\iasrecst.dll
2009-04-15 11:45:11 ----A---- C:\Windows\system32\iasdatastore.dll
2009-04-15 11:45:11 ----A---- C:\Windows\system32\iasads.dll
2009-04-15 11:45:10 ----A---- C:\Windows\system32\iashost.exe
2009-04-15 11:45:05 ----A---- C:\Windows\system32\lsasrv.dll
2009-04-15 11:45:05 ----A---- C:\Windows\system32\kernel32.dll
2009-04-15 11:45:04 ----A---- C:\Windows\system32\secur32.dll
2009-04-15 11:45:04 ----A---- C:\Windows\system32\apilogen.dll
2009-04-15 11:45:04 ----A---- C:\Windows\system32\amxread.dll
2009-04-14 11:07:06 ----D---- C:\Windows\system32\oodag
2009-04-14 11:04:10 ----D---- C:\Program Files\OO Software
2009-04-14 10:52:05 ----A---- C:\Windows\system32\uxtuneup.dll
2009-04-14 10:52:05 ----A---- C:\Windows\system32\authuitu.dll
2009-04-14 10:52:02 ----A---- C:\Windows\system32\TuneUpDefragService.exe
2009-04-14 10:50:46 ----A---- C:\Windows\system32\TUProgSt.exe
2009-04-14 10:50:31 ----D---- C:\Users\Gerstmann\AppData\Roaming\TuneUp Software
2009-04-14 10:49:59 ----D---- C:\ProgramData\TuneUp Software
2009-04-14 10:49:59 ----D---- C:\Program Files\TuneUp Utilities 2009
2009-04-14 10:49:03 ----SHD---- C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357}
2009-04-14 10:41:07 ----DC---- C:\Windows\system32\DRVSTORE
2009-04-14 10:40:17 ----D---- C:\Program Files\Microsoft Sync Framework
2009-04-14 10:39:09 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition
2009-04-14 10:37:38 ----D---- C:\Program Files\Windows Live SkyDrive
2009-04-14 10:37:15 ----D---- C:\Program Files\Windows Live
2009-04-14 10:30:44 ----D---- C:\Program Files\Common Files\Windows Live

======List of files/folders modified in the last 1 months======

2009-05-10 16:20:48 ----D---- C:\Windows\Temp
2009-05-10 15:55:48 ----D---- C:\Users\Gerstmann\AppData\Roaming\Corel
2009-05-10 11:23:19 ----D---- C:\Windows
2009-05-09 20:31:57 ----D---- C:\Windows\system32\drivers
2009-05-09 19:08:29 ----AD---- C:\Windows\System32
2009-05-09 18:56:33 ----D---- C:\Windows\system32\catroot2
2009-05-09 18:46:55 ----SHD---- C:\System Volume Information
2009-05-09 17:47:41 ----RD---- C:\Program Files
2009-05-09 15:38:24 ----D---- C:\ProgramData\McAfee
2009-05-09 15:37:21 ----SHD---- C:\Windows\Installer
2009-05-09 15:37:20 ----D---- C:\Windows\Registration
2009-05-09 15:36:48 ----RSD---- C:\Windows\assembly
2009-05-09 15:36:41 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-09 15:36:40 ----D---- C:\Windows\inf
2009-05-09 15:35:35 ----D---- C:\Program Files\Internet Explorer
2009-05-09 13:50:31 ----HD---- C:\ProgramData
2009-05-08 10:53:40 ----D---- C:\Windows\winsxs
2009-05-08 09:07:20 ----D---- C:\Windows\system32\catroot
2009-05-07 21:21:17 ----D---- C:\Toshiba
2009-05-07 20:41:19 ----D---- C:\Program Files\Toshiba TEMPRO
2009-05-07 20:41:19 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-05-05 09:35:16 ----D---- C:\Windows\system32\Tasks
2009-05-04 23:03:31 ----SD---- C:\Users\Gerstmann\AppData\Roaming\Microsoft
2009-04-28 23:35:24 ----D---- C:\Windows\rescache
2009-04-28 23:16:25 ----D---- C:\Windows\system32\de-DE
2009-04-28 23:16:17 ----D---- C:\Windows\system32\migration
2009-04-28 23:16:17 ----D---- C:\Windows\system32\en-US
2009-04-28 23:16:17 ----D---- C:\Windows\PolicyDefinitions
2009-04-28 23:15:42 ----D---- C:\ProgramData\Microsoft Help
2009-04-28 23:12:21 ----RSD---- C:\Windows\Fonts
2009-04-28 23:12:18 ----D---- C:\Program Files\Common Files\microsoft shared
2009-04-23 08:57:08 ----D---- C:\Program Files\McAfee
2009-04-19 15:50:00 ----A---- C:\Program Files\readme.txt
2009-04-19 15:07:44 ----A---- C:\Windows\system32\Msvcrt10.dll
2009-04-19 15:07:43 ----A---- C:\Windows\system32\plugin.dll
2009-04-19 15:07:42 ----A---- C:\Windows\system32\icmfilter.dll
2009-04-15 13:01:21 ----D---- C:\Program Files\Windows Mail
2009-04-15 13:01:20 ----D---- C:\Windows\system32\wbem
2009-04-15 13:01:18 ----D---- C:\Windows\system32\manifeststore
2009-04-15 13:01:17 ----D---- C:\Windows\AppPatch
2009-04-14 12:23:42 ----D---- C:\Windows\Microsoft.NET
2009-04-14 10:52:00 ----D---- C:\Windows\Tasks
2009-04-14 10:40:07 ----SD---- C:\ProgramData\Microsoft
2009-04-14 10:38:46 ----D---- C:\Windows\SoftwareDistribution
2009-04-14 10:37:51 ----D---- C:\Program Files\Microsoft
2009-04-14 10:30:44 ----D---- C:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 jswpslwf;JumpStart Wireless Filter Driver; C:\Windows\system32\DRIVERS\jswpslwf.sys [2008-04-28 20384]
R1 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys [2009-03-25 214024]
R1 MPFP;MPFP; C:\Windows\System32\Drivers\Mpfp.sys [2008-10-23 130424]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-10-17 8704]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-07-29 919552]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-04-08 3548672]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2008-03-04 188416]
R3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2008-03-25 980992]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2008-03-25 207872]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2009-03-25 79880]
R3 mfebopk;McAfee Inc. mfebopk; C:\Windows\system32\drivers\mfebopk.sys [2009-03-25 35272]
R3 mfesmfk;McAfee Inc. mfesmfk; C:\Windows\system32\drivers\mfesmfk.sys [2009-03-25 40552]
R3 O2MDRDR;O2MDRDR; C:\Windows\system32\DRIVERS\o2media.sys [2008-04-15 51160]
R3 QIOMem;Generic IO & Memory Access; C:\Windows\system32\DRIVERS\QIOMem.sys [2007-04-09 8192]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-11-29 196144]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 16128]
R3 usbvideo;Chicony USB 2.0 Camera; C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]
R3 UVCFTR;UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [2007-12-17 18432]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-03-25 661504]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2009-03-27 311808]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-02-06 55280]
S3 mferkdk;McAfee Inc. mferkdk; C:\Windows\system32\drivers\mferkdk.sys [2009-03-25 34216]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 Tosrfcom;Tosrfcom; C:\Windows\system32\drivers\Tosrfcom.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-04-07 667648]
R2 ConfigFree Service;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-04-17 40960]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2009-01-23 203280]
R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2009-01-08 797864]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2009-01-09 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-01-09 359952]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-03-25 144704]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2009-03-19 884360]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\McAfee\MSK\MskSrver.exe [2009-01-09 26640]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-08-29 935208]
R2 O&O Defrag;O&O Defrag; C:\Windows\system32\oodag.exe [2009-02-25 1352960]
R2 o2flash;O2Micro Flash Memory Card Service; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [2007-02-12 65536]
R2 ProtexisLicensing;ProtexisLicensing; C:\Windows\system32\PSIService.exe [2006-11-02 174656]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO); C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [2009-04-21 116104]
R2 TNaviSrv;TOSHIBA Navi Support Service; C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [2008-06-05 83312]
R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\Windows\system32\TODDSrv.exe [2007-11-21 129632]
R2 TosCoSrv;TOSHIBA Power Saver; C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe [2008-01-17 431456]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-04-14 604416]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2006-08-23 49152]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-10-17 386560]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2009-03-24 606736]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv; C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728]
S2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe []
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-27 34312]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
S3 fsssvc;Windows Live Family Safety; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-07-18 29744]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-22 137200]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 jswpsapi;Jumpstart Wifi Protected Setup; C:\Program Files\Jumpstart\jswpsapi.exe [2008-04-16 954368]
S3 MBackMonitor;MBackMonitor; C:\Program Files\McAfee\MBK\MBackMonitor.exe [2009-01-09 68112]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-04-01 365072]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-04-14 360704]

-----------------EOF-----------------