hallo,

seit ein paar tagen kommt immer wieder bei mir die site online555casino.com. Seit dem Zeitpunkt kann ich einige Programme wie Spybot, Kantaris nicht mehr öffnen.
Ich hab mal HiJack drüber laufen lassen wäre super wenn mir jemand mit dem Problem helfen könnte.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:37, on 25.08.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe
C:\Programme\Silvercrest MTS2218 driver\KMConfig.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Silvercrest MTS2218 driver\KMProcess.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Firebird\FIREBI~1\bin\fbguard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Silvercrest MTS2218 driver\KMWDSrv.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\Programme\iPod\bin\iPodService.exe
C:\PROGRA~1\Firebird\FIREBI~1\bin\fbserver.exe
C:\Programme\PokerStars\PokerStars.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Andy\Desktop\HJTInstall.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\Andy\LOKALE~1\Temp\Rar$EX00.937\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: XML Class - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {A9C00446-CA14-4EF3-AACB-723AE6634D61} - (no file)
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\RealMedia\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KMCONFIG] C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ISUSPM] "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Monopod] C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-1085031214-1563985344-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

Hi,

das HJ-Log ist nicht vollständig, allerdings haben wir hier schon was nettes kleines:
O4 - HKCU\..\Run: [Monopod] C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe


Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

• Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

• Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe
         

• Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

• Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

• Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Also:
Anleitung Avenger (by swandog46)

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:



2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist.

Kopiere nun folgenden Text in das weiße Feld:
(bei -> "input script here")

Files to delete:
C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe

Folders to delete:
C:\DOKUME~1\Andy\LOKALE~1\Temp
         

3.) Schliesse nun alle Programme (vorher notfalls abspeichern!) und Browser-Fenster, nach dem Ausführen des Avengers wird das System neu gestartet.

4.) Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet!

5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt
Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

Hijackthis, fixen:
öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten
Beim fixen müssen alle Programme geschlossen sein!

O4 - HKCU\..\Run: [Monopod] C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe
         

Erweitertes Vorgehen:

Malwarebytes Antimalware (MAM).
Anleitung&Download hier: http://www.trojaner-board.de/51187-malwarebytes-anti-malware.html
Fullscan und alles bereinigen lassen! Log posten.

RSIT
Random's System Information Tool (RSIT) von random/random liest Systemdetails aus und erstellt ein aussagekräftiges Logfile.
* Lade Random's System Information Tool (RSIT) herunter http://filepony.de/download-rsit/
* speichere es auf Deinem Desktop.
* Starte mit Doppelklick die RSIT.exe.
* Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
* Wenn Du HijackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren.
* In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept".
* Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen.
* Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
* Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
* Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread.

Gmer:
http://www.trojaner-board.de/74908-anleitung-gmer-rootkit-scanner.html
Den Downloadlink findest Du links oben (www.gmer.net/files), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein.

Chris

hier ist das ergebnis von virustotal

a-squared 4.5.0.24 2009.08.26 -
AhnLab-V3 5.0.0.2 2009.08.25 Win-Trojan/Downloader.143360.AA
AntiVir 7.9.1.3 2009.08.26 TR/Fakealert.143360
Antiy-AVL 2.0.3.7 2009.08.24 -
Authentium 5.1.2.4 2009.08.26 W32/FakeAlert.BY.gen!Eldorado
Avast 4.8.1335.0 2009.08.26 Win32:Trojan-gen {Other}
AVG 8.5.0.406 2009.08.25 Downloader.Small.GHM
BitDefender 7.2 2009.08.26 -
CAT-QuickHeal 10.00 2009.08.25 -
ClamAV 0.94.1 2009.08.26 -
Comodo 2102 2009.08.26 -
DrWeb 5.0.0.12182 2009.08.26 Trojan.DownLoad.44784
eSafe 7.0.17.0 2009.08.26 Suspicious File
eTrust-Vet 31.6.6702 2009.08.26 -
F-Prot 4.5.1.85 2009.08.25 W32/FakeAlert.BY.gen!Eldorado
F-Secure 8.0.14470.0 2009.08.26 Trojan-Downloader:W32/Renos.gen!C
Fortinet 3.120.0.0 2009.08.26 PossibleThreat
GData 19 2009.08.26 Win32:Trojan-gen {Other}
Ikarus T3.1.1.68.0 2009.08.26 -
Jiangmin 11.0.800 2009.08.26 Rootkit.Agent.czw
K7AntiVirus 7.10.827 2009.08.25 -
Kaspersky 7.0.0.125 2009.08.26 Packed.Win32.Katusha.e
McAfee 5720 2009.08.25 -
McAfee+Artemis 5720 2009.08.25 Artemis!772136A6EFB8
McAfee-GW-Edition 6.8.5 2009.08.26 Heuristic.LooksLike.Trojan.Fakealert.H
Microsoft 1.4903 2009.08.26 TrojanDownloader:Win32/Renos.JI
NOD32 4369 2009.08.26 Win32/TrojanDownloader.FakeAlert.AHC
Norman 2009.08.26 W32/Renos.VTS
nProtect 2009.1.8.0 2009.08.26 -
Panda 10.0.2.2 2009.08.26 Trj/CI.A
PCTools 4.4.2.0 2009.08.26 -
Prevx 3.0 2009.08.26 Medium Risk Malware
Rising 21.44.11.00 2009.08.25 Packer.Win32.LoveLHM.a [Suspicious]
Sophos 4.44.0 2009.08.26 Mal/EncPk-JD
Sunbelt 3.2.1858.2 2009.08.25 -
Symantec 1.4.4.12 2009.08.26 -
TheHacker 6.3.4.3.388 2009.08.25 -
TrendMicro 8.950.0.1094 2009.08.26 -
VBA32 3.12.10.10 2009.08.26 -
ViRobot 2009.8.26.1903 2009.08.26 -
VirusBuster 4.6.5.0 2009.08.26 -
weitere Informationen
File size: 143360 bytes
MD5...: 772136a6efb8c8e9e4d70aa429a9b014
SHA1..: bbb59e235ac950ec1052ad13a049c7b12b52b7f7
SHA256: 7099d3b79f5d18a49691496d24b5b58d755eb288dea37105b8118f0152a828c1
ssdeep: 3072:Vb8muGxzFwWI9vtbo3TzcfrCx83T/Tf+sLb4/:hhhFwJba4fP/T3b4
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x110a
timedatestamp.....: 0x48103b42 (Thu Apr 24 07:48:18 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2903 0x2a00 5.17 9c1f0d22c15f2605d665141408cb41d4
.rdata 0x4000 0x1a75d 0x1a800 7.31 d5a279a1d0d8705c7242c4d656503425
.edata 0x1f000 0x16d93 0x2a00 0.18 46b2d1ecdd8e92733ff48168af5aa850
.bss 0x36000 0x339 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x37000 0x2265 0x2400 0.11 4310f9f686df90fad49e4efdb1fc1525

( 5 imports )
> KERNEL32.DLL: GetCurrentProcess, GetFileAttributesA, GetOEMCP, FreeLibrary, GetFileSize, ExitProcess, GetCurrentThread, GetModuleFileNameA, lstrcpyA, GetModuleHandleA, GetFileType, HeapFree, lstrcmpA, GetCurrentProcessId, HeapAlloc, WideCharToMultiByte, lstrcpynA, lstrcmpiA
> KERNEL32.DLL: GetConsoleOutputCP, GetOEMCP, GetConsoleOutputCP, lstrcatA, GetConsoleOutputCP, GetCurrentProcess, GetConsoleOutputCP, GlobalAlloc, GetConsoleOutputCP, lstrcpyA, GetConsoleOutputCP, WideCharToMultiByte, GetConsoleOutputCP, GlobalFree, GetConsoleOutputCP, GetFileType, GetConsoleOutputCP, GetFileAttributesA
> KERNEL32.DLL: GetConsoleOutputCP, GetFileSize, GlobalAlloc, GetFileType, lstrcatA, lstrcmpA, HeapFree, lstrcpyA, GetOEMCP, GetLocalTime, ExitProcess, HeapAlloc, GetModuleHandleA, FreeLibrary, lstrcpynA, DeleteFileA, GlobalFree, GetStringTypeA, GetCurrentThreadId
> USER32.DLL: DrawTextW, CalcMenuBar, DialogBoxParamA, AlignRects, GetDlgItem, CopyRect, CopyIcon, CloseWindow, InsertMenuA, DrawTextA, GetWindowTextLengthA, LoadMenuA, AppendMenuW, IsWindow, DrawIconEx, DrawIcon
> USER32.DLL: LoadCursorA, DialogBoxParamA, GetCursor, GetWindowTextA, DialogBoxParamW, GetWindowTextLengthA, EndDialog, AppendMenuA, DrawTextA, IsWindow, IsMenu, CopyRect, GetDlgItem, CopyImage, DrawIcon, GetMenu, CopyIcon, GetDC

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (58.4%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
VXD Driver (0.2%)
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=224D199500B7644130770271A2A6A50026519D32' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=224D199500B7644130770271A2A6A50026519D32</a>

Hi,

Avengerscript und HJ durchführen wie beschrieben...
Danach MAM und RSIT...

chris

hier das ergebnis von avenger

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe" deleted successfully.
Folder "C:\DOKUME~1\Andy\LOKALE~1\Temp" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

kann MAM nicht installieren was nun??

Hi,

versuche es bereits im Downloadidalog umzubenennen...
Wenn das nichts bringt, fahren wir gleich schweres Geschütz auf...
(Die nette Malware verhindert den Start....)

Combofix
(Benenne auch hier gleich im Downloadialog die exe auf test.com um)
Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report angezeigt, den bitte kopieren und in deinem Thread einfuegen.

Danach auf jeden Fall noch RSIT...
Falls auch Combofix nicht laufen sollten, versuche ein Log mit GMER zu erstellen...

chris

hier der erste RSIT Log 1. Teil

Logfile of random's system information tool 1.06 (written by random/random)
Run by Andy at 2009-08-26 16:53:09
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 7 GB (28%) free of 25 GB
Total RAM: 894 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:53:12, on 26.08.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\WLTRAY.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe
C:\Programme\Silvercrest MTS2218 driver\KMConfig.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Silvercrest MTS2218 driver\KMProcess.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Firebird\FIREBI~1\bin\fbguard.exe
C:\Programme\Silvercrest MTS2218 driver\KMWDSrv.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Firebird\FIREBI~1\bin\fbserver.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Dokumente und Einstellungen\Andy\Desktop\RSIT.exe
C:\DOKUME~1\Andy\LOKALE~1\Temp\Rar$EX00.922\Andy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: XML Class - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: (no name) - {A9C00446-CA14-4EF3-AACB-723AE6634D61} - (no file)
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\RealMedia\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KMCONFIG] C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ISUSPM] "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Monopod] C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-1085031214-1563985344-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'andi')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O21 - SSODL: qegbdmwf - {A71B6962-2DE6-4E0B-BAC0-12A43992FB8F} - C:\WINDOWS\qegbdmwf.dll (file missing)
O21 - SSODL: pntqkflv - {B1986BEE-0D6A-481F-AD6F-C9E5754EF6A6} - C:\WINDOWS\pntqkflv.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\PROGRA~1\Firebird\FIREBI~1\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\PROGRA~1\Firebird\FIREBI~1\bin\fbserver.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Programme\Silvercrest MTS2218 driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 10239 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-11-23 370296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4eaf-8143-8C619470B13D}]
XML Class - C:\WINDOWS\system32\msxml71.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Programme\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 184423]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-10-13 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Programme\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]
{A9C00446-CA14-4EF3-AACB-723AE6634D61}
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-10-13 806912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Programme\Java\jre1.5.0_06\bin\jusched.exe [2005-11-10 36975]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY []
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"TkBellExe"=C:\Programme\RealMedia\Update_OB\realsched.exe -osboot []
"KMCONFIG"=C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe [2008-05-30 212992]
"QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2008-11-04 413696]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-14 172544]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-08-03 419088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"=C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe [2007-03-29 222128]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
"Monopod"=C:\DOKUME~1\Andy\LOKALE~1\Temp\1B.tmp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Programme\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3
"gusvc"=2
"gupdate1c9a2f3bd2b3d50"=2

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-06-03 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
qegbdmwf - {A71B6962-2DE6-4E0B-BAC0-12A43992FB8F} - C:\WINDOWS\qegbdmwf.dll []
pntqkflv - {B1986BEE-0D6A-481F-AD6F-C9E5754EF6A6} - C:\WINDOWS\pntqkflv.dll []
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programme\Yahoo!\Messenger\YServer.exe"="C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programme\VideoLAN\VLC\vlc.exe"="C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Programme\Messenger\msmsgs.exe"="C:\Programme\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Programme\SecondLife\SLVoice.exe"="C:\Programme\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"D:\Auswertprogramme\java\jre\bin\javaw.exe"="D:\Auswertprogramme\java\jre\bin\javaw.exe:*:Enabled:javaw"
"D:\Auswertprogramme\java\j2re1.4.2_04\bin\java.exe"="D:\Auswertprogramme\java\j2re1.4.2_04\bin\java.exe:*:Enabled:java"
"D:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe"="D:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Programme\PokerStrategy\PokerStrategy Equilator\Equilator.exe"="C:\Programme\PokerStrategy\PokerStrategy Equilator\Equilator.exe:*:Enabled:PokerStrategy Equilator"
"C:\Programme\Zattoo\zattood.exe"="C:\Programme\Zattoo\zattood.exe:*:Enabled:zattood"
"C:\Programme\Zattoo\Zattoo2.exe"="C:\Programme\Zattoo\Zattoo2.exe:*:Enabled: "
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Programme\PokerStrategy\PokerStrategy Elephant\PokerStrategy Elephant.exe"="C:\Programme\PokerStrategy\PokerStrategy Elephant\PokerStrategy Elephant.exe:*:Enabled:PokerStrategy Elephant"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Programme\Electronic Arts\EADM\Core.exe"="C:\Programme\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Programme\Java\jre1.5.0_06\launch4j-tmp\JD-WinLauncher.exe"="C:\Programme\Java\jre1.5.0_06\launch4j-tmp\JD-WinLauncher.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

======List of files/folders created in the last 1 months======

2009-08-26 16:53:09 ----D---- C:\rsit
2009-08-26 16:46:48 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-08-26 16:46:48 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-08-26 16:33:14 ----D---- C:\Avenger
2009-08-26 16:33:14 ----A---- C:\avenger.txt
2009-08-26 16:32:03 ----A---- C:\zip.exe
2009-08-26 16:32:03 ----A---- C:\cleanup.exe
2009-08-26 16:32:03 ----A---- C:\cleanup.bat
2009-08-26 12:37:17 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-24 20:59:51 ----D---- C:\WINDOWS\pss
2009-08-24 20:53:05 ----A---- C:\WINDOWS\_MSRSTRT.EXE
2009-08-24 08:12:30 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-08-22 11:35:00 ----D---- C:\WINDOWS\system32\XPSViewer
2009-08-22 11:34:51 ----D---- C:\Programme\MSBuild
2009-08-22 11:34:48 ----D---- C:\WINDOWS\system32\en-US
2009-08-22 11:34:30 ----D---- C:\Programme\Reference Assemblies
2009-08-22 11:33:46 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-08-22 11:33:46 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-08-22 11:33:45 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-08-22 00:25:36 ----D---- C:\Programme\Spybot - Search & Destroy
2009-08-22 00:25:36 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-08-13 10:02:04 ----D---- C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\BSplayer Pro
2009-08-13 10:02:03 ----D---- C:\Programme\Webteh
2009-08-13 09:58:18 ----D---- C:\Programme\SMPlayer
2009-08-13 09:53:19 ----D---- C:\Programme\Kantaris
2009-08-13 08:23:09 ----D---- C:\Programme\OpenSource DTSAC3DD+ Source Filter
2009-08-13 08:23:07 ----D---- C:\Programme\MONOGRAM AMR SplitterDecoder
2009-08-13 08:23:02 ----D---- C:\Programme\CD Audio Reader Filter
2009-08-13 08:22:59 ----D---- C:\Programme\DScaler5
2009-08-13 08:22:43 ----D---- C:\Programme\OpenSource Flash Video Splitter
2009-08-13 08:22:25 ----D---- C:\Programme\RealMedia
2009-08-13 08:21:39 ----D---- C:\Programme\SHOUTcast Source
2009-08-13 08:21:33 ----D---- C:\Programme\Haali
2009-08-13 08:21:22 ----D---- C:\Programme\DSP-worx
2009-08-13 08:20:31 ----D---- C:\Programme\DirectVobSub
2009-08-13 08:19:54 ----D---- C:\Programme\Zoom Player
2009-08-13 07:54:39 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-08-13 07:54:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-08-13 07:54:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-08-13 07:54:17 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-08-13 07:54:10 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-08-13 07:54:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-08-13 07:53:53 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-08-13 07:53:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-08-13 07:51:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-08-13 07:51:18 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-08-12 08:20:54 ----HD---- C:\Downloads
2009-08-12 00:38:45 ----D---- C:\Programme\Mach5 Software
2009-08-03 15:47:35 ----D---- C:\Programme\HDI-Gerling
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\px.dll
2009-08-03 14:38:45 ----D---- C:\Programme\Winamp

hier nochmal der RSIT Log und nun???

Logfile of random's system information tool 1.06 (written by random/random)
Run by Andy at 2009-08-26 17:33:45
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 7 GB (29%) free of 25 GB
Total RAM: 894 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:33:52, on 26.08.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Firebird\FIREBI~1\bin\fbguard.exe
C:\Programme\Silvercrest MTS2218 driver\KMWDSrv.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\o2flash.exe
C:\Programme\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Firebird\FIREBI~1\bin\fbserver.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Andy\Desktop\RSIT.exe
C:\Programme\trend micro\Andy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1750559
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KMCONFIG] C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ISUSPM] "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-1085031214-1563985344-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'andi')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\PROGRA~1\Firebird\FIREBI~1\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\PROGRA~1\Firebird\FIREBI~1\bin\fbserver.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Programme\Silvercrest MTS2218 driver\KMWDSrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 8709 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-11-23 370296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Programme\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 184423]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]
PDFCreator Toolbar Helper - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-10-13 806912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Programme\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-10-13 806912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Programme\Java\jre1.5.0_06\bin\jusched.exe [2005-11-10 36975]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
"Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY []
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]
"KMCONFIG"=C:\Programme\Silvercrest MTS2218 driver\StartAutorun.exe [2008-05-30 212992]
"QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2008-11-04 413696]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-14 172544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"=C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe [2007-03-29 222128]
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Programme\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3
"gusvc"=2
"gupdate1c9a2f3bd2b3d50"=2

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-06-03 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programme\Yahoo!\Messenger\YServer.exe"="C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Programme\VideoLAN\VLC\vlc.exe"="C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Programme\Messenger\msmsgs.exe"="C:\Programme\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Programme\SecondLife\SLVoice.exe"="C:\Programme\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"D:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe"="D:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Programme\PokerStrategy\PokerStrategy Equilator\Equilator.exe"="C:\Programme\PokerStrategy\PokerStrategy Equilator\Equilator.exe:*:Enabled:PokerStrategy Equilator"
"C:\Programme\Zattoo\zattood.exe"="C:\Programme\Zattoo\zattood.exe:*:Enabled:zattood"
"C:\Programme\Zattoo\Zattoo2.exe"="C:\Programme\Zattoo\Zattoo2.exe:*:Enabled: "
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Programme\PokerStrategy\PokerStrategy Elephant\PokerStrategy Elephant.exe"="C:\Programme\PokerStrategy\PokerStrategy Elephant\PokerStrategy Elephant.exe:*:Enabled:PokerStrategy Elephant"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Programme\Java\jre1.5.0_06\launch4j-tmp\JD-WinLauncher.exe"="C:\Programme\Java\jre1.5.0_06\launch4j-tmp\JD-WinLauncher.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

======List of files/folders created in the last 1 months======

2009-08-26 17:33:45 ----D---- C:\Programme\trend micro
2009-08-26 17:30:42 ----A---- C:\ComboFix.txt
2009-08-26 17:12:44 ----A---- C:\Boot.bak
2009-08-26 17:12:35 ----RASHD---- C:\cmdcons
2009-08-26 17:10:03 ----A---- C:\WINDOWS\zip.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\SWSC.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\SWREG.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\sed.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\PEV.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\NIRCMD.exe
2009-08-26 17:10:03 ----A---- C:\WINDOWS\grep.exe
2009-08-26 17:09:49 ----D---- C:\WINDOWS\ERDNT
2009-08-26 17:09:48 ----SD---- C:\test.com
2009-08-26 17:08:48 ----D---- C:\Qoobox
2009-08-26 16:53:09 ----D---- C:\rsit
2009-08-26 16:46:48 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-08-26 16:46:48 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-08-26 16:33:14 ----D---- C:\Avenger
2009-08-26 16:33:14 ----A---- C:\avenger.txt
2009-08-26 16:32:03 ----A---- C:\zip.exe
2009-08-26 16:32:03 ----A---- C:\cleanup.bat
2009-08-26 12:37:17 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-24 20:59:51 ----D---- C:\WINDOWS\pss
2009-08-24 20:53:05 ----A---- C:\WINDOWS\_MSRSTRT.EXE
2009-08-24 08:12:30 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-08-22 11:35:00 ----D---- C:\WINDOWS\system32\XPSViewer
2009-08-22 11:34:51 ----D---- C:\Programme\MSBuild
2009-08-22 11:34:48 ----D---- C:\WINDOWS\system32\en-US
2009-08-22 11:34:30 ----D---- C:\Programme\Reference Assemblies
2009-08-22 11:33:46 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-08-22 11:33:46 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-08-22 11:33:45 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-08-22 00:25:36 ----D---- C:\Programme\Spybot - Search & Destroy
2009-08-22 00:25:36 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-08-13 10:02:04 ----D---- C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\BSplayer Pro
2009-08-13 10:02:03 ----D---- C:\Programme\Webteh
2009-08-13 09:58:18 ----D---- C:\Programme\SMPlayer
2009-08-13 09:53:19 ----D---- C:\Programme\Kantaris
2009-08-13 08:23:09 ----D---- C:\Programme\OpenSource DTSAC3DD+ Source Filter
2009-08-13 08:23:07 ----D---- C:\Programme\MONOGRAM AMR SplitterDecoder
2009-08-13 08:23:02 ----D---- C:\Programme\CD Audio Reader Filter
2009-08-13 08:22:59 ----D---- C:\Programme\DScaler5
2009-08-13 08:22:43 ----D---- C:\Programme\OpenSource Flash Video Splitter
2009-08-13 08:22:25 ----D---- C:\Programme\RealMedia
2009-08-13 08:21:39 ----D---- C:\Programme\SHOUTcast Source
2009-08-13 08:21:33 ----D---- C:\Programme\Haali
2009-08-13 08:21:22 ----D---- C:\Programme\DSP-worx
2009-08-13 08:20:31 ----D---- C:\Programme\DirectVobSub
2009-08-13 08:19:54 ----D---- C:\Programme\Zoom Player
2009-08-13 07:54:39 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-08-13 07:54:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-08-13 07:54:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-08-13 07:54:17 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-08-13 07:54:10 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-08-13 07:54:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-08-13 07:53:53 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-08-13 07:53:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-08-13 07:51:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-08-13 07:51:18 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-08-12 08:20:54 ----HD---- C:\Downloads
2009-08-12 00:38:45 ----D---- C:\Programme\Mach5 Software
2009-08-03 15:47:35 ----D---- C:\Programme\HDI-Gerling
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-08-03 14:38:50 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-08-03 14:38:49 ----N---- C:\WINDOWS\system32\px.dll
2009-08-03 14:38:45 ----D---- C:\Programme\Winamp

======List of files/folders modified in the last 1 months======

2009-08-26 17:33:45 ----RD---- C:\Programme
2009-08-26 17:31:16 ----D---- C:\WINDOWS\Prefetch
2009-08-26 17:31:05 ----D---- C:\Programme\Mozilla Firefox
2009-08-26 17:31:01 ----D---- C:\WINDOWS\Temp
2009-08-26 17:30:46 ----D---- C:\WINDOWS\system32
2009-08-26 17:29:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-08-26 17:28:18 ----D---- C:\WINDOWS
2009-08-26 17:28:18 ----A---- C:\WINDOWS\system.ini
2009-08-26 17:25:32 ----D---- C:\WINDOWS\system32\drivers
2009-08-26 17:25:32 ----D---- C:\WINDOWS\AppPatch
2009-08-26 17:25:31 ----D---- C:\Programme\Gemeinsame Dateien
2009-08-26 17:20:55 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-26 17:20:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-26 17:20:22 ----SD---- C:\WINDOWS\Tasks
2009-08-26 17:19:57 ----D---- C:\WINDOWS\system32\config
2009-08-26 17:12:45 ----RASH---- C:\boot.ini
2009-08-26 13:22:52 ----D---- C:\Programme\PokerStars
2009-08-26 12:52:04 ----A---- C:\WINDOWS\NeroDigital.ini
2009-08-26 12:37:17 ----HD---- C:\WINDOWS\inf
2009-08-24 21:00:59 ----A---- C:\WINDOWS\win.ini
2009-08-24 20:57:25 ----D---- C:\Programme\jose
2009-08-24 08:13:38 ----A---- C:\WINDOWS\imsins.BAK
2009-08-24 08:13:25 ----D---- C:\WINDOWS\system32\CatRoot
2009-08-23 11:03:49 ----D---- C:\WINDOWS\Microsoft.NET
2009-08-22 11:37:24 ----SHD---- C:\WINDOWS\Installer
2009-08-22 11:36:47 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-22 11:35:02 ----RSD---- C:\WINDOWS\assembly
2009-08-22 11:34:45 ----RSD---- C:\WINDOWS\Fonts
2009-08-22 11:34:00 ----D---- C:\WINDOWS\system32\spool
2009-08-22 11:32:21 ----D---- C:\WINDOWS\WinSxS
2009-08-17 22:44:19 ----D---- C:\Programme\Full Tilt Poker
2009-08-17 19:19:51 ----D---- C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\UseNeXT
2009-08-13 10:48:44 ----D---- C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\vlc
2009-08-13 10:14:03 ----D---- C:\Programme\UseNeXT
2009-08-13 07:54:16 ----HD---- C:\WINDOWS\$hf_mig$
2009-08-13 07:53:56 ----D---- C:\Programme\Outlook Express
2009-08-11 07:50:23 ----D---- C:\WINDOWS\Minidump
2009-08-05 10:59:36 ----N---- C:\WINDOWS\system32\mswebdvd.dll
2009-07-31 03:01:21 ----D---- C:\WINDOWS\system32\de-de
2009-07-31 03:01:20 ----D---- C:\Programme\Internet Explorer
2009-07-31 03:01:03 ----D---- C:\WINDOWS\ie7updates
2009-07-30 02:49:14 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-06-28 17801]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-06-03 3100160]
R3 BCM43XX;Treiber Broadcom 802.11 Netzwerkadapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2004-12-22 369024]
R3 catchme;catchme; \??\C:\DOKUME~1\Andy\LOKALE~1\Temp\catchme.sys []
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
R3 KMWDFilter;KMWDFilter; \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS []
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys [2009-04-25 6144]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2005-09-30 78720]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 CoachUsb;Coach Digital Camera on USB; C:\WINDOWS\system32\DRIVERS\CoachUsb.sys [2004-03-17 46944]
S3 CoachVc;Coach Video Capture; C:\WINDOWS\system32\DRIVERS\CoachVc.sys [2004-03-17 44256]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 rtl8139;NT-Treiber für Realtek RTL8139(A/B/C)-basierten PCI-Fast Ethernet-Adapter; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-14 79232]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys []
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Programme\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-06-03 552960]
R2 avast! Antivirus;avast! Antivirus; C:\Programme\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\PROGRA~1\Firebird\FIREBI~1\bin\fbguard.exe [2004-02-23 65536]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service; C:\Programme\Silvercrest MTS2218 driver\KMWDSrv.exe [2008-05-30 208896]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [2006-12-14 61440]
R2 O2Flash;O2Micro Flash Memory; C:\WINDOWS\system32\o2flash.exe [2005-01-27 36864]
R2 pgsql-8.3;PostgreSQL Database Server 8.3; C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe [2008-02-01 65536]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\wltrysvc.exe [2004-12-22 65536]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Programme\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Programme\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\PROGRA~1\Firebird\FIREBI~1\bin\fbserver.exe [2004-02-23 1515599]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-06-02 593920]
S2 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usnjsvc;Messenger USN Journal Reader-Service für freigegebene Ordner; C:\Programme\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 gupdate1c9a2f3bd2b3d50;Google Update Service (gupdate1c9a2f3bd2b3d50); C:\Programme\Google\Update\GoogleUpdate.exe [2009-03-12 133104]
S4 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2008-11-20 536872]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Hi,

Rookit, bitte sofort das hier löschen:
C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job

Jetzt noch mal MAM starten und laufen lassen, vorher updaten...
Das müsste noch einiges finden...

chris
(Bin nur noch kurz online...)

wie lösch ich das???