HJT LOG nach Smitfraud

exds · 09.11.2009, 14:39

Hi

Hatte vor kurzen Smitfraud aufm Rechner.
Hab ihn dann mit dem smitfraudfix und diversen Antivirus Progs entfernt.
Denke ich jedenfalls.
Hab jetzt mal ein hjt log erstellt und würde mich freuen wenn den jemand auswerten würde.
Will 100% sicher gehen

edit :ups sorry lade die anderen programme auch noch und mach dann nochmal log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:25:15, on 09.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20661)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\WINXP\RTHDCPL.EXE
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\Logitech\G-series Software\LGDCore.exe
C:\Programme\Logitech\G-series Software\LCDMon.exe
C:\WINXP\system32\ctfmon.exe
C:\Programme\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Programme\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Programme\Logitech\G-series Software\Applets\LCDClock.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programme\MagicTune Premium\GammaTray.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\MagicTune Premium\MagicTuneEngine.exe
C:\WINXP\system32\wbem\wmiapsrv.exe
C:\WINXP\system32\wscntfy.exe
C:\WINXP\System32\svchost.exe
C:\Programme\MagicTune Premium\MagicTune.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINXP\system32\taskmgr.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Programme\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Programme\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVP] "E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: GammaTray.lnk = ?
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O20 - AppInit_DLLs: E:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Programme\MagicTune Premium\MagicTuneEngine.exe

--
End of file - 6758 bytes

exds · 09.11.2009, 16:12

installationsliste

Code:

ATTFilter

HijackThis 2.0.2
Intel(R) Network Connections 14.3.0.0
Java(TM) 6 Update 14
JDownloader
Kaspersky Anti-Virus 2010
Killing Floor
Left 4 Dead
Left 4 Dead 2 Demo
Logitech G-series Keyboard Software
MagicTune Premium
Malwarebytes' Anti-Malware
Mass Effect
Men of War (Remove Only)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 SP1
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Home and Student 2007-Testversion
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.5.5)
MSXML 6.0 Parser (KB933579)
Mumble and Murmur
NVIDIA PhysX
Octoshape Streaming Services
Panda ActiveScan 2.0
Patch 1.16.4 for "Men of War"
Plants Vs Zombies
Portal
Realtek High Definition Audio Driver
Risen
Rockstar Games Social Club
Source SDK Base - Orange Box
Spybot - Search & Destroy
Steam
Team Fortress 2
Torchlight
Unreal Tournament 3 (LG)
Ventrilo Client
VLC media player 1.0.1
Warhammer 40,000: Dawn of War II
Windows Media Format 11 runtime
Windows XP Service Pack 3
WinRAR
xp-AntiSpy 3.97-3
Zombie Panic! Source

Malwarebytes

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.41
Datenbank Version: 3133
Windows 5.1.2600 Service Pack 3

09.11.2009 16:05:22
mbam-log-2009-11-09 (16-05-22).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|)
Durchsuchte Objekte: 220904
Laufzeit: 29 minute(s), 7 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

RSIT

Code:

ATTFilter

Source Name: ATI Smart
Time Written: 20090927164106.000000+120
Event Type: Informationen
User: 

Computer Name: MR-PC
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 336
Source Name: SecurityCenter
Time Written: 20090927150117.000000+120
Event Type: Informationen
User: 

Computer Name: MR-PC
Event Code: 105
Message: The service was started.

Record Number: 335
Source Name: ATI Smart
Time Written: 20090927150112.000000+120
Event Type: Informationen
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\ATI Technologies\ATI.ACE\Core-Static;C:\Programme\Intel\DMIX;C:\Programme\Gemeinsame Dateien\DivX Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel
"PROCESSOR_REVISION"=0f0b
"NUMBER_OF_PROCESSORS"=4
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"RGSCLauncher"=E:\Programme\Rockstar Games\Rockstar Games Social Club
"RGSC"=E:\Programme\Rockstar Games\Rockstar Games Social Club\1_0_0_0

-----------------EOF-----------------

exds · 09.11.2009, 16:13

RSIT 2

Code:

ATTFilter

C:\WINXP\system32\wscntfy.exe
C:\WINXP\System32\svchost.exe
C:\Programme\MagicTune Premium\MagicTune.exe
C:\Programme\Mozilla Firefox\firefox.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Dokumente und Einstellungen\Meiko\Eigene Dateien\Downloads\RSIT.exe
C:\WINXP\system32\NOTEPAD.EXE
C:\WINXP\system32\NOTEPAD.EXE
C:\WINXP\system32\wbem\wmiprvse.exe
E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Programme\Trend Micro\HijackThis\Meiko.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Programme\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Programme\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVP] "E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: GammaTray.lnk = ?
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O20 - AppInit_DLLs: E:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Programme\MagicTune Premium\MagicTuneEngine.exe

--
End of file - 7225 bytes

======Scheduled tasks folder======

C:\WINXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\WINXP\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll [2009-10-20 68112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]
EWPBrowseObject Class - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-09-11 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll [2009-10-20 268816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-09-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Programme\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINXP\RTHDCPL.EXE [2007-08-20 16384512]
"Alcmtr"=C:\WINXP\ALCMTR.EXE [2005-05-03 69632]
"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-09-11 148888]
""= []
"Launch LGDCore"=C:\Programme\Logitech\G-series Software\LGDCore.exe [2006-03-06 1122304]
"Launch LCDMon"=C:\Programme\Logitech\G-series Software\LCDMon.exe [2006-03-06 497152]
"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-08-13 98304]
"MSConfig"=C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-14 172544]
"AVP"=E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-10-20 340456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-09-10 420176]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINXP\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [2009-01-08 70936]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD9LanguageShortcut]
C:\Programme\CyberLink\PowerDVD9\Language\Language.exe [2008-10-13 50472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl9]
C:\Programme\CyberLink\PowerDVD9\PDVD9Serv.exe [2009-02-16 87336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
E:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe [2009-09-21 306088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
e:\programme\steam\steam.exe [2009-10-24 1217808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrB"=2
"PnkBstrA"=2

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
GammaTray.lnk - C:\Programme\MagicTune Premium\GammaTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="E:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINXP\system32\Ati2evxx.dll [2009-08-14 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINXP\system32\klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINXP\system32\WgaLogon.dll [2007-10-16 3584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINXP\system32\WPDShServiceObj.dll [2007-10-09 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\MagicTune Premium\MagicTune.exe"="C:\Programme\MagicTune Premium\MagicTune.exe:*:Enabled:MagicTune"
"E:\Programme\THQ\Company of Heroes\RelicCOH.exe"="E:\Programme\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:Company of Heroes.lnk"
"E:\Programme\THQ\Company of Heroes\RelicDownloader\RelicDownloader.exe"="E:\Programme\THQ\Company of Heroes\RelicDownloader\RelicDownloader.exe:*:Enabled:Relic Downloader"
"E:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="E:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"E:\Programme\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="E:\Programme\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV"
"E:\Programme\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe"="E:\Programme\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe:*:Enabled:Batman: Arkham Asylum"
"E:\Programme\Steam\steamapps\common\mass effect\Binaries\MassEffect.exe"="E:\Programme\Steam\steamapps\common\mass effect\Binaries\MassEffect.exe:*:Enabled:Mass Effect"
"E:\Programme\THQ\Company of Heros\RelicCOH.exe"="E:\Programme\THQ\Company of Heros\RelicCOH.exe:*:Enabled:Company of Heroes"
"E:\Programme\THQ\Company of Heros\RelicDownloader\RelicDownloader.exe"="E:\Programme\THQ\Company of Heros\RelicDownloader\RelicDownloader.exe:*:Enabled:Relic Downloader"
"E:\Programme\Unreal Tournament 3 (LG)\Binaries\UT3.exe"="E:\Programme\Unreal Tournament 3 (LG)\Binaries\UT3.exe:*:Enabled:Unreal Tournament 3"
"E:\Programme\Steam\steamapps\common\killingfloor\System\KillingFloor.exe"="E:\Programme\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:*:Enabled:Killing Floor"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2009-11-09 16:05:48 ----D---- C:\rsit
2009-11-09 15:35:15 ----D---- C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\Malwarebytes
2009-11-09 15:35:09 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-11-09 15:35:00 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-11-09 13:59:27 ----D---- C:\Programme\Trend Micro
2009-11-09 13:26:09 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2009-11-09 13:25:12 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files
2009-11-09 13:23:30 ----D---- C:\WINXP\pss
2009-11-09 13:10:06 ----D---- C:\WINXP\LastGood
2009-11-08 20:40:52 ----A---- C:\WINXP\SchedLgU.Txt
2009-11-08 20:30:59 ----A---- C:\WINXP\system32\tmp.txt
2009-11-08 20:30:58 ----A---- C:\rapport.txt
2009-11-08 20:27:50 ----D---- C:\WINXP\system32\LogFiles
2009-11-08 20:20:16 ----D---- C:\Programme\Panda Security
2009-11-08 20:04:49 ----A---- C:\WINXP\wininit.ini
2009-11-08 19:53:14 ----D---- C:\Programme\Spybot - Search & Destroy
2009-11-08 19:53:14 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-11-08 18:42:01 ----D---- C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\runic games
2009-11-08 18:36:21 ----D---- C:\Programme\Runic Games
2009-10-30 00:53:06 ----D---- C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\InstallShield Installation Information
2009-10-30 00:40:43 ----D---- C:\WINXP\45235788142C44BE8A4DDDE9A84492E5.TMP
2009-10-20 19:34:56 ----A---- C:\WINXP\system32\klogon.dll
2009-10-20 17:35:29 ----D---- C:\Programme\Gemeinsame Dateien\BioWare
2009-10-20 00:57:02 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2009-10-20 00:56:11 ----D---- C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\CyberLink
2009-10-20 00:55:42 ----D---- C:\Programme\Gemeinsame Dateien\CyberLink
2009-10-20 00:55:09 ----D---- C:\Programme\CyberLink
2009-10-20 00:54:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp
2009-10-20 00:33:59 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVS4YOU
2009-10-20 00:33:46 ----D---- C:\Programme\Gemeinsame Dateien\AVSMedia
2009-10-20 00:33:46 ----A---- C:\WINXP\system32\xvidvfw.dll
2009-10-20 00:33:46 ----A---- C:\WINXP\system32\xvidcore.dll
2009-10-20 00:33:46 ----A---- C:\WINXP\system32\msxml3a.dll
2009-10-20 00:33:46 ----A---- C:\WINXP\system32\mpg4c32.dll
2009-10-20 00:33:46 ----A---- C:\WINXP\system32\mcdvd_32.dll
2009-10-20 00:33:45 ----D---- C:\Programme\AVS4YOU
2009-10-20 00:33:45 ----A---- C:\WINXP\system32\msvcr70.dll
2009-10-20 00:33:45 ----A---- C:\WINXP\system32\msvcp70.dll
2009-10-20 00:33:45 ----A---- C:\WINXP\system32\mfc70.dll
2009-10-20 00:33:45 ----A---- C:\WINXP\system32\GdiPlus.dll
2009-10-10 23:57:17 ----A---- C:\WINXP\kaillera.ini
2009-10-10 12:20:22 ----D---- C:\WINXP\1C4551A64743409391E41477CD655043.TMP

======List of files/folders modified in the last 1 months======

2009-11-09 16:05:59 ----D---- C:\WINXP\Prefetch
2009-11-09 16:05:55 ----D---- C:\WINXP\Temp
2009-11-09 15:35:10 ----D---- C:\WINXP\system32\drivers
2009-11-09 15:35:00 ----RD---- C:\Programme
2009-11-09 13:30:39 ----SHD---- C:\System Volume Information
2009-11-09 13:27:03 ----SHD---- C:\WINXP\Installer
2009-11-09 13:26:42 ----HD---- C:\WINXP\inf
2009-11-09 13:26:33 ----D---- C:\WINXP\system32
2009-11-09 13:25:07 ----SH---- C:\boot.ini
2009-11-09 13:25:07 ----A---- C:\WINXP\win.ini
2009-11-09 13:25:07 ----A---- C:\WINXP\system.ini
2009-11-09 13:23:30 ----D---- C:\WINXP
2009-11-09 13:10:06 ----D---- C:\WINXP\system32\CatRoot2
2009-11-09 13:09:07 ----D---- C:\Programme\Mozilla Firefox
2009-11-08 20:00:09 ----SD---- C:\WINXP\Tasks
2009-11-08 18:36:20 ----D---- C:\WINXP\WinSxS
2009-11-04 22:45:33 ----D---- C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\vlc
2009-11-03 03:30:15 ----D---- C:\Dokumente und Einstellungen\Meiko\Anwendungsdaten\dvdcss
2009-10-30 00:40:51 ----D---- C:\WINXP\system32\DirectX
2009-10-30 00:40:41 ----D---- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2009-10-27 20:59:02 ----D---- C:\Programme\Canon
2009-10-26 16:29:09 ----A---- C:\WINXP\system32\PerfStringBackup.INI
2009-10-20 17:35:29 ----D---- C:\Programme\Gemeinsame Dateien
2009-10-20 17:25:54 ----RSD---- C:\WINXP\assembly
2009-10-20 00:55:41 ----HD---- C:\Programme\InstallShield Installation Information
2009-10-20 00:54:17 ----A---- C:\WINXP\system32\msvcr71.dll
2009-10-20 00:54:17 ----A---- C:\WINXP\system32\msvcp71.dll
2009-10-20 00:33:49 ----RSD---- C:\WINXP\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel-Prozessortreiber; C:\WINXP\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINXP\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 kl1;Kl1; \??\C:\WINXP\system32\drivers\kl1.sys []
R1 KLIF;Kaspersky Lab Driver; C:\WINXP\system32\DRIVERS\klif.sys [2009-11-09 315408]
R2 atksgt;atksgt; C:\WINXP\system32\DRIVERS\atksgt.sys [2009-09-11 281760]
R2 lirsgt;lirsgt; C:\WINXP\system32\DRIVERS\lirsgt.sys [2009-09-11 25888]
R3 ati2mtag;ati2mtag; C:\WINXP\system32\DRIVERS\ati2mtag.sys [2009-08-14 4485632]
R3 ESLvnic1;ESLvnic Virtual Network 32 Bit; C:\WINXP\system32\DRIVERS\ESLvnic.sys [2009-09-01 23512]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINXP\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINXP\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINXP\system32\drivers\RtkHDAud.sys [2007-08-28 4609024]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINXP\system32\DRIVERS\klim5.sys [2009-09-14 32272]
R3 MagicTune;MagicTune; C:\WINXP\system32\drivers\MTiCtwl.sys [2008-10-24 13184]
R3 mouhid;Maus-HID-Treiber; C:\WINXP\system32\DRIVERS\mouhid.sys [2007-10-09 12288]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINXP\system32\DRIVERS\Rtenicxp.sys [2007-04-14 94592]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINXP\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINXP\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINXP\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINXP\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 ALSysIO;ALSysIO; \??\C:\DOKUME~1\Meiko\LOKALE~1\Temp\ALSysIO.sys []
S3 E1000;Intel(R) PRO/1000 Network Connection Driver; C:\WINXP\system32\DRIVERS\e1000325.sys [2008-08-20 171152]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINXP\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 NAL;Nal Service ; \??\C:\WINXP\system32\Drivers\iqvw32.sys []
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\D:\NTGLM7X.sys []
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINXP\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINXP\system32\DRIVERS\WudfPf.sys [2007-10-09 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINXP\system32\DRIVERS\wudfrd.sys [2007-10-09 82944]
S4 IntelIde;IntelIde; C:\WINXP\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINXP\system32\Ati2evxx.exe [2009-08-14 602112]
R2 AVP;Kaspersky Anti-Virus; E:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-10-20 340456]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-09-11 152984]
R2 MagicTuneEngine;MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [2007-08-23 45056]
S2 ATI Smart;ATI Smart; C:\WINXP\system32\ati2sgag.exe [2009-08-13 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINXP\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 PnkBstrA;PnkBstrA; C:\WINXP\system32\PnkBstrA.exe [2009-09-16 66872]
S4 PnkBstrB;PnkBstrB; C:\WINXP\system32\PnkBstrB.exe [2009-09-16 103736]

-----------------EOF-----------------

so hoffe das reicht

HJT LOG nach Smitfraud

Log-Analyse und Auswertung: HJT LOG nach Smitfraud