TR/Dropper.Gen , TR/Agent.620544.A , EXP/Pidief.GI Befall

bfk

Hallo Liebes Trojaner Board,
Gestern habe ich nach 1 monatiger Internetpause (wegen Umzugs) die neue Antivir version installiert und folgende Viren wurden mir gemeldet:

1) TR/Dropper.Gen' [trojan]
H:\Windows\TEMP\71591e4bdf1d4710f6453bf4e19b119f.exe'
H:\Windows\TEMP\42e9ba0fa5c84bf821cb390a11c45c7d.exe'

2) TR/Agent.620544.A'
C:\System Volume Information\_restore{61E01E4E-B285-468C-A3BB-5DB124C643DE}\RP925\A0196357.exe'

3) EXP/Pidief.GI' [exploit]
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\9s2fwv8h.default\Cache\725BD9D4d01

Bisher vorgenommen:
- Antimalware wie in Anleitung durchgeführt, log siehe unten.
- CClean wie in Anleitung durchgeführt.
- Rsit logs erstellt, siehe unten.

Anti Malware log
Malwarebytes' Anti-Malware 1.43
Datenbank Version: 3470
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

02.01.2010 00:47:12
mbam-log-2010-01-02 (00-47-12).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|H:\|L:\|)
Durchsuchte Objekte: 207045
Laufzeit: 3 hour(s), 7 minute(s), 56 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\drivers\oreans32.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

Rsit logs
log.txt:
Logfile of random's system information tool 1.06 (written by random/random)
Run by *** at 2010-01-02 15:20:00
Microsoft Windows XP Professional Service Pack 2
System drive C: has 4 GB (24%) free of 15 GB
Total RAM: 2047 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:04, on 02.01.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AlienGUIse\wbload.exe
C:\Programme\Gemeinsame Dateien\EPSON\eEBAPI\eEBSVC.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIENE.EXE
C:\Programme\Mozilla Firefox\firefox.exe
c:\programme\antivir personaledition classic\avcenter.exe
C:\WINDOWS\system32\NOTEPAD.EXE
F:\RSIT.exe
C:\Programme\HijackThis\***.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h*tp://ww*.winfuture.de/
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo PX700W(Netzwerk)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIENE.EXE /FU "C:\WINDOWS\TEMP\E_S70.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Programme\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.versatel.de/internet-cd/
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F842074-1356-4D00-96B3-FB3F99654244}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{974ED356-2F9C-48C3-B727-1D24D5B503EC}: NameServer = 192.168.1.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - D:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\eEBAPI\eEBSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6402 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}]
Easy Photo Print - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll [2008-04-02 266240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} - Easy Photo Print - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll [2008-04-02 266240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"=C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe [2003-09-17 57344]
"NWEReboot"= []
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"avgnt"=C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-18 266497]
"HP Software Update"=C:\Programme\HP\HP Software Update\HPWuSchd2.exe [2005-05-11 49152]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-03-09 7561216]
"EEventManager"=C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [2008-05-07 591696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo PX700W(Netzwerk)"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIENE.EXE [2008-04-07 188928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe [2005-09-08 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE [2003-06-18 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
C:\WINDOWS\CTHELPER.EXE [2005-08-29 16384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Programme\iTunes\iTunesHelper.exe [2007-09-14 267064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2006-03-09 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
C:\Programme\Octoshape Streaming Services\***\OctoshapeClient.exe [2006-02-13 214648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe [2007-06-29 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe [2005-08-26 36975]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2005-05-11 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Pml Driver HPZ12"=2
"iPod Service"=3

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Cisco Systems VPN Client.lnk - C:\Programme\Cisco Systems\VPN Client\vpngui.exe

C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart
Adobe Gamma.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="wbsys.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB]
C:\Programme\AlienGUIse\fastload.dll [2001-12-20 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-03 240128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoRecentDocsNetHood"=1
"NoDesktopCleanupWizard"=1
"NoTaskGrouping"=1
"NoAutoTrayNotify"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoTaskGrouping"=
"NoAutoTrayNotify"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\mIRC\mirc.exe"="C:\Programme\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Programme\miranda\miranda32.exe"="C:\Programme\miranda\miranda32.exe:*:Enabled:Miranda IM"
"C:\WINDOWS\System32\dpvsetup.exe"="C:\WINDOWS\System32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\System32\RUNDLL32.EXE"="C:\WINDOWS\System32\RUNDLL32.EXE:*:Enabled:Eine DLL-Datei als Anwendung ausführen"
"H:\***\downloads\win\miranda\miranda32.exe"="H:\***\downloads\win\miranda\miranda32.exe:*:Enabled:Miranda IM"
"D:\q4\Quake4.exe"="D:\q4\Quake4.exe:*:Enabled:Quake 4"
"D:\Steam\SteamApps\undissbar@gmx.de\counter-strike\hl.exe"="D:\Steam\SteamApps\undissbar@gmx.de\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Steam\SteamApps\bufkawillbeta\counter-strike\hl.exe"="D:\Steam\SteamApps\bufkawillbeta\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Steam\SteamApps\bufkawillbeta\counter-strike source\hl2.exe"="D:\Steam\SteamApps\bufkawillbeta\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Programme\HLSW\hlsw.exe"="C:\Programme\HLSW\hlsw.exe:*:Enabled:HLSW"
"D:\mostwanted\speed.exe"="D:\mostwanted\speed.exe:*:Enabled:speed"
"D:\cod\CoD2MP_s.exe"="D:\cod\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Programme\Serv-U\ServUDaemon.exe"="C:\Programme\Serv-U\ServUDaemon.exe:*:Enabled:ServUDaemon"
"C:\Programme\Soulseek\slsk.exe"="C:\Programme\Soulseek\slsk.exe:*:Enabled:SoulSeek"
"D:\Steam\SteamApps\undissbar@gmx.de\deathmatch classic\hl.exe"="D:\Steam\SteamApps\undissbar@gmx.de\deathmatch classic\hl.exe:*:Enabled:Half-Life Launcher"
"D:\kotor\swupdate.exe"="D:\kotor\swupdate.exe:*:Enabled:Star Wars: Knights of the old Republic Update Program"
"D:\Steam\SteamApps\undissbar@gmx.de\half-life\hl.exe"="D:\Steam\SteamApps\undissbar@gmx.de\half-life\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Programme\FlashFXP\flashfxp.exe"="C:\Programme\FlashFXP\flashfxp.exe:*:Enabled:FlashFXP v3"
"D:\TrackMania Nations ESWC\TmNationsESWC.exe"="D:\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\Programme\Mozilla Firefox\FIREFOX.EXE"="C:\Programme\Mozilla Firefox\FIREFOX.EXE:*:Enabled:Firefox"
"C:\Programme\PPLive TV\PPPlayer.exe"="C:\Programme\PPLive TV\PPPlayer.exe:*:Enabled:PPLive TV"
"C:\Programme\Gemeinsame Dateien\Synacast\SynaLive\PE.exe"="C:\Programme\Gemeinsame Dateien\Synacast\SynaLive\PE.exe:*:Enabled:PE"
"F:\Azureus\Azureus.exe"="F:\Azureus\Azureus.exe:*:Enabled:Azureus"
"D:\prey\prey.exe"="D:\prey\prey.exe:*:Enabled:PREY"
"H:\World of Warcraft\WoW-1.11.0-deDE-downloader.exe"="H:\World of Warcraft\WoW-1.11.0-deDE-downloader.exe:*:Enabled:Blizzard Downloader"
"D:\Steam\SteamApps\undissbar@gmx.de\day of defeat source\hl2.exe"="D:\Steam\SteamApps\undissbar@gmx.de\day of defeat source\hl2.exe:*:Enabled:hl2"
"H:\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-deDE-downloader.exe"="H:\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-deDE-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Programme\Octoshape Streaming Services\***\OctoshapeClient.exe"="C:\Programme\Octoshape Streaming Services\***\OctoshapeClient.exe:*:Enabled:OctoshapeClient"
"C:\Programme\VideoLAN\VLC\vlc.exe"="C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"D:\Die Siedler II\bin\S2DNG.exe"="D:\Die Siedler II\bin\S2DNG.exe:*isabled:S2DNG"
"C:\Programme\Sony Ericsson\Update Service\ma3platform.exe"="C:\Programme\Sony Ericsson\Update Service\ma3platform.exe:*:Enabled:ma3platform"
"D:\Steam\SteamApps\undissbar@gmx.de\the ship\ship.exe"="D:\Steam\SteamApps\undissbar@gmx.de\the ship\ship.exe:*:Enabled:ship"
"D:\warsow\warsow.exe"="D:\warsow\warsow.exe:*:Enabled:Warsow"
"H:\warrock\System\WarRock.exe"="H:\warrock\System\WarRock.exe:*:Enabled:WarRock.exe"
"D:\Der Herr der Ringe Online\lotroclient.exe"="D:\Der Herr der Ringe Online\lotroclient.exe:*:Enabled:lotroclient.exe"
"D:\Steam\SteamApps\common\lost planet demo\LostPlanetDX9.exe"="D:\Steam\SteamApps\common\lost planet demo\LostPlanetDX9.exe:*:Enabled:LostPlanetDX9"
"D:\warsow03\warsow.exe"="D:\warsow03\warsow.exe:*:Enabled:Warsow"
"D:\Steam\SteamApps\common\red orchestra\System\RedOrchestra.exe"="D:\Steam\SteamApps\common\red orchestra\System\RedOrchestra.exe:*:Enabled:RedOrchestra"
"D:\Steam\Steam.exe"="D:\Steam\Steam.exe:*:Enabled:Steam"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"H:\UT2004\System\UT2004.exe"="H:\UT2004\System\UT2004.exe:*:Enabled:UT2004"
"D:\Steam\SteamApps\undissbar@gmx.de\counter-strike source\hl2.exe"="D:\Steam\SteamApps\undissbar@gmx.de\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonUS\NGM\NGM.exe"="C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"D:\KartRider\NMService.exe"="D:\KartRider\NMService.exe:*:Enabled:Nexon Messenger Core"
"D:\Steam\SteamApps\undissbar@gmx.de\source sdk base\hl2.exe"="D:\Steam\SteamApps\undissbar@gmx.de\source sdk base\hl2.exe:*:Enabled:hl2"
"H:\Regnum Online\RegnumOnline.exe"="H:\Regnum Online\RegnumOnline.exe:*:Enabled:Regnum Online"
"C:\Programme\PPStream\PPStream.exe"="C:\Programme\PPStream\PPStream.exe:*:Enabled:PPStream"
"H:\Regnum Online\LiveServer\ROClientGame.exe"="H:\Regnum Online\LiveServer\ROClientGame.exe:*:Enabled:RegnumOnline"
"D:\TmNationsForever\TmForever.exe"="D:\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\Programme\Sony\Station\LaunchPad\LaunchPad.exe"="C:\Programme\Sony\Station\LaunchPad\LaunchPad.exe:*:Enabled:LaunchPad"
"C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Dyyno Receiver\DPPM.exe"="C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Dyyno Receiver\DPPM.exe:*:Enabledyyno P2P Receiver"
"H:\Azureus\Azureus.exe"="H:\Azureus\Azureus.exe:*:Enabled:Azureus"
"F:\WoW-BurningCrusade-deDE-Installer-downloader.exe"="F:\WoW-BurningCrusade-deDE-Installer-downloader.exe:*:Enabled:Blizzard Downloader"
"H:\World of Warcraft\BackgroundDownloader.exe"="H:\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe"="C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\http://www.macromedia.com\bin\octosh...bled:Octoshape add-in for Adobe Flash Player"
"C:\Programme\PPLive\PPLive.exe"="C:\Programme\PPLive\PPLive.exe:*:Enabled:PPLive"
"H:\SPSS16\SPSSWinWrapIDE.exe"="H:\SPSS16\SPSSWinWrapIDE.exe:*isabled:SPSS Basic Script Editor (1031)"
"H:\SPSS16\spss.com"="H:\SPSS16\spss.com:*isabled:SPSS 16.0 für Windows (1031:com)"
"H:\SPSS16\spss.exe"="H:\SPSS16\spss.exe:*isabled:SPSS 16.0 für Windows (1031:exe)"
"C:\Programme\PPLiveVA\PPLiveVA.exe"="C:\Programme\PPLiveVA\PPLiveVA.exe:*:Enabled:PPLiveVA"
"C:\Programme\Internet Explorer\iexplore.exe"="C:\Programme\Internet Explorer\iexplore.exe:*isabled:Internet Explorer"
"D:\Steam\SteamApps\common\titan quest\Titan Quest.exe"="D:\Steam\SteamApps\common\titan quest\Titan Quest.exe:*:Enabled:Titan Quest"
"D:\Steam\SteamApps\nik@counterstrike.de\counter-strike\hl.exe"="D:\Steam\SteamApps\nik@counterstrike.de\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"G:\EpsonNet EasyInstall\EasyInstall.exe"="G:\EpsonNet EasyInstall\EasyInstall.exe:*:Enabled:EasyInstall"
"C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe"="C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate"
"D:\Steam\SteamApps\common\titan quest\help.htm"="D:\Steam\SteamApps\common\titan quest\help.htm:*:Enabled:Titan Quest"
"D:\Steam\SteamApps\common\titan quest immortal throne\Tqit.exe"="D:\Steam\SteamApps\common\titan quest immortal throne\Tqit.exe:*:Enabled:Titan Quest: Immortal Throne"
"D:\Steam\SteamApps\common\titan quest immortal throne\help.htm"="D:\Steam\SteamApps\common\titan quest immortal throne\help.htm:*:Enabled:Titan Quest: Immortal Throne"
"C:\WINDOWS\System32\PnkBstrA.exe"="C:\WINDOWS\System32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\System32\PnkBstrB.exe"="C:\WINDOWS\System32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"D:\Steam\SteamApps\common\world of goo\WorldOfGoo.exe"="D:\Steam\SteamApps\common\world of goo\WorldOfGoo.exe:*:Enabled:World of Goo"
"D:\Steam\SteamApps\common\left 4 dead\left4dead.exe"="D:\Steam\SteamApps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead"
"D:\Steam\SteamApps\undissbar@gmx.de\insurgency\hl2.exe"="D:\Steam\SteamApps\undissbar@gmx.de\insurgency\hl2.exe:*:Enabled:hl2"
"H:\Project Torque\ProjectTorque.bin"="H:\Project Torque\ProjectTorque.bin:*:Enabled:Game"
"D:\Steam\SteamApps\common\jade empire\JadeEmpireLauncher.exe"="D:\Steam\SteamApps\common\jade empire\JadeEmpireLauncher.exe:*:Enabled:Jade Empire"
"D:\Steam\SteamApps\common\jade empire\JadeEmpireConfig.exe"="D:\Steam\SteamApps\common\jade empire\JadeEmpireConfig.exe:*:Enabled:Jade Empire"
"D:\Dragon Age\bin_ship\daorigins.exe"="D:\Dragon Age\bin_ship\daorigins.exe:*:Enabledragon Age Origins Game"
"D:\Dragon Age\DAOriginsLauncher.exe"="D:\Dragon Age\DAOriginsLauncher.exe:*:Enabledragon Age Origins Launcher"
"D:\Dragon Age\bin_ship\daupdatersvc.service.exe"="D:\Dragon Age\bin_ship\daupdatersvc.service.exe:*:Enabledragon Age Origins Updater"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\FlashFXP\flashfxp.exe"="C:\Programme\FlashFXP\flashfxp.exe:*:Enabled:FlashFXP v3"

======List of files/folders created in the last 1 months======

2010-01-02 14:49:46 ----D---- C:\rsit
2010-01-02 14:26:40 ----D---- C:\Programme\CCleaner
2010-01-01 21:37:20 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
2010-01-01 21:37:15 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-01-01 21:37:14 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-12-28 09:02:08 ----A---- C:\WINDOWS\DEBUGSM.INI

======List of files/folders modified in the last 1 months======

2010-01-02 15:02:02 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-12-31 15:31:10 ----A---- C:\WINDOWS\winamp.ini
2009-12-18 21:12:00 ----A---- C:\WINDOWS\NeroDigital.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 43008]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2004-10-14 4962]
R1 avgio;avgio; \??\C:\Programme\AntiVir PersonalEdition Classic\avgio.sys []
R2 Asapi;Asapi; C:\WINDOWS\system32\drivers\Asapi.sys [2000-05-12 8768]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2007-12-09 278984]
R2 CVPNDRVA;Cisco Systems IPsec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys []
R2 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2006-09-04 18048]
R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys []
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2005-11-09 60800]
R3 avgntflt;avgntflt; \??\C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2005-08-29 501760]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2005-08-29 438784]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2005-08-29 7168]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2005-08-29 142336]
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2007-01-24 127376]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2006-09-17 223128]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2005-08-29 77824]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2005-08-29 752128]
R3 hap16v2k;Creative P16V HAL Driver; C:\WINDOWS\system32\drivers\hap16v2k.sys [2005-08-29 153088]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2005-11-09 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-03-09 3650368]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-11-09 33536]
R3 nvmpu401;Service for NVIDIA(R) nForce(TM) MIDI UART; C:\WINDOWS\system32\drivers\nvmpu401.sys [2005-11-09 10240]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-11-09 12928]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2005-08-29 114688]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-09-25 47360]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S1 oreans32;oreans32; \??\C:\WINDOWS\system32\drivers\oreans32.sys []
S3 AF05BDA;AF9005 BDA Device; C:\WINDOWS\system32\drivers\AF05BDA.sys [2005-12-29 122752]
S3 au6qw6ua;au6qw6ua; C:\WINDOWS\system32\drivers\au6qw6ua.sys []
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2005-08-18 340768]
S3 CVirtA;Cisco Systems VPN Adapter; C:\WINDOWS\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2006-09-21 10578]
S3 hap17v2k;Creative P17V HAL Driver; C:\WINDOWS\system32\drivers\hap17v2k.sys [2005-08-29 179200]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744]
S3 LHidFlt2;Logitech HID/USB Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFlt2.sys []
S3 MPE;BDA MPE-Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 ntgrip;Gravis GamePort-Gerätetreiber; C:\WINDOWS\system32\drivers\ntgrip.sys [2001-08-17 51552]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 SONYPVU1;Sony USB-Filtertreiber (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2007-09-06 30336]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 vsdatant;vsdatant; \??\C:\WINDOWS\system32\vsdatant.sys []
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Filtertreiber für Systemwiederherstellung; C:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-03 73472]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;AntiVir PersonalEdition Classic Planer; C:\Programme\AntiVir PersonalEdition Classic\sched.exe [2008-10-26 68865]
R2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Programme\AntiVir PersonalEdition Classic\avguard.exe [2008-10-26 151297]
R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2007-09-06 110592]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Programme\Cisco Systems\VPN Client\cvpnd.exe [2007-04-03 1516584]
R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Programme\Gemeinsame Dateien\EPSON\eEBAPI\eEBSVC.exe [2006-12-19 94208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-03-09 143436]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-08-16 75064]
S3 Adobe LM Service;Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-12-11 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater; D:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Programme\iPod\bin\iPodService.exe [2007-09-14 503608]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 UMWdf;Windows-Benutzermodus-Treiberframework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-03 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]

-----------------EOF-----------------