Hallo...
Ich habe bei XP pro zwei Konten eingerichtet, ein Admin- und ein eingeschränktes Konto, mit dem ich ins Internet gehe.
Habe jetzt festgestellt, dass ich im Admin Konto den iexplorer nicht starten kann.
Habe dann geschaut und festgestellt, dass mir die Zugriffsrechte auf den Ordner C:Programme/Intenet Explorer (und dessen inhalt) vollständig entzogen wurden !!
Mit dem eingeschränkten Konto kann ich weiterhin auf den Explorer zugreifen.
Darauf bemerkte ich , dass sich von keinem der beiden Konten Antivir updaten lässt, keine Fehlermeldung, nur scheinbar endlose Suche nach dem Server.
Habe dann noch im abgesicherten Modus einen vollständigen Systemcheck gemacht, bei dem nichts gefunden wurde (habe allerdings vorerst abgebrochen als C: fertig gescannt war)
Dass mir einfach mal so frech Zugrifsrechte abhanden kommen, wurmt mich sehr...
Kann einer von euch Magiern helfen??
Danke im Voraus

Hier das Log: (hoffentlich zu eurer zufriedennheit präpariert..)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:40:29, on 14.01.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\sched.exe
F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Google\Update\GoogleUpdate.exe
C:\Programme\MagicTune Premium\MagicTuneEngine.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Progs\Security\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Join Air\AssistantServices.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avgnt.exe
F:\Progs\Security\ZoneAlarm 9.1\zlclient.exe
C:\Programme\CheckPoint\ZAForceField\ForceField.exe
C:\Programme\Microsoft Xbox 360 Accessories\XboxStat.exe
F:\Progs\Security\Sandboxie\SbieCtrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Dokumente und Einstellungen\Obi Wan\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h++p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h++p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h++p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h++p://smartsurfer.web.de/client/redirect
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [avgnt] "F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Progs\Security\ZoneAlarm 9.1\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Programme\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [XboxStat] "C:\Programme\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SandboxieControl] "F:\Progs\Security\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-57989841-1580818891-1177238915-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Internet_2')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-57989841-1580818891-1177238915-1005 Startup: OpenOffice.org 3.1.lnk = F:\Progs\Office\OpenOffice 3.10\OpenOffice.org 3\program\quickstart.exe (User 'Internet_2')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - h++p://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h++p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Programme\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Programme\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - F:\Progs\Security\Sandboxie\SbieSvc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: UI Assistant Service - Unknown owner - C:\Programme\Join Air\AssistantServices.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6162 bytes

Falls das noch nicht ausreichen sollte, habe ich noch die beiden Log´s , die ich über das Randoms System Information Tool erstellt habe.
Zuerst die info.txt, dann die log.txt, danach wiederum die log-Datei von Malwarebytes, die drei darin gefundenen Registry- Schlüssel habe ich wohl selbst über das XP-Sicherheitscenter deaktiviert, weil die ständigen Benachrichtigungen nerven.. wie auch immer:

RSIT_info.txt:

info.txt logfile of random's system information tool 1.06 2010-01-14 22:35:10

======Uninstall list======

-->MsiExec /X{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUN0407.EXE -f"F:\Progs\Photo\Photoshop 7\Uninst.isu" -c"F:\Progs\Photo\Photoshop 7\Uninst.dll"
Adobe Reader 9.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A92000000001}
AMD Processor Driver-->C:\Programme\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x0007 -removeonly
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Avira AntiVir Personal - Free Antivirus-->F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\setup.exe /REMOVE
BioShock-->C:\Programme\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\Setup.exe -runfromtemp -l0x0009 -removeonly
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Borderlands-->MsiExec.exe /X{52B65911-1559-4ED5-9461-46957FDD48CD}
CCleaner-->"F:\Progs\Security\CrapCleaner2.27\uninst.exe"
EmoDio-->"C:\Programme\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\setup.exe" -runfromtemp -l0x0407 -removeonly
EmoDio-->MsiExec.exe /X{C20CE592-B0F8-4D20-BF31-0151CA6331A6}
FIFA 10-->MsiExec.exe /X{11202615-E557-4ECF-9B86-F59C81E52909}
FLV Player 1.3.3-->"F:\Progs\Player\FLV_Playerv1.3.3\uninstall.exe"
Free M4a to MP3 Converter 6.1-->"F:\Progs\Converter\m4a-to-mp3-converter\unins000.exe"
Google Earth-->MsiExec.exe /X{C084BC61-E537-11DE-8616-005056806466}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HijackThis 2.0.2-->"C:\Dokumente und Einstellungen\Obi Wan\Desktop\HijackThis.exe" /uninstall
Hotfix für Windows XP (KB942288-v3)-->"C:\WINDOWS\$NtUninstallKB942288-v3$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
iTunes-->MsiExec.exe /I{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}
Join Air-->"C:\Programme\InstallShield Installation Information\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}\setup.exe" -runfromtemp -l0x0007 -removeonly
LEGO Star Wars II-->C:\Programme\InstallShield Installation Information\{578FA426-47C0-4A3F-98A4-01ACD26B7556}\setup.exe -runfromtemp -l0x0407
LEGO® Indiana Jones™-->C:\Programme\InstallShield Installation Information\{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}\Setup.exe -runfromtemp -l0x0407
Machinarium-->G:\Games\Machinarium\uninst.exe
MagicTune Premium-->C:\Programme\InstallShield Installation Information\{D6044256-A309-43B5-9833-D3FAFE2AD24D}\setup.exe -runfromtemp -l0x0007 -removeonly
Malwarebytes' Anti-Malware-->"F:\Progs\Security\ Malwarebytes Anti-Malware \unins000.exe"
Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0 German Language Pack-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 German Language Pack\setup.exe
Microsoft .NET Framework 3.0 German Language Pack-->MsiExec.exe /X{F2A7F421-1679-48D5-B918-96999014ED53}
Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4D243BA7-9AC4-46D1-90E5-EEB88974F501}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.1-->"C:\WINDOWS\$NtUninstallWdf01001$\spuninst\spuninst.exe"
Microsoft Tool Web Package : EXTRACT.EXE-->MsiExec.exe /X{D52A721B-E44C-4AD7-AD4F-29D83144384B}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Xbox 360 Accessories 1.1-->MsiExec.exe /X{CC13FB47-0B90-46C3-9BB7-57D2DB455D4D}
Mp3tag v2.41-->F:\Progs\Mp3\Mp3tag v2.41\Mp3tagUninstall.EXE
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
MyFreeCodec-->C:\Programme\MyFree Codec\09c beta\uninstall.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX v8.10.29-->MsiExec.exe /X{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}
OpenOffice.org 3.1-->MsiExec.exe /I{D765F1CE-5AE5-4C47-B134-AE58AC474740}
PHASE 88 ControlPanel-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FEF82C7B-A738-4EE2-9600-39895B21506F}\setup.exe" -l0x9
Picasa 3-->"F:\Progs\Photo\Picasa3\Uninstall.exe"
Pro Evolution Soccer 2010-->MsiExec.exe /X{283FFB23-8751-4B08-ACB8-5E0F8BCF7727}
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x7 -removeonly
RESIDENT EVIL 5-->MsiExec.exe /X{AC08BBA0-96B9-431A-A7D0-D8598E493775}
Samplitude 11-->MsiExec.exe /X{AE0009FD-8F50-4565-835D-4432BD18D792}
Sandboxie 3.30-->"C:\WINDOWS\Installer\SandboxieInstall.exe" /remove
Security Update für Microsoft .NET Framework 2.0 (KB928365)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
Sicherheitsupdate für Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
SmartSurfer2.0-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{3B64983B-A039-11D4-8B5A-0050DA45E354}\setup.exe" -l0x7
Star Wars Empire at War-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{99AE7207-8612-4DBA-A8F8-BAE5C633390D}\Setup.exe" -l0x7 -removeonly
STREET FIGHTER IV-->MsiExec.exe /X{59ABBDF0-E1E5-48AF-85FB-F523A08C3490}
Switch Uninstall-->C:\Programme\NCH Swift Sound\Switch\uninst.exe
Update für Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
VLC media player 1.0.0-->F:\Progs\Player\VLC media player 1.0 Final\uninstall.exe
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (DEU)-->MsiExec.exe /X{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation DE Language Pack-->MsiExec.exe /I{7228FD8C-3B9E-4204-AE36-8A466107685B}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
WinRAR-->F:\Progs\Packer\WinRAR 3.80\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
ZoneAlarm Toolbar-->C:\Programme\CheckPoint\ZAForceField\Uninstall.exe
ZoneAlarm-->F:\Progs\Security\ZoneAlarm 9.1\zauninst.exe

======Security center information======

AV: AntiVir Desktop
FW: ZoneAlarm Firewall

======System event log======

Computer Name: HAL9000
Event Code: 7036
Message: Dienst "Telefonie" befindet sich jetzt im Status "Ausgeführt".

Record Number: 3323
Source Name: Service Control Manager
Time Written: 20091226131010.000000+060
Event Type: Informationen
User:

Computer Name: HAL9000
Event Code: 7036
Message: Dienst "Kompatibilität für schnelle Benutzerumschaltung" befindet sich jetzt im Status "Ausgeführt".

Record Number: 3322
Source Name: Service Control Manager
Time Written: 20091226131010.000000+060
Event Type: Informationen
User:

Computer Name: HAL9000
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Kompatibilität für schnelle Benutzerumschaltung" gesendet.

Record Number: 3321
Source Name: Service Control Manager
Time Written: 20091226131010.000000+060
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: HAL9000
Event Code: 7036
Message: Dienst "Terminaldienste" befindet sich jetzt im Status "Ausgeführt".

Record Number: 3320
Source Name: Service Control Manager
Time Written: 20091226131010.000000+060
Event Type: Informationen
User:

Computer Name: HAL9000
Event Code: 1101
Message: SBIE1101 Sandboxie driver (SbieDrv) version 3.30 initialized

Record Number: 3319
Source Name: SbieDrv
Time Written: 20091226130955.000000+060
Event Type: Informationen
User:

=====Application event log=====

Computer Name: HAL9000
Event Code: 0
Message:
Record Number: 622
Source Name: iPod Service
Time Written: 20091222175908.000000+060
Event Type: Informationen
User:

Computer Name: HAL9000
Event Code: 1
Message:
Record Number: 621
Source Name: Bonjour Service
Time Written: 20091222175857.000000+060
Event Type: Informationen
User:

Computer Name: HAL9000
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!

Record Number: 620
Source Name: Avira AntiVir
Time Written: 20091222175849.000000+060
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: HAL9000
Event Code: 4097
Message: Die Anwendung "G:\Games\Fifa2010\FIFA10.exe" hat einen Programmfehler verursacht.
Datum und Zeit des Fehlers: 22.12.2009 um 11:51:20.671
Ausnahme: c0000005 an Adresse 0063E582 (FIFA10!AptArray__ConvertAptValue)

Record Number: 619
Source Name: DrWatson
Time Written: 20091222115120.000000+060
Event Type: Informationen
User:

Computer Name: HAL9000
Event Code: 1000
Message: Fehlgeschlagene Anwendung fifa10.exe, Version 0.0.0.0, fehlgeschlagenes Modul fifa10.exe, Version 0.0.0.0, Fehleradresse 0x0023e582.

Record Number: 618
Source Name: Application Error
Time Written: 20091222115112.000000+060
Event Type: Fehler
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 6 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=0602
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Programme\QuickTime\QTSystem\QTJava.zip
"tvdumpflags"=8

-----------------EOF-----------------

RSIT_log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Obi Wan at 2010-01-14 22:34:56
Microsoft Windows XP Professional Service Pack 3
System drive C: has 15 GB (59%) free of 25 GB
Total RAM: 2047 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:35:08, on 14.01.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\sched.exe
F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avguard.exe
C:\Programme\MagicTune Premium\MagicTuneEngine.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Progs\Security\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Join Air\AssistantServices.exe
C:\Programme\CheckPoint\ZAForceField\ForceField.exe
C:\Programme\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avgnt.exe
F:\Progs\Security\ZoneAlarm 9.1\zlclient.exe
C:\Programme\Microsoft Xbox 360 Accessories\XboxStat.exe
F:\Progs\Security\Sandboxie\SbieCtrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\MagicTune Premium\MagicTune.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
F:\Progs\Security\ Malwarebytes Anti-Malware \mbam.exe
C:\Dokumente und Einstellungen\Obi Wan\Desktop\Randoms System Information Tool.exe
C:\Programme\trend micro\Obi Wan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smartsurfer.web.de/client/redirect
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [avgnt] "F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Progs\Security\ZoneAlarm 9.1\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Programme\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [XboxStat] "C:\Programme\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SandboxieControl] "F:\Progs\Security\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-57989841-1580818891-1177238915-1005\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Internet_2')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-57989841-1580818891-1177238915-1005 Startup: OpenOffice.org 3.1.lnk = F:\Progs\Office\OpenOffice 3.10\OpenOffice.org 3\program\quickstart.exe (User 'Internet_2')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Programme\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: MagicTuneEngine - Unknown owner - C:\Programme\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - F:\Progs\Security\Sandboxie\SbieSvc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: UI Assistant Service - Unknown owner - C:\Programme\Join Air\AssistantServices.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6387 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}]
ZoneAlarm Toolbar Registrar - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2009-10-14 578928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - ZoneAlarm Toolbar - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2009-10-14 578928]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"ZoneAlarm Client"=F:\Progs\Security\ZoneAlarm 9.1\zlclient.exe [2009-11-22 1037192]
"ISW"=C:\Programme\CheckPoint\ZAForceField\ForceField.exe [2009-10-14 730480]
"XboxStat"=C:\Programme\Microsoft Xbox 360 Accessories\XboxStat.exe [2007-09-27 734264]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"Adobe ARM"=C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"=F:\Progs\Security\Sandboxie\SbieCtrl.exe [2008-09-02 716800]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
F:\Progs\Reader\AcrobatReader9\Reader\Reader_sl.exe [2009-10-03 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
F:\Progs\Mp3\i_Tunes 9\iTunesHelper.exe [2009-09-21 305440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\QTTask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2008-12-09 18063872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSTray]
F:\Progs\Mp3\EmoDio\SMSTray.exe [2009-04-16 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec]
C:\Programme\Join Air\UIExec.exe [2009-08-31 132608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk]
C:\PROGRA~1\GEMEIN~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2000-08-24 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^GammaTray.lnk]
C:\PROGRA~1\MAGICT~1\GAMMAT~1.EXE [2007-01-15 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Obi Wan^Startmenü^Programme^Autostart^OpenOffice.org 3.1.lnk]
F:\Progs\Office\OPENOF~1.10\OPENOF~1.ORG\program\QUICKS~1.EXE [2009-04-16 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3
"gusvc"=3
"gupdate"=2
"Bonjour Service"=2
"Apple Mobile Device"=2

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"G:\Games\PES2010\pes2010.exe"="G:\Games\PES2010\pes2010.exe:*:Enabled:Pro Evolution Soccer 2010"
"G:\Games\StarWars_Empire_at_War\GameData\sweaw.exe"="G:\Games\StarWars_Empire_at_War\GameData\sweaw.exe:*:Enabled:Star Wars: Empire at War"
"G:\Games\Borderlands\Gearbox Software\Borderlands\Binaries\Borderlands.exe"="G:\Games\Borderlands\Gearbox Software\Borderlands\Binaries\Borderlands.exe:*:Enabled:Borderlands"
"G:\Games\Streetfighter4\StreetFighterIV.exe"="G:\Games\Streetfighter4\StreetFighterIV.exe:*:Enabled:STREET FIGHTER IV"
"G:\Games\Resident Evil_5\RE5DX9.EXE"="G:\Games\Resident Evil_5\RE5DX9.EXE:*:Enabled:RESIDENT EVIL 5 (DX9)"
"F:\Progs\Mp3\EmoDio\SMSMain.exe"="F:\Progs\Mp3\EmoDio\SMSMain.exe:*:Enabled:EmoDio"
"C:\Programme\Google\Google Earth\client\googleearth.exe"="C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"
"F:\Progs\Security\ Malwarebytes Anti-Malware \mbam.exe"="F:\Progs\Security\ Malwarebytes Anti-Malware \mbam.exe:*:Enabled:Malwarebytes' Anti-Malware"
"F:\Progs\Photo\Photoshop 7\ImageReady.exe"="F:\Progs\Photo\Photoshop 7\ImageReady.exe:*:Enabled:Adobe ImageReady 7.0"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*isabled:Bonjour"
"F:\Progs\Mp3\i_Tunes 9\iTunes.exe"="F:\Progs\Mp3\i_Tunes 9\iTunes.exe:*isabled:iTunes"
"G:\Games\Resident Evil_5\RE5DX10.EXE"="G:\Games\Resident Evil_5\RE5DX10.EXE:*isabled:RESIDENT EVIL 5 (DX10)"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*isabled:MUZ AOD APP player"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{106207ce-d6a6-11de-ad77-806d6172696f}]
shell\AutoRun\command - D:\Run.exe


======List of files/folders created in the last 1 months======

2010-01-14 22:34:58 ----D---- C:\Programme\trend micro
2010-01-14 22:34:56 ----D---- C:\rsit
2010-01-14 21:51:04 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\Malwarebytes
2010-01-14 21:50:58 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-01-10 18:54:27 ----D---- C:\Programme\TerraTec
2010-01-10 18:54:23 ----A---- C:\WINDOWS\system32\Asio88mt.dll
2010-01-10 18:53:39 ----D---- C:\TerraTec
2010-01-10 11:39:27 ----D---- C:\WINDOWS\BDOSCAN8
2009-12-31 14:34:49 ----HDC---- C:\WINDOWS\$NtUninstallWdf01001$
2009-12-31 14:34:34 ----A---- C:\WINDOWS\system32\WdfCoInstaller01001.dll
2009-12-31 14:34:27 ----D---- C:\Programme\Microsoft Xbox 360 Accessories
2009-12-31 12:38:01 ----D---- C:\WINDOWS\system32\xlive
2009-12-31 12:38:01 ----D---- C:\Programme\Microsoft Games for Windows - LIVE
2009-12-30 16:06:21 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\Google
2009-12-30 16:01:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google
2009-12-28 12:52:33 ----D---- C:\WINDOWS\pss
2009-12-25 11:25:02 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\CheckPoint
2009-12-25 11:24:58 ----D---- C:\Programme\CheckPoint
2009-12-25 11:24:57 ----A---- C:\WINDOWS\system32\zlcommdb.dll
2009-12-25 11:24:57 ----A---- C:\WINDOWS\system32\zlcomm.dll
2009-12-25 11:24:57 ----A---- C:\WINDOWS\system32\vsregexp.dll
2009-12-25 11:24:55 ----A---- C:\WINDOWS\system32\vswmi.dll
2009-12-25 11:24:54 ----D---- C:\WINDOWS\system32\ZoneLabs
2009-12-25 11:24:54 ----A---- C:\WINDOWS\system32\zpeng25.dll
2009-12-25 11:24:54 ----A---- C:\WINDOWS\system32\vsxml.dll
2009-12-25 11:24:54 ----A---- C:\WINDOWS\system32\vspubapi.dll
2009-12-25 11:24:54 ----A---- C:\WINDOWS\system32\vsmonapi.dll
2009-12-25 11:24:16 ----D---- C:\WINDOWS\Internet Logs
2009-12-25 11:24:16 ----A---- C:\WINDOWS\system32\vsutil.dll
2009-12-25 11:24:16 ----A---- C:\WINDOWS\system32\vsinit.dll
2009-12-25 11:24:16 ----A---- C:\WINDOWS\system32\vsdata.dll
2009-12-24 21:02:07 ----D---- C:\Programme\2K Games
2009-12-24 16:15:58 ----D---- C:\WINDOWS\ie8updates
2009-12-24 16:15:54 ----D---- C:\Programme\MSXML 4.0
2009-12-24 15:51:07 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-12-24 15:50:46 ----D---- C:\Programme\MSBuild
2009-12-24 15:49:12 ----D---- C:\WINDOWS\system32\XPSViewer
2009-12-24 15:49:11 ----D---- C:\WINDOWS\system32\en-us
2009-12-24 15:49:02 ----D---- C:\Programme\Reference Assemblies
2009-12-24 15:48:53 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-12-24 15:48:05 ----RSD---- C:\WINDOWS\assembly
2009-12-24 15:47:56 ----D---- C:\WINDOWS\Microsoft.NET
2009-12-24 15:24:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-12-24 15:24:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-12-24 15:24:45 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-12-24 15:24:42 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-12-24 15:24:40 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-12-24 15:24:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-12-24 15:24:35 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-12-24 15:24:33 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2009-12-24 15:24:30 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2009-12-24 15:24:28 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-12-24 15:24:24 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-12-24 15:24:22 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-12-24 15:24:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-12-24 15:24:16 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-12-24 15:24:14 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-12-24 15:24:11 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-12-24 15:24:09 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-12-24 15:24:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-12-24 15:24:03 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-12-24 15:23:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-12-24 15:23:53 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-12-24 15:23:50 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-12-24 15:23:47 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-12-24 15:23:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-12-24 15:23:41 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-12-24 15:23:38 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-12-24 15:23:35 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-12-24 15:23:32 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-12-24 15:23:29 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-12-24 15:23:27 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-12-24 15:23:24 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-12-24 15:23:21 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-12-24 15:23:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2009-12-24 15:23:14 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-12-24 15:23:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-12-24 15:23:08 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2009-12-24 15:23:06 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-12-24 15:23:02 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-12-24 15:22:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-12-24 15:22:55 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-12-24 15:22:51 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-12-24 15:22:47 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-12-24 15:22:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-12-24 15:22:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-12-24 15:22:33 ----A---- C:\WINDOWS\system32\MRT.exe
2009-12-24 15:22:31 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-12-24 15:22:28 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-12-24 15:22:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-12-24 15:22:22 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-12-24 15:22:18 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-12-24 15:22:17 ----HD---- C:\WINDOWS\$hf_mig$
2009-12-24 13:49:49 ----HDC---- C:\WINDOWS\$NtUninstallKB942288-v3$
2009-12-24 13:49:13 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-12-24 13:49:13 ----A---- C:\WINDOWS\system32\wups2.dll
2009-12-24 13:49:13 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2009-12-24 13:49:13 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2009-12-24 13:49:13 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2009-12-24 13:48:25 ----D---- C:\Programme\Resource Kit
2009-12-24 13:48:25 ----A---- C:\WINDOWS\extract.exe
2009-12-24 13:46:04 ----D---- C:\PCWELT
2009-12-24 13:35:44 ----D---- C:\WINDOWS\WBEM
2009-12-24 13:35:39 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-12-24 13:35:38 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-12-24 13:35:36 ----HDC---- C:\WINDOWS\ie8
2009-12-22 18:20:50 ----RA---- C:\WINDOWS\system32\MaJGUILib.dll
2009-12-22 18:20:50 ----A---- C:\WINDOWS\system32\MaXMLProto.dll
2009-12-22 18:20:50 ----A---- C:\WINDOWS\system32\MaJUtilLib.dll
2009-12-22 18:06:56 ----A---- C:\WINDOWS\ModemLog_ZTE Proprietary USB Modem.txt
2009-12-22 18:05:04 ----D---- C:\WINDOWS\system32\SupportAppCB
2009-12-22 18:05:03 ----D---- C:\Programme\Join Air
2009-12-21 21:48:20 ----D---- C:\Programme\MyFree Codec
2009-12-19 17:13:07 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\Apple Computer
2009-12-19 17:13:03 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-12-19 17:12:51 ----D---- C:\Programme\iPod
2009-12-19 17:12:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-19 17:12:44 ----D---- C:\Programme\Bonjour
2009-12-19 17:12:33 ----D---- C:\Programme\QuickTime
2009-12-19 17:12:33 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2009-12-19 17:12:23 ----D---- C:\Programme\Apple Software Update
2009-12-19 17:12:15 ----D---- C:\Programme\Gemeinsame Dateien\Apple
2009-12-19 17:12:15 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2009-12-19 12:40:31 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-12-19 10:27:06 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\Mp3tag
2009-12-18 21:21:46 ----A---- C:\WINDOWS\FISHUI.INI
2009-12-18 20:38:08 ----D---- C:\My Video
2009-12-18 20:37:45 ----A---- C:\WINDOWS\system32\msvcr71.dll
2009-12-18 20:37:41 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\DataCast
2009-12-18 20:37:32 ----D---- C:\Programme\MarkAny
2009-12-16 19:56:35 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-12-16 19:56:35 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-12-16 19:56:35 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-12-16 19:56:35 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-12-16 19:56:35 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-12-16 19:56:35 ----N---- C:\WINDOWS\system32\px.dll
2009-12-16 19:56:18 ----D---- C:\WINDOWS\system32\IOSUBSYS
2009-12-16 19:56:18 ----D---- C:\Programme\Google
2009-12-16 13:47:41 ----A---- C:\WINDOWS\ModemLog_SmartUSB56 Voice Modem #2.txt

======List of files/folders modified in the last 1 months======

2010-01-14 22:35:08 ----D---- C:\WINDOWS\Prefetch
2010-01-14 22:34:58 ----RD---- C:\Programme
2010-01-14 22:05:47 ----D---- C:\WINDOWS\Temp
2010-01-14 22:02:22 ----D---- C:\WINDOWS
2010-01-14 22:01:57 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-14 22:00:48 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-14 21:51:00 ----D---- C:\WINDOWS\system32\drivers
2010-01-14 21:48:35 ----D---- C:\WINDOWS\Debug
2010-01-13 21:39:18 ----A---- C:\WINDOWS\win.ini
2010-01-12 19:51:46 ----RSH---- C:\boot.ini
2010-01-12 19:51:46 ----A---- C:\WINDOWS\system.ini
2010-01-11 23:08:22 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\vlc
2010-01-10 18:57:38 ----HD---- C:\WINDOWS\inf
2010-01-10 18:55:52 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-10 18:55:47 ----D---- C:\WINDOWS\system32
2010-01-10 18:54:39 ----SHD---- C:\WINDOWS\Installer
2010-01-10 18:54:27 ----HD---- C:\Programme\InstallShield Installation Information
2010-01-10 11:39:29 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-01-08 11:20:34 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2010-01-08 10:51:58 ----D---- C:\Programme\Gemeinsame Dateien\Adobe
2010-01-06 21:45:21 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\dvdcss
2010-01-05 21:31:02 ----D---- C:\WINDOWS\system32\DirectX
2010-01-01 20:31:37 ----A---- C:\WINDOWS\Sandboxie.ini
2009-12-31 14:34:34 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-12-31 12:38:01 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2009-12-30 16:02:05 ----SD---- C:\WINDOWS\Tasks
2009-12-28 20:06:44 ----D---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\Bioshock
2009-12-27 20:53:36 ----SHD---- C:\RECYCLER
2009-12-27 13:36:08 ----D---- C:\Dokumente und Einstellungen
2009-12-25 22:49:35 ----D---- C:\Programme\MagicTune Premium
2009-12-24 16:16:38 ----D---- C:\Programme\Internet Explorer
2009-12-24 16:16:24 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-24 16:16:18 ----D---- C:\WINDOWS\WinSxS
2009-12-24 15:51:03 ----D---- C:\WINDOWS\system32\de-de
2009-12-24 15:49:10 ----RSD---- C:\WINDOWS\Fonts
2009-12-24 15:48:54 ----D---- C:\WINDOWS\system32\spool
2009-12-24 15:47:59 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-12-24 15:47:56 ----D---- C:\WINDOWS\pchealth
2009-12-24 15:26:10 ----D---- C:\WINDOWS\system32\wbem
2009-12-24 15:26:10 ----D---- C:\WINDOWS\AppPatch
2009-12-24 15:24:44 ----D---- C:\Programme\Messenger
2009-12-24 15:23:22 ----D---- C:\Programme\Outlook Express
2009-12-24 13:57:10 ----D---- C:\WINDOWS\SoftwareDistribution
2009-12-24 13:49:53 ----D---- C:\WINDOWS\system32\mui
2009-12-24 13:49:14 ----D---- C:\WINDOWS\Help
2009-12-24 13:35:45 ----D---- C:\WINDOWS\system32\config
2009-12-24 13:35:41 ----D---- C:\WINDOWS\Media
2009-12-19 17:12:15 ----D---- C:\Programme\Gemeinsame Dateien
2009-12-16 19:44:47 ----SD---- C:\Dokumente und Einstellungen\Obi Wan\Anwendungsdaten\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;AMD HwPState Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 avgio;avgio; \??\F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2009-11-22 486280]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-22 56816]
R2 ISWKL;ZoneAlarm Toolbar ISWKL; \??\C:\Programme\CheckPoint\ZAForceField\ISWKL.sys []
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ews88mt;EWS88 WDM Audio; C:\WINDOWS\system32\drivers\ews88wdm.sys [2007-03-14 95712]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 MagicTune;MagicTune; C:\WINDOWS\system32\drivers\MTiCtwl.sys [2008-03-14 14848]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-11-27 58368]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-11-27 19968]
R3 SbieDrv;SbieDrv; \??\F:\Progs\Security\Sandboxie\SbieDrv.sys []
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-04-20 479200]
R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\WINDOWS\system32\DRIVERS\xusb21.sys [2007-02-27 61984]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-12-11 4959232]
S3 MagixASIODrv;MAGIX_ASIO_BoostDriver; \??\F:\Progs\Sound\Samplitude11\mxasio.sys []
S3 massfilter;ZTE Mass Storage Filter Driver; C:\WINDOWS\system32\drivers\massfilter.sys [2009-04-22 9728]
S3 MODEMCSA;Unimodem-Datenstromfiltergerät; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys [2008-04-13 126686]
S3 Mtlstrm;Mtlstrm; C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys [2008-04-13 1309184]
S3 NtMtlFax;NtMtlFax; C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys [2008-04-13 180360]
S3 Slnt7554;USB Soft Modem Driver; C:\WINDOWS\system32\DRIVERS\slnt7554.sys [2008-04-13 129535]
S3 SlNtHal;SlNtHal; C:\WINDOWS\system32\DRIVERS\Slnthal.sys [2008-04-13 95424]
S3 SlWdmSup;SlWdmSup; C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys [2008-04-13 13240]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys [2009-02-02 104960]
S3 ZTEusbnmea;ZTE NMEA Port; C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys [2009-02-02 105344]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys [2009-02-02 104960]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;Filtertreiber für Systemwiederherstellung; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; F:\Progs\Security\Antivir9\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 IswSvc;ZoneAlarm Toolbar IswSvc; C:\Programme\CheckPoint\ZAForceField\IswSvc.exe [2009-10-14 476528]
R2 MagicTuneEngine;MagicTuneEngine; C:\Programme\MagicTune Premium\MagicTuneEngine.exe [2007-08-23 45056]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 SbieSvc;Sandboxie Service; F:\Progs\Security\Sandboxie\SbieSvc.exe [2008-09-02 48640]
R2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2008-04-14 73796]
R2 UI Assistant Service;UI Assistant Service; C:\Programme\Join Air\AssistantServices.exe [2009-08-31 241664]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2009-11-22 2384240]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S4 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
S4 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S4 gupdate;Google Update Service (gupdate); C:\Programme\Google\Update\GoogleUpdate.exe [2009-12-30 135664]
S4 gusvc;Google Updater Service; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S4 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-09-21 545568]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------



Malwarebytes_log:

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3565
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

14.01.2010 21:59:40
mbam-log-2010-01-14 (21-59-40).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 130382
Laufzeit: 2 minute(s), 56 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)