HI T Board

Habe folgenede Probleme mit meinem PC.

Am anfang ist nichts aber wenn ich im Internet bin verlangsamt er übel und ich kann nicht mehr daran arbeiten ab und zu kommen skript fehler auf einigen seiten und applikationen die ich aber leider nicht beachte.

Das war eigentlich nie der Fall doch in letzter Zeit habe ich ziemlich viel runtergeladen somit weis ich nicht ob ich mir was eingeholt habe.

Ich kann nur eins zum herunterfahren sagen.

da kommt meistens der gleiche fehler das irgendeine exe datei nicht beendet werden kann. Habe das Problem auch wenn zb Yahoo messenger an is

im anhang befindet sich die LOG von AVZ Danke im voraus

Hallo und

Bitte diese Liste beachten und abarbeiten. Beim Scan mit MalwareBytes auch alle externen Speicher (ext. Platten, USB-Sticks, ... mit anklemmen!! )

Wichtig für Benutzer mit Windows Vista und Windows 7: Bitte alle Tools per Rechtsklick => Als Admin ausführen!

Die Logfiles kannst Du zB alle in eine Datei zippen und auf File-Upload.net hochladen und hier verlinken, denn 1. sind manche Logfiles fürs Board nämlich zu groß und 2. kann ich mit einem Klick mir gleich alle auf einmal runterladen.

sorry hab ich jetzt ein fehler gemacht dachte ich habe alles befolgt sorry wenn nicht

Ja, Du hast AVZ ausgeführt. Mit AVZ kann aber nur undoreal umgehen, deswegen bitte die anderen Logs posten.

ok hab ich gemacht als erster der mailware log



Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3615
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

1/22/2010 8:06:08 PM
mbam-log-2010-01-22 (20-06-08).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 165681
Laufzeit: 44 minute(s), 37 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Trojan.Downloader) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Documents and Settings\Fener\Desktop\AdobeAcrobat9ProExtended\keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{D739F7F5-53FB-467E-AF7D-2D1235613489}\RP350\A0133438.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{D739F7F5-53FB-467E-AF7D-2D1235613489}\RP350\A0133441.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

und hier die RSIT logs

info.txt logfile of random's system information tool 1.06 2010-01-22 20:09:01

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS.0\INF\PCHealth.inf
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Adobe Acrobat 9 Pro Extended - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-7761-000000000004}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS.0\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}
Advertising Center-->MsiExec.exe /X{b2ec4a38-b545-4a00-8214-13fe0e915e6d}
Call of Duty(R) - World at War(TM)-->C:\Program Files\InstallShield Installation Information\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\setup.exe -runfromtemp -l0x0407
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
DolbyFiles-->MsiExec.exe /X{b1adf008-e898-4fe2-8a1f-690d9a06acaf}
Gizmo Central-->"C:\Program Files\Gizmo\gdirector.exe" /Uninstall
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotspot Shield 1.21-->C:\Program Files\Hotspot Shield\Uninstall.exe
HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Deskjet All-In-One Software 8.0-->C:\Program Files\HP\Digital Imaging\{24557DC0-0839-496f-82F9-C4EB72EFE4FA}\setup\hpzscr01.exe -datfile hposcr12.dat
HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
HP Smart Web Printing 1.0-->MsiExec.exe /X{E3030F57-9E6B-4E36-95B6-F7B4DBDEB8FB}
HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
IZArc 4.1-->"C:\Program Files\IZArc\unins000.exe"
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216014FF}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Menu Templates - Starter Kit-->MsiExec.exe /X{b78120a0-cf84-4366-a393-4d0a59bc546c}
Microsoft .NET Framework 2.0-->C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Movie Templates - Starter Kit-->MsiExec.exe /X{e498385e-1c51-459a-b45f-1721e37aa1a0}
Mozilla Firefox (3.5.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.23)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Nero 9 Trial-->C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="8M01-209M-AH6P-5UW0-WHAW-C53X-473X-79MH"
Nero BurnRights-->MsiExec.exe /X{7829db6f-a066-4e40-8912-cb07887c20bb}
Nero ControlCenter-->MsiExec.exe /X{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}
Nero CoverDesigner-->MsiExec.exe /X{62ac81f6-bdd3-4110-9d36-3e9eaab40999}
Nero DiscSpeed-->MsiExec.exe /X{869200db-287a-4dc0-b02b-2b6787fbcd4c}
Nero DriveSpeed-->MsiExec.exe /X{33cf58f5-48d8-4575-83d6-96f574e4d83a}
Nero InfoTool-->MsiExec.exe /X{fbcdfd61-7dcf-4e71-9226-873ba0053139}
Nero Installer-->MsiExec.exe /X{e8a80433-302b-4ff1-815d-fcc8eac482ff}
Nero Live-->MsiExec.exe /X{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}
Nero Online Upgrade-->MsiExec.exe /X{dba84796-8503-4ff0-af57-1747dd9a166d}
Nero PhotoSnap-->MsiExec.exe /X{9e82b934-9a25-445b-b8df-8012808074ac}
Nero Recode-->MsiExec.exe /X{359cfc0a-beb1-440d-95ba-cf63a86da34f}
Nero Rescue Agent-->MsiExec.exe /X{368ba326-73ad-4351-84ed-3c0a7a52cc53}
Nero ShowTime-->MsiExec.exe /X{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}
Nero StartSmart OEM-->MsiExec.exe /X{4D43D635-6FDA-4fa5-AA9B-23CF73D058EA}
Nero StartSmart-->MsiExec.exe /X{7748ac8c-18e3-43bb-959b-088faea16fb2}
Nero Vision-->MsiExec.exe /X{43e39830-1826-415d-8bae-86845787b54b}
Nero WaveEditor-->MsiExec.exe /X{a209525b-3377-43f4-b886-32f6b6e7356f}
NeroBurningROM-->MsiExec.exe /X{d025a639-b9c9-417d-8531-208859000af8}
NeroExpress-->MsiExec.exe /X{595a3116-40bb-4e0f-a2e8-d7951da56270}
NeroLiveGadget-->MsiExec.exe /X{9e9fdde6-2c26-492a-85a0-05646b3f2795}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NewsLeecher v3.9 Final-->"C:\Program Files\NewsLeecher\unins000.exe"
NoPayPOKER-->"C:\Program Files\NoPayPOKER\uninstall\unins000.exe"
NVIDIA Drivers-->C:\WINDOWS.0\system32\nvuninst.exe UninstallGUI
PartyPoker-->"C:\Program Files\PartyGaming\PartyPoker\Uninstall.exe" "C:\Program Files\PartyGaming\PartyPoker\install.log"
Philips SPC210NC Webcam -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{38D95956-E92C-4473-904B-CD877EA04410}\Setup.exe" -l0x7
PunkBuster Services-->C:\WINDOWS.0\system32\pbsvc.exe -u
Quick Macros 2-->"C:\Program Files\Quick Macros 2\unins000.exe"
QuickPar 0.9-->C:\Program Files\QuickPar\uninst.exe
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
REALTEK PCIE NIC Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E2F183-BAC4-4D01-BD7A-59F781E17EFA}\Setup.exe" -l0x7 REMOVE
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SoundTrax-->MsiExec.exe /X{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}
VLC media player 1.0.0-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VMware Workstation-->MsiExec.exe /I{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}
Windows Live Fotogalerie-->MsiExec.exe /X{2BA722D1-48D1-406E-9123-8AE5431D63EF}
Windows Live Mail-->MsiExec.exe /I{C4D738F7-996A-4C81-B8FA-C4E26D767E41}
Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}
Windows Live Sync-->MsiExec.exe /X{76618402-179D-4699-A66B-D351C59436BC}
Windows Live Toolbar-->MsiExec.exe /X{70B7A167-0B88-445D-A3EA-97C73AA88CAC}
Windows Live Writer-->MsiExec.exe /X{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS.0\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS.0\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
WISO Steuer 2010-->"C:\Program Files\InstallShield Installation Information\{46B70DEB-97B3-4E38-B746-EC16905E6A8F}\Setup.exe" -runfromtemp -l0x0007 -removeonly
Wolfenstein - Enemy Territory-->C:\PROGRA~1\WOLFEN~1\Uninstall\Unwise.exe /u C:\PROGRA~1\WOLFEN~1\Uninstall\Install.log
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG

======System event log======

Computer Name: 35DE5D7CB
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 5928
Source Name: Tcpip
Time Written: 20091223112541.000000+060
Event Type: warning
User:

Computer Name: 35DE5D7CB
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 000400813. The following
error occurred:
The semaphore timeout period has expired.
.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Record Number: 58
Source Name: Dhcp
Time Written: 20091221125439.000000+060
Event Type: warning
User:
5DE5D7CB
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 5726
Source Name: Tcpip
Time Written: 20091217194305.000000+060
Event Type: warning
User:

Computer Name: DE5D7CB
Event Code: 422
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 5536
Source Name: Tcpip
Time Written: 20091212230527.000000+060
Event Type: warning
User:

5DE5D7CB
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 00040EFF0813. The following
error occurred:
The semaphore timeout period has expired.
.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Record Number: 5481
Source Name: Dhcp
Time Written: 20091210083543.000000+060
Event Type: warning
User:

=====Application event log=====

Computer Name: E5D7CB
Event Code: 1002
Message: Hanging application PartyGaming.exe, version 1.0.0.133, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 578
Source Name: Application Hang
Time Written: 20090831133444.000000+120
Event Type: error
User:

Computer Name: DE5D7CB
Event Code: 1002
Message: Hanging application newsLeecher.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 572
Source Name: Application Hang
Time Written: 20090830214636.000000+120
Event Type: error
User:

Computer Name: DE5D7CB
Event Code: 1002
Message: Hanging application nopaypoker.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 571
Source Name: Application Hang
Time Written: 20090830191519.000000+120
Event Type: error
User:

Computer Name: 5DE5D7CB
Event Code: 1002
Message: Hanging application YahooMessenger.exe, version 9.0.0.2162, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 505
Source Name: Application Hang
Time Written: 20090819202358.000000+120
Event Type: error
User:

Computer Name: 5DE5D7CB
Event Code: 1000
Message: Faulting application yahoomessenger.exe, version 9.0.0.2162, faulting module unknown, version 0.0.0.0, fault address 0x0f000000.

Record Number: 504
Source Name: Application Error
Time Written: 20090819202222.000000+120
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------


Logfile of random's system information tool 1.06 (written by random/random)
Run by Fener at 2010-01-22 20:08:52
Microsoft Windows XP Professional Service Pack 3
System drive C: has 24 GB (49%) free of 50 GB
Total RAM: 2559 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:08:59 PM, on 1/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\nvsvc32.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Quick Macros 2\qmserv.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\avmwlanstick\FRITZWLANMini.exe
C:\WINDOWS.0\RTHDCPL.EXE
C:\WINDOWS.0\system32\RUNDLL32.EXE
C:\WINDOWS.0\VM_STI.EXE
C:\Program Files\Quick Macros 2\qm.exe
C:\WINDOWS.0\system32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gizmo\gservice.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS.0\system32\svchost.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\PnkBstrA.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32\vmnat.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS.0\system32\vmnetdhcp.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS.0\system32\NOTEPAD.EXE
C:\WINDOWS.0\system32\wuauclt.exe
C:\Documents and Settings\Fener\Desktop\RSIT.exe
C:\Program Files\trend micro\Fener.exe

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS.0\VM_STI.EXE Philips SPC210NC Webcam
O4 - HKLM\..\Run: [Quick Macros] "C:\Program Files\Quick Macros 2\qm.exe" S
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [GizmoDriveDelegate] RUNDLL32.EXE C:\PROGRA~1\GIZMO\GDRIVE.DLL,Remount_Startup_Images
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Gizmo Central - Arainia Solutions - C:\Program Files\Gizmo\gservice.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS.0\system32\PnkBstrA.exe
O23 - Service: Quick Macros (quickmacros2) - Unknown owner - C:\Program Files\Quick Macros 2\qmserv.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS.0\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS.0\system32\vmnat.exe

--
End of file - 8946 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14 92504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE84A6AA-A333-4B92-B276-C11E2212E4FE}]
CPrintEnhancer Object - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll [2006-12-15 599472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
Hotspot Shield Class - C:\Program Files\Hotspot Shield\hssie\HssIE.dll [2009-07-19 204248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"=C:\Program Files\avmwlanstick\FRITZWLANMini.exe [2006-06-23 343552]
"RTHDCPL"=C:\WINDOWS.0\RTHDCPL.EXE [2006-09-12 16264192]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS.0\system32\NvMcTray.dll [2009-06-10 86016]
"NvCplDaemon"=C:\WINDOWS.0\system32\NvCpl.dll [2009-06-10 13758464]
"BigDogPath"=C:\WINDOWS.0\VM_STI.EXE [2004-06-09 40960]
"Quick Macros"=C:\Program Files\Quick Macros 2\qm.exe [2009-09-01 1224704]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2008-06-12 37232]
""= []
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-06-11 640376]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2009-05-26 4351216]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]
"GizmoDriveDelegate"=C:\PROGRA~1\GIZMO\GDRIVE.DLL [2010-01-18 390752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS.0\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS.0\SkyTel.EXE [2006-05-16 2879488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin210.exe.lnk]
C:\PROGRA~1\Philips\PHILIP~1\TRAYMI~1.EXE [2006-05-10 278528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="acaptuser32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS.0\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=91000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Documents and Settings\Fener\temp\TeamViewer\Version4\TeamViewer.exe"="C:\Documents and Settings\Fener\temp\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Program Files\VMware\VMware Workstation\vmware-authd.exe"="C:\Program Files\VMware\VMware Workstation\vmware-authd.exe:*:Enabled:VMware Authd"
"C:\Program Files\NoPayPOKER\nopaypoker.exe"="C:\Program Files\NoPayPOKER\nopaypoker.exe:*:Enabled:nopaypoker"
"C:\Program Files\Wolfenstein - Enemy Territory\ET.exe"="C:\Program Files\Wolfenstein - Enemy Territory\ET.exe:*:Enabled:ET"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS.0\system32\PnkBstrA.exe"="C:\WINDOWS.0\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS.0\system32\PnkBstrB.exe"="C:\WINDOWS.0\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.unpacked.exe"="C:\Program Files\Activision\Call of Duty - World at War\CoDWaW.unpacked.exe:*:Enabled:Call of Duty(R): World at War Campaign/Coop"
"C:\Program Files\ASPMonitor\ASMonitor.exe"="C:\Program Files\ASPMonitor\ASMonitor.exe:*:Enabled:System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58f5ba96-cb9c-11de-b168-00040eff0813}]
shell\Auto\command - F:\Cn911.exe
shell\AutoRun\command - C:\WINDOWS.0\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{68f1ffe8-7478-11de-b0f1-c34145d70ec3}]
shell\AutoRun\command - F:\pushinst.exe


======List of files/folders created in the last 1 months======

2010-01-22 20:08:52 ----D---- C:\rsit
2010-01-22 20:08:52 ----D---- C:\Program Files\trend micro
2010-01-22 19:09:20 ----D---- C:\Documents and Settings\Fener\Application Data\Malwarebytes
2010-01-22 19:09:14 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-22 19:09:14 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-01-21 19:43:29 ----D---- C:\AVZ
2010-01-20 20:42:54 ----A---- C:\WINDOWS.0\system32\pbsvc.exe
2010-01-20 20:34:12 ----D---- C:\Program Files\Activision
2010-01-18 14:35:42 ----A---- C:\WINDOWS.0\wiso.ini
2010-01-18 14:32:44 ----D---- C:\Program Files\WISO
2010-01-18 14:32:20 ----D---- C:\Documents and Settings\All Users\Application Data\Buhl Data Service GmbH
2010-01-18 14:25:31 ----D---- C:\Documents and Settings\Fener\Application Data\Gizmo
2010-01-18 14:25:27 ----D---- C:\Program Files\Gizmo
2010-01-14 18:02:07 ----A---- C:\WINDOWS.0\system32\XAudio2_5.dll
2010-01-14 18:02:07 ----A---- C:\WINDOWS.0\system32\xactengine3_5.dll
2010-01-14 18:02:06 ----A---- C:\WINDOWS.0\system32\D3DCompiler_42.dll
2010-01-14 18:02:05 ----A---- C:\WINDOWS.0\system32\d3dcsx_42.dll
2010-01-14 18:02:04 ----A---- C:\WINDOWS.0\system32\d3dx11_42.dll
2010-01-14 18:02:04 ----A---- C:\WINDOWS.0\system32\d3dx10_42.dll
2010-01-14 18:02:03 ----A---- C:\WINDOWS.0\system32\D3DX9_42.dll
2010-01-14 18:02:02 ----A---- C:\WINDOWS.0\system32\d3dx10_41.dll
2010-01-14 18:02:02 ----A---- C:\WINDOWS.0\system32\D3DCompiler_41.dll
2010-01-14 18:02:00 ----A---- C:\WINDOWS.0\system32\XAudio2_4.dll
2010-01-14 18:02:00 ----A---- C:\WINDOWS.0\system32\XAPOFX1_3.dll
2010-01-14 18:02:00 ----A---- C:\WINDOWS.0\system32\D3DX9_41.dll
2010-01-14 18:01:59 ----A---- C:\WINDOWS.0\system32\xactengine3_4.dll
2010-01-14 18:01:57 ----A---- C:\WINDOWS.0\system32\X3DAudio1_6.dll
2010-01-14 18:01:55 ----A---- C:\WINDOWS.0\system32\d3dx10_40.dll
2010-01-14 18:01:55 ----A---- C:\WINDOWS.0\system32\D3DCompiler_40.dll
2010-01-14 18:01:54 ----A---- C:\WINDOWS.0\system32\D3DX9_40.dll
2010-01-14 18:01:53 ----A---- C:\WINDOWS.0\system32\XAudio2_3.dll
2010-01-14 18:01:53 ----A---- C:\WINDOWS.0\system32\XAPOFX1_2.dll
2010-01-14 18:01:52 ----A---- C:\WINDOWS.0\system32\xactengine3_3.dll
2010-01-14 18:01:52 ----A---- C:\WINDOWS.0\system32\X3DAudio1_5.dll
2010-01-14 18:01:51 ----A---- C:\WINDOWS.0\system32\XAudio2_2.dll
2010-01-14 18:01:51 ----A---- C:\WINDOWS.0\system32\XAPOFX1_1.dll
2010-01-14 18:01:51 ----A---- C:\WINDOWS.0\system32\xactengine3_2.dll
2010-01-14 18:01:50 ----A---- C:\WINDOWS.0\system32\d3dx10_39.dll
2010-01-14 18:01:50 ----A---- C:\WINDOWS.0\system32\D3DCompiler_39.dll
2010-01-14 18:01:49 ----A---- C:\WINDOWS.0\system32\XAudio2_1.dll
2010-01-14 18:01:49 ----A---- C:\WINDOWS.0\system32\XAPOFX1_0.dll
2010-01-14 18:01:49 ----A---- C:\WINDOWS.0\system32\D3DX9_39.dll
2010-01-14 18:01:48 ----A---- C:\WINDOWS.0\system32\xactengine3_1.dll
2010-01-14 18:01:47 ----A---- C:\WINDOWS.0\system32\X3DAudio1_4.dll
2010-01-14 18:01:46 ----A---- C:\WINDOWS.0\system32\d3dx10_38.dll
2010-01-14 18:01:46 ----A---- C:\WINDOWS.0\system32\D3DCompiler_38.dll
2010-01-14 18:01:45 ----A---- C:\WINDOWS.0\system32\D3DX9_38.dll
2010-01-14 18:01:44 ----A---- C:\WINDOWS.0\system32\XAudio2_0.dll
2010-01-14 18:01:43 ----A---- C:\WINDOWS.0\system32\xactengine3_0.dll
2010-01-14 18:01:43 ----A---- C:\WINDOWS.0\system32\X3DAudio1_3.dll
2010-01-14 18:01:41 ----A---- C:\WINDOWS.0\system32\D3DX9_37.dll
2010-01-14 18:01:41 ----A---- C:\WINDOWS.0\system32\d3dx10_37.dll
2010-01-14 18:01:41 ----A---- C:\WINDOWS.0\system32\D3DCompiler_37.dll
2010-01-14 18:01:40 ----A---- C:\WINDOWS.0\system32\xactengine2_10.dll
2010-01-14 18:01:39 ----A---- C:\WINDOWS.0\system32\d3dx9_36.dll
2010-01-14 18:01:39 ----A---- C:\WINDOWS.0\system32\d3dx10_36.dll
2010-01-14 18:01:39 ----A---- C:\WINDOWS.0\system32\D3DCompiler_36.dll
2010-01-14 18:01:37 ----A---- C:\WINDOWS.0\system32\xactengine2_9.dll
2010-01-14 18:01:36 ----A---- C:\WINDOWS.0\system32\d3dx10_35.dll
2010-01-14 18:01:36 ----A---- C:\WINDOWS.0\system32\D3DCompiler_35.dll
2010-01-14 18:01:35 ----A---- C:\WINDOWS.0\system32\d3dx9_35.dll
2010-01-14 17:59:33 ----D---- C:\WINDOWS.0\Logs
2010-01-08 14:15:33 ----A---- C:\WINDOWS.0\system32\xactengine2_8.dll
2010-01-08 14:15:33 ----A---- C:\WINDOWS.0\system32\X3DAudio1_2.dll
2010-01-08 14:15:32 ----A---- C:\WINDOWS.0\system32\xinput1_3.dll
2010-01-08 14:15:32 ----A---- C:\WINDOWS.0\system32\d3dx9_34.dll
2010-01-08 14:15:32 ----A---- C:\WINDOWS.0\system32\d3dx10_34.dll
2010-01-08 14:15:32 ----A---- C:\WINDOWS.0\system32\D3DCompiler_34.dll
2010-01-08 14:15:31 ----A---- C:\WINDOWS.0\system32\xactengine2_7.dll
2010-01-08 14:15:31 ----A---- C:\WINDOWS.0\system32\d3dx10_33.dll
2010-01-08 14:15:31 ----A---- C:\WINDOWS.0\system32\D3DCompiler_33.dll
2010-01-08 14:15:29 ----A---- C:\WINDOWS.0\system32\xactengine2_6.dll
2010-01-08 14:15:29 ----A---- C:\WINDOWS.0\system32\xactengine2_5.dll
2010-01-08 14:15:29 ----A---- C:\WINDOWS.0\system32\d3dx9_33.dll
2010-01-08 14:15:28 ----A---- C:\WINDOWS.0\system32\xactengine2_4.dll
2010-01-08 14:15:28 ----A---- C:\WINDOWS.0\system32\xactengine2_3.dll
2010-01-08 14:15:28 ----A---- C:\WINDOWS.0\system32\x3daudio1_1.dll
2010-01-08 14:15:28 ----A---- C:\WINDOWS.0\system32\d3dx9_31.dll
2010-01-08 14:15:27 ----A---- C:\WINDOWS.0\system32\xinput1_2.dll
2010-01-08 14:15:27 ----A---- C:\WINDOWS.0\system32\xinput1_1.dll
2010-01-08 14:15:27 ----A---- C:\WINDOWS.0\system32\xactengine2_2.dll
2010-01-08 14:15:27 ----A---- C:\WINDOWS.0\system32\xactengine2_1.dll
2010-01-08 14:15:20 ----A---- C:\WINDOWS.0\system32\xactengine2_0.dll
2010-01-08 14:15:20 ----A---- C:\WINDOWS.0\system32\x3daudio1_0.dll
2010-01-08 14:15:19 ----A---- C:\WINDOWS.0\system32\xinput9_1_0.dll
2010-01-08 14:15:19 ----A---- C:\WINDOWS.0\system32\d3dx9_29.dll
2010-01-08 14:15:19 ----A---- C:\WINDOWS.0\system32\d3dx9_28.dll
2010-01-08 14:15:19 ----A---- C:\WINDOWS.0\system32\d3dx9_27.dll
2010-01-08 14:15:18 ----A---- C:\WINDOWS.0\system32\d3dx9_26.dll
2010-01-08 14:15:18 ----A---- C:\WINDOWS.0\system32\d3dx9_25.dll
2010-01-08 14:15:16 ----A---- C:\WINDOWS.0\system32\d3dx9_24.dll
2010-01-08 14:14:03 ----SHD---- C:\WINDOWS.0\ftpcache
2010-01-08 14:11:59 ----A---- C:\WINDOWS.0\game.ini
2010-01-08 12:27:37 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2010-01-05 23:47:56 ----D---- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2010-01-04 14:23:10 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-01-04 14:22:48 ----RA---- C:\WINDOWS.0\system32\AdobePDFUI.dll
2010-01-04 14:22:48 ----RA---- C:\WINDOWS.0\system32\AdobePDF.dll
2010-01-04 14:10:55 ----D---- C:\Program Files\IZArc
2010-01-04 00:53:45 ----HDC---- C:\WINDOWS.0\$NtUninstallWMFDist11$
2010-01-04 00:52:06 ----D---- C:\Program Files\Windows Media Connect 2
2010-01-04 00:51:59 ----A---- C:\WINDOWS.0\system32\spupdsvc.exe
2010-01-04 00:51:55 ----HDC---- C:\WINDOWS.0\$NtUninstallwmp11$
2010-01-04 00:48:44 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-12-26 15:45:16 ----A---- C:\WINDOWS.0\system32\javaws.exe
2009-12-26 15:45:16 ----A---- C:\WINDOWS.0\system32\javaw.exe
2009-12-26 15:45:16 ----A---- C:\WINDOWS.0\system32\java.exe

======List of files/folders modified in the last 1 months======

2010-01-22 20:08:52 ----RD---- C:\Program Files
2010-01-22 20:07:58 ----D---- C:\WINDOWS.0\Temp
2010-01-22 20:07:56 ----D---- C:\Program Files\Mozilla Firefox
2010-01-22 20:07:52 ----D---- C:\Documents and Settings\All Users\Application Data\VMware
2010-01-22 20:07:18 ----D---- C:\WINDOWS.0\system32\drivers
2010-01-22 20:06:45 ----A---- C:\WINDOWS.0\SchedLgU.Txt
2010-01-22 20:06:08 ----D---- C:\Program Files\Internet Explorer
2010-01-22 19:09:20 ----D---- C:\WINDOWS.0\Prefetch
2010-01-22 18:57:41 ----D---- C:\Program Files\Mozilla Thunderbird
2010-01-21 20:02:54 ----D---- C:\WINDOWS.0\system32\CatRoot2
2010-01-21 20:02:04 ----D---- C:\WINDOWS.0
2010-01-21 19:41:56 ----SHD---- C:\System Volume Information
2010-01-21 19:41:56 ----D---- C:\WINDOWS.0\system32\Restore
2010-01-20 23:02:34 ----D---- C:\WINDOWS.0\system
2010-01-20 20:56:54 ----A---- C:\WINDOWS.0\system32\PnkBstrB.exe
2010-01-20 20:44:03 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-01-20 20:44:02 ----D---- C:\WINDOWS.0\system32\DirectX
2010-01-20 20:44:01 ----HD---- C:\WINDOWS.0\inf
2010-01-20 20:43:50 ----RSD---- C:\WINDOWS.0\assembly
2010-01-20 20:42:54 ----D---- C:\WINDOWS.0\system32\LogFiles
2010-01-20 20:42:54 ----D---- C:\WINDOWS.0\system32
2010-01-20 20:42:54 ----A---- C:\WINDOWS.0\system32\PnkBstrA.exe
2010-01-20 20:42:50 ----SHD---- C:\WINDOWS.0\Installer
2010-01-20 20:42:50 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-20 20:42:50 ----HD---- C:\Config.Msi
2010-01-20 17:03:32 ----D---- C:\Documents and Settings\Fener\Application Data\vlc
2010-01-15 14:05:04 ----D---- C:\WINDOWS.0\WinSxS
2010-01-15 13:59:19 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-01-15 06:49:57 ----D---- C:\Program Files\Windows Media Player
2010-01-15 06:49:57 ----D---- C:\Program Files\Outlook Express
2010-01-15 06:49:57 ----D---- C:\Program Files\Common Files\System
2010-01-15 06:49:56 ----D---- C:\WINDOWS.0\system32\usmt
2010-01-14 18:53:26 ----RSHDC---- C:\WINDOWS.0\system32\dllcache
2010-01-14 18:53:23 ----D---- C:\WINDOWS.0\Resources
2010-01-14 18:53:22 ----D---- C:\WINDOWS.0\Cursors
2010-01-08 14:15:21 ----D---- C:\WINDOWS.0\Microsoft.NET
2010-01-08 13:03:12 ----D---- C:\Documents and Settings\Fener\Application Data\Image Zone Express
2010-01-08 12:57:29 ----D---- C:\Documents and Settings\Fener\Application Data\Adobe
2010-01-06 21:58:47 ----D---- C:\Documents and Settings\Fener\Application Data\Skype
2010-01-06 21:34:05 ----D---- C:\Documents and Settings\Fener\Application Data\skypePM
2010-01-04 20:17:26 ----SD---- C:\Documents and Settings\Fener\Application Data\Microsoft
2010-01-04 14:23:13 ----D---- C:\Program Files\Common Files\Adobe
2010-01-04 14:23:13 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-01-04 14:23:10 ----D---- C:\Program Files\Common Files
2010-01-04 14:19:22 ----RSD---- C:\WINDOWS.0\Fonts
2010-01-04 14:18:04 ----D---- C:\Program Files\Adobe
2010-01-04 14:13:22 ----D---- C:\Documents and Settings\Fener\Application Data\VMware
2010-01-04 00:55:29 ----A---- C:\WINDOWS.0\win.ini
2010-01-04 00:52:02 ----D---- C:\WINDOWS.0\Help
2009-12-30 20:31:29 ----A---- C:\WINDOWS.0\system32\PerfStringBackup.INI
2009-12-26 15:45:13 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 GizmoDrv;Gizmo Device Driver; C:\WINDOWS.0\system32\drivers\GizmoDrv.sys [2010-01-18 23624]
R1 intelppm;Intel Processor Driver; C:\WINDOWS.0\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS.0\System32\drivers\ws2ifsl.sys [2008-04-14 12032]
R2 hcmon;VMware hcmon; \??\C:\WINDOWS.0\system32\drivers\hcmon.sys []
R2 vmci;VMware vmci; \??\C:\WINDOWS.0\system32\Drivers\vmci.sys []
R2 VMnetBridge;VMware Bridge Protocol; C:\WINDOWS.0\system32\DRIVERS\vmnetbridge.sys [2008-10-28 31280]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\WINDOWS.0\system32\drivers\vmnetuserif.sys []
R2 VMparport;VMware VMparport; \??\C:\WINDOWS.0\system32\Drivers\VMparport.sys []
R2 vmx86;VMware vmx86; \??\C:\WINDOWS.0\system32\Drivers\vmx86.sys []
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys []
R3 FWLANUSB;AVM FRITZ!WLAN; C:\WINDOWS.0\system32\DRIVERS\fwlanusb.sys [2006-04-06 264704]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS.0\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS.0\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 HssDrv;Hotspot Shield Helper Miniport; C:\WINDOWS.0\system32\DRIVERS\HssDrv.sys [2009-07-02 33840]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS.0\system32\drivers\RtkHDAud.sys [2006-09-12 4381184]
R3 mouhid;Mouse HID Driver; C:\WINDOWS.0\system32\DRIVERS\mouhid.sys [2009-07-14 12160]
R3 nv;nv; C:\WINDOWS.0\system32\DRIVERS\nv4_mini.sys [2009-06-10 8087712]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS.0\system32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
R3 tap0901;TAP-Win32 Adapter V9; C:\WINDOWS.0\system32\DRIVERS\tap0901.sys [2009-07-22 28592]
R3 tapvpn;TAP VPN Adapter; C:\WINDOWS.0\system32\DRIVERS\tapvpn.sys [2008-01-23 27136]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS.0\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS.0\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS.0\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vmkbd;VMware kbd; \??\C:\WINDOWS.0\system32\drivers\VMkbd.sys []
R3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\WINDOWS.0\system32\DRIVERS\vmnetadapter.sys [2008-10-28 16560]
R3 ZSMC301b;Philips SPC210NC Webcam; C:\WINDOWS.0\System32\Drivers\usbVM31b.sys [2005-02-26 91527]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS.0\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS.0\system32\DRIVERS\HPZid412.sys [2006-12-06 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS.0\system32\DRIVERS\HPZipr12.sys [2006-12-06 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS.0\system32\DRIVERS\HPZius12.sys [2006-12-06 21568]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS.0\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS.0\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS.0\system32\drivers\nchssvad.sys [2009-08-14 27136]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS.0\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 qmphook;QM process triggers; \??\C:\Program Files\Quick Macros 2\qmphook.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS.0\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS.0\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS.0\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS.0\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS.0\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS.0\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS.0\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS.0\system32\drivers\IntelIde.sys []
S4 sr;System Restore Filter Driver; C:\WINDOWS.0\system32\DRIVERS\sr.sys [2008-04-14 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Gizmo Central;Gizmo Central; C:\Program Files\Gizmo\gservice.exe [2010-01-18 31856]
R2 HotspotShieldService;Hotspot Shield Service; C:\Program Files\Hotspot Shield\bin\openvpnas.exe [2009-07-22 131632]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\WINDOWS.0\system32\svchost.exe [2008-04-14 14336]
R2 HssSrv;Hotspot Shield Helper Service; C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe [2009-06-15 331312]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-05-15 935208]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS.0\System32\svchost.exe [2008-04-14 14336]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS.0\system32\nvsvc32.exe [2009-06-10 168004]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS.0\System32\svchost.exe [2008-04-14 14336]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS.0\system32\PnkBstrA.exe [2010-01-20 66872]
R2 quickmacros2;Quick Macros; C:\Program Files\Quick Macros 2\qmserv.exe [2009-08-23 9728]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files\VMware\VMware Workstation\vmware-authd.exe [2008-10-28 113200]
R2 VMnetDHCP;VMware DHCP Service; C:\WINDOWS.0\system32\vmnetdhcp.exe [2008-10-28 326192]
R2 VMware NAT Service;VMware NAT Service; C:\WINDOWS.0\system32\vmnat.exe [2008-10-28 399920]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS.0\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-01-04 651720]
S3 HssTrayService;Hotspot Shield Tray Service; C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE [2009-07-22 57640]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ufad-ws60;VMware Agent Service; C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe [2008-10-02 191024]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Program Files\Windows Media Player\wmpnetwk.exe [2006-10-24 920576]

-----------------EOF-----------------

hab ich schon wieder was falsch gemacht das keiner hilft ?

Zitat von nakres

hab ich schon wieder was falsch gemacht das keiner hilft ?

Geduld ist eine Tugend!!
Ich bin zwar "Mitarbeiter" hier im Forum, d.h. aber nicht, dass ich hier 24 Stunden am Tag zur Verfügung stehe! Ich hab auch Freizeit und Du bekommst hier den Support kostenlos!

Wenn Du schnelle Hilfe haben willst, musst Du einen Vor-Ort-Service bezahlen!!

So, und nun kann ich mich um Deine Logs kümmern...

Edit: Bitte CF anwenden:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

• Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

hab das nicht so gemeint,

habe befolgt was du gesagt hast danke im voraus

ComboFix 10-01-24.03 - Fener 01/25/2010 11:17:29.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.2161 [GMT 1:00]
Running from: c:\documents and settings\Fener\Desktop\Cofi.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Philips SPC210NC Webcam
c:\documents and settings\All Users\Start Menu\Programs\Philips SPC210NC Webcam \Uninstall Philips SPC210NC Webcam.lnk
c:\windows.0\system32\sysinfo.exe

.
((((((((((((((((((((((((( Files Created from 2009-12-25 to 2010-01-25 )))))))))))))))))))))))))))))))
.

2010-01-22 19:08 . 2010-01-22 19:09 -------- d-----w- C:\rsit
2010-01-22 19:08 . 2010-01-22 19:08 -------- d-----w- c:\program files\trend micro
2010-01-22 18:09 . 2010-01-22 18:09 -------- d-----w- c:\documents and settings\Fener\Application Data\Malwarebytes
2010-01-22 18:09 . 2010-01-07 15:07 38224 ----a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys
2010-01-22 18:09 . 2010-01-22 18:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-22 18:09 . 2010-01-22 18:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-22 18:09 . 2010-01-07 15:07 19160 ----a-w- c:\windows.0\system32\drivers\mbam.sys
2010-01-21 18:43 . 2010-01-21 18:44 -------- d-----w- C:\AVZ
2010-01-20 19:42 . 2010-01-20 19:42 682280 ----a-w- c:\windows.0\system32\pbsvc.exe
2010-01-18 13:32 . 2010-01-18 13:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Buhl Data Service GmbH
2010-01-18 13:32 . 2010-01-18 13:32 -------- d-----w- c:\documents and settings\Fener\Local Settings\Application Data\Buhl Data Service
2010-01-18 13:25 . 2010-01-18 13:26 -------- d-----w- c:\documents and settings\Fener\Application Data\Gizmo
2010-01-18 13:25 . 2010-01-18 13:25 23624 ----a-w- c:\windows.0\system32\drivers\gizmodrv.sys
2010-01-18 13:25 . 2010-01-18 13:25 -------- d-----w- c:\program files\Gizmo
2010-01-14 17:02 . 2009-09-04 16:44 515416 ----a-w- c:\windows.0\system32\XAudio2_5.dll
2010-01-14 17:02 . 2009-09-04 16:44 238936 ----a-w- c:\windows.0\system32\xactengine3_5.dll
2010-01-14 17:02 . 2009-09-04 16:29 1974616 ----a-w- c:\windows.0\system32\D3DCompiler_42.dll
2010-01-14 17:02 . 2009-09-04 16:29 5501792 ----a-w- c:\windows.0\system32\d3dcsx_42.dll
2010-01-14 17:02 . 2009-09-04 16:29 453456 ----a-w- c:\windows.0\system32\d3dx10_42.dll
2010-01-14 17:02 . 2009-09-04 16:29 235344 ----a-w- c:\windows.0\system32\d3dx11_42.dll
2010-01-14 17:02 . 2009-09-04 16:29 1892184 ----a-w- c:\windows.0\system32\D3DX9_42.dll
2010-01-14 17:02 . 2009-03-09 14:27 453456 ----a-w- c:\windows.0\system32\d3dx10_41.dll
2010-01-14 17:02 . 2009-03-09 14:27 1846632 ----a-w- c:\windows.0\system32\D3DCompiler_41.dll
2010-01-14 17:02 . 2009-09-04 16:44 69464 ----a-w- c:\windows.0\system32\XAPOFX1_3.dll
2010-01-14 17:02 . 2009-03-16 13:18 517448 ----a-w- c:\windows.0\system32\XAudio2_4.dll
2010-01-14 17:02 . 2009-03-09 14:27 4178264 ----a-w- c:\windows.0\system32\D3DX9_41.dll
2010-01-14 16:59 . 2010-01-14 16:59 -------- d-----w- c:\windows.0\Logs
2010-01-08 13:14 . 2010-01-08 13:14 -------- d-sh--w- c:\windows.0\ftpcache
2010-01-08 13:12 . 2010-01-20 19:43 22328 ----a-w- c:\documents and settings\Fener\Application Data\PnkBstrK.sys
2010-01-08 11:27 . 2010-01-08 11:27 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-05 22:47 . 2010-01-05 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2010-01-04 13:23 . 2010-01-04 13:23 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-01-04 13:22 . 2008-04-07 04:38 22872 ----a-r- c:\windows.0\system32\AdobePDFUI.dll
2010-01-04 13:22 . 2008-04-07 04:38 45392 ----a-r- c:\windows.0\system32\AdobePDF.dll
2010-01-04 13:10 . 2010-01-04 13:11 -------- d-----w- c:\program files\IZArc
2010-01-03 23:55 . 2008-04-14 12:00 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-01-03 23:53 . 2010-01-03 23:53 -------- d-----w- c:\windows.0\system32\drivers\umdf
2010-01-03 23:52 . 2010-01-03 23:52 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-03 23:51 . 2006-05-16 18:11 22752 ----a-w- c:\windows.0\system32\spupdsvc.exe
2010-01-03 23:41 . 2010-01-03 23:41 -------- d-----w- c:\documents and settings\Fener\Local Settings\Application Data\ratDVD
2009-12-26 14:41 . 2009-12-26 14:41 152576 ----a-w- c:\documents and settings\Fener\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-26 14:41 . 2009-12-26 14:41 79488 ----a-w- c:\documents and settings\Fener\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-25 10:08 . 2009-07-19 16:23 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-25 10:06 . 2009-07-21 06:05 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware
2010-01-25 10:06 . 2009-07-21 06:07 -------- d-----w- c:\documents and settings\LocalService\Application Data\VMware
2010-01-24 17:52 . 2009-07-24 19:50 -------- d-----w- c:\documents and settings\Fener\Application Data\vlc
2010-01-24 14:06 . 2009-07-19 15:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-24 13:49 . 2009-08-22 18:13 138464 ----a-w- c:\windows.0\system32\drivers\PnkBstrK.sys
2010-01-24 13:49 . 2009-08-22 18:13 111928 ----a-w- c:\windows.0\system32\PnkBstrB.exe
2010-01-23 17:53 . 2009-08-03 19:28 -------- d-----w- c:\documents and settings\Fener\Application Data\Skype
2010-01-23 17:36 . 2009-08-03 19:30 -------- d-----w- c:\documents and settings\Fener\Application Data\skypePM
2010-01-20 19:42 . 2009-08-22 18:13 66872 ----a-w- c:\windows.0\system32\PnkBstrA.exe
2010-01-08 12:03 . 2009-11-19 16:14 -------- d-----w- c:\documents and settings\Fener\Application Data\Image Zone Express
2010-01-05 23:24 . 2009-10-02 21:44 8 ----a-w- c:\windows.0\system32\nvModes.dat
2010-01-05 22:47 . 2009-07-19 17:15 21960 ----a-w- c:\documents and settings\Fener\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-04 13:23 . 2009-07-21 08:05 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-04 13:13 . 2009-07-21 06:11 -------- d-----w- c:\documents and settings\Fener\Application Data\VMware
2009-12-26 14:45 . 2009-07-19 18:31 -------- d-----w- c:\program files\Java
2009-12-08 16:20 . 2009-12-08 16:20 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-08 16:19 . 2009-12-08 16:14 -------- d-----w- c:\program files\Microsoft
2009-12-08 16:19 . 2009-07-19 17:43 -------- d-----w- c:\program files\Windows Live
2009-12-08 16:16 . 2009-12-08 16:16 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-12-08 16:15 . 2009-12-08 16:15 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-12-02 11:52 . 2009-07-19 16:47 -------- d-----w- c:\program files\PartyGaming
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-07-19 17:56 204248 ----a-w- c:\program files\Hotspot Shield\HssIE\HssIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"GizmoDriveDelegate"="c:\progra~1\GIZMO\GDRIVE.DLL" [2010-01-18 390752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"="c:\program files\avmwlanstick\FRITZWLANMini.exe" [2006-06-23 343552]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 16264192]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"NvMediaCenter"="c:\windows.0\system32\NvMcTray.dll" [2009-06-10 86016]
"NvCplDaemon"="c:\windows.0\system32\NvCpl.dll" [2009-06-10 13758464]
"BigDogPath"="c:\windows.0\VM_STI.EXE" [2004-06-09 40960]
"Quick Macros"="c:\program files\Quick Macros 2\qm.exe" [2009-09-01 1224704]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows.0\system32\acaptuser32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows.0\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TrayMin210.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\TrayMin210.exe.lnk
backup=c:\windows.0\pss\TrayMin210.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 15:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 16:43 69632 ----a-r- c:\windows.0\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-10 19:52 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-r- c:\windows.0\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Documents and Settings\\Fener\\temp\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\NoPayPOKER\\nopaypoker.exe"=
"c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS.0\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS.0\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 GizmoDrv;Gizmo Device Driver;c:\windows.0\system32\drivers\gizmodrv.sys [1/18/2010 2:25 PM 23624]
R2 Gizmo Central;Gizmo Central;c:\program files\Gizmo\gservice.exe [1/18/2010 2:25 PM 31856]
R2 vmci;VMware vmci;c:\windows.0\system32\drivers\vmci.sys [10/28/2008 10:08 PM 54960]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows.0\system32\drivers\fwlanusb.sys [7/19/2009 4:27 PM 264704]
S2 quickmacros2;Quick Macros;c:\program files\Quick Macros 2\qmserv.exe [9/12/2009 12:04 PM 9728]
S3 qmphook;QM process triggers;c:\program files\Quick Macros 2\qmphook.sys [9/12/2009 12:04 PM 4096]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
FF - ProfilePath - c:\documents and settings\Fener\Application Data\Mozilla\Firefox\Profiles\ej01h1hh.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-25 11:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•A~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS.0\\system32\\FM20ENU.DLL"
.
Completion time: 2010-01-25 11:21:14
ComboFix-quarantined-files.txt 2010-01-25 10:21

Pre-Run: 33,392,472,064 bytes free
Post-Run: 33,360,343,040 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - A29905FDC8BCBEC8F7CAC124A3AB4D03

Ok. Mach bitte noch einen Kontrollscan, öffne Malwarebytes, aktualisiere das Programm, starte einen Vollscan und lass alle etwaigen Funde entfernen. Anschließend wieder das Logfile posten.

das spuckt er diesmal aus


Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3633
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

1/25/2010 12:54:17 PM
mbam-log-2010-01-25 (12-54-13).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 162351
Laufzeit: 15 minute(s), 2 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{65266D3E-5119-47A3-A4DC-8D2A2572DC49}\RP1\A0000039.sys (Malware.Trace) -> No action taken.

PS: was ist ein malware trace ?

Scheint ein Überrest in der SWH zu sein. Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des Systems durch einen Wiederherstellungspunkt wahrscheinlich wieder eine Infektion nach sich ziehen würde.

Noch weitere Meldungen oder Probleme?

die habe ich schon beim ersten mal zurückgesetzt.

ist so gesehen der pc wieder sauber das ich zb internet banking durchführen kann.

Lt. Logfiles ist der PC wieder sauber und ich denke auch, dass Du wieder Internetbanking amchen kannst. Beachte aber, dass es immer ein Restrisiko gibt.

danke dir cosinus und nächstes mal zeige ich mehr geduld