hiho. ich bräuchte hilfe bei der auswertung des logs von GMER, da ich daraus gar nicht schlüssig werde.
nachdem mein wow account gehackt wurde, riet man mir dies druchzuführen.
schonmal danke für die hilfe.. Jörg

hier das log:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-28 10:03:07
Windows 6.0.6002 Service Pack 2
Running: 0t92vrc6.exe; Driver: C:\Users\BRAUKL~1\AppData\Local\Temp\pxlyquob.sys

.text ...

---- System - GMER 1.0.15 ----

SSDT 8B366150 ZwConnectPort
SSDT 96FB0248 ZwOpenProcess
SSDT 96FB024D ZwOpenThread
SSDT 96FB0252 ZwWriteVirtualMemory
SSDT 96FB0257 ZwTerminateProcess
SSDT 96FB025C ZwCreateThread

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\a-squared Free\a2service.exe[2120] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
IAT C:\Program Files\a-squared Free\a2service.exe[2120] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [00454AB4] C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\a-squared Free\a2service.exe[2120] kernel32.dll!CreateThread + 1A 76E0C928 4 Bytes CALL 0045495D C:\Program Files\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00173104e249 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xED 0xC2 0xF3 0xBE ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2E 0x85 0x57 0x5D ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA6 0x58 0xED 0xC0 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00173104e249
Reg HKLM\SYSTEM\CurrentControlSet\Services\lvupdtio
Reg HKLM\SYSTEM\CurrentControlSet\Services\lvupdtio@DisplayName lvupdtio
Reg HKLM\SYSTEM\CurrentControlSet\Services\lvupdtio@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\lvupdtio@ImagePath \??\C:\Program Files\ASUS\ASUS Live Update\SYS\lvupdtio.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\lvupdtio@Start 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\lvupdtio@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xED 0xC2 0xF3 0xBE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2E 0x85 0x57 0x5D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA6 0x58 0xED 0xC0 ...

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 1C1 822C1904 4 Bytes [50, 61, 36, 8B]
.text ntkrnlpa.exe!KeSetEvent + 221 822C1964 4 Bytes [5C, 02, FB, 96] {POP ESP; ADD BH, BL; XCHG ESI, EAX}
.text ntkrnlpa.exe!KeSetEvent + 3F2 822C1B35 3 Bytes [02, FB, 96] {ADD BH, BL; XCHG ESI, EAX}
.text ntkrnlpa.exe!KeSetEvent + 40D 822C1B50 4 Bytes [4D, 02, FB, 96] {DEC EBP; ADD BH, BL; XCHG ESI, EAX}
.text ntkrnlpa.exe!KeSetEvent + 621 822C1D64 4 Bytes [57, 02, FB, 96] {PUSH EDI; ADD BH, BL; XCHG ESI, EAX}

---- EOF - GMER 1.0.15 ----

Hallo und

Aus dem GMER Log kann ich keine Rootkits erkennen.

Ein paar Fragen hätte ich:

1.) Hast Du schon den Blizzard-Support kontaktiert?
2.) Wie einfach oder komplex war Dein Passwort, wie viele Stellen, welcher Zeichensatz?
3.) Dasselbe Passwort auch für Dein Mailkonto oder für was anderes benutzt?
4.) Hast Du Dich an einem anderen Rechner (der vllt infiziert war!) in WoW eingeloggt?


Danach diese Liste beachten und abarbeiten. Beim Scan mit MalwareBytes auch alle externen Speicher (ext. Platten, USB-Sticks, ... mit anklemmen!! )

Wichtig für Benutzer mit Windows Vista und Windows 7: Bitte alle Tools per Rechtsklick => Als Admin ausführen!

Die Logfiles kannst Du zB alle in eine Datei zippen und auf File-Upload.net hochladen und hier verlinken, denn 1. sind manche Logfiles fürs Board nämlich zu groß und 2. kann ich mit einem Klick mir gleich alle auf einmal runterladen.

erstmal vielen dank für deine hilfe.

ja mit blizzz support hab ich schon gesprochen, die haben halt in ihrer mail geschrieben, dass ich GMER durchlaufen lassen soll.
der ging bei mir aber anfangs nich, also hab ich Sophos durchlaufen lassen und a-square secure free. beide mit befunden die ich in quarantäne verschoben hab.
cc cleaner hab ich auch vorher schon regelmäßig benutzt und Anti-Malware läuft grad durch...
wozu ist das RSIT Tool dann noch gut?
wie gesagt, musste mich bis montag noch nie mit sowas beschäftigen.

edit: achso ja, mein altes pw war nich sehr sicher muss ich zugeben...

beide mit befunden die ich in quarantäne verschoben hab.

Die Logs mit den Funden bitte auch nachreichen.

hier schonmal die von a-square:

a-squared free v. 4.5.0.27
(C) 2003-2010 Emsi Software GmbH - www.emsisoft.com

ID Object
0 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:40 Trace.TrackingCookie.de.sitestat.com!A2
1 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:69 Trace.TrackingCookie.ad.yieldmanager.com!A2
2 D:\da Gamez\Starcraft_Netzwerk\storm.dll Trojan.Win32.Vapsup.vdi!A2
3 C:\Users\Brauklaus\Documents\Studium\Skripte\Tips, Anleitungen, Hinweise und Vorlagen für Diplomarbeiten\Anleitung zur formalen Gestaltung wissenschaftlicher Arbeiten.pdf User
4 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:75 Trace.TrackingCookie.adsfac.eu!A2
5 C:\Users\Brauklaus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\44e4ef72-51af6a27.idx User
6 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:65 Trace.TrackingCookie.ad.yieldmanager.com!A2
7 D:\da Gamez\Starcraft_Netzwerk\battle.snp Trojan.Win32.Vapsup.vdf!A2
8 C:\Windows\ConfigSetRoot\WinRaR\winrar_key.zip User
9 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:83 Trace.TrackingCookie.adsfac.eu!A2
10 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:207 Trace.TrackingCookie.adserv!A2
11 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:66 Trace.TrackingCookie.ad.yieldmanager.com!A2
12 D:\da Gamez\Starcraft_Netzwerk\standard.snp Trojan.Win32.Vapsup.vdg!A2
13 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:80 Trace.TrackingCookie.adsfac.eu!A2
14 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:79 Trace.TrackingCookie.adsfac.eu!A2
15 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:81 Trace.TrackingCookie.adsfac.eu!A2
16 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:77 Trace.TrackingCookie.adsfac.eu!A2
17 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:68 Trace.TrackingCookie.ad.yieldmanager.com!A2
18 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:70 Trace.TrackingCookie.ad.yieldmanager.com!A2
19 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:181 Trace.TrackingCookie.adserv!A2
20 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:84 Trace.TrackingCookie.adsfac.eu!A2
21 C:\Users\Brauklaus\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\44e4ef72-51af6a27 User
22 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:78 Trace.TrackingCookie.adsfac.eu!A2
23 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:67 Trace.TrackingCookie.ad.yieldmanager.com!A2
24 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:76 Trace.TrackingCookie.adsfac.eu!A2
25 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:55 Trace.TrackingCookie.www.com!A2
26 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:82 Trace.TrackingCookie.adsfac.eu!A2
27 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:208 Trace.TrackingCookie.s2.trafficmaxx.de!A2
28 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:103 Trace.TrackingCookie.ad.zanox.com!A2
29 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:62 Trace.TrackingCookie.adsfac.eu!A2
30 C:\Users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\cookies.txt:71 Trace.TrackingCookie.ad.yieldmanager.com!A2
31 C:\Users\Public\starcraft\Starcraft\STAR-KEY.EXE User




bie dem sophos find ich das log nich...

8 C:\Windows\ConfigSetRoot\WinRaR\winrar_key.zip User
31C:\Users\Public\starcraft\Starcraft\STAR-KEY.EXE User

Was bitteschön ist denn das?

kannte das programm nicht und da man während des scans nicht in quarantäne verschieben konnte hab ich die manuell rein geschoben.
hab die eine mal wiederhergestellt und gleich nochmal geprüft, es waren auch insgesamt auch "nur" 2 trojaner...


C:\Windows\ConfigSetRoot\WinRaR\winrar_key.zip Virus.Win32.Trojan!IK

edit: und das noch :

C:\Users\Brauklaus\Documents\Studium\Skripte\Tips, Anleitungen, Hinweise und Vorlagen für Diplomarbeiten\Anleitung zur formalen Gestaltung wissenschaftlicher Arbeiten.pdf Exploit.PDF-JS!IK

Lade dir Lop S&D herunter.

Führe Lop S&D.exe per Doppelklick aus. VISTA-User: Rechtsklick => Ausführen als Admin!!
Wähle die Sprache deiner Wahl und anschließend die Option 1.
Warte bis der Scanbericht erstellt wird und poste ihn hier (Du findest ihn unter C:\lopR.txt, sollte der Bericht nicht erscheinen).

alles klar:



--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU T5300 @ 1.73GHz )
BIOS : Default System BIOS
USER : Brauklaus ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 2007 (Activated)
Firewall : Norton Internet Security 2007 (Not Activated)
C:\ (Local Disk) - NTFS - Total:67 Go (Free:6 Go)
D:\ (Local Disk) - NTFS - Total:39 Go (Free:19 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 28.01.2010|13:50 )

[ UAC => 1 ]

--------------------\\ Ordner Verzeichnis unter Local

[27.09.2007|17:36] C:\Users\BRAUKL~1\AppData\Local\Adobe
[07.02.2008|13:58] C:\Users\BRAUKL~1\AppData\Local\Ahead
[22.04.2007|17:31] C:\Users\BRAUKL~1\AppData\Local\Anwendungsdaten
[21.08.2009|17:21] C:\Users\BRAUKL~1\AppData\Local\ATI
[11.11.2009|20:07] C:\Users\BRAUKL~1\AppData\Local\Blizzard Entertainment
[14.03.2007|11:49] C:\Users\BRAUKL~1\AppData\Local\cmdial32.dll
[18.02.2008|18:14] C:\Users\BRAUKL~1\AppData\Local\d3d9caps.dat
[18.01.2010|19:31] C:\Users\BRAUKL~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[10.12.2009|19:03] C:\Users\BRAUKL~1\AppData\Local\eMule
[07.06.2009|01:21] C:\Users\BRAUKL~1\AppData\Local\GDIPFONTCACHEV1.DAT
[22.07.2009|17:25] C:\Users\BRAUKL~1\AppData\Local\Google
[27.01.2010|23:06] C:\Users\BRAUKL~1\AppData\Local\IconCache.db
[15.12.2009|09:23] C:\Users\BRAUKL~1\AppData\Local\install.exe.manifest
[23.07.2008|22:18] C:\Users\BRAUKL~1\AppData\Local\Microsoft
[31.08.2008|09:04] C:\Users\BRAUKL~1\AppData\Local\Microsoft Games
[23.07.2008|22:18] C:\Users\BRAUKL~1\AppData\Local\Microsoft Help
[14.11.2007|13:31] C:\Users\BRAUKL~1\AppData\Local\Mozilla
[03.01.2010|14:55] C:\Users\BRAUKL~1\AppData\Local\PokerStars
[26.10.2009|20:59] C:\Users\BRAUKL~1\AppData\Local\PokerStars.NET
[28.01.2010|13:48] C:\Users\BRAUKL~1\AppData\Local\Temp
[22.04.2007|17:31] C:\Users\BRAUKL~1\AppData\Local\Temporary Internet Files
[06.05.2008|19:04] C:\Users\BRAUKL~1\AppData\Local\TVU Networks
[22.04.2007|17:31] C:\Users\BRAUKL~1\AppData\Local\Verlauf
[25.04.2007|18:46] C:\Users\BRAUKL~1\AppData\Local\VirtualStore
[18.12.2008|21:13] C:\Users\BRAUKL~1\AppData\Local\Zattoo
[18.12.2008|18:10] C:\Users\BRAUKL~1\AppData\Local\ZattooPlayer
[6|Datei(en),] C:\Users\BRAUKL~1\AppData\Local\Bytes
[22|Verzeichnis(se),] C:\Users\BRAUKL~1\AppData\Local\Bytes frei

--------------------\\ Geplante Aufgaben unter C:\Windows\Tasks

[28.01.2010 13:48][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[28.01.2010 13:44][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[28.01.2010 13:44][--a------] C:\Windows\tasks\1-Klick-Wartung.job
[27.01.2010 14:53][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{8D8A6358-CDDD-4536-BD61-E992DE1BAF44}.job
[28.01.2010 13:44][--ah-----] C:\Windows\tasks\SA.DAT
[27.01.2010 23:07][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Ordner Verzeichnis unter C:\ProgramData

[17.11.2007|12:58] C:\ProgramData\addr_file.html
[27.01.2010|14:24] C:\ProgramData\Adobe
[11.11.2007|15:39] C:\ProgramData\Apple Computer
[02.11.2006|14:02] C:\ProgramData\Application Data
[08.11.2007|11:28] C:\ProgramData\ASUS
[17.11.2007|12:54] C:\ProgramData\Avira
[17.10.2008|10:43] C:\ProgramData\Blizzard
[01.09.2009|13:15] C:\ProgramData\Blizzard Entertainment
[09.01.2008|19:29] C:\ProgramData\Creative
[23.05.2007|03:06] C:\ProgramData\DAEMON Tools Lite
[02.11.2006|14:02] C:\ProgramData\Desktop
[02.11.2006|14:02] C:\ProgramData\Documents
[10.12.2009|19:03] C:\ProgramData\eMule
[18.11.2007|19:38] C:\ProgramData\ezsid.dat
[10.06.2008|22:33] C:\ProgramData\ezsidmv.dat
[02.11.2006|14:02] C:\ProgramData\Favorites
[17.05.2007|14:01] C:\ProgramData\InstallShield
[07.09.2007|17:32] C:\ProgramData\LUUnInstall.LiveUpdate
[28.01.2010|10:37] C:\ProgramData\Malwarebytes
[23.07.2008|17:51] C:\ProgramData\Microsoft
[23.07.2008|17:51] C:\ProgramData\Microsoft Help
[09.01.2008|19:14] C:\ProgramData\muvee Technologies
[18.10.2008|17:30] C:\ProgramData\Nero
[06.04.2007|15:22] C:\ProgramData\P4G
[18.11.2007|19:33] C:\ProgramData\Skype
[27.01.2010|22:06] C:\ProgramData\Spybot - Search & Destroy
[02.11.2006|14:02] C:\ProgramData\Start Menu
[07.09.2007|17:58] C:\ProgramData\Symantec
[24.10.2008|16:02] C:\ProgramData\TEMP
[02.11.2006|14:02] C:\ProgramData\Templates
[22.04.2007|17:51] C:\ProgramData\T-Online
[18.02.2008|16:55] C:\ProgramData\TuneUp Software
[29.09.2009|20:33] C:\ProgramData\TVU Networks
[06.11.2007|15:27] C:\ProgramData\Ulead Systems
[08.09.2008|14:17] C:\ProgramData\WindowsSearch
[03.02.2009|00:12] C:\ProgramData\xml6AC6.tmp
[03.02.2009|00:12] C:\ProgramData\xml6D65.tmp
[03.02.2009|00:12] C:\ProgramData\xml6E60.tmp
[7|Datei(en),] C:\ProgramData\Bytes
[33|Verzeichnis(se),] C:\ProgramData\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Program Files

[27.01.2010|13:57] C:\Program Files\Adobe
[07.11.2007|08:37] C:\Program Files\ArcorOnline
[27.01.2010|14:34] C:\Program Files\a-squared Free
[08.11.2007|14:31] C:\Program Files\ASUS
[06.04.2007|15:15] C:\Program Files\ATI
[06.04.2007|15:15] C:\Program Files\ATI Technologies
[17.11.2007|12:54] C:\Program Files\Avira
[06.11.2007|15:23] C:\Program Files\Azureus
[17.10.2007|10:48] C:\Program Files\Buka
[07.07.2009|11:46] C:\Program Files\CCleaner
[15.12.2009|09:32] C:\Program Files\Classic Menu for Office
[22.07.2009|17:23] C:\Program Files\Common Files
[09.01.2008|19:42] C:\Program Files\Creative
[06.06.2009|18:12] C:\Program Files\directx
[22.07.2009|17:24] C:\Program Files\DivX
[28.12.2008|13:58] C:\Program Files\DopLive
[27.09.2007|17:50] C:\Program Files\Foxit Software
[22.07.2009|17:24] C:\Program Files\Google
[07.07.2009|09:56] C:\Program Files\Hamachi
[18.02.2008|17:06] C:\Program Files\HP DeskJet 640C Series
[16.07.2009|13:35] C:\Program Files\ICQ6
[12.01.2010|11:29] C:\Program Files\ICQ6.5
[03.10.2008|22:52] C:\Program Files\InstallShield Installation Information
[06.04.2007|15:12] C:\Program Files\Intel
[27.01.2010|14:11] C:\Program Files\Internet Explorer
[02.11.2007|10:54] C:\Program Files\Java
[28.01.2010|10:37] C:\Program Files\Malwarebytes' Anti-Malware
[06.06.2009|18:24] C:\Program Files\Microsoft Games
[04.05.2007|19:00] C:\Program Files\Microsoft Office
[23.07.2008|17:46] C:\Program Files\Microsoft SDKs
[23.07.2008|17:55] C:\Program Files\Microsoft SQL Server
[23.07.2008|17:51] C:\Program Files\Microsoft SQL Server Compact Edition
[23.07.2008|17:51] C:\Program Files\Microsoft Synchronization Services
[23.07.2008|17:51] C:\Program Files\Microsoft Visual Studio 9.0
[04.05.2007|19:01] C:\Program Files\Microsoft Works
[23.07.2008|17:53] C:\Program Files\Microsoft.NET
[27.01.2010|14:11] C:\Program Files\Movie Maker
[27.05.2009|15:02] C:\Program Files\Mozilla Firefox
[02.11.2006|13:37] C:\Program Files\MSBuild
[10.01.2007|20:56] C:\Program Files\MSXML 4.0
[09.01.2008|19:15] C:\Program Files\muvee Technologies
[07.09.2007|18:03] C:\Program Files\Norton Internet Security
[15.12.2009|09:34] C:\Program Files\OpenXML-ODF Translator
[06.04.2007|15:22] C:\Program Files\P4G
[24.06.2009|07:59] C:\Program Files\PDFTK Builder
[17.11.2009|10:45] C:\Program Files\PokerStars
[03.11.2009|15:46] C:\Program Files\PokerStars.NET
[06.11.2007|15:24] C:\Program Files\PowerForPhone
[11.11.2007|15:42] C:\Program Files\QuickTime
[06.04.2007|15:16] C:\Program Files\Realtek
[02.11.2006|13:37] C:\Program Files\Reference Assemblies
[30.07.2007|10:59] C:\Program Files\Sierra On-Line
[09.01.2008|19:13] C:\Program Files\SightSpeed
[18.11.2007|19:33] C:\Program Files\Skype
[29.09.2009|20:46] C:\Program Files\SopCast
[27.01.2010|15:32] C:\Program Files\Sophos
[27.01.2010|07:43] C:\Program Files\Spybot - Search & Destroy
[06.04.2007|15:30] C:\Program Files\Symantec
[06.04.2007|15:24] C:\Program Files\Synaptics
[01.12.2007|15:32] C:\Program Files\Teamspeak2_RC2
[22.04.2007|17:51] C:\Program Files\T-Online
[18.02.2008|16:55] C:\Program Files\TuneUp Utilities 2008
[29.09.2009|20:33] C:\Program Files\TVUPlayer
[02.11.2006|14:01] C:\Program Files\Uninstall Information
[10.12.2009|13:56] C:\Program Files\uTorrent
[14.07.2009|10:37] C:\Program Files\Valve
[28.10.2008|17:47] C:\Program Files\Veetle
[14.05.2007|21:03] C:\Program Files\VideoLAN
[27.01.2010|14:11] C:\Program Files\Windows Calendar
[27.01.2010|14:11] C:\Program Files\Windows Collaboration
[27.01.2010|14:11] C:\Program Files\Windows Defender
[27.01.2010|14:11] C:\Program Files\Windows Journal
[27.01.2010|14:11] C:\Program Files\Windows Mail
[27.01.2010|14:11] C:\Program Files\Windows Media Player
[02.11.2006|13:37] C:\Program Files\Windows NT
[27.01.2010|14:11] C:\Program Files\Windows Photo Gallery
[27.01.2010|20:28] C:\Program Files\Windows Portable Devices
[27.01.2010|14:11] C:\Program Files\Windows Sidebar
[20.05.2007|11:33] C:\Program Files\WinRAR
[06.04.2007|15:19] C:\Program Files\Wireless Console 2
[27.01.2010|20:39] C:\Program Files\World of Warcraft
[0|Datei(en),] C:\Program Files\Bytes
[83|Verzeichnis(se),] C:\Program Files\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Program Files\Common Files

[27.01.2010|13:58] C:\Program Files\Common Files\Adobe
[30.01.2008|23:14] C:\Program Files\Common Files\Ahead
[22.04.2007|18:36] C:\Program Files\Common Files\Blizzard Entertainment
[22.07.2009|17:23] C:\Program Files\Common Files\DivX Shared
[18.02.2008|14:01] C:\Program Files\Common Files\InstallShield
[13.05.2007|13:50] C:\Program Files\Common Files\Java
[28.05.2007|17:44] C:\Program Files\Common Files\LightScribe
[22.04.2007|17:51] C:\Program Files\Common Files\Marmiko Shared
[23.07.2008|17:53] C:\Program Files\Common Files\microsoft shared
[09.01.2008|19:15] C:\Program Files\Common Files\muvee Technologies
[18.10.2008|17:30] C:\Program Files\Common Files\Nero
[22.07.2009|17:23] C:\Program Files\Common Files\PX Storage Engine
[02.11.2006|12:18] C:\Program Files\Common Files\Services
[10.06.2008|22:32] C:\Program Files\Common Files\Skype
[02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines
[30.10.2007|00:25] C:\Program Files\Common Files\SWF Studio
[07.09.2007|17:58] C:\Program Files\Common Files\Symantec Shared
[27.01.2010|14:11] C:\Program Files\Common Files\System
[18.02.2008|16:53] C:\Program Files\Common Files\Wise Installation Wizard
[0|Datei(en),] C:\Program Files\Common Files\Bytes
[21|Verzeichnis(se),] C:\Program Files\Common Files\Bytes frei

--------------------\\ Process

( 57 Processes )

... OK !

--------------------\\ Ueberpruefung mit S_Lop

Kein Lop Ordner gefunden !

--------------------\\ Suche nach Lop Dateien - Ordnern

Kein Lop Ordner gefunden !

--------------------\\ Suche innerhalb der Registry

..... OK !

--------------------\\ Ueberpruefung der Hosts Datei

Hosts Datei SAUBER


--------------------\\ Suche nach verborgenen Dateien mit Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-28 13:50:25
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Suche nach anderen Infektionen


Kein anderen Infektionen gefunden !

[F:21][D:5]-> C:\Users\BRAUKL~1\AppData\Local\Temp
[F:1][D:1]-> C:\Users\BRAUKL~1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:12][D:4]-> C:\Users\BRAUKL~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:9][D:4]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 28.01.2010|13:52 - Option : [1]

--------------------\\ Scan beendet um 13:52:11
[ UAC => 1 ]

Hm, postest Du auch noch die Logs von Malwarebytes und RSIT ?

jo grad erst aus uni gekommen..

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3649
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

28.01.2010 17:31:10
mbam-log-2010-01-28 (17-31-05).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 258273
Laufzeit: 1 hour(s), 54 minute(s), 39 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Brauklaus\AppData\Local\Temp\xml_inc.dll (Trojan.GamesThief) -> No action taken.


kann ich die datein in dem programm löschen oder muss ich das manuell machen?

jut, letzteres hat sich erledigt, button nich gefunden

hier noch das RSIT log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Brauklaus at 2010-01-28 18:00:00
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 7 GB (9%) free of 69 GB
Total RAM: 1023 MB (33% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:00:51, on 28.01.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\V0350Mon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Brauklaus\Desktop\RSIT.exe
C:\Program Files\trend micro\Brauklaus.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.mini20.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.arcor.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [C:\Windows\system32\V0350Ext.ax] C:\Windows\system32\RegSvr32.exe /s C:\Windows\system32\V0350Ext.ax
O4 - HKLM\..\Run: [V0350Mon.exe] C:\Windows\V0350Mon.exe
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Update Service (gupdate1ca0ae8ae8cdfe5) (gupdate1ca0ae8ae8cdfe5) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - T-Online International AG, Marmiko IT-Solutions GmbH - C:\Program Files\Common Files\Marmiko Shared\MZCCntrl.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 7594 bytes

======Scheduled tasks folder======

C:\Windows\tasks\1-Klick-Wartung.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{8D8A6358-CDDD-4536-BD61-E992DE1BAF44}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2009-12-18 61888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-05-30 1410344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2006-12-01 4186112]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-22 815104]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-17 266497]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2009-12-18 40368]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"C:\Windows\system32\V0350Ext.ax"=C:\Windows\system32\RegSvr32.exe [2006-11-02 14336]
"V0350Mon.exe"=C:\Windows\V0350Mon.exe [2007-08-23 28672]
" Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-01-07 1394000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11ab619e-d4dd-11dd-8fd1-0019d2cf38e2}]
shell\AutoRun\command - F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17899c47-d020-11dd-a0b6-001a92d8eec8}]
shell\AutoRun\command - F:\Menu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dbac9a49-08d2-11dc-932b-0019d2cf38e2}]
shell\AutoRun\command - G:\HL2UE_setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f02a0a8c-1444-11dd-936c-001a92d8eec8}]
shell\AutoRun\command - F:\wd_windows_tools\setup.exe


======List of files/folders created in the last 1 months======

2010-01-28 18:00:01 ----D---- C:\Program Files\trend micro
2010-01-28 18:00:00 ----D---- C:\rsit
2010-01-28 13:50:04 ----A---- C:\lopR.txt
2010-01-28 13:49:26 ----D---- C:\Lop SD
2010-01-28 10:37:48 ----D---- C:\Users\Brauklaus\AppData\Roaming\Malwarebytes
2010-01-28 10:37:31 ----D---- C:\ProgramData\Malwarebytes
2010-01-28 10:37:29 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-27 20:28:24 ----D---- C:\Program Files\Windows Portable Devices
2010-01-27 20:25:57 ----A---- C:\Windows\system32\UIAnimation.dll
2010-01-27 20:25:56 ----A---- C:\Windows\system32\UIRibbonRes.dll
2010-01-27 20:25:55 ----A---- C:\Windows\system32\UIRibbon.dll
2010-01-27 20:25:18 ----A---- C:\Windows\system32\WMPhoto.dll
2010-01-27 20:25:17 ----A---- C:\Windows\system32\cdd.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\XpsRasterService.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\WindowsCodecs.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2010-01-27 20:25:15 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\dxdiagn.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\dxdiag.exe
2010-01-27 20:25:15 ----A---- C:\Windows\system32\d3d10warp.dll
2010-01-27 20:25:15 ----A---- C:\Windows\system32\d2d1.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\xpsservices.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\XpsPrint.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\OpcServices.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\FntCache.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\DWrite.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\d3d11.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\d3d10level9.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\d3d10core.dll
2010-01-27 20:25:14 ----A---- C:\Windows\system32\d3d10_1core.dll
2010-01-27 20:25:13 ----A---- C:\Windows\system32\dxgi.dll
2010-01-27 20:25:13 ----A---- C:\Windows\system32\d3d10_1.dll
2010-01-27 20:25:13 ----A---- C:\Windows\system32\d3d10.dll
2010-01-27 20:24:37 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2010-01-27 20:24:37 ----A---- C:\Windows\system32\wpdbusenum.dll
2010-01-27 20:24:37 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2010-01-27 20:24:34 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2010-01-27 20:24:32 ----A---- C:\Windows\system32\WpdMtpUS.dll
2010-01-27 20:24:32 ----A---- C:\Windows\system32\WpdConns.dll
2010-01-27 20:24:31 ----A---- C:\Windows\system32\wpdshext.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\WPDSp.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\WpdMtp.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\wpd_ci.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2010-01-27 20:24:30 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2010-01-27 20:23:05 ----A---- C:\Windows\system32\oleaccrc.dll
2010-01-27 20:23:04 ----A---- C:\Windows\system32\UIAutomationCore.dll
2010-01-27 20:23:04 ----A---- C:\Windows\system32\oleacc.dll
2010-01-27 15:32:47 ----D---- C:\Program Files\Sophos
2010-01-27 14:30:08 ----D---- C:\Program Files\a-squared Free
2010-01-27 14:09:15 ----D---- C:\Windows\system32\eu-ES
2010-01-27 14:09:15 ----D---- C:\Windows\system32\ca-ES
2010-01-27 14:09:12 ----D---- C:\Windows\system32\vi-VN
2010-01-27 13:49:39 ----SHD---- C:\Config.Msi
2010-01-27 13:28:02 ----D---- C:\Windows\system32\EventProviders
2010-01-22 07:53:02 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 07:53:01 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 07:52:57 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 07:52:56 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 07:52:53 ----A---- C:\Windows\system32\ieapfltr.dll
2010-01-22 07:52:52 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 07:52:51 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 07:52:48 ----A---- C:\Windows\system32\ieencode.dll
2010-01-13 11:38:20 ----A---- C:\Windows\system32\t2embed.dll
2010-01-13 11:38:20 ----A---- C:\Windows\system32\fontsub.dll

======List of files/folders modified in the last 1 months======

2010-01-28 18:00:05 ----D---- C:\Windows\Temp
2010-01-28 18:00:01 ----RD---- C:\Program Files
2010-01-28 17:58:39 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-01-28 17:58:35 ----D---- C:\Windows\Minidump
2010-01-28 17:58:35 ----D---- C:\Windows
2010-01-28 17:51:06 ----D---- C:\Windows\system32\drivers
2010-01-28 17:49:09 ----D---- C:\Windows\Speech
2010-01-28 16:38:22 ----SHD---- C:\System Volume Information
2010-01-28 13:45:54 ----D---- C:\Windows\Prefetch
2010-01-28 10:37:31 ----HD---- C:\ProgramData
2010-01-28 09:24:34 ----D---- C:\Users\Brauklaus\AppData\Roaming\uTorrent
2010-01-27 22:21:13 ----D---- C:\Windows\System32
2010-01-27 20:56:59 ----D---- C:\Windows\rescache
2010-01-27 20:39:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-01-27 20:39:22 ----D---- C:\Windows\inf
2010-01-27 20:39:08 ----D---- C:\Program Files\World of Warcraft
2010-01-27 20:33:48 ----D---- C:\Windows\system32\Tasks
2010-01-27 20:28:26 ----D---- C:\Windows\system32\de-DE
2010-01-27 20:28:24 ----D---- C:\Windows\system32\wbem
2010-01-27 20:28:21 ----D---- C:\Windows\system32\zh-TW
2010-01-27 20:28:21 ----D---- C:\Windows\system32\zh-HK
2010-01-27 20:28:21 ----D---- C:\Windows\system32\zh-CN
2010-01-27 20:28:21 ----D---- C:\Windows\system32\uk-UA
2010-01-27 20:28:21 ----D---- C:\Windows\system32\tr-TR
2010-01-27 20:28:21 ----D---- C:\Windows\system32\th-TH
2010-01-27 20:28:21 ----D---- C:\Windows\system32\sv-SE
2010-01-27 20:28:21 ----D---- C:\Windows\system32\sr-Latn-CS
2010-01-27 20:28:21 ----D---- C:\Windows\system32\sl-SI
2010-01-27 20:28:21 ----D---- C:\Windows\system32\sk-SK
2010-01-27 20:28:21 ----D---- C:\Windows\system32\pt-PT
2010-01-27 20:28:21 ----D---- C:\Windows\system32\pt-BR
2010-01-27 20:28:21 ----D---- C:\Windows\system32\pl-PL
2010-01-27 20:28:21 ----D---- C:\Windows\system32\nl-NL
2010-01-27 20:28:21 ----D---- C:\Windows\system32\lv-LV
2010-01-27 20:28:21 ----D---- C:\Windows\system32\lt-LT
2010-01-27 20:28:21 ----D---- C:\Windows\system32\ko-KR
2010-01-27 20:28:21 ----D---- C:\Windows\system32\ja-JP
2010-01-27 20:28:21 ----D---- C:\Windows\system32\it-IT
2010-01-27 20:28:21 ----D---- C:\Windows\system32\hu-HU
2010-01-27 20:28:21 ----D---- C:\Windows\system32\hr-HR
2010-01-27 20:28:21 ----D---- C:\Windows\system32\he-IL
2010-01-27 20:28:21 ----D---- C:\Windows\system32\fr-FR
2010-01-27 20:28:21 ----D---- C:\Windows\system32\fi-FI
2010-01-27 20:28:21 ----D---- C:\Windows\system32\et-EE
2010-01-27 20:28:21 ----D---- C:\Windows\system32\es-ES
2010-01-27 20:28:21 ----D---- C:\Windows\system32\el-GR
2010-01-27 20:28:21 ----D---- C:\Windows\system32\cs-CZ
2010-01-27 20:28:21 ----D---- C:\Windows\system32\bg-BG
2010-01-27 20:28:20 ----D---- C:\Windows\system32\ru-RU
2010-01-27 20:28:20 ----D---- C:\Windows\system32\ro-RO
2010-01-27 20:28:20 ----D---- C:\Windows\system32\nb-NO
2010-01-27 20:28:20 ----D---- C:\Windows\system32\en-US
2010-01-27 20:28:20 ----D---- C:\Windows\system32\da-DK
2010-01-27 20:28:20 ----D---- C:\Windows\system32\ar-SA
2010-01-27 20:28:09 ----D---- C:\Windows\Microsoft.NET
2010-01-27 20:28:07 ----RSD---- C:\Windows\assembly
2010-01-27 20:26:15 ----D---- C:\Windows\winsxs
2010-01-27 20:26:12 ----D---- C:\Windows\system32\catroot
2010-01-27 20:25:40 ----D---- C:\Windows\system32\catroot2
2010-01-27 14:24:46 ----D---- C:\ProgramData\Adobe
2010-01-27 14:23:05 ----SHD---- C:\Boot
2010-01-27 14:11:32 ----D---- C:\Program Files\Windows Mail
2010-01-27 14:11:32 ----D---- C:\Program Files\Windows Calendar
2010-01-27 14:11:32 ----D---- C:\Program Files\Movie Maker
2010-01-27 14:11:29 ----D---- C:\Program Files\Windows Sidebar
2010-01-27 14:11:29 ----D---- C:\Program Files\Internet Explorer
2010-01-27 14:11:28 ----D---- C:\Program Files\Windows Media Player
2010-01-27 14:11:28 ----D---- C:\Program Files\Windows Collaboration
2010-01-27 14:11:27 ----D---- C:\Program Files\Windows Journal
2010-01-27 14:11:24 ----D---- C:\Program Files\Windows Photo Gallery
2010-01-27 14:11:24 ----D---- C:\Program Files\Common Files\System
2010-01-27 14:11:17 ----D---- C:\Windows\servicing
2010-01-27 14:11:17 ----D---- C:\Windows\ehome
2010-01-27 14:11:17 ----D---- C:\Program Files\Windows Defender
2010-01-27 14:10:53 ----D---- C:\Windows\IME
2010-01-27 14:10:52 ----D---- C:\Windows\system32\XPSViewer
2010-01-27 14:10:46 ----D---- C:\Windows\system32\oobe
2010-01-27 14:10:45 ----D---- C:\Windows\system32\migration
2010-01-27 14:10:39 ----D---- C:\Windows\system32\setup
2010-01-27 14:10:39 ----D---- C:\Windows\system32\AdvancedInstallers
2010-01-27 14:10:38 ----D---- C:\Windows\system32\SLUI
2010-01-27 14:10:37 ----D---- C:\Windows\system32\manifeststore
2010-01-27 14:10:30 ----D---- C:\Windows\system32\migwiz
2010-01-27 14:09:22 ----RSD---- C:\Windows\Fonts
2010-01-27 14:09:21 ----D---- C:\Windows\AppPatch
2010-01-27 14:09:12 ----D---- C:\Windows\system32\Boot
2010-01-27 13:58:48 ----SHD---- C:\Windows\Installer
2010-01-27 13:58:06 ----D---- C:\Program Files\Common Files\Adobe
2010-01-27 13:57:37 ----D---- C:\Program Files\Adobe
2010-01-27 07:43:00 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-01-26 10:59:59 ----D---- C:\Users\Brauklaus\AppData\Roaming\ICQ
2010-01-20 20:32:36 ----D---- C:\Users\Brauklaus\AppData\Roaming\teamspeak2
2010-01-18 08:50:59 ----D---- C:\Windows\Debug
2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-01-12 11:29:59 ----D---- C:\Program Files\ICQ6.5
2010-01-05 01:17:46 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys [2009-05-27 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-05-27 75096]
R1 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-10-20 202872]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2008-04-23 21248]
R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2006-10-24 185744]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2006-12-28 18688]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2006-11-14 32256]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2006-11-14 43520]
R2 RMCAST;RMCAST (Pgm)-Protokolltreiber; C:\Windows\system32\DRIVERS\RMCAST.sys [2009-04-11 113664]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [2009-05-27 52056]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2006-12-01 1655464]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adaptertreiber für Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-12-19 1786880]
R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-12-21 2305536]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2009-12-20 234016]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
R3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2006-10-24 11792]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2007-04-06 109744]
R3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2006-10-24 144784]
R3 SYMIDS;SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [2006-10-24 38928]
R3 SYMNDISV;SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [2006-10-24 37008]
R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2006-10-24 26384]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-11-22 181304]
S3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2006-11-02 19456]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2006-11-02 92160]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2006-11-02 220160]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2006-11-02 29184]
S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2008-01-15 25280]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]
S3 ipswuio;ipswuio; C:\Windows\System32\DRIVERS\ipswuio.sys []
S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\MARMIK~1\MACNDIS5.SYS [2005-11-24 17280]
S3 MEMSWEEP2;MEMSWEEP2; \??\C:\Windows\system32\9DB6.tmp []
S3 MODEMCSA;Unimodem-Datenstromfiltergerät; C:\Windows\system32\drivers\MODEMCSA.sys [2008-01-19 18432]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver; \??\C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2005-09-28 17664]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2006-11-02 49664]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\Sandra.sys []
S3 SQTECH930B;SQ930 USB 2.0 Video Camera; C:\Windows\System32\Drivers\Capt930b.sys []
S3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 VF0350Afx;VF0350 Audio FX; C:\Windows\system32\Drivers\V0350Afx.sys [2007-06-11 142656]
S3 VF0350Vfx;VF0350 Video FX; C:\Windows\system32\DRIVERS\V0350VFx.sys [2007-03-05 7424]
S3 VF0350Vid;Live! Cam Video IM (VF0350); C:\Windows\system32\DRIVERS\V0350Vid.sys [2007-08-29 170368]
S3 WCPU;WCPU; \??\C:\Program Files\P4G\WCPU.sys [2007-01-02 11120]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files\a-squared Free\a2service.exe [2009-10-01 1858144]
R2 AntiVirScheduler;AntiVir PersonalEdition Classic Planer; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-24 68865]
R2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-24 151297]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2006-12-21 557056]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-04-30 554616]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-10-24 107624]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-10-24 107624]
R2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-10-24 107624]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst; C:\Program Files\Common Files\Marmiko Shared\MZCCntrl.exe [2005-11-15 61440]
R2 SymAppCore;Symantec AppCore Service; C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2006-09-20 46736]
S2 gupdate1ca0ae8ae8cdfe5;Google Update Service (gupdate1ca0ae8ae8cdfe5); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-22 133104]
S3 BthServ;Bluetooth-Unterstützungsdienst; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 comHost;COM Host; C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2006-10-13 49296]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 ISPwdSvc;Symantec IS Password Validation; C:\Program Files\Norton Internet Security\isPwdSvc.exe [2006-10-27 80552]
S3 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
S3 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2006-12-29 123248]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
S3 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe []
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2008-02-18 307968]
S3 UxTuneUp;TuneUp Designerweiterung; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440]
S4 MSSQLServerADHelper;Hilfsdienst von SQL Server für Active Directory; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 SQLBrowser;SQL Server-Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]

-----------------EOF-----------------

bin ich jetz clean ?

gruß jörg

Bitte mal den Avenger anwenden


1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:



3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

files to delete:
C:\Windows\System32\DRIVERS\ipswuio.sys
C:\Windows\system32\9DB6.tmp

drivers to delete:
ipswuio
MEMSWEEP2
         

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net - Ihr kostenloser File Hoster! hochladen und hier verlinken.

das log:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\Windows\System32\DRIVERS\ipswuio.sys" not found!
Deletion of file "C:\Windows\System32\DRIVERS\ipswuio.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\Windows\system32\9DB6.tmp" not found!
Deletion of file "C:\Windows\system32\9DB6.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Driver "ipswuio" deleted successfully.
Driver "MEMSWEEP2" deleted successfully.

Completed script processing.


und hier der link fürs backup:

http://www.file-upload.net/download-2210399/backup.zip.html