Rootkit.Agent../System32/Drivers/

Fanta · 14.05.2010, 17:45

Hallo,

ich brauche bitte Hilfe bei folgendem Problem:

den CC Cleaner habe ich schon angewand.

Malwarebytes brachte folgendes Ergebsnis:
ich kann die "Auswahl entfernen". Im erneuten Scan taucht er wieder auf.

Wie bekomme ich ihn los.

Danke und Gruß

Fanta

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 6.0.6000
Internet Explorer 7.0.6000.16575

14.05.2010 18:21:08
mbam-log-2010-05-14 (18-21-08).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 122874
Laufzeit: 28 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\system32\Drivers\ztjqo.sys (Rootkit.Agent) -> No action taken.

cosinus · 14.05.2010, 17:56

Hallo und

Bei diesem Rootkit ist ein GMER und OSAM Log notwendig, bitte erstellen + posten.

StLB · 14.05.2010, 17:58

... zu langsam

Fanta · 15.05.2010, 13:36

Hallo,

GMER funtkioniert leider nicht. Entweder stürzt der Laptop ab oder das
Programm wird mit einem Fehler beendet.

Das Andere hat funktioniert. Hier der log:

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 09:35:33 on 15.05.2010

OS: Windows Vista Home Premium Edition (Build 6000), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.3

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries

[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Norton Security Scan for Esther.job" - "Symantec Corporation" - C:\Program Files\Norton Security Scan\Nss.exe
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2008\OneClick.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"collab.cpl" - "Microsoft Corporation" - C:\Windows\system32\collab.cpl
"DModem.cpl" - ? - C:\Windows\system32\DModem.cpl
"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\Windows\system32\ISUSPM.cpl
"stacgui.cpl" - "SigmaTel, Inc." - C:\Windows\system32\stacgui.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"DLABMFSM" (DLABMFSM) - "Roxio" - C:\Windows\System32\DLA\DLABMFSM.SYS
"DLABOIOM" (DLABOIOM) - "Roxio" - C:\Windows\System32\DLA\DLABOIOM.SYS
"DLACDBHM" (DLACDBHM) - "Roxio" - C:\Windows\System32\Drivers\DLACDBHM.SYS
"DLADResM" (DLADResM) - "Roxio" - C:\Windows\System32\DLA\DLADResM.SYS
"DLAIFS_M" (DLAIFS_M) - "Roxio" - C:\Windows\System32\DLA\DLAIFS_M.SYS
"DLAOPIOM" (DLAOPIOM) - "Roxio" - C:\Windows\System32\DLA\DLAOPIOM.SYS
"DLAPoolM" (DLAPoolM) - "Roxio" - C:\Windows\System32\DLA\DLAPoolM.SYS
"DLARTL_M" (DLARTL_M) - "Roxio" - C:\Windows\System32\Drivers\DLARTL_M.SYS
"DLAUDFAM" (DLAUDFAM) - "Roxio" - C:\Windows\System32\DLA\DLAUDFAM.SYS
"DLAUDF_M" (DLAUDF_M) - "Roxio" - C:\Windows\System32\DLA\DLAUDF_M.SYS
"DRVMCDB" (DRVMCDB) - "Sonic Solutions" - C:\Windows\System32\Drivers\DRVMCDB.SYS
"DRVNDDM" (DRVNDDM) - "Roxio" - C:\Windows\System32\Drivers\DRVNDDM.SYS
"DSproct" (DSproct) - "Gteko Ltd." - C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
"dsunidrv" (dsunidrv) - "Gteko Ltd." - C:\Program Files\DellSupport\Drivers\dsunidrv.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"SASKUTIL" (SASKUTIL) - ? - C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"ztjqo" (ztjqo) - ? - C:\Windows\system32\drivers\ztjqo.sys (Hidden registry entry, rootkit activity | File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{A173B69A-1F9B-4823-9FDA-412F641E65D6} "INSMimeFilterPP Class" - ? - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{5E44E225-A408-11CF-B581-008029601108} "Roxio DragToDisc Shell Extension" - "Roxio" - C:\Program Files\Roxio\Drag-to-Disc\Shellex.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{52B87208-9CCF-42C9-B88E-069281105805} "Trojan Remover Shell Extension" - "Simply Super Software" - C:\PROGRA~1\TROJAN~1\Trshlex.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2008\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software GmbH" - C:\Windows\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "get_atlcom Class" - "NOS Microsystems Ltd." - C:\Program Files\NOS\bin\gp.ocx / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{149E45D8-163E-4189-86FC-45022AB2B6C9} "SpinTop DRM Control" - "SpinTop Media Inc." - C:\Windows\Downloaded Program Files\stg_drm.ocx / file:///C:/Program%20Files/Delicious%20-%20Emily's%20Taste%20of%20Fame/Images/stg_drm.ocx
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy b\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Dell Inc." - C:\Program Files\BAE\BAE.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy b\SDHelper.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? - (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Esther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Digital Line Detect.lnk" - "Avanquest Software " - C:\Program Files\Digital Line Detect\DLG.exe (Shortcut exists | File exists)
"QuickSet.lnk" - "Dell Inc" - C:\Program Files\Dell\QuickSet\quickset.exe (Shortcut exists | File exists)
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DellSupport" - "Gteko Ltd." - "C:\Program Files\DellSupport\DSAgnt.exe" /startup
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy b\TeaTimer.exe
"StartCCC" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (File found, but it contains no detailed information)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"FLMOFFICE4DMOUSE" - ? - C:\Program Files\Browser Mouse\mouse32a.exe
"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup" - "Macrovision Corporation" - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
"LexwareInfoService" - "Lexware GmbH & Co. KG" - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
" Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"PCMService" - "CyberLink Corp." - "C:\Program Files\Dell\MediaDirect\PCMService.exe"
"RoxioDragToDisc" - "Roxio" - "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
"RoxWatchTray" - "Sonic Solutions" - "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
"SigmatelSysTrayApp" - "SigmaTel, Inc." - sttray.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"TMRUBottedTray" - ? - "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
"TrojanScanner" - "Simply Super Software" - C:\Program Files\Trojan Remover\Trjscan.exe /boot

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%SystemRoot%\System32\TuneUpDefragService.exe,-1" (TuneUp.Defrag) - "TuneUp Software GmbH" - C:\Windows\System32\TuneUpDefragService.exe
"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software GmbH" - C:\Windows\System32\uxtuneup.dll
"@C:\Program Files\NOS\bin\getPlus_Helper.dll,-101" (getPlusHelper) - "NOS Microsystems Ltd." - C:\Program Files\NOS\bin\getPlus_Helper.dll
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Boonty Games" (Boonty Games) - "BOONTY" - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
"DSBrokerService" (DSBrokerService) - ? - C:\Program Files\DellSupport\brkrsvc.exe
"Google Desktop Manager 5.9.911.3589" (GoogleDesktopManager-110309-193829) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate1c9ed0ea1ae75a0)" (gupdate1c9ed0ea1ae75a0) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Haufe iDesk-Service in C:\Program Files\Haufe\iDesk\iDeskService\Zope" (HRService) - ? - C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe (File found, but it contains no detailed information)
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"iWinTrusted" (iWinTrusted) - "iWin Inc." - C:\Program Files\iWin Games\iWinTrusted.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Roxio Hard Drive Watcher 9" (RoxWatch9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy b\SDWinSec.exe
"SigmaTel Audio Service" (STacSV) - "SigmaTel, Inc." - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
"stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
"Trend Micro RUBotted Service" (RUBotted) - ? - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\system32\FISHTY~1.SCR (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Danke schön!

cosinus · 16.05.2010, 18:36

Zitat:

"ztjqo" (ztjqo) - ? - C:\Windows\system32\drivers\ztjqo.sys (Hidden registry entry, rootkit activity | File not found)

Bitte mit OSAM deaktivieren + löschen (delete from storage)
Rechner neu starten und neues OSAM Log posten.

Fanta · 16.05.2010, 19:19

hallo,

ich habe alle Schritte abgearbeitet (dank der tollen Anleitung, ist es auch für Laien möglich)

Danke für die Hilfe!

Hier ist der Log:

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:15:28 on 16.05.2010

OS: Windows Vista Home Premium Edition (Build 6000), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.3

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries

[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Norton Security Scan.job" - "Symantec Corporation" - C:\Program Files\Norton Security Scan\Nss.exe
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2008\OneClick.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"collab.cpl" - "Microsoft Corporation" - C:\Windows\system32\collab.cpl
"DModem.cpl" - ? - C:\Windows\system32\DModem.cpl
"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\Windows\system32\ISUSPM.cpl
"stacgui.cpl" - "SigmaTel, Inc." - C:\Windows\system32\stacgui.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"DLABMFSM" (DLABMFSM) - "Roxio" - C:\Windows\System32\DLA\DLABMFSM.SYS
"DLABOIOM" (DLABOIOM) - "Roxio" - C:\Windows\System32\DLA\DLABOIOM.SYS
"DLACDBHM" (DLACDBHM) - "Roxio" - C:\Windows\System32\Drivers\DLACDBHM.SYS
"DLADResM" (DLADResM) - "Roxio" - C:\Windows\System32\DLA\DLADResM.SYS
"DLAIFS_M" (DLAIFS_M) - "Roxio" - C:\Windows\System32\DLA\DLAIFS_M.SYS
"DLAOPIOM" (DLAOPIOM) - "Roxio" - C:\Windows\System32\DLA\DLAOPIOM.SYS
"DLAPoolM" (DLAPoolM) - "Roxio" - C:\Windows\System32\DLA\DLAPoolM.SYS
"DLARTL_M" (DLARTL_M) - "Roxio" - C:\Windows\System32\Drivers\DLARTL_M.SYS
"DLAUDFAM" (DLAUDFAM) - "Roxio" - C:\Windows\System32\DLA\DLAUDFAM.SYS
"DLAUDF_M" (DLAUDF_M) - "Roxio" - C:\Windows\System32\DLA\DLAUDF_M.SYS
"DRVMCDB" (DRVMCDB) - "Sonic Solutions" - C:\Windows\System32\Drivers\DRVMCDB.SYS
"DRVNDDM" (DRVNDDM) - "Roxio" - C:\Windows\System32\Drivers\DRVNDDM.SYS
"DSproct" (DSproct) - "Gteko Ltd." - C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
"dsunidrv" (dsunidrv) - "Gteko Ltd." - C:\Program Files\DellSupport\Drivers\dsunidrv.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"SASKUTIL" (SASKUTIL) - ? - C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
(Disabled) "ztjqo" (ztjqo) - ? - C:\Windows\system32\drivers\ztjqo.sys (Hidden registry entry, rootkit activity | File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{A173B69A-1F9B-4823-9FDA-412F641E65D6} "INSMimeFilterPP Class" - ? - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{5E44E225-A408-11CF-B581-008029601108} "Roxio DragToDisc Shell Extension" - "Roxio" - C:\Program Files\Roxio\Drag-to-Disc\Shellex.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{52B87208-9CCF-42C9-B88E-069281105805} "Trojan Remover Shell Extension" - "Simply Super Software" - C:\PROGRA~1\TROJAN~1\Trshlex.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2008\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software GmbH" - C:\Windows\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "get_atlcom Class" - "NOS Microsystems Ltd." - C:\Program Files\NOS\bin\gp.ocx / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{149E45D8-163E-4189-86FC-45022AB2B6C9} "SpinTop DRM Control" - "SpinTop Media Inc." - C:\Windows\Downloaded Program Files\stg_drm.ocx / file:///C:/Program%20Files/Delicious%20-%20Emily's%20Taste%20of%20Fame/Images/stg_drm.ocx
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy b\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Dell Inc." - C:\Program Files\BAE\BAE.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy b\SDHelper.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? - (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Esther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Digital Line Detect.lnk" - "Avanquest Software " - C:\Program Files\Digital Line Detect\DLG.exe (Shortcut exists | File exists)
"QuickSet.lnk" - "Dell Inc" - C:\Program Files\Dell\QuickSet\quickset.exe (Shortcut exists | File exists)
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DellSupport" - "Gteko Ltd." - "C:\Program Files\DellSupport\DSAgnt.exe" /startup
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy b\TeaTimer.exe
"StartCCC" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (File found, but it contains no detailed information)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"FLMOFFICE4DMOUSE" - ? - C:\Program Files\Browser Mouse\mouse32a.exe
"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"ISUSPM Startup" - "Macrovision Corporation" - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
"LexwareInfoService" - "Lexware GmbH & Co. KG" - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
" Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"PCMService" - "CyberLink Corp." - "C:\Program Files\Dell\MediaDirect\PCMService.exe"
"RoxioDragToDisc" - "Roxio" - "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
"RoxWatchTray" - "Sonic Solutions" - "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
"SigmatelSysTrayApp" - "SigmaTel, Inc." - sttray.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"TMRUBottedTray" - ? - "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
"TrojanScanner" - "Simply Super Software" - C:\Program Files\Trojan Remover\Trjscan.exe /boot

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%SystemRoot%\System32\TuneUpDefragService.exe,-1" (TuneUp.Defrag) - "TuneUp Software GmbH" - C:\Windows\System32\TuneUpDefragService.exe
"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software GmbH" - C:\Windows\System32\uxtuneup.dll
"@C:\Program Files\NOS\bin\getPlus_Helper.dll,-101" (getPlusHelper) - "NOS Microsystems Ltd." - C:\Program Files\NOS\bin\getPlus_Helper.dll
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Boonty Games" (Boonty Games) - "BOONTY" - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
"DSBrokerService" (DSBrokerService) - ? - C:\Program Files\DellSupport\brkrsvc.exe
"Google Desktop Manager 5.9.911.3589" (GoogleDesktopManager-110309-193829) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate1c9ed0ea1ae75a0)" (gupdate1c9ed0ea1ae75a0) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Haufe iDesk-Service in C:\Program Files\Haufe\iDesk\iDeskService\Zope" (HRService) - ? - C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe (File found, but it contains no detailed information)
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"iWinTrusted" (iWinTrusted) - "iWin Inc." - C:\Program Files\iWin Games\iWinTrusted.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Roxio Hard Drive Watcher 9" (RoxWatch9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy b\SDWinSec.exe
"SigmaTel Audio Service" (STacSV) - "SigmaTel, Inc." - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
"stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
"Trend Micro RUBotted Service" (RUBotted) - ? - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\system32\FISHTY~1.SCR (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus · 17.05.2010, 07:59

Gut. Dann bitte jetzt Malwarebytes aktualisieren, einen Vollscan machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Fanta · 17.05.2010, 19:53

Hallo,

hier der Log von dem Malwarebyte:

Malwarebytes' Anti-Malware 1.46
xx.malwarebytes.org

Datenbank Version: 4109

Windows 6.0.6000
Internet Explorer 7.0.6000.16575

17.05.2010 20:25:41
mbam-log-2010-05-17 (20-25-41).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 270992
Laufzeit: 1 Stunde(n), 57 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\System32\drivers\ztjqo.sys (Rootkit.Agent) -> No action taken.

Und hier die Logs von OTL:

OTL logfile created on: 17.05.2010 20:27:05 - Run 2
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\xxx\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16575)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 34,00% Memory free
4,00 Gb Paging File | 2,00 Gb Available in Paging File | 52,00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136,96 Gb Total Space | 85,03 Gb Free Space | 62,08% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 6,30 Gb Free Space | 63,01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: xx-PC
Current User Name: xx
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\x\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre6\bin\jp2launcher.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Spybot - Search & Destroy b\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy b\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Browser Mouse\mouse32a.exe ()
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - c:\Program Files\Java\jre1.6.0\bin\java.exe (Sun Microsystems, Inc.)
PRC - C:\Windows\sttray.exe (SigmaTel, Inc.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe (SigmaTel, Inc.)
PRC - C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe (Sonic Solutions)
PRC - C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software )
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
PRC - C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)

========== Modules (SafeList) ==========

MOD - C:\Users\xx\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Boonty Games) -- File not found
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (GoogleDesktopManager-110309-193829) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (SBSDWSCService) -- C:\Program Files\Spybot - Search & Destroy b\SDWinSec.exe (Safer Networking Ltd.)
SRV - (HRService) -- C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe ()
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (RUBotted) -- C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (STacSV) -- C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe (SigmaTel, Inc.)
SRV - (DSBrokerService) -- C:\Program Files\DellSupport\brkrsvc.exe ()

========== Driver Services (SafeList) ==========

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (RMCAST) RMCAST (Pgm) -- C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (TMPassthruMP) -- C:\Windows\System32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) -- C:\Windows\System32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (SigmaTel, Inc.)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (bcm4sbxp) -- C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (DSproct) -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (DLADResM) -- C:\Windows\System32\DLA\DLADResM.SYS (Roxio)
DRV - (DLABMFSM) -- C:\Windows\System32\DLA\DLABMFSM.SYS (Roxio)
DRV - (DLAUDF_M) -- C:\Windows\System32\DLA\DLAUDF_M.SYS (Roxio)
DRV - (DLAUDFAM) -- C:\Windows\System32\DLA\DLAUDFAM.SYS (Roxio)
DRV - (DLAOPIOM) -- C:\Windows\System32\DLA\DLAOPIOM.SYS (Roxio)
DRV - (DLABOIOM) -- C:\Windows\System32\DLA\DLABOIOM.SYS (Roxio)
DRV - (DLAIFS_M) -- C:\Windows\System32\DLA\DLAIFS_M.SYS (Roxio)
DRV - (DLAPoolM) -- C:\Windows\System32\DLA\DLAPoolM.SYS (Roxio)
DRV - (dsunidrv) -- C:\Program Files\DellSupport\Drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (DRVNDDM) -- C:\Windows\System32\drivers\DRVNDDM.SYS (Roxio)
DRV - (DLACDBHM) -- C:\Windows\System32\drivers\DLACDBHM.SYS (Roxio)
DRV - (DLARTL_M) -- C:\Windows\System32\drivers\DLARTL_M.SYS (Roxio)
DRV - (DRVMCDB) -- C:\Windows\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iplay.com/?o=shp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Yahoo!"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.50
FF - prefs.js..extensions.enabledItems: yetanothersmoothscrolling@kataho:3.0.11
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.04.02 18:35:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.02 18:35:54 | 000,000,000 | ---D | M]

[2008.06.19 20:14:28 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\mozilla\Extensions
[2010.05.17 18:08:06 | 000,000,000 | ---D | M] -- C:\Users\xx\AppData\Roaming\mozilla\Firefox\Profiles\0jlbbrhk.default\extensions
[2010.01.25 00:14:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Exx\AppData\Roaming\mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.05.05 22:21:40 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Exx\AppData\Roaming\mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.03.18 20:27:03 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\Esther\AppData\Roaming\mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.03.13 15:45:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xx\AppData\Roaming\mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010.03.21 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\Exx\AppData\Roaming\mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\yetanothersmoothscrolling@kataho
[2010.03.06 16:02:19 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007.03.05 21:10:39 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.08.31 11:28:34 | 000,147,456 | ---- | M] (Oberon Media) -- C:\Program Files\Mozilla Firefox\plugins\npMyGames.dll
[2007.03.05 14:59:06 | 000,645,504 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\npOGAPlugin.dll
[2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\Mozilla Firefox\plugins\npracplug.dll
[2006.09.26 12:03:14 | 000,000,000 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010.03.13 19:35:10 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.13 19:35:10 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.13 19:35:11 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.11.08 08:55:12 | 000,000,609 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\WebSearchober4502204.gif
[2010.03.21 18:46:31 | 000,000,175 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\WebSearchober4502204.src
[2010.03.13 19:35:11 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.13 19:35:11 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
[2009.04.07 14:59:38 | 000,000,872 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\Yahooober105119963.gif
[2009.10.04 16:53:42 | 000,000,205 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\Yahooober105119963.src

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy b\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe ()
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy b\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy b\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Delicious%20-%20Emily's%20Taste%20of%20Fame/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img19.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img19.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{bc45ed9d-cb43-11db-a6ee-0016cfd11ed0}\Shell\AutoRun\command - "" = F:\.\MigWiz\migsetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010.05.17 19:27:05 | 000,571,392 | ---- | C] (OldTimer Tools) -- C:\Users\xx\Desktop\OTL.exe
[2010.05.16 19:55:02 | 000,000,000 | ---D | C] -- C:\Users\Esther\AppData\Roaming\Online Solutions
[2010.05.16 17:04:25 | 000,000,000 | ---D | C] -- C:\Program Files\OperationChaos_at
[2010.05.16 12:06:23 | 000,000,000 | ---D | C] -- C:\Program Files\Youda Safari
[2010.05.15 09:18:26 | 000,000,000 | ---D | C] -- C:\Users\Exxr\Desktop\osam_autorun_manager_5_0_portable
[2010.05.14 16:41:56 | 000,000,000 | ---D | C] -- C:\Program Files\RoyalEnvoy_at
[2010.05.14 15:02:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2010.05.14 10:40:41 | 000,000,000 | ---D | C] -- C:\Program Files\Sally's Studio Collector's Edition
[2010.05.13 18:04:38 | 000,000,000 | ---D | C] -- C:\Program Files\Royal Envoy
[2010.05.13 13:11:10 | 000,000,000 | ---D | C] -- C:\Users\Exx\AppData\Roaming\Wildfire
[2010.05.09 17:13:52 | 000,000,000 | ---D | C] -- C:\Users\Exx\AppData\Roaming\Family Farm
[2010.05.09 17:07:40 | 000,000,000 | ---D | C] -- C:\Users\Exx\Desktop\Viren Trojaner
[2010.05.05 22:21:20 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010.05.04 20:25:42 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy b
[2010.05.04 20:18:28 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Users\xx\Desktop\setup-spybotsd162.exe
[2010.05.04 20:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
[2010.05.04 20:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\SDHelper (Spybot - Search & Destroy)
[2010.05.04 20:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)
[2010.05.04 20:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\File Scanner Library (Spybot - Search & Destroy)
[2010.05.03 07:05:52 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ztvcabinet.dll
[2010.05.03 07:05:48 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2010.05.03 07:05:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2010.05.02 17:42:33 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\03343AE287F68AA8F685ED228E277A6D
[2010.05.01 13:28:30 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\freshgames
[2010.04.25 10:53:51 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Clickteam
[2010.04.18 17:04:10 | 003,502,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010.04.18 17:04:10 | 003,468,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010.04.18 17:03:21 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010.04.18 16:55:19 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2010.04.18 16:55:18 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2010.04.18 16:54:22 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll
[2010.04.18 16:54:22 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiougc.exe
[2010.04.18 15:44:27 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Realore_DressUpRush
[2010.04.18 13:26:41 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\Zylom DressUpRush
[2010.04.18 11:25:13 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Roaming\BigFish DressUpRush
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.05.17 20:29:43 | 004,718,592 | -HS- | M] () -- C:\Users\xxx\ntuser.dat
[2010.05.17 20:05:45 | 000,003,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.17 20:05:45 | 000,003,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.17 19:48:02 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.05.17 19:27:24 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Users\xxx\Desktop\OTL.exe
[2010.05.17 18:48:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.05.17 18:08:20 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010.05.17 18:07:33 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{4F1AD747-E258-45ED-95D5-4AE40737C6A0}.job
[2010.05.17 18:05:45 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.17 18:05:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.17 18:04:48 | 2145,849,344 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.17 07:15:10 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.05.17 07:14:32 | 003,563,765 | -H-- | M] () -- C:\Users\xxx\AppData\Local\IconCache.db
[2010.05.17 07:12:22 | 000,000,125 | ---- | M] () -- C:\ioSpecial.ini
[2010.05.16 19:56:20 | 000,823,808 | ---- | M] () -- C:\Windows\System32\drivers\ztjqo.sys
[2010.05.16 13:01:48 | 044,897,485 | ---- | M] () -- C:\Users\xxx\Documents\backup160510.zip
[2010.05.16 12:58:28 | 190,989,312 | ---- | M] () -- C:\Users\xxx\Documents\backup160510.pst
[2010.05.16 12:40:29 | 000,072,504 | ---- | M] () -- C:\Users\xxx\Desktop\bookmarks.html
[2010.05.15 21:51:28 | 000,293,376 | ---- | M] () -- C:\Users\xxx\Desktop\00oqz03f.exe
[2010.05.15 09:32:18 | 000,049,435 | ---- | M] () -- C:\Users\xxx\Documents\osam.html
[2010.05.15 09:01:26 | 004,272,474 | ---- | M] () -- C:\Users\xxx\Desktop\osam_autorun_manager_5_0_portable.rar
[2010.05.09 16:45:38 | 000,023,724 | ---- | M] () -- C:\Users\xxx\Documents\cc_20100509_164509.reg
[2010.05.08 09:53:05 | 000,026,112 | ---- | M] () -- C:\Users\xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.06 10:36:38 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.05.05 22:41:47 | 000,073,308 | ---- | M] () -- C:\Users\xxx\Documents\cc_20100505_224123.reg
[2010.05.04 20:26:06 | 000,001,031 | ---- | M] () -- C:\Users\xxx\Desktop\Spybot - Search & Destroy.lnk
[2010.05.04 20:24:57 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Users\xxx\Desktop\setup-spybotsd162.exe
[2010.05.02 18:34:11 | 000,000,036 | ---- | M] () -- C:\Users\xxx\AppData\Local\housecall.guid.cache
[2010.04.29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.04.29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.04.25 19:59:51 | 000,018,977 | ---- | M] () -- C:\Users\xxx\steuer 2009 a.elfo
[2010.04.19 19:34:10 | 000,022,493 | ---- | M] () -- C:\Users\xxx\steuer 2009.elfo
[2010.04.18 17:04:10 | 003,502,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010.04.18 17:04:10 | 003,468,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010.04.18 17:03:21 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010.04.18 16:55:19 | 000,220,672 | ---- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2010.04.18 16:55:18 | 000,062,464 | ---- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2010.04.18 16:54:22 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tcpipcfg.dll
[2010.04.18 16:54:22 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netiougc.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.05.16 13:01:46 | 044,897,485 | ---- | C] () -- C:\Users\xxx\Documents\backup160510.zip
[2010.05.16 12:56:07 | 190,989,312 | ---- | C] () -- C:\Users\xxx\Documents\backup160510.pst
[2010.05.16 12:40:28 | 000,072,504 | ---- | C] () -- C:\Users\xxx\Desktop\bookmarks.html
[2010.05.15 21:51:27 | 000,293,376 | ---- | C] () -- C:\Users\xxx\Desktop\00oqz03f.exe
[2010.05.15 09:32:18 | 000,049,435 | ---- | C] () -- C:\Users\xxx\Documents\osam.html
[2010.05.15 09:00:57 | 004,272,474 | ---- | C] () -- C:\Users\xxx\Desktop\osam_autorun_manager_5_0_portable.rar
[2010.05.09 16:45:12 | 000,023,724 | ---- | C] () -- C:\Users\xxx\Documents\cc_20100509_164509.reg
[2010.05.05 22:41:29 | 000,073,308 | ---- | C] () -- C:\Users\xxx\Documents\cc_20100505_224123.reg
[2010.05.03 07:05:52 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2010.05.03 07:05:52 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2010.05.03 07:05:52 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2010.05.03 07:05:52 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2010.05.02 18:34:11 | 000,000,036 | ---- | C] () -- C:\Users\xxx\AppData\Local\housecall.guid.cache
[2010.05.02 17:43:22 | 000,823,808 | ---- | C] () -- C:\Windows\System32\drivers\ztjqo.sys
[2010.04.20 19:24:21 | 000,018,977 | ---- | C] () -- C:\Users\xxx\steuer 2009 a.elfo
[2007.12.12 21:28:21 | 000,000,000 | ---- | C] () -- C:\Windows\System32\jsproxy.dll
[2007.03.09 22:44:02 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2007.03.05 20:54:10 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.03.01 03:45:48 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.03.01 03:45:32 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007.03.01 03:45:24 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.02.28 20:19:07 | 000,056,056 | ---- | C] () -- C:\Windows\System32\DLAAPI_W.DLL
[2007.02.28 20:19:07 | 000,000,120 | ---- | C] () -- C:\Windows\wininit.ini
[2006.11.07 21:25:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006.11.03 19:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 10:35:19 | 000,018,944 | ---- | C] () -- C:\Windows\System32\perfnet.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.09.17 01:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006.09.17 01:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006.04.21 10:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll
[2001.11.14 14:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001.10.10 08:57:58 | 000,073,786 | ---- | C] () -- C:\Windows\System32\dntvmc23.dll
[2001.10.10 08:57:58 | 000,061,497 | ---- | C] () -- C:\Windows\System32\dntvm23.dll
[2001.03.07 08:02:30 | 000,229,431 | ---- | C] () -- C:\Windows\System32\dnt23.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:7DFDF9DF
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:7920E530
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:2BC498A4
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:69FD6BF0
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:C7B98566
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:C0F01B5A
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:1CB3187E
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:81A3F151
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:3D5B1D7A
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:ED810E46
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:C07A6A6B
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:B9AA1D6D
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:52E3B819
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:3B812EE0
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:43860CE8
@Alternate Data Stream - 918 bytes -> C:\ProgramData\TEMP:7964DDC1
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_PVX2VCGKMVF9FFNYTKBRVLNGCMSMYJ598W2L4WERXPUL6HHXVJ4TVVVVVVVVVVVVV
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_PVX2VCGFMVF9VFNYTK1RVLNJCMNS45LBX89LH9KVVVVTVVJVPJVE
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_PVX2VCGFMVF9V8N4TKBRVDNGCMXLH4M98WLP46MVF4VTVFBVLJVK
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_PVX2VCGFMVF9FFNYTKBRVLNGCMPL9EKVRF1XYCDVLJVKVK5V14TJ
@Alternate Data Stream - 85 bytes -> C:\ProgramData:$SS_DESCRIPTOR_PVX2V6GKMV89FFN4TK1RVDNJCMLP4AMBXFSM0JKVVBVTVVBVVVVT
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\Zamby:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\outlook contact:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\outlook calendar:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\My PSP Files:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\My Games:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\ICCTT:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\Electronic Arts:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\Eigene Google Gadgets:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Documents\Alawar:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Desktop\Viren Trojaner:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Desktop\spiele:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Desktop\osam_autorun_manager_5_0_portable:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Desktop\Elster:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Desktop\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\xxx\Desktop\config:Roxio EMC Stream
@Alternate Data Stream - 347 bytes -> C:\ProgramData\TEMP:766C5F65
@Alternate Data Stream - 339 bytes -> C:\ProgramData\TEMP:995B275C
@Alternate Data Stream - 328 bytes -> C:\ProgramData\TEMP:CDAD96F5
@Alternate Data Stream - 322 bytes -> C:\ProgramData\TEMP:202A6D97
@Alternate Data Stream - 321 bytes -> C:\ProgramData\TEMP:E603573E
@Alternate Data Stream - 311 bytes -> C:\ProgramData\TEMP:4CB560CF
@Alternate Data Stream - 311 bytes -> C:\ProgramData\TEMP:141BCC26
@Alternate Data Stream - 306 bytes -> C:\ProgramData\TEMP:D81A09B0
@Alternate Data Stream - 306 bytes -> C:\ProgramData\TEMP:60A06E3E
@Alternate Data Stream - 298 bytes -> C:\ProgramData\TEMP:5C5DFEA1
@Alternate Data Stream - 296 bytes -> C:\ProgramData\TEMP:1387592D
@Alternate Data Stream - 294 bytes -> C:\ProgramData\TEMP:0F94040F
@Alternate Data Stream - 293 bytes -> C:\ProgramData\TEMP:9AF3A05F
@Alternate Data Stream - 165 bytes -> C:\ProgramData\TEMP:435657D8
@Alternate Data Stream - 162 bytes -> C:\ProgramData\TEMP:ED54EEBD
@Alternate Data Stream - 161 bytes -> C:\ProgramData\TEMP:AF2E5A21
@Alternate Data Stream - 161 bytes -> C:\ProgramData\TEMP:2DDB3026
@Alternate Data Stream - 159 bytes -> C:\ProgramData\TEMP:AA9B4A9E
@Alternate Data Stream - 159 bytes -> C:\ProgramData\TEMP:2117D4B2
@Alternate Data Stream - 157 bytes -> C:\ProgramData\TEMP:D07803DA
@Alternate Data Stream - 157 bytes -> C:\ProgramData\TEMP:8B0F52E5
@Alternate Data Stream - 156 bytes -> C:\ProgramData\TEMP:49C8B9AA
@Alternate Data Stream - 156 bytes -> C:\ProgramData\TEMP:09F1110F
@Alternate Data Stream - 155 bytes -> C:\ProgramData\TEMP:A9508297
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:EAA01E60
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:7F7562E0
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:F8E17318
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:F6E5C7FB
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:66A105B9
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:60D735B2
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:F0B7772F
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:9C0F3393
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:53ABB239
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:56C17A93
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:4C97EF04
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:FBE5FDB9
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:966CEAE7
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:7E100A8C
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:6E770FA8
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:E0A3E0DB
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:C48A983C
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:B3B92717
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:F0A06891
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:CEE4A457
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:60D0CFE2
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:AA5522A0
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:3D2773A9
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:22741C1F
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:1CC24DDC
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:F43B7E8F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:DD2A808F
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:908A1B53
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:7210ACCB
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:D6A4A911
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:D30CE047
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:74B502CB
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:39F1E9F9
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:E6CCB309
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:D4D19B47
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:6E11933F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:91DEEE71
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:78F471E2
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:74699137
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:6D4F7F2B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:EF5B3572
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:ED45A20F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:D20FFA63
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:BBF60A29
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:55C54F7C
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:2E45FA8F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:02B823FE
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:FB914833
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:B9E9A5F9
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:7CFF127A
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:16F2A6FF
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:FA345B65
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:E62BE020
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:C6D0ABC3
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:C04C48D4
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:7E26B7DC
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:5425B7F5
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:3B3A35EC
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:0E660858
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:EA701346
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:D61069DE
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:BE6DC701
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B83BF1A6
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:AA8AD2BF
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:8D542132
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:6D6B9915
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:5FD47318
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:4E95348B
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:33384BC0
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0EC44AEB
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0651F96C
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:F81E7082
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:F7CB87BE
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:CE6885F1
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:ABDDBC11
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:96EE29A3
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:92C45D1A
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:5E3FBF9D
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:3780BCC3
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:325064EA
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:02573978
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:AB8C6381
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:9AE67195
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:70EB7261
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:708793B6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:596E2371
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:2164CF08
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:0EE601C7
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:0860D6D6
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:FD444D31
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:EC7C9796
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:E5816AB5
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:E2CB42C9
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:E1CC2D5E
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:DE47A3DA
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:C5E2BAEE
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:A18121AD
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:F8A67568
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DF0F61BB
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:C7B0EA92
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:C0A2E219
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:A23D24E7
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:93D985FC
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:8BB2EE92
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:7A0EFE63
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:36A39835
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:3064D21D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:F14D1F80
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D68C96C3
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D46ECFD5
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:D02FBAEC
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:CF39FA77
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:B54102AD
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:AD727397
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:9BFB769D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:98AE08EA
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:9857FAE3
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:969C0C96
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:6DA3BBF2
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:41099CE9
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:1ACD6C7C
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0DFE2AE1
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0AE6CC6C
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:A4AD016E
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:90865A6D
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:8E7F155B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:45F3AD49
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:1B9E79B3
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:0C5BC70E
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:059167AF
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:FC8FFA4E

Fanta · 17.05.2010, 19:55

hier der zweite Teil:

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:F67AAFC5
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:F1175E1D
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:D2A5A561
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:D1713795
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:CC073296
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:935FDE88
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:76A59E49
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5E707762
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:55E1514E
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:30FF836C
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1D8AAA7B
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:0E684AC9
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:E1D818F7
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:DAFD38AE
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:D5E0200E
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:B9F8321A
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:AF5A3939
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:AC95B5ED
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:AB6E0B6B
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:700CD00E
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:483AC68A
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:35A81752
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:2AFE59F2
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F9E46E4C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:CDB75348
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:CD9109D4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:9B285B76
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:896E1EFF
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:887EAE14
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8173A019
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:80E965A3
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:7CEDF9F3
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C6EBC69
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:439E3411
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:41D1C7CB
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:3A925163
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:35C78DCC
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:3539CD43
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2CDB9CA3
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:0E22C5DB
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:0355E87F
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:00811B66
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:FC60E0F8
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:D0DCD8D7
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:C35B4B19
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:A4076A3B
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:9398DBB4
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:88698068
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:7B2BB690
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:69E3AF64
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:61F0C8FB
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:4DCAC4BC
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:471AD3D0
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:38D53DB8
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:3745E745
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:33A7CC67
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1DEE6B65
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:122B409D
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FECEF728
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:F7F6E6CB
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:F1272EEC
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:ED796303
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:ED194880
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E40BF3ED
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:D8F9D810
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:BDF08FAF
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:A8E946CD
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:8FC4D5E3
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:8CCDAB14
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:6FD26134
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:49EDF10D
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:48FEA089
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:43982D5E
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:072B9E55
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:DA3FF453
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D1D657D4
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:B845F669
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:AC0528D9
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A7B70C4E
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A71D3858
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:88AA70D1
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:1A5207FA
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:0F55D468
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:FC2D0F32
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:F791B5EF
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:D690C7F7
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:D26DD363
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:CA381C4C
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:B3942462
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:8C81B36D
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:538B96B5
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:4C49306C
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:44581F2B
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:3B4DA230
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:0D52F295
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:D16E7091
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:ABE89FFE
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:9331E9D2
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:89F44603
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:883EDFB5
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:74456BF5
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:6051163F
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:5B111056
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:4363DE71
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:3D58ADDB
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:38B32B54
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:225CD7D5
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:1F7A10DD
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:FBFC061F
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:F4F720BA
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:E3CEEC4C
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:CB0AACC9
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C7F5E798
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C611D6C8
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:9ACB70D7
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:974C6D78
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:84CFEE62
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5A437AC3
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:413E2927
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:34B9286E
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:1E5EC928
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:17F7AEA3
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:03D08225
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:FF510ADC
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:FE66A7BB
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:FC2E567F
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:E1982A23
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:D994162E
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:C86B29EB
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:B093E177
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:AEABFEC4
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A7DA2BCD
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A4BF246C
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:86148D88
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:842B0AED
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:69D59C23
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:663B62CA
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5C826C73
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5AE33054
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:490BCC52
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:1792752F
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:E07EA07E
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:D2397415
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:B19CC382
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:A96D3F23
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:A86C3734
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:8BCF4DE2
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:8AA99C0C
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:6C5EC3CD
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:444C53BA
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:4220A65C
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:3C282BEA
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:3A6BC948
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:097FF903
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:F061428B
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:EA2FBCA1
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:C7465C63
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BCFDAB5F
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BA5938AB
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:A5264343
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:A3B8F70C
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:9AA05701
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:90B52091
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:6677D85A
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:627B7F7C
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:52E1DB1D
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:4F636E25
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:3790BACD
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:23430C4C
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:17C6C557
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:F82CA780
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:F35AE645
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:EF794BCD
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:938EC881
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:90D89144
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:3EA7510F
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:322D2CD3
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:10D98D98
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:0DAD93FF
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:027B8698
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:F6C0CA66
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:EB5BDBB0
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:E412AAF2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:D4D056EC
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B90C7652
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B6D90CD7
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:9A6EBBF2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:48D45EF0
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:12EA4DC9
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:067F588D
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:FC98D33A
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:FBE81670
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:FA206A00
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:B321E944
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A688EF17
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:9D3C16C7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:7547DA5B
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:6FE17A89
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:6BF0805F
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:47FE7AB7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:0AC32449
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:BAD540F2
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B902F888
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B12D1A7D
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:AA004D25
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:81653DC8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:51A22C60
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:4FE30352
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:48372097
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:3447AB86
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:062AF572
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:EF4FB3C5
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:E56502D3
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:E4E43015
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:D8DB81DC
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:C81D3839
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:9FC06D35
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:923F8E55
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:537E6E55
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:48070A48
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:41B2DADD
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:3DF63AD7
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:2FF4577A
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:F59BA980
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:F2AF86D9
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DF0BC727
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DAE3649B
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C8E82994
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C8AC644A
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:BB24555F
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:82E1D3A4
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:666FB4AA
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:5EBA4934
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:2F141B68
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:0C9CD455
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:F79DAA38
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:F0AB86C0
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:997E6AF4
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:7D9D2CAF
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:63F8EC77
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:639F0420
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:273A8657
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:FC4EA67C
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:DE892EFB
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:D507AEDA
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:D0668210
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:BDCD8531
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:AA60673F
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:949E3D1B
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:5A8F8A0C
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:38849DE5
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:127DC18D
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:10F6E97E
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:0FB9F88B
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:05816AFA
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:0207454C
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:F42B5B0E
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:F0762150
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:EC5EFA15
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:E0AF4473
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:E025AEA1
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:D7DA89B1
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:AF54CFFD
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:A561576B
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:97C4F81F
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:9547F1DB
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:680086AB
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:090FB735
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:8F067037
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:102394C6
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:E41267F2
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:CD2FDB64
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:9A7901A9
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:92A815D8
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:8DA9DB01
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:89A5891E
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:848CC150
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:80B291A7
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:49EB0FDC
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:39C7B7C6
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:36E20A37
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:1CE87230
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:07241935
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:E07230CC
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:A4F0E644
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:A0C7D68A
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:70E897B5
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4E6B8D68
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:4C509008
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:2F384CF4
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:28DB0DC4
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:1D6686D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:FDC41D2C
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:95775248
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:71FA8B7F
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:6BD304B9
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:67BA17B9
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:53DF59D1
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:E2B84483
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:D708EEF9
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:D31BE97C
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:CB0EB1DE
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:C337006C
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:B2CD146E
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:9B52F176
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:8247A199
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:79A70C33
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:57EE48CA
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:43E95997
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:41289DF0
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:28476D43
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:213AFE42
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:101708D3
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:F44D3C53
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:F0BD89FA
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:DFC3B090
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:DE6EED8B
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:BDCD0530
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:880F0FEF
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:61FEC5E3
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:614F17D3
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:4CF61E54
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:4AD2C54D
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:46700142
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:299EEE45
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:164FA86E
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:B268A25C
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:9E2BD6A9
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:96C05DC7
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:918B7566
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:8BA6C9F8
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:89C2A42C
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:293ADB24
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:27D1368B
< End of report >

OTL Extras logfile created on: 17.05.2010 20:27:05 - Run 2
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\xx\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16575)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 34,00% Memory free
4,00 Gb Paging File | 2,00 Gb Available in Paging File | 52,00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136,96 Gb Total Space | 85,03 Gb Free Space | 62,08% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 6,30 Gb Free Space | 63,01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: xx-PC
Current User Name: xx
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01735BCA-DE8B-4430-BB4D-8B59584E7D1A}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07B1D089-4700-4F12-9072-3071FBBACBBF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{3F1E3B13-D398-4CD4-A29A-5F482282B505}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{A837AE0A-AB18-4C89-A2D3-45C7CD6A511F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{BA3D79A7-5915-4529-890F-4D5F7A05ACD1}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"TCP Query User{154AE4B4-7D5A-4C5E-9BA0-4F121823A89A}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{E8A53557-C3E2-450C-A308-55B988324113}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05BCCA33-61E7-5FFD-2661-77E4E09F6960}" = CCC Help German
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0E57595A-1716-772F-7D63-F3C103F1F91F}" = Catalyst Control Center Graphics Previews Vista
"{12650598-D7B9-4FB5-91B2-2CAA641AC589}" = Trend Micro RUBotted
"{1A19B4A3-6CE7-4388-B21F-679803C6C76B}" = TAXMAN 2009
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23BD8792-B4E0-49FB-8239-003A47A38F2E}" = TAXMAN 2007
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2ED3018F-EDFA-4715-9103-88985DD9C84C}" = Youda Safari
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{382BAB22-50F4-4F11-91F6-9A35C0FB6BE9}" = TAXMAN 2007
"{38BEAE84-C96E-9909-FAB7-09F4965BC1CA}" = ccc-core-static
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4F5A53E6-3CBE-44D7-91AD-2E535348484F}" = ccc-Branding
"{53A01CC6-14B0-4512-A2E7-10D39BF83DC4}" = QuickSet
"{55448B7F-E602-4DC4-B9BF-792714B71640}" = TAXMAN 2007
"{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008
"{58B2B6D3-E5FF-4D16-87AC-52CC5717C7C6}" = Tiscali Internet
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = Benutzerhandbuch
"{5CF6F512-2B1E-4293-BE5A-358FFE647E94}" = Catalyst Control Center Graphics Full New
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{65B2875E-2D94-E907-C0C6-FB9A1FC2160E}" = Catalyst Control Center Graphics Light
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{69496452-FAF3-43BC-9907-BA9CEC65FC10}" = Lexware Info Service
"{700C61BE-9424-4B20-9153-7A0C59722AF4}" = TAXMAN Bibliothek 2009
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AAC9EC1-79B8-E67C-0A6C-0DA06048A6EF}" = Catalyst Control Center Graphics Full Existing
"{7ADE3A47-B425-45E9-8FF6-11BE2B775645}" = Corel Snapfire Plus
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{85302BFB-5198-CE39-D87E-813BBA60B497}" = Catalyst Control Center Core Implementation
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{93A1B09E-BAFA-4628-A5B6-921CB026955A}" = Corel Paint Shop Pro Photo XI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A4E86B6A-6EEC-41FD-8960-26947F0E3353}" = Haufe iDesk-Service
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA095606-7801-BB46-894A-8871BCDBACFB}" = ccc-utility
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.1 - Deutsch
"{AFD25854-438C-D36D-6495-4DC03492AFE9}" = Skins
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B480BD2A-F1BA-4FE6-8C8E-34C6111B72C9}" = ElsterFormular 2007/2008
"{C61187B9-2867-41F9-8D40-A94D302BAB51}" = TAXMAN 2007
"{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}" = Microsoft Outlook-Sicherung für Persönliche Ordner
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5C8E140-6E6F-11DD-9AA9-0050560400B1}" = Haufe iDesk-Service
"{D5EE9880-8165-B586-CC43-C4E8EA577C96}" = Catalyst Control Center Localization German
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DA15D535-5E1D-4076-B520-8571346D6238}" = Norton™ Security Scan
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E56618D8-E328-407A-B3EE-D6F8A61D294C}" = Tory's Shop 'n Rush
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EFE38CC6-2592-4F93-B59B-CE4B69600890}" = TAXMAN 2009
"{F331FBDC-7DCF-4598-9E7C-E11865677AB4}" = TAXMAN 2008
"{F48AAE0F-52F4-11DD-B1F7-0050560400B1}" = Haufe iDesk-Browser
"{F55CA27A-8C3C-4E7D-891B-D29FD3259A94}" = TAXMAN 2008
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem-Diagnose-Tool
"{FD023F61-65E9-465C-B558-7C64EB2B97E6}" = Assistant zum Anpassen des Dell-Systems
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Alice Greenfingers Trial Version_is1" = Alice Greenfingers Trial Version 1.06
"am-ranchrushr2premiumedition" = Ranch Rush(R) 2 Premium Edition
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BFG-Avenue Flo" = Avenue Flo
"BFGC" = Big Fish Games: Game Manager
"BFG-Sally's Salon" = Sally's Salon
"BFG-Youda Safari" = Youda Safari
"Browser Mouse" = Browser Mouse
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"Diner Dash 5 Boom!_is1" = Diner Dash 5 Boom!
"ElsterFormular 11.3.0.4235" = ElsterFormular
"ENTERPRISER" = Microsoft Office Enterprise 2007
"Farm Frenzy_is1" = Farm Frenzy
"Findet Nemo" = Findet Nemo Screen Saver
"Free Registry Cleaner for Vista_is1" = Free Registry Cleaner for Vista 1.0
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Operation Chaos_is1" = Operation Chaos
"PAC-MAN Free Trial_is1" = PAC-MAN Free Trial
"Royal Envoy_is1" = Royal Envoy
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Trojan Remover_is1" = Trojan Remover 6.8.1
"WinRAR archiver" = WinRAR

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Delicious - Emilys Holiday Season Deluxe" = Delicious - Emilys Holiday Season Deluxe

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15.05.2010 12:29:49 | Computer Name = xx-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3743 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: a40 Anfangszeit: 01caf42a87c7bfc4 Zeitpunkt der Beendigung:
58

Error - 15.05.2010 12:32:11 | Computer Name = xx-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung 4n5rd6sb.exe, Version 1.0.15.15281, Zeitstempel
0x4b2763f0, fehlerhaftes Modul 4n5rd6sb.exe, Version 1.0.15.15281, Zeitstempel
0x4b2763f0, Ausnahmecode 0xc0000005, Fehleroffset 0x0000c4b1, Prozess-ID 0xc90, Anwendungsstartzeit
01caf44be6600f20.

Error - 15.05.2010 13:14:09 | Computer Name = xx-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.2.3743 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 124c Anfangszeit: 01caf4514afdf956 Zeitpunkt der Beendigung:
58

Error - 15.05.2010 13:19:39 | Computer Name = xx-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung syzrgcgo.exe, Version 1.0.15.15281, Zeitstempel
0x4b2763f0, fehlerhaftes Modul syzrgcgo.exe, Version 1.0.15.15281, Zeitstempel
0x4b2763f0, Ausnahmecode 0xc0000005, Fehleroffset 0x0000c4b1, Prozess-ID 0xa9c, Anwendungsstartzeit
01caf4524f8ddca6.

Error - 15.05.2010 13:28:29 | Computer Name = xx-PC | Source = ESENT | ID = 494
Description = Catalog Database (1520) Catalog Database: Database recovery failed
with error -1216 because it encountered references to a database, 'C:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb',
which is no longer present. The database was not brought to a Clean Shutdown state
before it was removed (or possibly moved or renamed). The database engine will
not permit recovery to complete for this instance until the missing database is
re-instated. If the database is truly no longer available and no longer required,
procedures for recovering from this error are available in the Microsoft Knowledge
Base or by following the "more information" link at the bottom of this message.

Error - 15.05.2010 13:28:29 | Computer Name = xx-PC | Source = ESENT | ID = 454
Description = Catalog Database (1520) Catalog Database: Database recovery/restore
failed with unexpected error -1216.

Error - 15.05.2010 13:28:29 | Computer Name = xx-PC | Source = Microsoft-Windows-CAPI2 | ID = 131329
Description =

Error - 15.05.2010 15:54:42 | Computer Name = xx-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung 00oqz03f.exe, Version 1.0.15.15281, Zeitstempel
0x4b2763f0, fehlerhaftes Modul 00oqz03f.exe, Version 1.0.15.15281, Zeitstempel
0x4b2763f0, Ausnahmecode 0xc0000005, Fehleroffset 0x0000c4b1, Prozess-ID 0x14f0,
Anwendungsstartzeit 01caf4682a731650.

Error - 16.05.2010 11:43:38 | Computer Name = xx-PC | Source = EventSystem | ID = 4621
Description =

Error - 16.05.2010 13:55:35 | Computer Name = xx-PC | Source = EventSystem | ID = 4621
Description =

[ OSession Events ]
Error - 28.07.2007 03:02:01 | Computer Name = xx-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6023.5000, Microsoft Office Version: 12.0.4518.1014. This session lasted 48298
seconds with 720 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 17.05.2010 13:41:18 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:41:20 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:41:23 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:35 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:38 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:40 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:43 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:45 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:48 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

Error - 17.05.2010 13:57:50 | Computer Name = xx-PC | Source = disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.

< End of report >

Danke und Gruß
Fanta

cosinus · 17.05.2010, 20:36

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
[2010.05.16 19:56:20 | 000,823,808 | ---- | M] () -- C:\Windows\System32\drivers\ztjqo.sys
:Commands
[purity]
[resethosts]
[emptytemp]

Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Fanta · 17.05.2010, 20:51

Hallo,

ich habe OTL ausgeführt, der Rechner wurde neu gestartet.
Hier ist das Log:

All processes killed
========== OTL ==========
C:\Windows\System32\drivers\ztjqo.sys moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: xxx
->Temp folder emptied: 2332050 bytes
->Temporary Internet Files folder emptied: 11012090 bytes
->Java cache emptied: 71997261 bytes
->FireFox cache emptied: 45599609 bytes
->Flash cache emptied: 5969 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1467513806 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32537562 bytes
RecycleBin emptied: 188000 bytes

Total Files Cleaned = 1.556,00 mb

OTL by OldTimer - Version 3.2.4.1 log created on 05172010_214311

Files\Folders moved on Reboot...
C:\Windows\temp\JET8535.tmp moved successfully.

Registry entries deleted on Reboot...

Gruß
Fanta

cosinus · 17.05.2010, 21:00

Der Rootkitfund müsste nun weg sein. Kannst Du ja nochmal kontrollieren mit Malwarebytes bzw. AntiVir.

Wenn er nicht mehr gefunden wird, bitte CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Fanta · 18.05.2010, 20:51

Hallo,

erstmal vielen Dank für die HIlfe. Der Rootkit ist jetzt weg.

Malwarebytes findet keine infizierten Objekte.

Dafür findet das Antivir wieder einen Trojaner. Mit Antivir lässt er sich nicht löschen.
Beim nächsten Lauf wird er wieder angezeigt. Steht der im Zusammenhang mit dem dem Rootkit?

Combo habe ich noch nicht angewendet.

Kannst du mir bitte nochmal helfen?

Hier der Log von Antivir:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Dienstag, 18. Mai 2010 18:08

Es wird nach 2132076 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows Vista
Windowsversion : (plain) [6.0.6000]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : xx-PC

Versionsinformationen:
BUILD.DAT : 10.0.0.567 32097 Bytes 19.04.2010 15:50:00
AVSCAN.EXE : 10.0.3.0 433832 Bytes 19.04.2010 16:55:50
AVSCAN.DLL : 10.0.3.0 56168 Bytes 19.04.2010 16:55:50
LUKE.DLL : 10.0.2.3 104296 Bytes 07.03.2010 16:32:59
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 09:59:47
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 06:35:52
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19.11.2009 09:01:37
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20.01.2010 19:24:40
VBASE003.VDF : 7.10.3.75 996864 Bytes 26.01.2010 19:12:42
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05.03.2010 18:43:33
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15.04.2010 17:45:54
VBASE006.VDF : 7.10.6.83 2048 Bytes 15.04.2010 17:45:54
VBASE007.VDF : 7.10.6.84 2048 Bytes 15.04.2010 17:45:55
VBASE008.VDF : 7.10.6.85 2048 Bytes 15.04.2010 17:45:55
VBASE009.VDF : 7.10.6.86 2048 Bytes 15.04.2010 17:45:55
VBASE010.VDF : 7.10.6.87 2048 Bytes 15.04.2010 17:45:55
VBASE011.VDF : 7.10.6.88 2048 Bytes 15.04.2010 17:45:55
VBASE012.VDF : 7.10.6.89 2048 Bytes 15.04.2010 17:45:55
VBASE013.VDF : 7.10.6.90 2048 Bytes 15.04.2010 17:45:55
VBASE014.VDF : 7.10.6.123 126464 Bytes 19.04.2010 16:57:10
VBASE015.VDF : 7.10.6.152 123392 Bytes 21.04.2010 16:57:13
VBASE016.VDF : 7.10.6.178 122880 Bytes 22.04.2010 16:57:10
VBASE017.VDF : 7.10.6.206 120320 Bytes 26.04.2010 16:11:02
VBASE018.VDF : 7.10.6.232 99328 Bytes 28.04.2010 16:41:25
VBASE019.VDF : 7.10.7.2 155648 Bytes 30.04.2010 17:11:59
VBASE020.VDF : 7.10.7.26 119808 Bytes 04.05.2010 20:07:02
VBASE021.VDF : 7.10.7.51 118272 Bytes 06.05.2010 19:46:39
VBASE022.VDF : 7.10.7.75 404992 Bytes 10.05.2010 17:02:54
VBASE023.VDF : 7.10.7.100 125440 Bytes 13.05.2010 14:31:00
VBASE024.VDF : 7.10.7.119 177664 Bytes 17.05.2010 16:07:10
VBASE025.VDF : 7.10.7.120 2048 Bytes 17.05.2010 16:07:10
VBASE026.VDF : 7.10.7.121 2048 Bytes 17.05.2010 16:07:11
VBASE027.VDF : 7.10.7.122 2048 Bytes 17.05.2010 16:07:11
VBASE028.VDF : 7.10.7.123 2048 Bytes 17.05.2010 16:07:11
VBASE029.VDF : 7.10.7.124 2048 Bytes 17.05.2010 16:07:11
VBASE030.VDF : 7.10.7.125 2048 Bytes 17.05.2010 16:07:12
VBASE031.VDF : 7.10.7.129 57344 Bytes 18.05.2010 16:07:12
Engineversion : 8.2.1.242
AEVDF.DLL : 8.1.2.0 106868 Bytes 23.04.2010 16:57:13
AESCRIPT.DLL : 8.1.3.29 1343866 Bytes 12.05.2010 18:58:30
AESCN.DLL : 8.1.6.1 127347 Bytes 12.05.2010 18:58:29
AESBX.DLL : 8.1.3.1 254324 Bytes 23.04.2010 16:57:13
AERDL.DLL : 8.1.4.6 541043 Bytes 17.04.2010 17:46:02
AEPACK.DLL : 8.2.1.1 426358 Bytes 14.04.2010 17:45:58
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 12.05.2010 18:58:29
AEHEUR.DLL : 8.1.1.27 2670967 Bytes 06.05.2010 19:46:45
AEHELP.DLL : 8.1.11.3 242039 Bytes 14.04.2010 17:45:55
AEGEN.DLL : 8.1.3.9 377203 Bytes 12.05.2010 18:58:28
AEEMU.DLL : 8.1.2.0 393588 Bytes 23.04.2010 16:57:12
AECORE.DLL : 8.1.15.3 192886 Bytes 12.05.2010 18:58:28
AEBB.DLL : 8.1.1.0 53618 Bytes 23.04.2010 16:57:11
AVWINLL.DLL : 10.0.0.0 19304 Bytes 14.01.2010 09:59:10
AVPREF.DLL : 10.0.0.0 44904 Bytes 14.01.2010 09:59:07
AVREP.DLL : 10.0.0.8 62209 Bytes 18.02.2010 14:47:40
AVREG.DLL : 10.0.3.0 53096 Bytes 19.04.2010 16:55:50
AVSCPLR.DLL : 10.0.3.0 83816 Bytes 19.04.2010 16:55:50
AVARKT.DLL : 10.0.0.14 227176 Bytes 19.04.2010 16:55:49
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 26.01.2010 07:53:25
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 10:57:53
AVSMTP.DLL : 10.0.0.17 63848 Bytes 16.03.2010 13:38:54
NETNT.DLL : 10.0.0.0 11624 Bytes 19.02.2010 12:40:55
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28.01.2010 11:10:08
RCTEXT.DLL : 10.0.53.0 98152 Bytes 19.04.2010 16:55:49

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: mittel

Beginn des Suchlaufs: Dienstag, 18. Mai 2010 18:08

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'wermgr.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'mcupdate.EXE' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'wuauclt.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'java.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'jp2launcher.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '156' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'CPSHelpRunner.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'quickset.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'DLG.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '19' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTTray.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.EXE' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'DSAgnt.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'AdobeARM.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'RoxMediaDB9.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'TMRUBottedTray.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'mouse32a.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'GrooveMonitor.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'PCMService.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleDesktop.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'DrgToDsc.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'RoxWatchTray9.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'issch.exe' - '12' Modul(e) wurden durchsucht
Durchsuche Prozess 'sttray.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'xaudio.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '7' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'STacSV.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'TMRUBotted.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'RoxWatch9.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleUpdate.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '152' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '90' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '159' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'Ati2evxx.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '385' Dateien ).

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <OS>
C:\Users\xx\AppData\Roaming\NTDOS804N.dll
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
Beginne mit der Suche in 'D:\' <RECOVERY>

Beginne mit der Desinfektion:
C:\Users\xx\AppData\Roaming\NTDOS804N.dll
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen2
[WARNUNG] Die Datei wurde ignoriert.

Ende des Suchlaufs: Dienstag, 18. Mai 2010 21:32
Benötigte Zeit: 2:57:29 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

24274 Verzeichnisse wurden überprüft
365889 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
365888 Dateien ohne Befall
1601 Archive wurden durchsucht
1 Warnungen
0 Hinweise
520300 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden

Danke!

cosinus · 18.05.2010, 21:17

Das müssten wir auch mit CF wegkriegen, wende das jetzt bitte mal an.

Fanta · 18.05.2010, 22:02

Hallo,

ComboFix ist erledigt. Hier das Ergebnis.

Code:

ATTFilter

ComboFix 10-05-16.06 - xxr 18.05.2010  22:32:33.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.2046.1092 [GMT 2:00]
ausgeführt von:: c:\users\xx\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\xx\AppData\Roaming\.#
c:\users\xx\AppData\Roaming\Microsoft\Windows\Recent\ Futtereulen.de .url
c:\users\xx\AppData\Roaming\Microsoft\Windows\Recent\1moregame.com.url
c:\users\xxr\AppData\Roaming\Microsoft\Windows\Recent\Ameisensekte-Forum.url

.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games


(((((((((((((((((((((((   Dateien erstellt von 2010-04-18 bis 2010-05-18  ))))))))))))))))))))))))))))))
.

2010-05-18 20:39 . 2010-05-18 20:39	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-05-17 19:43 . 2010-05-17 19:43	--------	d-----w-	C:\_OTL
2010-05-16 17:55 . 2010-05-16 18:01	--------	d-----w-	c:\users\xxr\AppData\Roaming\Online Solutions
2010-05-16 15:04 . 2010-05-16 15:04	--------	d-----w-	c:\program files\OperationChaos_at
2010-05-14 13:02 . 2010-05-14 13:02	--------	d-----w-	c:\program files\Common Files\Symantec Shared
2010-05-14 08:40 . 2010-05-14 08:41	--------	d-----w-	c:\program files\Sally's Studio Collector's Edition
2010-05-05 20:21 . 2010-05-17 05:12	--------	d-----w-	c:\program files\CCleaner
2010-05-04 18:25 . 2010-05-09 15:11	--------	d-----w-	c:\program files\Spybot - Search & Destroy b
2010-05-04 18:18 . 2010-05-04 18:23	--------	d-----w-	c:\program files\TeaTimer (Spybot - Search & Destroy)
2010-05-04 18:18 . 2010-05-04 18:23	--------	d-----w-	c:\program files\SDHelper (Spybot - Search & Destroy)
2010-05-04 18:18 . 2010-05-04 18:18	--------	d-----w-	c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2010-05-04 18:18 . 2010-05-04 18:18	--------	d-----w-	c:\program files\File Scanner Library (Spybot - Search & Destroy)
2010-05-03 05:05 . 2006-06-19 11:01	69632	----a-w-	c:\windows\system32\ztvcabinet.dll
2010-05-03 05:05 . 2006-05-25 13:52	162304	----a-w-	c:\windows\system32\ztvunrar36.dll
2010-05-03 05:05 . 2005-08-25 23:50	77312	----a-w-	c:\windows\system32\ztvunace26.dll
2010-05-03 05:05 . 2003-02-02 18:06	153088	----a-w-	c:\windows\system32\UNRAR3.dll
2010-05-03 05:05 . 2002-03-05 23:00	75264	----a-w-	c:\windows\system32\unacev2.dll
2010-05-03 05:05 . 2010-05-15 18:25	--------	d-----w-	c:\program files\Trojan Remover
2010-05-03 05:05 . 2010-05-03 05:05	--------	d-----w-	c:\programdata\Simply Super Software
2010-05-02 15:42 . 2010-05-08 18:42	--------	d-----w-	c:\users\xx\AppData\Roaming\03343AE287F68AA8F685ED228E277A6D
2010-04-25 08:53 . 2010-04-25 08:54	--------	d-----w-	c:\users\xx\AppData\Roaming\Clickteam

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-18 20:40 . 2007-02-28 17:51	12	----a-w-	c:\windows\bthservsdp.dat
2010-05-18 20:39 . 2008-06-19 18:01	--------	d-----w-	c:\programdata\Google Updater
2010-05-18 20:22 . 2007-06-14 18:16	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-05-17 21:01 . 2007-06-09 19:15	--------	d-----w-	c:\programdata\PlayFirst
2010-05-16 07:36 . 2007-04-21 19:05	--------	d-----w-	c:\programdata\Microsoft Help
2010-05-15 18:25 . 2008-04-21 16:50	--------	d-----w-	c:\program files\Norton Security Scan
2010-05-08 18:16 . 2007-08-12 15:07	--------	d-----w-	c:\program files\Sallys Salon
2010-05-08 07:44 . 2010-03-22 21:52	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-05-06 08:36 . 2009-10-03 08:26	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-05 16:48 . 2007-06-14 18:16	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2010-05-01 15:05 . 2009-06-13 08:15	--------	d-----w-	c:\users\xx\AppData\Roaming\ERS G-Studio
2010-05-01 10:22 . 2007-02-28 18:02	--------	d-----w-	c:\program files\Common Files\Java
2010-04-29 13:39 . 2010-03-22 21:52	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2010-03-22 21:52	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-04-25 08:05 . 2009-08-12 11:12	--------	d-----w-	c:\programdata\Namco
2010-04-18 16:52 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-04-18 15:05 . 2010-04-18 15:05	58368	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2010-04-18 15:05 . 2010-04-18 15:05	211968	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2010-04-18 15:05 . 2010-04-18 15:05	102400	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2010-04-18 15:04 . 2010-04-18 15:04	3502480	----a-w-	c:\windows\system32\ntkrnlpa.exe
2010-04-18 15:04 . 2010-04-18 15:04	3468168	----a-w-	c:\windows\system32\ntoskrnl.exe
2010-04-18 15:03 . 2010-04-18 15:03	434176	----a-w-	c:\windows\system32\vbscript.dll
2010-04-18 14:56 . 2010-04-18 14:56	171520	----a-w-	c:\windows\system32\wintrust.dll
2010-04-18 14:54 . 2010-04-18 14:54	815104	----a-w-	c:\windows\system32\drivers\tcpip.sys
2010-04-18 14:54 . 2010-04-18 14:54	25088	----a-w-	c:\windows\system32\drivers\tunnel.sys
2010-04-18 14:54 . 2010-04-18 14:54	22016	----a-w-	c:\windows\system32\netiougc.exe
2010-04-18 14:54 . 2010-04-18 14:54	179712	----a-w-	c:\windows\system32\iphlpsvc.dll
2010-04-18 14:54 . 2010-04-18 14:54	167424	----a-w-	c:\windows\system32\tcpipcfg.dll
2010-04-18 14:54 . 2010-04-18 14:54	15360	----a-w-	c:\windows\system32\drivers\TUNMP.SYS
2010-04-18 14:53 . 2010-04-18 14:53	97792	----a-w-	c:\windows\system32\cabview.dll
2010-04-18 13:44 . 2010-04-18 13:44	--------	d-----w-	c:\users\xxr\AppData\Roaming\Realore_DressUpRush
2010-04-16 18:15 . 2010-04-16 18:15	--------	d-----w-	c:\users\xx\AppData\Roaming\elsterformular
2010-04-16 18:14 . 2007-05-17 14:45	--------	d-----w-	c:\program files\ElsterFormular
2010-04-16 17:46 . 2010-04-16 17:46	--------	d-----w-	c:\programdata\elsterformular
2010-04-13 17:47 . 2010-04-13 17:47	--------	d-----w-	c:\users\xx\AppData\Roaming\Avira
2010-04-11 18:03 . 2007-02-28 18:03	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-04-09 09:57 . 2010-04-09 09:57	--------	d-----w-	c:\program files\Diner Dash 5 Boom!
2010-04-07 11:49 . 2010-02-06 18:43	--------	d-----w-	c:\users\Exxr\AppData\Roaming\Oberon Media
2010-04-06 09:14 . 2008-10-11 19:44	--------	d-----w-	c:\programdata\AlawarWrapper
2010-04-05 15:19 . 2007-03-05 18:11	--------	d-----w-	c:\users\xx\AppData\Roaming\Roxio
2010-04-04 16:28 . 2010-04-04 16:28	--------	d-----w-	c:\users\xx\AppData\Roaming\Frogwares
2010-04-04 14:51 . 2010-04-04 14:51	--------	d-----w-	c:\users\xx\AppData\Roaming\Silverback Productions
2010-04-02 13:45 . 2008-12-26 10:20	--------	d-----w-	c:\programdata\InterAction studios
2010-03-29 19:16 . 2006-11-02 15:33	641344	----a-w-	c:\windows\system32\perfh007.dat
2010-03-29 19:16 . 2006-11-02 15:33	116706	----a-w-	c:\windows\system32\perfc007.dat
2010-03-27 17:51 . 2010-03-27 17:51	61440	--sha-r-	c:\users\xx\AppData\Roaming\NTDOS804N.dll
2010-03-27 17:51 . 2010-03-27 17:51	61440	--sha-r-	c:\users\xx\AppData\Roaming\NTDOS804N.dll
2010-03-27 17:37 . 2010-03-27 17:37	--------	d-----w-	c:\users\xx\AppData\Roaming\Happyville__
2010-03-22 21:52 . 2010-03-22 21:52	--------	d-----w-	c:\users\xx\AppData\Roaming\Malwarebytes
2010-03-22 21:52 . 2010-03-22 21:52	--------	d-----w-	c:\programdata\Malwarebytes
2010-03-21 15:01 . 2010-03-21 15:01	--------	d-----w-	c:\users\xx\AppData\Roaming\Pirate Stories Kit   Ellis
2010-03-21 13:06 . 2007-06-09 19:15	--------	d-----w-	c:\users\xxr\AppData\Roaming\PlayFirst
2010-03-20 21:31 . 2010-03-20 20:35	--------	d-----w-	c:\programdata\SZ
2010-03-20 19:15 . 2009-11-07 21:55	--------	d-----w-	c:\program files\Common Files\Adobe
2010-03-20 08:11 . 2010-03-20 08:11	--------	d-----w-	c:\programdata\XLab
2010-03-13 18:45 . 2010-03-13 18:45	396800	----a-w-	c:\windows\system32\drivers\http.sys
2010-03-13 18:45 . 2010-03-13 18:45	31232	----a-w-	c:\windows\system32\httpapi.dll
2010-03-13 18:45 . 2010-03-13 18:45	24064	----a-w-	c:\windows\system32\nshhttp.dll
2010-03-13 13:39 . 2010-03-13 13:39	268435456	--sha-w-	C:\WinPEpge.sys
2010-03-07 16:41 . 2010-03-07 16:41	1923768	----a-w-	c:\programdata\NOS\Adobe_Downloads\install_flash_player.exe
2010-03-07 16:41 . 2010-03-07 16:41	1025992	----a-w-	c:\programdata\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-03-06 16:48 . 2007-03-05 18:10	117808	----a-w-	c:\users\xx\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-06 14:01 . 2009-10-22 20:02	411368	----a-w-	c:\windows\system32\deploytk.dll
2010-03-06 13:53 . 2010-03-06 13:53	2048	----a-w-	c:\windows\system32\tzres.dll
2010-03-06 13:52 . 2010-03-06 13:52	435712	----a-w-	c:\windows\system32\RMActivate_ssp.exe
2010-03-06 13:52 . 2010-03-06 13:52	312320	----a-w-	c:\windows\system32\msdrm.dll
2010-03-06 13:52 . 2010-03-06 13:52	154112	----a-w-	c:\windows\system32\secproc_ssp.dll
2010-03-06 13:52 . 2010-03-06 13:52	523776	----a-w-	c:\windows\system32\RMActivate_isv.exe
2010-03-06 13:52 . 2010-03-06 13:52	515584	----a-w-	c:\windows\system32\RMActivate.exe
2010-03-06 13:52 . 2010-03-06 13:52	473088	----a-w-	c:\windows\system32\secproc_isv.dll
2010-03-06 13:52 . 2010-03-06 13:52	472576	----a-w-	c:\windows\system32\secproc.dll
2010-03-06 13:52 . 2010-03-06 13:52	431104	----a-w-	c:\windows\system32\RMActivate_ssp_isv.exe
2010-03-06 13:52 . 2010-03-06 13:52	154624	----a-w-	c:\windows\system32\secproc_ssp_isv.dll
2010-03-01 07:05 . 2009-12-31 08:58	124784	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-02-19 19:01 . 2010-02-19 19:01	1233160	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-02-19 18:31 . 2010-03-06 17:35	31936	----a-w-	c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-02-19 18:31 . 2010-03-06 17:35	29344	----a-w-	c:\users\Esther\AppData\Roaming\Mozilla\Firefox\Profiles\0jlbbrhk.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-02-19 18:20 . 2010-02-19 18:20	84992	----a-w-	c:\windows\system32\drivers\srvnet.sys
2010-02-19 18:20 . 2010-02-19 18:20	306688	----a-w-	c:\windows\system32\drivers\srv.sys
2010-02-19 18:08 . 2010-02-19 18:08	50176	----a-w-	c:\windows\system32\iyuv_32.dll
2010-02-19 18:08 . 2010-02-19 18:08	22528	----a-w-	c:\windows\system32\msyuv.dll
2010-02-19 18:08 . 2010-02-19 18:08	11776	----a-w-	c:\windows\system32\tsbyuv.dll
2010-02-19 18:08 . 2010-02-19 18:08	65024	----a-w-	c:\windows\system32\avicap32.dll
2010-02-19 18:08 . 2010-02-19 18:08	1327616	----a-w-	c:\windows\system32\quartz.dll
2010-02-19 18:08 . 2010-02-19 18:08	123904	----a-w-	c:\windows\system32\msvfw32.dll
2010-02-19 18:08 . 2010-02-19 18:08	88576	----a-w-	c:\windows\system32\avifil32.dll
2010-02-19 18:08 . 2010-02-19 18:08	82944	----a-w-	c:\windows\system32\mciavi32.dll
2010-02-19 18:08 . 2010-02-19 18:08	31232	----a-w-	c:\windows\system32\msvidc32.dll
2010-02-19 18:08 . 2010-02-19 18:08	13312	----a-w-	c:\windows\system32\msrle32.dll
2007-05-28 13:13 . 2007-05-28 13:13	774144	----a-w-	c:\program files\RngInterstitial.dll
2010-02-04 19:09 . 2010-02-04 19:09	119808	----a-w-	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-03-01 01:45 . 2007-03-01 01:44	8192	--sha-w-	c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-11 1232896]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy b\TeaTimer.exe" [2009-03-05 2260480]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-12 446976]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-04-11 1006264]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 815104]
"SigmatelSysTrayApp"="sttray.exe" [2006-12-01 303104]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-02-04 30192]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2006-10-13 184320]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"FLMOFFICE4DMOUSE"="c:\program files\Browser Mouse\mouse32a.exe" [2007-05-28 360448]
"TMRUBottedTray"="c:\program files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2007-12-18 288088]
"LexwareInfoService"="c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2008-09-11 339240]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
" Malwarebytes Anti-Malware  (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-08-04 1068424]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-3 703280]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-2-28 50688]
QuickSet.lnk - c:\windows\Installer\{53A01CC6-14B0-4512-A2E7-10D39BF83DC4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-2-28 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R2 gupdate1c9ed0ea1ae75a0;Google Update Service (gupdate1c9ed0ea1ae75a0);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 133104]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-02-04 30192]
R3 HRService;Haufe iDesk-Service in c:\program files\Haufe\iDesk\iDeskService\Zope;c:\program files\Haufe\iDesk\iDeskService\iDeskService.exe [2008-08-20 70336]
R3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\DRIVERS\TMPassthru.sys [2007-11-27 35216]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 RUBotted;Trend Micro RUBotted Service;c:\program files\Trend Micro\RUBotted\TMRUBotted.exe [2007-12-18 517456]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy b\SDWinSec.exe [2009-01-26 1153368]
S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\DRIVERS\TMPassthru.sys [2007-11-27 35216]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
getPlusHelper	REG_MULTI_SZ   	getPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-04-02 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-01-08 11:19]

2010-05-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-19 20:38]

2010-05-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 16:38]

2010-05-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 16:38]

2010-04-02 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [2007-04-19 20:42]

2010-05-18 c:\windows\Tasks\User_Feed_Synchronization-{4F1AD747-E258-45ED-95D5-4AE40737C6A0}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.iplay.com/?o=shp
FF - ProfilePath - c:\users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\0jlbbrhk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npMyGames.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

AddRemove-Delicious - Emilys Holiday Season Deluxe - c:\users\xx\AppData\Local\Zylom Games\Delicious - Emilys Holiday Season Deluxe\GameInstlr.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-05-18 22:43
Windows 6.0.6000  NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(1272)
c:\windows\system32\btncopy.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\SigmaTel\C-Major Audio\WDM\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\windows\system32\conime.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-05-18  22:51:29 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-05-18 20:51

Vor Suchlauf: 22 Verzeichnis(se), 90.626.461.696 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 90.211.782.656 Bytes frei

- - End Of File - - A068F036023B8E537BDE69B2BA0738E2

14.05.2010, 17:56	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Rootkit.Agent../System32/Drivers/ Hallo und Bei diesem Rootkit ist ein GMER und OSAM Log notwendig, bitte erstellen + posten. __________________ __________________

14.05.2010, 17:58	#3
StLB /// Helfer-Team	Rootkit.Agent../System32/Drivers/ ... zu langsam __________________ __________________

18.05.2010, 21:17	#14
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Rootkit.Agent../System32/Drivers/ Das müssten wir auch mit CF wegkriegen, wende das jetzt bitte mal an. __________________ Logfiles bitte immer in CODE-Tags posten

Rootkit.Agent../System32/Drivers/

Plagegeister aller Art und deren Bekämpfung: Rootkit.Agent../System32/Drivers/