Trojan:Win32/Orsam!rtf und Trojandownloader:Win32/Bredolab.AA

Logfile of random's system information tool 1.07 (written by random/random)
Run by yoigen at 2010-06-11 19:00:23
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 55 GB (36%) free of 153 GB
Total RAM: 2047 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:00:30, on 11.06.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\Programme\Microsoft Security Essentials\msseces.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Application Updater\ApplicationUpdater.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\NettalkIRCD\NettalkIRCD.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\***\Eigene Dateien\RSIT.exe
C:\Programme\trend micro\yoigen.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Ask.com Deutschland - die andere Suchmaschine
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSSE] "C:\Programme\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Dokumente und Einstellungen\***\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - HKCU\..\Run: [Google Update] "C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Programme\Steam\Steam.exe" -silent
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI" TRANSFORMS="C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST" WISE_SETUP_EXE_PATH="c:\nvidia\displaydriver\195.62\winxp\international\PhysX_9.09.0814_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Programme\MagicDisc\MagicDisc.exe
O4 - Startup: My_AutoWarkey_Script.lnk = C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe
O4 - Startup: Warkeys Update.lnk = C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C893582-9922-45FD-90B8-40D64D3690EC}: NameServer = 192.168.178.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Application Updater - Spigot, Inc. - C:\Programme\Application Updater\ApplicationUpdater.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NettalkIRCD (NtIrcd) - Nicolas Kruse - C:\Programme\NettalkIRCD\NettalkIRCD.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 6526 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-507921405-1303643608-725345543-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-507921405-1303643608-725345543-1004UA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}]
Dealio Toolbar - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll [2009-12-16 700416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Programme\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2010-02-21 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
SearchSettings Class - C:\Programme\Search Settings\SearchSettings.dll [2009-12-16 1109504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-02-21 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - Dealio Toolbar - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll [2009-12-16 700416]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Programme\Ask.com\GenericAskToolbar.dll [2010-02-04 1197448]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-04-12 16132608]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SearchSettings"=C:\Programme\Search Settings\SearchSettings.exe [2009-12-16 975360]
"SunJavaUpdateSched"=C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [2010-01-11 246504]
"MSSE"=C:\Programme\Microsoft Security Essentials\msseces.exe [2010-02-21 1093208]
"WinampAgent"=C:\Programme\Winamp\winampa.exe [2010-01-14 37888]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-04-11 56080]
"nwiz"=nwiz.exe /installquiet []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-04-03 13670504]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-04-03 110696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Skype"=C:\Programme\Skype\Phone\Skype.exe [2009-10-09 25623336]
"MSMSGS"=C:\Programme\Messenger\msmsgs.exe [2004-08-04 1667584]
"Octoshape Streaming Services"=C:\Dokumente und Einstellungen\***\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [2009-01-08 70936]
"Google Update"=C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2010-05-09 136176]
"Steam"=C:\Programme\Steam\Steam.exe [2010-05-18 1238352]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WiseStubReboot"=MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI TRANSFORMS=C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST WISE_SETUP_EXE_PATH=c:\nvidia\displaydriver\195.62\winxp\international\PhysX_9.09.0814_SystemSoftware.exe []

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe

C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart
MagicDisc.lnk - C:\Programme\MagicDisc\MagicDisc.exe
My_AutoWarkey_Script.lnk - C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe
Warkeys Update.lnk - C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Skype\Plugin Manager\skypePM.exe"="C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Programme\mIRC\mirc.exe"="C:\Programme\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Programme\Garena\Garena.exe"="C:\Programme\Garena\Garena.exe:*:Enabled:Garena"
"C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\wtvClient.exe"="C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\wtvClient.exe:*:Enabled:wtvClient"
"C:\Programme\OfficialCnCTiberianSun\EA Games\Command & Conquer The First Decade\Command & Conquer(tm) Tiberian Sun(tm)\SUN\Game.exe"="C:\Programme\OfficialCnCTiberianSun\EA Games\Command & Conquer The First Decade\Command & Conquer(tm) Tiberian Sun(tm)\SUN\Game.exe:*:Enabled:Main executable for Tiberian Sun"
"C:\Dokumente und Einstellungen\***\Desktop\wtvClient0.97.02(2)\wtvClient.exe"="C:\Dokumente und Einstellungen\***\Desktop\wtvClient0.97.02(2)\wtvClient.exe:*:Enabled:wtvClient"
"C:\Programme\Java\jre6\bin\java.exe"="C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Programme\BitTorrent\bittorrent.exe"="C:\Programme\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Programme\StarCraft II Beta\StarCraft II.exe"="C:\Programme\StarCraft II Beta\StarCraft II.exe:*:Enabled:Blizzard Launcher"
"C:\Programme\StarCraft II Beta\Versions\Base13891\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base13891\SC2.exe:*:Enabled:StarCraft II"
"C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\w*w.macromedia.com\bin\octoshape\octoshape.exe"="C:\Dokumente und Einstellungen\***\Anwendungsdaten\Macromedia\Flash Player\w/w.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player"
"C:\Programme\StarCraft II Beta\Versions\Base14093\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14093\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\StarCraft II Beta\Versions\Base14133\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14133\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\Opera\opera.exe"="C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\wtvClient0.97.02\wtvClient.exe"="C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\wtvClient0.97.02\wtvClient.exe:*:Enabled:wtvClient"
"C:\Dokumente und Einstellungen\***\Desktop\wtvClient0.97.02\wtvClient.exe"="C:\Dokumente und Einstellungen\***\Desktop\wtvClient0.97.02\wtvClient.exe:*:Enabled:wtvClient"
"C:\Programme\StarCraft II Beta\Versions\Base14259\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14259\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\DotAzilla\DotAzilla.exe"="C:\Programme\DotAzilla\DotAzilla.exe:*:Enabled:DotAzilla"
"C:\Programme\Warcraft III\Warcraft III.exe"="C:\Programme\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Programme\Warcraft III\Frozen Throne.exe"="C:\Programme\Warcraft III\Frozen Throne.exe:*:Enabled:Warcraft III - The Frozen Throne"
"C:\Dokumente und Einstellungen\***\Desktop\gproxyplusplus_ptr_windows_1.0\gproxy.exe"="C:\Dokumente und Einstellungen\***\Desktop\gproxyplusplus_ptr_windows_1.0\gproxy.exe:*:Enabled:gproxy"
"C:\Programme\StarCraft II Beta\Versions\Base14356\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14356\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\CCP\EVE\bin\ExeFile.exe"="C:\Programme\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile"
"C:\Dokumente und Einstellungen\***\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe"="C:\Dokumente und Einstellungen\***\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Enabled:Main program for Octoshape client"
"C:\Programme\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.game"="C:\Programme\Electronic Arts\Command & Conquer 4 Tiberian Twilight\Data\CNC4.game:*:Enabled:Command & Conquer™ 4"
"C:\Programme\League of Legends\Air\LolClient.exe"="C:\Programme\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby"
"C:\Programme\League of Legends\Game\League of Legends.exe"="C:\Programme\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Programme\StarCraft II Beta\Versions\Base14593\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14593\SC2.exe:*:Enabled:StarCraft II"
"E:\World of Warcraft\Launcher.exe"="E:\World of Warcraft\Launcher.exe:*:Enabled:Launcher"
"C:\Programme\StarCraft II Beta\Versions\Base14621\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14621\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\StarCraft II Beta\Versions\Base14803\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base14803\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\Java\jre6\bin\javaw.exe"="C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Programme\StarCraft II Beta\Versions\Base15133\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15133\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\DotAlicious Gaming Client\client.exe"="C:\Programme\DotAlicious Gaming Client\client.exe:*:Enabled:client"
"C:\Programme\StarCraft II Beta\Versions\Base15250\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15250\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\xchat\xchat.exe"="C:\Programme\xchat\xchat.exe:*:Enabled:XChat IRC Client"
"C:\Programme\StarCraft II Beta\Versions\Base15343\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15343\SC2.exe:*:Enabled:StarCraft II"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Programme\StarCraft II Beta\Versions\Base15392\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15392\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\Steam\Steam.exe"="C:\Programme\Steam\Steam.exe:*:Enabled:Steam"
"C:\Programme\StarCraft II Beta\Versions\Base15449\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15449\SC2.exe:*:Enabled:StarCraft II"
"C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene eBooks\L4D2.AuRoRa\L4D2.AuRoRa\left4dead2.exe"="C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene eBooks\L4D2.AuRoRa\L4D2.AuRoRa\left4dead2.exe:*:Enabled:left4dead2"
"C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene eBooks\L4D2.AuRoRa\L4D2.AuRoRa\srcds.exe"="C:\Dokumente und Einstellungen\***\Eigene Dateien\Eigene eBooks\L4D2.AuRoRa\L4D2.AuRoRa\srcds.exe:*:Enabled:srcds"
"C:\Programme\StarCraft II Beta\Versions\Base15580\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15580\SC2.exe:*:Enabled:StarCraft II"
"C:\Programme\StarCraft II Beta\Versions\Base15623\SC2.exe"="C:\Programme\StarCraft II Beta\Versions\Base15623\SC2.exe:*:Enabled:StarCraft II"
"C:\Dokumente und Einstellungen\***\Desktop\gproxy\gproxy.exe"="C:\Dokumente und Einstellungen\***\Desktop\gproxy\gproxy.exe:*:Enabled:gproxy"
"C:\Programme\Stunlock Studios\Bloodline Champions Beta\Binary\BloodlineChampionsLoader.exe"="C:\Programme\Stunlock Studios\Bloodline Champions Beta\Binary\BloodlineChampionsLoader.exe:*:Enabled:BloodlineChampionsLoader"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{469c800c-18b1-11df-aeb1-001d605580cb}]
shell\AutoRun\command - E:\autorun.exe


======List of files/folders created in the last 1 months======

2010-06-11 18:58:09 ----D---- C:\rsit
2010-06-11 18:43:00 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
2010-06-11 18:42:46 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-06-11 18:42:45 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-06-11 18:28:53 ----D---- C:\Programme\CCleaner
2010-06-11 18:05:05 ----D---- C:\Programme\Stunlock Studios
2010-06-11 18:03:23 ----D---- C:\Programme\Microsoft XNA
2010-06-11 17:04:01 ----D---- C:\Programme\Thief - Deadly Shadows
2010-06-11 17:03:27 ----A---- C:\WINDOWS\system32\CmdLineExt03.dll
2010-06-09 18:50:25 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-09 18:50:22 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-09 18:50:17 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-09 18:47:56 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-09 18:47:51 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-09 18:47:47 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-06-09 18:43:02 ----HDC---- C:\WINDOWS\$NtUninstallKB982381$
2010-06-08 19:59:11 ----D---- C:\Programme\EuphRO
2010-06-07 16:59:39 ----A---- C:\WINDOWS\system32\MRT.exe
2010-06-07 16:59:28 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$
2010-05-27 14:10:36 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-05-22 16:26:51 ----D---- C:\Programme\SystemRequirementsLab
2010-05-18 19:53:54 ----D---- C:\Programme\Steam
2010-05-16 19:42:04 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-05-16 19:42:02 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2010-05-16 19:42:00 ----D---- C:\WINDOWS\system32\LogFiles
2010-05-16 19:42:00 ----A---- C:\WINDOWS\system32\pbsvc_heroes.exe
2010-05-16 19:22:56 ----D---- C:\Programme\EA Games
2010-05-16 17:23:04 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Real
2010-05-13 16:00:39 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\X-Chat 2
2010-05-13 16:00:38 ----D---- C:\Programme\xchat
2010-05-13 15:58:35 ----D---- C:\Programme\NettalkIRCD
2010-05-13 15:52:38 ----D---- C:\Programme\mIRC
2010-05-13 12:37:43 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$

======List of files/folders modified in the last 1 months======

2010-06-11 19:00:30 ----D---- C:\Programme\Trend Micro
2010-06-11 19:00:21 ----D---- C:\WINDOWS\Temp
2010-06-11 18:59:39 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Skype
2010-06-11 18:58:43 ----SD---- C:\WINDOWS\Tasks
2010-06-11 18:55:14 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-11 18:53:00 ----D---- C:\WINDOWS
2010-06-11 18:52:06 ----HDC---- C:\WINDOWS\$NtUninstallKB890046$
2010-06-11 18:52:06 ----D---- C:\WINDOWS\system32\drivers
2010-06-11 18:51:35 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-11 18:51:05 ----HD---- C:\Programme\Explorer
2010-06-11 18:50:25 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\mIRC
2010-06-11 18:42:45 ----RD---- C:\Programme
2010-06-11 18:37:08 ----D---- C:\WINDOWS\Minidump
2010-06-11 18:37:08 ----D---- C:\WINDOWS\Debug
2010-06-11 18:18:00 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\skypePM
2010-06-11 18:15:48 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\BitTorrent
2010-06-11 18:06:48 ----SHD---- C:\WINDOWS\Installer
2010-06-11 18:03:53 ----RSD---- C:\WINDOWS\assembly
2010-06-11 18:03:52 ----D---- C:\WINDOWS\system32\DirectX
2010-06-11 18:03:49 ----HD---- C:\WINDOWS\inf
2010-06-11 18:03:24 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2010-06-11 17:05:29 ----HD---- C:\Programme\InstallShield Installation Information
2010-06-11 17:03:27 ----D---- C:\WINDOWS\system32
2010-06-09 19:02:01 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-09 18:50:27 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-09 18:50:21 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-09 18:47:16 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-09 18:47:02 ----D---- C:\WINDOWS\WinSxS
2010-06-09 18:45:49 ----D---- C:\WINDOWS\Prefetch
2010-06-09 18:43:08 ----D---- C:\Programme\Internet Explorer
2010-06-08 19:50:49 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\TS3Client
2010-06-08 18:28:23 ----D---- C:\Programme\StarCraft II Beta
2010-06-08 16:14:45 ----D---- C:\Programme\Logitech
2010-06-07 20:51:25 ----D---- C:\Programme\Warcraft III
2010-06-04 23:05:57 ----D---- C:\Programme\Garena
2010-06-04 22:59:15 ----D---- C:\Programme\TeamSpeak 3 Client
2010-05-31 19:23:46 ----D---- C:\Program Files
2010-05-29 21:38:43 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Winamp
2010-05-29 20:57:53 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\vlc
2010-05-27 21:16:27 ----D---- C:\DVDVideoSoft
2010-05-22 16:37:57 ----D---- C:\WINDOWS\Help
2010-05-22 16:36:45 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-05-22 16:35:34 ----D---- C:\Programme\NVIDIA Corporation
2010-05-22 12:16:50 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Blizzard Entertainment
2010-05-19 14:26:41 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NOS
2010-05-15 17:06:34 ----D---- C:\Programme\DotAlicious Gaming Client
2010-05-14 13:24:21 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-05-13 12:37:45 ----D---- C:\Programme\Outlook Express

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-04 40192]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2009-12-02 149040]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; C:\WINDOWS\System32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-04-23 4402176]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-04-11 20496]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-04-11 34832]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-04-11 36112]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2007-04-11 28688]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-12 5810]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2010-04-04 10232128]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOKUME~1\***\LOKALE~1\Temp\OEH114.tmp []
S3 NTSIM;NTSIM; \??\C:\WINDOWS\System32\ntsim.sys []
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Application Updater;Application Updater; C:\Programme\Application Updater\ApplicationUpdater.exe [2009-12-16 375296]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2010-02-21 153376]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Programme\Microsoft Security Essentials\MsMpEng.exe [2009-12-09 17904]
R2 NtIrcd;NettalkIRCD; C:\Programme\NettalkIRCD\NettalkIRCD.exe [2006-03-01 459776]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2010-04-03 154216]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2010-05-16 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2010-05-22 215016]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------