Hallo verehrtes Tojaner-Board Team,

hatte mir einige Trojaner gefangen, die von meinem Virenschutz-Programm G-Data nicht erkannt wurden. Erst nachdem mein Webbrowser ständig neue Seiten aufmachen wollte, erhielt ich von G-Data Warnmeldungen:

U.a. wie folgt:

- 195.88.144.97; TrojanHeur.lGo@r4tVgtbc
- www3.workfree38-td.xorg.pl; JS:Redirector-CI
- www2.supersafetyin11.xorg.pl; TrojanFakeAV-EJ
- TrojanHeur.lgo@reebYCCl
- ww2:getsuperbclean-81p.xorg.pl; TrojanFakeAV.KUE, JS:Fake AV-EJ


Malwarebytes' Anti-Malware meldete folgende infizierte Dateien:

C:\WINDOWS\system32\drivers\rjezb.sys (Rootkit.Agent)
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\temp\stp0b142.exe (Trojan.FraudTool)
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\temp\wnoaxcrmse.tmp (Malware.Packer.Gen)
C:\Dokumente und Einstellungen\All Users\Favoriten\_favdata.dat (Malware.Trace)

sowie D:\Programme\downloaded\rnsetup.exe (Rogue.SpywareCleaner)

Nach der Desinfektion blieben jedoch immer noch die Öffnungsversuch der Website 195.88.144.97 (mit ständig ändernden Namen) und dem TrojanHeur.lGo@r4tVgtbc

Nach Austausch von G-Data mit Kaspersky Pure wurden folgende Viren gefunden und desinfiziert:


Rootkit.Win32.TDSS.ap
in C.\SystemVolumeInformation\_restore{7170487C-745D-4177-8AF5-E918A046ABD2}\RP380\A0057718.sys

und am Folgetag: .

Trojan-GameThief.Win32.Magania.dilb in D:\PC\System\Apps\0DE4F643-C398-46ec-9339-2362F2311932\Skype(3.5.14.240)(u3)(6291)release_candidate.u3p/host/ hostClnUpNoOp.exe

sowie Packed.Win32.Krap.hc
in D:\System Volume Information\_restore{7170487C-745D-4177-8AF5-E918A046ABD2}\RP387\A0061039.exe

Nicht mehr benötigte Programme habe ich gelöscht und den PC mit CCleaner „gereinigt“. Seitdem habe ich keine Warnmeldungen mehr. Doch ein Gefühl der Unsicherheit bleibt. Ich würde mich daher sehr freuen, wenn jemand die Log-Files der verschiedenen Programme (Kaspersky, MBAM, RSIT, GMER, Combofix) kontrollieren könnte, ob nicht doch noch irgendetwas Verdächtiges übrig geblieben ist. Aus Platzgründen schicke ich zunächst nur die Logfiles von Combofix und Rsit. Hierfür herzlichen Dank im Voraus.



Combofix Logfile:

ComboFix 10-06-10.04 -  11.06.2010  13:11:32.4.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2047.1501 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\\Desktop\ComboFix.exe
AV: Kaspersky PURE *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: ActiveArmor Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
FW: Kaspersky PURE *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\\Recent\Thumbs.db
c:\windows\system32\swctl.dll
c:\windows\system32\Thumbs.db

.
(((((((((((((((((((((((   Dateien erstellt von 2010-05-11 bis 2010-06-11  ))))))))))))))))))))))))))))))
.

2010-06-09 12:25 . 2010-06-09 12:35	--------	d-----w-	c:\dokumente und einstellungen\BNM\Lokale Einstellungen\Anwendungsdaten\Wheelman
2010-06-06 06:07 . 2010-06-06 06:07	--------	d-----w-	c:\windows\system32\Lang
2010-06-05 20:43 . 2010-06-05 20:43	--------	d-----w-	c:\programme\letstrade
2010-06-05 20:43 . 2002-08-29 06:32	28160	------w-	c:\windows\system32\msxml3a.dll
2010-06-05 20:42 . 2010-06-05 20:42	8192	----a-r-	c:\dokumente und einstellungen\\Anwendungsdaten\Microsoft\Installer\{E358634B-F124-46FD-8618-C00D0E92B0D3}\IconE358634B.exe
2010-06-05 17:19 . 2010-06-11 05:00	--------	d-----w-	C:\rsit
2010-06-05 17:19 . 2010-06-11 04:59	--------	d-----w-	c:\programme\trend micro
2010-06-05 16:42 . 2010-06-05 16:42	--------	d-----w-	c:\programme\Windows Live Safety Center
2010-06-05 16:35 . 2010-05-21 12:14	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-06-03 19:29 . 2010-06-05 09:07	--------	d-----w-	c:\dokumente und einstellungen\\Lokale Einstellungen\Anwendungsdaten\Wheelman
2010-06-03 19:29 . 2010-06-03 19:29	--------	d-----w-	c:\dokumente und einstellungen\\Lokale Einstellungen\Anwendungsdaten\PC
2010-06-03 19:10 . 2008-10-27 08:04	514384	----a-w-	c:\windows\system32\XAudio2_3.dll
2010-06-03 19:10 . 2008-10-27 08:04	70992	----a-w-	c:\windows\system32\XAPOFX1_2.dll
2010-06-03 19:10 . 2008-10-10 02:52	452440	----a-w-	c:\windows\system32\d3dx10_40.dll
2010-06-03 19:10 . 2008-10-10 02:52	4379984	----a-w-	c:\windows\system32\D3DX9_40.dll
2010-06-03 19:10 . 2008-10-10 02:52	2036576	----a-w-	c:\windows\system32\D3DCompiler_40.dll
2010-06-03 17:17 . 2010-06-03 17:17	166760	----a-w-	c:\dokumente und einstellungen\\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\uninstall.exe
2010-06-03 16:45 . 2010-06-03 16:46	--------	d-----w-	c:\windows\system32\MpEngineStore
2010-06-03 14:22 . 2010-06-03 14:22	--------	d-----w-	c:\programme\Sun
2010-06-03 14:21 . 2010-06-03 14:21	411368	----a-w-	c:\windows\system32\deployJava1.dll
2010-06-03 12:27 . 2010-06-03 12:27	932368	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-06-03 12:27 . 2010-06-03 12:27	678416	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-06-03 12:27 . 2010-06-03 12:27	604688	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-06-03 12:27 . 2010-06-03 12:27	522768	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-06-03 12:27 . 2010-06-03 12:27	1096208	----a-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-06-03 12:17 . 2010-06-03 12:26	97549	----a-w-	c:\windows\system32\drivers\klick.dat
2010-06-03 12:17 . 2010-06-03 12:26	113933	----a-w-	c:\windows\system32\drivers\klin.dat
2010-06-03 12:17 . 2009-12-14 10:44	88632	----a-w-	c:\windows\system32\drivers\CSCrySec.sys
2010-06-03 12:17 . 2009-12-14 10:44	39352	----a-w-	c:\windows\system32\drivers\CSVirtualDiskDrv.sys
2010-06-03 12:16 . 2010-06-03 12:16	--------	d-----w-	c:\programme\Kaspersky Lab
2010-06-03 12:16 . 2010-06-03 12:16	--------	d-----w-	c:\programme\Gemeinsame Dateien\InfoWatch
2010-06-03 12:16 . 2010-06-11 10:54	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2010-06-03 12:15 . 2010-06-03 12:15	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files
2010-06-03 09:27 . 2010-06-03 09:27	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-06-03 08:48 . 2010-06-03 09:26	--------	d-----w-	c:\programme\Gemeinsame Dateien\PC Tools
2010-06-02 21:41 . 2010-06-03 09:26	--------	d-----w-	c:\programme\JonDo
2010-06-02 19:56 . 2010-06-03 17:10	--------	d-----w-	c:\dokumente und einstellungen\\Anwendungsdaten\JonDo

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-11 05:27 . 2003-04-02 12:00	80936	----a-w-	c:\windows\system32\perfc007.dat
2010-06-11 05:27 . 2003-04-02 12:00	452316	----a-w-	c:\windows\system32\perfh007.dat
2010-06-06 16:43 . 2010-06-06 16:43	--------	d-----w-	c:\dokumente und einstellungen\BNM\Anwendungsdaten\Logitech
2010-06-05 20:43 . 2008-03-06 08:26	--------	d-----w-	c:\programme\Gemeinsame Dateien\buhl data service
2010-06-05 20:43 . 2008-03-06 08:26	632320	----a-w-	c:\windows\fpuninst.exe
2010-06-05 20:42 . 2008-03-09 16:15	--------	d-----w-	c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-06-03 19:09 . 2008-01-18 10:19	--------	d--h--w-	c:\programme\InstallShield Installation Information
2010-06-03 16:45 . 2004-08-03 21:14	162816	----a-w-	c:\windows\system32\drivers\netbt.sys
2010-06-03 14:26 . 2008-01-23 11:14	--------	d-----w-	c:\programme\OpenOffice.org 2.3
2010-06-03 14:22 . 2008-03-10 13:43	--------	d-----w-	c:\programme\Gemeinsame Dateien\Java
2010-06-03 14:21 . 2008-03-10 13:44	--------	d-----w-	c:\programme\Java
2010-06-03 11:46 . 2008-01-18 15:53	--------	d-----w-	c:\programme\Gemeinsame Dateien\G DATA
2010-05-30 12:18 . 2010-05-06 12:46	54920	----a-w-	c:\windows\system32\drivers\pxrts.sys
2010-05-30 12:18 . 2010-05-06 12:46	30320	----a-w-	c:\windows\system32\drivers\pxscan.sys
2010-05-30 12:18 . 2010-05-06 12:46	24400	----a-w-	c:\windows\system32\drivers\pxkbf.sys
2010-05-30 09:08 . 2010-04-25 19:58	79488	----a-w-	c:\dokumente und einstellungen\\Anwendungsdaten\Sun\Java\jre1.6.0_20\gtapi.dll
2010-05-23 20:38 . 2008-01-18 10:17	34512	----a-w-	c:\dokumente und einstellungen\\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-05-17 17:02 . 2008-01-24 08:20	--------	d-----w-	c:\programme\Google
2010-05-15 10:42 . 2008-01-18 15:54	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\G DATA
2010-05-08 22:48 . 2009-05-03 20:29	68976	----a-w-	c:\windows\system32\drivers\GRD.sys
2010-05-08 22:41 . 2009-08-26 22:07	28616	----a-w-	c:\windows\system32\drivers\GDBehave.sys
2010-05-08 22:31 . 2010-05-08 22:31	--------	d-----w-	c:\programme\G Data
2010-05-08 20:27 . 2010-02-28 15:20	--------	d-----w-	c:\dokumente und einstellungen\\Anwendungsdaten\Corel
2010-05-06 09:57 . 2010-02-28 15:21	2828	--sha-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
2010-05-06 09:57 . 2010-02-28 15:21	2828	--sha-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
2010-05-06 09:57 . 2010-02-28 15:21	88	--sh--r-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\82504B59E2.sys
2010-05-06 09:57 . 2010-02-28 15:21	88	--sh--r-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\82504B59E2.sys
2010-05-04 17:14 . 2004-08-03 22:57	832512	----a-w-	c:\windows\system32\wininet.dll
2010-05-04 17:14 . 2004-08-03 22:57	78336	------w-	c:\windows\system32\ieencode.dll
2010-05-04 17:14 . 2004-08-03 22:57	17408	------w-	c:\windows\system32\corpol.dll
2010-05-02 08:05 . 2004-08-03 22:46	1851392	------w-	c:\windows\system32\win32k.sys
2010-04-29 13:39 . 2008-12-11 22:42	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2008-12-11 22:42	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-04-20 05:29 . 2004-08-03 22:54	285696	----a-w-	c:\windows\system32\atmfd.dll
2010-03-23 20:01 . 2009-11-04 21:22	152576	----a-w-	c:\dokumente und einstellungen\\Anwendungsdaten\Sun\Java\jre1.6.0_17\lzma.dll
2010-03-23 19:56 . 2009-11-24 07:35	79488	----a-w-	c:\dokumente und einstellungen\\Anwendungsdaten\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-21 18:14 . 2010-03-21 18:12	79488	----a-w-	c:\dokumente und einstellungen\\Anwendungsdaten\Sun\Java\jre1.6.0_18\gtapi.dll
2008-04-14 02:22 . 2004-08-03 22:57	1028096	--sha-w-	c:\windows\system32\mfc42.dll
2008-04-14 02:22 . 2004-08-03 22:57	343040	--sha-w-	c:\windows\system32\msvcrt.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2009-12-25 14:42	129552	----a-w-	c:\programme\Kaspersky Lab\Kaspersky PURE\shellex.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"="c:\windows\Tray\wintmr.exe" [2004-08-03 5926328]
"PasswordManager"="c:\progra~1\KASPER~1\KASPER~1\KASPER~1\MODULE~1\stpass.exe" [2009-12-24 3037616]

c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
Hama Wireless LAN Utility.lnk - c:\programme\Hama\Common\RaUI.exe [2009-1-23 610304]
Logitech SetPoint.lnk - d:\programme\Logitech\SetPoint\SetPoint.exe [2008-6-27 805392]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42	72208	----a-w-	c:\programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^RICOH Gate La.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\RICOH Gate La.lnk
backup=c:\windows\pss\RICOH Gate La.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17	952768	----a-w-	c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42	36272	----a-w-	d:\programme\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 02:22	15360	------w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2008-02-29 01:12	76304	----a-w-	c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:22	1695232	------w-	c:\programme\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 15:18	413696	----a-w-	c:\programme\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2007-11-20 17:15	1826816	----a-w-	c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2008-07-02 15:15	397312	------w-	d:\programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="d:\programme\iTunes\iTunesHelper.exe"
"Adobe Reader Speed Launcher"="d:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"d:\\Programme\\Caplio Software\\RGateLXP.exe"=
"d:\\Programme\\Salfeld\\Kisi\\kisiset.exe"=
"c:\\WINDOWS\\system32\\cc32\\webtmr.exe"=
"c:\\WINDOWS\\system32\\cchservice.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Programme\\iTunes\\iTunes.exe"=
"d:\\Programme\\ICQ6.5\\ICQ.exe"=
"d:\\Programme\\Mozilla Firefox\\firefox.exe"=
"d:\\Programme\\Ubisoft Entertainment\\Wheelman\\Binaries\\WheelmanGame-Final.exe"=

R0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\drivers\CSCrySec.sys [03.06.2010 14:17 88632]
R0 GDNdisIc;GDNdisIc;c:\windows\system32\drivers\GDNdisIc.sys [24.09.2009 20:22 22528]
R0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14.10.2009 20:18 36880]
R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\drivers\CSVirtualDiskDrv.sys [03.06.2010 14:17 39352]
R2 CSObjectsSrv;Verwaltungsservice vom CryproStorage-System;c:\programme\Gemeinsame Dateien\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [21.12.2009 17:34 743992]
R2 GDTdiInterceptor;GDTdiInterceptor;c:\windows\system32\drivers\GDTdiIcpt.sys [03.05.2009 18:30 51784]
R2 Windows-CCHook-Service;Windows-CCHook-Service;c:\windows\system32\cchservice.exe [17.12.2008 22:43 967344]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.09.2009 13:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02.10.2009 18:39 19472]
S0 rjezb;rjezb; [x]
S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\drivers\rt2500usb.sys [22.01.2009 03:09 245376]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [03.01.2009 19:41 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [03.01.2009 19:41 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [03.01.2009 19:41 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [03.01.2009 19:41 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [03.01.2009 19:41 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [03.01.2009 19:41 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [03.01.2009 19:41 115752]
S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM);c:\windows\system32\drivers\sea3bus.sys [26.01.2007 21:05 61600]
S3 sea3mdfl;Sony Ericsson Device 0A3 USB WMC Modem Filter;c:\windows\system32\drivers\sea3mdfl.sys [26.01.2007 21:06 9392]
S3 sea3mdm;Sony Ericsson Device 0A3 USB WMC Modem Driver;c:\windows\system32\drivers\sea3mdm.sys [26.01.2007 21:06 97152]
S3 sea3mgmt;Sony Ericsson Device 0A3 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea3mgmt.sys [26.01.2007 21:07 88656]
S3 sea3nd5;Sony Ericsson Device 0A3 USB Ethernet Emulation SEMCA3 (NDIS);c:\windows\system32\drivers\sea3nd5.sys [26.01.2007 21:05 18736]
S3 sea3obex;Sony Ericsson Device 0A3 USB WMC OBEX Interface;c:\windows\system32\drivers\sea3obex.sys [26.01.2007 21:08 86464]
S3 sea3unic;Sony Ericsson Device 0A3 USB Ethernet Emulation SEMCA3 (WDM);c:\windows\system32\drivers\sea3unic.sys [26.01.2007 21:04 90832]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - mchInjDrv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-06-11 c:\windows\Tasks\1-Klick-Wartung.job
- d:\programme\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-29 16:47]

2010-06-11 c:\windows\Tasks\VLC media player.job
- c:\dokumente und einstellungen\\Eigene Dateien\VLC media player.lnk [2009-07-01 21:20]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.heute.de/
uInternet Connection Wizard,ShellNext = iexplore
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
IE: Nach Microsoft &Excel exportieren - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\\Anwendungsdaten\Mozilla\Firefox\Profiles\az0wroqs.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.tagesschau.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: d:\programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: d:\programme\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: d:\programme\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: d:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\programme\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: d:\programme\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: yahoo.homepage.dontask - trued:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
d:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

MSConfigStartUp-swg - c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-TkBellExe - c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, h**p://www.gmer.net
Rootkit scan 2010-06-11 13:17
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NetBT]
"ImagePath"="system32\drivers\netbt.kav"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1177238915-152049171-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"7040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1352)
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(1408)
c:\windows\system32\nvappfilter.dll
.
Zeit der Fertigstellung: 2010-06-11  13:18:59
ComboFix-quarantined-files.txt  2010-06-11 11:18

Vor Suchlauf: 5.241.991.168 Bytes frei
Nach Suchlauf: 6.395.105.280 Bytes frei

- - End Of File - - 22ADA1941B52B183F483D1B0E90FF2A2
         

--- --- ---

Logfile of random's system information tool 1.07 (written by random/random)
Run by *** at 2010-06-12 17:19:07
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 6 GB (19%) free of 32 GB
Total RAM: 2047 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:19:10, on 12.06.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cchservice.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\Programme\Hama\Common\RaUI.exe
D:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Dokumente und Einstellungen\***\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Programme\trend micro\***.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.heute.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky PURE\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ChicoSys] C:\WINDOWS\system32\cc32\webtmr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CCWinTray] C:\WINDOWS\Tray\wintmr.exe
O4 - HKCU\..\Run: [PasswordManager] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~1\MODULE~1\stpass.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Hama Wireless LAN Utility.lnk = C:\Programme\Hama\Common\RaUI.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Programme\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - h**p://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - h**p://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - h**p://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - h**p://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200669864953
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - h**p://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - h**p://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe
O23 - Service: Verwaltungsservice vom CryproStorage-System (CSObjectsSrv) - Infowatch - C:\Programme\Gemeinsame Dateien\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Windows-CCHook-Service - Salfeld Computer - C:\WINDOWS\system32\cchservice.exe

--
End of file - 8709 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Klick-Wartung.job
C:\WINDOWS\tasks\VLC media player.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Programme\Kaspersky Lab\Kaspersky PURE\ievkbd.dll [2009-12-25 68112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Programme\Java\jre6\bin\jp2ssv.dll [2010-06-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}]
FilterBHO Class - C:\Programme\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll [2009-12-25 268816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-06-03 79648]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"=C:\WINDOWS\Tray\wintmr.exe [2004-08-04 5926328]
"PasswordManager"=C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~1\MODULE~1\stpass.exe [2009-12-24 3037616]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
D:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
C:\WINDOWS\KHALMNPR.EXE [2008-02-29 76304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe [2009-01-05 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS\SkyTel.EXE [2007-11-20 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
D:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2008-07-02 397312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^RICOH Gate La.lnk]
D:\PROGRA~1\CAPLIO~1\RGateLXP.exe [2007-01-17 360448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Hama Wireless LAN Utility.lnk - C:\Programme\Hama\Common\RaUI.exe
Logitech SetPoint.lnk - D:\Programme\Logitech\SetPoint\SetPoint.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2009-12-25 219664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll [2008-05-02 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableClock"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Messenger\msmsgs.exe"="C:\Programme\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"D:\Programme\Caplio Software\RGateLXP.exe"="D:\Programme\Caplio Software\RGateLXP.exe:*:Enabled:RICOH Gate La for DSC"
"D:\Programme\Salfeld\Kisi\kisiset.exe"="D:\Programme\Salfeld\Kisi\kisiset.exe:*:Enabled:Kindersicherung"
"C:\WINDOWS\system32\cc32\webtmr.exe"="C:\WINDOWS\system32\cc32\webtmr.exe:*:Enabled:webtmr.exe"
"C:\WINDOWS\system32\cchservice.exe"="C:\WINDOWS\system32\cchservice.exe:*:Enabled:cchservice.exe"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"D:\Programme\iTunes\iTunes.exe"="D:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"D:\Programme\ICQ6.5\ICQ.exe"="D:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"D:\Programme\Mozilla Firefox\firefox.exe"="D:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"D:\Programme\Ubisoft Entertainment\Wheelman\Binaries\WheelmanGame-Final.exe"="D:\Programme\Ubisoft Entertainment\Wheelman\Binaries\WheelmanGame-Final.exe:*:Enabled:Wheelman"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90dabf0e-ef93-11dd-a095-001f1f181379}]
shell\AutoRun\command - G:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2010-06-12 10:13:26 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Kaspersky Lab
2010-06-11 21:22:11 ----A---- C:\WINDOWS\uninst.ini
2010-06-11 21:20:02 ----A---- C:\WINDOWS\CatClient.INI
2010-06-11 21:19:41 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\fun communications
2010-06-11 14:21:04 ----SHD---- C:\RECYCLER
2010-06-11 13:54:42 ----A---- C:\WINDOWS\system32\swctl.dll
2010-06-11 13:19:00 ----A---- C:\ComboFix.txt
2010-06-11 13:09:23 ----A---- C:\WINDOWS\PEV.exe
2010-06-11 13:09:23 ----A---- C:\WINDOWS\MBR.exe
2010-06-11 13:08:41 ----D---- C:\Qoobox
2010-06-11 07:25:23 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-11 07:24:14 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-11 07:23:42 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-11 07:22:09 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-11 07:21:58 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-11 07:21:40 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-06-11 02:56:29 ----A---- C:\TDSSKiller.2.3.2.0_11.06.2010_02.56.29_log.txt
2010-06-06 08:07:33 ----D---- C:\WINDOWS\system32\Lang
2010-06-05 19:19:58 ----D---- C:\rsit
2010-06-05 19:19:58 ----D---- C:\Programme\trend micro
2010-06-05 19:19:39 ----A---- C:\TDSSKiller.2.3.2.0_05.06.2010_19.19.39_log.txt
2010-06-05 18:42:49 ----D---- C:\Programme\Windows Live Safety Center
2010-06-05 18:35:08 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2010-06-03 21:10:00 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-06-03 21:10:00 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-06-03 21:10:00 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-06-03 21:10:00 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-06-03 21:10:00 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-06-03 21:09:59 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-06-03 21:09:58 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-06-03 21:09:57 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-06-03 21:09:56 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-06-03 21:09:56 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-06-03 21:09:56 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-06-03 21:09:56 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-06-03 21:09:56 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-06-03 21:09:56 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-06-03 21:09:55 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-06-03 21:09:55 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-06-03 21:09:55 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-06-03 21:09:55 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2010-06-03 21:09:55 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2010-06-03 21:09:54 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2010-06-03 21:09:54 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2010-06-03 21:09:53 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-06-03 21:09:53 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-06-03 21:09:53 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-06-03 21:09:52 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-06-03 21:09:51 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-06-03 21:09:51 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-06-03 21:09:51 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-06-03 21:09:51 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-06-03 21:09:50 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-06-03 21:09:50 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-06-03 21:09:50 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-06-03 21:09:50 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-06-03 21:09:50 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-06-03 21:09:49 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-06-03 21:09:44 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-06-03 21:09:44 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-06-03 21:09:44 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-06-03 21:09:43 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-06-03 21:09:43 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-06-03 21:09:43 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-06-03 21:09:43 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2010-06-03 21:09:42 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2010-06-03 21:09:42 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-06-03 21:09:41 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-06-03 21:09:31 ----D---- C:\WINDOWS\Logs
2010-06-03 18:45:38 ----D---- C:\WINDOWS\system32\MpEngineStore
2010-06-03 16:44:10 ----A---- C:\WINDOWS\system32\MRT.INI
2010-06-03 16:22:27 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
2010-06-03 16:22:12 ----D---- C:\Programme\Sun
2010-06-03 16:21:49 ----A---- C:\WINDOWS\system32\javaws.exe
2010-06-03 16:21:49 ----A---- C:\WINDOWS\system32\javaw.exe
2010-06-03 16:21:49 ----A---- C:\WINDOWS\system32\java.exe
2010-06-03 16:21:49 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-06-03 14:16:34 ----D---- C:\Programme\Kaspersky Lab
2010-06-03 14:16:34 ----D---- C:\Programme\Gemeinsame Dateien\InfoWatch
2010-06-03 14:16:33 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2010-06-03 14:15:29 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files
2010-06-03 10:48:46 ----D---- C:\Programme\Gemeinsame Dateien\PC Tools
2010-06-02 23:41:29 ----D---- C:\Programme\JonDo
2010-06-02 21:56:26 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\JonDo
2010-05-31 19:44:52 ----A---- C:\WINDOWS\hegames.ini
2010-05-17 21:41:02 ----D---- C:\Programme\Microsoft Office
2010-05-13 10:59:36 ----A---- C:\WINDOWS\gmer.ini

======List of files/folders modified in the last 1 months======

2010-06-12 16:51:28 ----D---- C:\WINDOWS\Prefetch
2010-06-12 16:24:37 ----D---- C:\WINDOWS\Temp
2010-06-12 10:09:42 ----D---- C:\WINDOWS\system32\wdrv
2010-06-12 10:09:41 ----D---- C:\WINDOWS\system32\cc32
2010-06-12 10:09:14 ----D---- C:\WINDOWS\system32\drivers
2010-06-11 22:37:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-11 22:37:30 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-11 21:22:51 ----RD---- C:\Programme
2010-06-11 21:22:11 ----D---- C:\WINDOWS\system32
2010-06-11 21:22:11 ----D---- C:\WINDOWS
2010-06-11 21:22:11 ----D---- C:\Programme\Gemeinsame Dateien\buhl data service
2010-06-11 16:32:39 ----D---- C:\WINDOWS\system32\NtmsData
2010-06-11 14:23:14 ----HD---- C:\WINDOWS\inf
2010-06-11 14:22:45 ----D---- C:\Dokumente und Einstellungen
2010-06-11 13:18:20 ----D---- C:\WINDOWS\ERDNT
2010-06-11 13:17:50 ----A---- C:\WINDOWS\system.ini
2010-06-11 13:14:10 ----D---- C:\WINDOWS\AppPatch
2010-06-11 13:14:09 ----D---- C:\Programme\Gemeinsame Dateien
2010-06-11 12:53:40 ----D---- C:\Config.Msi
2010-06-11 07:27:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-11 07:26:11 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-11 07:26:09 ----RSD---- C:\WINDOWS\assembly
2010-06-11 07:25:25 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-11 07:25:20 ----SHD---- C:\WINDOWS\Installer
2010-06-11 07:24:52 ----A---- C:\WINDOWS\win.ini
2010-06-11 07:24:27 ----A---- C:\WINDOWS\imsins.BAK
2010-06-11 07:24:12 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-11 07:20:52 ----D---- C:\WINDOWS\WinSxS
2010-06-11 07:17:39 ----D---- C:\WINDOWS\system32\de-de
2010-06-11 07:17:39 ----D---- C:\Programme\Internet Explorer
2010-06-11 07:17:34 ----D---- C:\WINDOWS\ie7updates
2010-06-06 18:41:32 ----A---- C:\WINDOWS\OEWABLog.txt
2010-06-06 08:06:35 ----RD---- C:\WINDOWS\Web
2010-06-05 22:43:51 ----A---- C:\WINDOWS\fpuninst.exe
2010-06-05 22:42:36 ----D---- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2010-06-05 18:42:49 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-06-03 21:10:01 ----D---- C:\WINDOWS\system32\DirectX
2010-06-03 21:09:31 ----HD---- C:\Programme\InstallShield Installation Information
2010-06-03 18:58:53 ----RASH---- C:\boot.ini
2010-06-03 16:42:10 ----D---- C:\Programme\Outlook Express
2010-06-03 16:35:23 ----D---- C:\WINDOWS\system32\CatRoot
2010-06-03 16:22:37 ----D---- C:\Programme\Gemeinsame Dateien\Java
2010-06-03 16:21:13 ----D---- C:\Programme\Java
2010-06-03 14:17:03 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-06-03 13:46:10 ----D---- C:\Programme\Gemeinsame Dateien\G DATA
2010-06-03 11:27:21 ----D---- C:\WINDOWS\system32\config
2010-06-03 11:27:07 ----D---- C:\WINDOWS\system32\wbem
2010-06-03 11:27:06 ----D---- C:\WINDOWS\Registration
2010-06-02 21:25:03 ----D---- C:\WINDOWS\pss
2010-05-30 14:17:41 ----A---- C:\WINDOWS\wininit.ini
2010-05-28 21:37:34 ----A---- C:\WINDOWS\system32\MRT.exe
2010-05-23 22:29:23 ----SD---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Microsoft
2010-05-17 21:41:04 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2010-05-17 21:41:03 ----D---- C:\WINDOWS\Help
2010-05-17 21:41:02 ----RSD---- C:\WINDOWS\Fonts
2010-05-17 19:59:04 ----SD---- C:\WINDOWS\Tasks
2010-05-17 19:59:04 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google
2010-05-17 19:02:02 ----D---- C:\Programme\Google
2010-05-16 00:29:39 ----D---- C:\WINDOWS\system32\Restore
2010-05-15 12:42:09 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\G DATA

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver; C:\WINDOWS\system32\DRIVERS\CSVirtualDiskDrv.sys [2009-12-14 39352]
R1 kl1;Kl1; \??\C:\WINDOWS\system32\drivers\kl1.sys []
R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2010-06-03 315408]
R1 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-09-18 6132576]
R1 NVTCP;NVIDIA TCP/IP Protocol Driver; C:\WINDOWS\System32\DRIVERS\NVTcp.sys [2006-03-22 109568]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2003-04-02 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-01-23 20747]
R2 BrPar;BrPar; C:\WINDOWS\System32\drivers\BrPar.sys [2000-07-24 19537]
R2 GDTdiInterceptor;GDTdiInterceptor; \??\C:\WINDOWS\system32\drivers\GDTdiIcpt.sys []
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-07-24 4749824]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-02-29 20240]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2008-02-29 63120]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2008-02-29 79120]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2008-01-18 5810]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-22 52736]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-22 18944]
R3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-01-12 252928]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-19 43520]
S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter; C:\WINDOWS\system32\DRIVERS\rt2500usb.sys [2005-10-17 245376]
S3 catchme;catchme; \??\C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys []
S3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\GTNDIS5.SYS []
S3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM); C:\WINDOWS\system32\DRIVERS\sea3bus.sys [2007-01-26 61600]
S3 sea3mdfl;Sony Ericsson Device 0A3 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\sea3mdfl.sys [2007-01-26 9392]
S3 sea3mdm;Sony Ericsson Device 0A3 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\sea3mdm.sys [2007-01-26 97152]
S3 sea3mgmt;Sony Ericsson Device 0A3 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\sea3mgmt.sys [2007-01-26 88656]
S3 sea3nd5;Sony Ericsson Device 0A3 USB Ethernet Emulation SEMCA3 (NDIS); C:\WINDOWS\system32\DRIVERS\sea3nd5.sys [2007-01-26 18736]
S3 sea3obex;Sony Ericsson Device 0A3 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\sea3obex.sys [2007-01-26 86464]
S3 sea3unic;Sony Ericsson Device 0A3 USB Ethernet Emulation SEMCA3 (WDM); C:\WINDOWS\system32\DRIVERS\sea3unic.sys [2007-01-26 90832]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys []
S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2009-07-15 13056]
S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2009-07-15 20736]
S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2009-07-15 24832]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CSObjectsSrv;Verwaltungsservice vom CryproStorage-System; C:\Programme\Gemeinsame Dateien\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2009-12-21 743992]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2006-03-30 143360]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-02-07 20543]
R2 JavaQuickStarterService;Java Quick Starter; D:\Programme\Java\jre6\bin\jqs.exe [2010-06-03 153376]
R2 nSvcIp;ForceWare IP service; C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-03-30 131131]
R2 nSvcLog;ForceWare user log service; C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-03-30 65599]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-09-18 163908]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Windows-CCHook-Service;Windows-CCHook-Service; C:\WINDOWS\system32\cchservice.exe [2004-08-04 967344]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 AVP;Kaspersky PURE; C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe [2009-12-25 340456]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-01-06 536872]
S3 LBTServ;Logitech Bluetooth Service; C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe [2008-05-02 121360]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-06-30 361728]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
         

Hallo und

wenn jemand die Log-Files der verschiedenen Programme (Kaspersky, MBAM, RSIT, GMER, Combofix) kontrollieren könnte

Poste bitte ALLE Logs komplett. Es fehlen die von Malwarebytes, Kaspersky und GMER.