| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: avast - bösartige website, Objekt: "newporto.cn/cgi-bin/options.cgi?"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.10.2010, 16:24
| #1 | |
| |  avast - bösartige website, Objekt: "newporto.cn/cgi-bin/options.cgi?" Hey, als ich mir neulich auf youtube einige Videos angesehen hab, hat sich Avast gemeldet, dass es eine bösartige Website blockiert hätte. Objektname ist entweder "newporto.cn/cgi-bin/options.cgi?" oder wie hier auf dem Bild:  .Seitdem krieg ich diese Meldung mehrmals in der Stunde, in unregelmäßigen Abständen. Des weiteren bleibt firefox ab und zu einfach "stehen". D.h. es friert nicht ein, sondern es ist, als wäre das Internet einfach weg, messenger Programme wie MSN oder ICQ funktionieren dann aber trotzdem noch tadellos. Auch das passiert in unregelmäßigen Abständen und unabhängig von der Warnmeldung von Avast (Ist aber gleichzeitig aufgetreten). CCleaner und Avast habe ich durchlaufen lassen, leider ohne Erfolg. Über google bin ich auf dieses Forum gestoßen, und zwar auf diesen Thread: http://www.trojaner-board.de/89418-a...tions-cgi.html , welcher wiederum auf diesen Thread verwiesen hat: http://www.trojaner-board.de/87486-b...apras-he.html. Da aber in beidem Threads die Anwendung von Combofix empfohlen wird, habe ich lieber einen eigenen thread gemacht. Bisher hab ich mir Hijackthis, Superantispy, OTL und Malwarebytes runtergeladen. Hier erstmal die HijackThis logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14:51:58, on 01.10.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe D:\Comodo\COMODO\COMODO Internet Security\cmdagent.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe D:\Avast\AvastSvc.exe C:\WINDOWS\Explorer.EXE D:\Avast\avastUI.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\ATI\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\spoolsv.exe D:\Comodo\COMODO\COMODO Internet Security\cfp.exe C:\Programme\DivX\DivX Update\DivXUpdate.exe D:\ICQ7.2\ICQ.exe C:\Programme\Creative\Shared Files\CTDevSrv.exe D:\Foldersize\FolderSizeSvc.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Creative\Software Update 3\SoftAuto.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe C:\Programme\ATI\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe D:\skype\Phone\Skype.exe C:\Programme\Windows Live\Messenger\msnmsgr.exe C:\Programme\Windows Live\Contacts\wlcomm.exe D:\Mozilla\firefox.exe C:\WINDOWS\system32\msiexec.exe D:\hijackthis\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: bxNewFolder - {51C8BCA8-2524-4523-BF09-738C4EEBFC58} - D:\bxNewFolder\bxNewFolder.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [avast5] D:\Avast\avastUI.exe /nogui O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [Ocs_SM] C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\OCS\SM\SearchAnonymizer.exe O4 - HKLM\..\Run: [COMODO Internet Security] "D:\Comodo\COMODO\COMODO Internet Security\cfp.exe" -h O4 - HKLM\..\Run: [DivXUpdate] "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKCU\..\Run: [ICQ] "D:\ICQ7.2\ICQ.exe" silent loginmode=4 O4 - HKCU\..\Run: [SoftAuto.exe] "C:\Programme\Creative\Software Update 3\SoftAuto.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\DAEMON Tools Pro\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ7.2\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ7.2\ICQ.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{424DE51C-BA67-46F1-A5E2-C07ACDEB4CFD}: NameServer = 156.154.70.22,156.154.71.22 O20 - AppInit_DLLs: O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - AVAST Software - D:\Avast\AvastSvc.exe O23 - Service: avast! Mail Scanner - AVAST Software - D:\Avast\AvastSvc.exe O23 - Service: avast! Web Scanner - AVAST Software - D:\Avast\AvastSvc.exe O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - D:\Comodo\COMODO\COMODO Internet Security\cmdagent.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Programme\Creative\Shared Files\CTDevSrv.exe O23 - Service: Creative Centrale Media Server (CTUPnPSv) - Creative Technology Ltd - C:\Programme\Creative\Creative Centrale\CTUPnPSv.exe O23 - Service: Folder Size (FolderSize) - Brio - D:\Foldersize\FolderSizeSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SearchAnonymizer - Unknown owner - C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe -- End of file - 6156 bytes Dann hier der Report von dem Malwarebytes Scan: hat etwas gefunden und gelöscht - Problem besteht weiterhin. Code:
ATTFilter Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4727
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
01.10.2010 16:34:45
mbam-log-2010-10-01 (16-34-45).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 202031
Laufzeit: 29 Minute(n), 30 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
E:\TrackMania United\tmunite.dll (Trojan.Agent) -> Quarantined and deleted successfully.
Anschliessend habe ich einen OTL Scan gemacht, nach dieser Vorgabe von Cosinus: Zitat:
Code:
ATTFilter OTL logfile created on: 01.10.2010 16:59:19 - Run 1 OTL by OldTimer - Version 3.2.14.1 Folder = C:\Dokumente und Einstellungen\sinthesis\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 48,83 Gb Total Space | 32,45 Gb Free Space | 66,46% Space Free | Partition Type: NTFS Drive D: | 87,89 Gb Total Space | 9,45 Gb Free Space | 10,76% Space Free | Partition Type: NTFS Drive E: | 96,16 Gb Total Space | 67,90 Gb Free Space | 70,61% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: AKBP-0218A09A15 Current User Name: sinthesis Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\sinthesis\Desktop\OTL.exe (OldTimer Tools) PRC - D:\Comodo\COMODO\COMODO Internet Security\cfp.exe (COMODO) PRC - D:\Comodo\COMODO\COMODO Internet Security\cmdagent.exe (COMODO) PRC - D:\Mozilla\firefox.exe (Mozilla Corporation) PRC - D:\Mozilla\plugin-container.exe (Mozilla Corporation) PRC - D:\Avast\AvastUI.exe (AVAST Software) PRC - D:\Avast\AvastSvc.exe (AVAST Software) PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe () PRC - D:\ICQ7.2\ICQ.exe (ICQ, LLC.) PRC - D:\Foldersize\FolderSizeSvc.exe (Brio) PRC - C:\Programme\ATI\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.) PRC - C:\Programme\ATI\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.) PRC - C:\Programme\Creative\Software Update 3\SoftAuto.exe (Creative Technology Ltd) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Creative\Shared Files\CTDevSrv.exe (Creative Technology Ltd) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\sinthesis\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\guard32.dll (COMODO) MOD - C:\WINDOWS\system32\clipantz.dll () MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found SRV - (cmdAgent) -- D:\Comodo\COMODO\COMODO Internet Security\cmdagent.exe (COMODO) SRV - (avast! Web Scanner) -- D:\Avast\AvastSvc.exe (AVAST Software) SRV - (avast! Mail Scanner) -- D:\Avast\AvastSvc.exe (AVAST Software) SRV - (avast! Antivirus) -- D:\Avast\AvastSvc.exe (AVAST Software) SRV - (SearchAnonymizer) -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe () SRV - (FolderSize) -- D:\Foldersize\FolderSizeSvc.exe (Brio) SRV - (CTUPnPSv) -- C:\Programme\Creative\Creative Centrale\CTUPnPSv.exe (Creative Technology Ltd) SRV - (CTDevice_Srv) -- C:\Programme\Creative\Shared Files\CTDevSrv.exe (Creative Technology Ltd) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.) DRV - (Inspect) -- C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO) DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdGuard.sys (COMODO) DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO) DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software) DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software) DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software) DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software) DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software) DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software) DRV - (L1e) -- C:\WINDOWS\system32\drivers\l1e51x86.sys (Atheros Communications, Inc.) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.) DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.) DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.) DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.) DRV - (Monfilt) -- C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.) DRV - (Ambfilt) -- C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: D:\Mozilla\components [2010.09.28 15:54:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: D:\Mozilla\plugins [2010.09.28 15:53:58 | 000,000,000 | ---D | M] [2010.09.28 15:54:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\Mozilla\Extensions [2010.09.30 16:45:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\Mozilla\Firefox\Profiles\s80dd0m0.default\extensions [2010.09.28 16:03:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\Mozilla\Firefox\Profiles\s80dd0m0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.09.29 14:10:48 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\Mozilla\Firefox\Profiles\s80dd0m0.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} O1 HOSTS File: ([2010.07.22 09:55:18 | 000,001,017 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 im.adtech.de O1 - Hosts: 127.0.0.1 adserver.adtech.de O1 - Hosts: 127.0.0.1 adtech.de O1 - Hosts: 127.0.0.1 ar.atwola.com O1 - Hosts: 127.0.0.1 atwola.com O1 - Hosts: 127.0.0.1 adserver.71i.de O1 - Hosts: 127.0.0.1 adicqserver.71i.de O1 - Hosts: 127.0.0.1 71i.de O2 - BHO: (bxNewFolder) - {51C8BCA8-2524-4523-BF09-738C4EEBFC58} - D:\bxNewFolder\bxNewFolder.dll () O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avast5] D:\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [COMODO Internet Security] D:\Comodo\COMODO\COMODO Internet Security\cfp.exe (COMODO) O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [Ocs_SM] C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\OCS\SM\SearchAnonymizer.exe (OCS) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] D:\DAEMON Tools Pro\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [ICQ] D:\ICQ7.2\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [SoftAuto.exe] C:\Programme\Creative\Software Update 3\SoftAuto.exe (Creative Technology Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ7.2\ICQ.exe (ICQ, LLC.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\sinthesis\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\sinthesis\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.07.21 16:36:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O36 - AppCertDlls: dfrgstrt - (C:\WINDOWS\system32\clipantz.dll) - C:\WINDOWS\system32\clipantz.dll () O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.10.01 16:03:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\Malwarebytes [2010.10.01 16:02:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.10.01 16:02:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.10.01 16:02:46 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.10.01 14:43:28 | 006,153,648 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\sinthesis\Desktop\mbam-setup.exe [2010.10.01 14:29:37 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\sinthesis\Desktop\OTL.exe [2010.10.01 00:35:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages [2010.10.01 00:34:29 | 001,230,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msvidctl.dll [2010.10.01 00:34:29 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nabtsfec.sys [2010.10.01 00:34:29 | 000,052,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\msdv.sys [2010.10.01 00:34:29 | 000,052,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msdv.sys [2010.10.01 00:34:29 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wstdecod.dll [2010.10.01 00:34:29 | 000,018,688 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wstcodec.sys [2010.10.01 00:34:29 | 000,014,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\streamip.sys [2010.10.01 00:34:29 | 000,010,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\slip.sys [2010.10.01 00:34:29 | 000,010,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndisip.sys [2010.10.01 00:34:28 | 000,285,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kstvtune.ax [2010.10.01 00:34:28 | 000,285,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kstvtune.ax [2010.10.01 00:34:28 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kswdmcap.ax [2010.10.01 00:34:28 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kswdmcap.ax [2010.10.01 00:34:28 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksxbar.ax [2010.10.01 00:34:28 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ksxbar.ax [2010.10.01 00:34:28 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bdaplgin.ax [2010.10.01 00:34:28 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\bdaplgin.ax [2010.10.01 00:34:28 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ccdecode.sys [2010.10.01 00:34:28 | 000,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\mpe.sys [2010.10.01 00:34:28 | 000,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mpe.sys [2010.10.01 00:34:28 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ipsink.ax [2010.10.01 00:34:28 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ipsink.ax [2010.10.01 00:34:28 | 000,011,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bdasup.sys [2010.10.01 00:34:28 | 000,011,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bdasup.sys [2010.10.01 00:34:27 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksolay.ax [2010.10.01 00:34:27 | 000,005,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstee.sys [2010.10.01 00:34:26 | 001,798,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qedit.dll [2010.10.01 00:34:26 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qasf.dll [2010.10.01 00:34:25 | 000,470,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qdvd.dll [2010.10.01 00:34:25 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qdv.dll [2010.10.01 00:34:25 | 000,257,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qcap.dll [2010.10.01 00:34:25 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\devenum.dll [2010.10.01 00:34:24 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmusic.dll [2010.10.01 00:34:24 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmsynth.dll [2010.10.01 00:34:24 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmstyle.dll [2010.10.01 00:34:23 | 001,201,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\d3d8.dll [2010.10.01 00:34:23 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dinput8.dll [2010.10.01 00:34:23 | 000,181,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmime.dll [2010.10.01 00:34:23 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmscript.dll [2010.10.01 00:34:23 | 000,058,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmcompos.dll [2010.10.01 00:34:23 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmloader.dll [2010.10.01 00:34:23 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmband.dll [2010.10.01 00:34:23 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dswave.dll [2010.10.01 00:34:22 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dxdiag.exe [2010.10.01 00:34:22 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsdmoprp.dll [2010.10.01 00:34:22 | 000,381,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvoice.dll [2010.10.01 00:34:22 | 000,186,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsdmo.dll [2010.10.01 00:34:22 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvvox.dll [2010.10.01 00:34:22 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvsetup.exe [2010.10.01 00:34:22 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dxdllreg.exe [2010.10.01 00:34:22 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvacm.dll [2010.10.01 00:34:21 | 001,294,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsound3d.dll [2010.10.01 00:34:21 | 001,189,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dx8vb.dll [2010.10.01 00:34:21 | 000,723,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnet.dll [2010.10.01 00:34:21 | 000,602,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dx7vb.dll [2010.10.01 00:34:21 | 000,381,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsound.dll [2010.10.01 00:34:21 | 000,208,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\joy.cpl [2010.10.01 00:34:21 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpwsockx.dll [2010.10.01 00:34:21 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpmodemx.dll [2010.10.01 00:34:21 | 000,068,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnhupnp.dll [2010.10.01 00:34:21 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnhpast.dll [2010.10.01 00:34:21 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pid.dll [2010.10.01 00:34:21 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnsvr.exe [2010.10.01 00:34:21 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\d3d8thk.dll [2010.10.01 00:34:21 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnlobby.dll [2010.10.01 00:34:21 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnaddr.dll [2010.10.01 00:34:20 | 000,797,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\d3dim700.dll [2010.10.01 00:34:20 | 000,648,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dinput.dll [2010.10.01 00:34:20 | 000,292,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ddraw.dll [2010.10.01 00:34:20 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dplayx.dll [2010.10.01 00:34:20 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dplaysvr.exe [2010.10.01 00:34:20 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ddrawex.dll [2010.09.30 19:19:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\DAEMON Tools Lite [2010.09.30 18:40:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite [2010.09.30 18:29:47 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\usbport.sys [2010.09.30 18:29:47 | 000,096,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\atapi.sys [2010.09.30 18:29:47 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\usbui.dll [2010.09.30 18:29:47 | 000,068,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\pci.sys [2010.09.30 18:29:47 | 000,059,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\usbhub.sys [2010.09.30 18:29:47 | 000,037,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\isapnp.sys [2010.09.30 18:29:47 | 000,024,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\pciidex.sys [2010.09.30 18:29:47 | 000,020,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\usbuhci.sys [2010.09.30 18:29:47 | 000,003,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\system32\DRIVERS\pciide.sys [2010.09.30 18:29:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\system32 [2010.09.30 18:29:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\INF [2010.09.30 18:29:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\system32\DRIVERS [2010.09.30 18:28:03 | 000,053,248 | R--- | C] (Windows XP Bundled build C-Centric Single User) -- C:\WINDOWS\System32\CSVer.dll [2010.09.30 18:28:03 | 000,000,000 | ---D | C] -- C:\Programme\Intel [2010.09.30 18:27:28 | 000,000,000 | ---D | C] -- C:\Intel [2010.09.29 20:19:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Eigene Dateien\Neuer Ordner [2010.09.29 00:18:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Desktop\Neuer Ordner (2) [2010.09.28 18:02:13 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\sinthesis\Recent [2010.09.28 15:54:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Anwendungsdaten\Mozilla [2010.09.23 14:25:24 | 000,000,000 | ---D | C] -- C:\Program Files [2010.09.23 14:25:14 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{26D901A1-2540-4430-81DC-0317F01BD7BE} [2010.09.23 14:24:13 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{A16967D8-8459-420A-8C25-9C9A247D348E} [2010.09.23 14:23:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Desktop\psychill.fm [2010.09.20 03:57:50 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0 [2010.09.19 16:27:46 | 000,000,000 | ---D | C] -- C:\Programme\SteelSeries [2010.09.19 16:16:13 | 000,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbccgp.sys [2010.09.14 16:44:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\sinthesis\Eigene Dateien\My Games [2010.09.14 16:34:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\Watson [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.10.01 16:42:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.10.01 16:42:34 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.10.01 16:40:58 | 004,718,592 | -H-- | M] () -- C:\Dokumente und Einstellungen\sinthesis\NTUSER.DAT [2010.10.01 16:40:58 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\sinthesis\ntuser.ini [2010.10.01 16:40:47 | 005,940,526 | -H-- | M] () -- C:\Dokumente und Einstellungen\sinthesis\Lokale Einstellungen\Anwendungsdaten\IconCache.db [2010.10.01 16:02:50 | 000,000,474 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.10.01 14:53:45 | 000,377,514 | ---- | M] () -- C:\Dokumente und Einstellungen\sinthesis\Desktop\avast.bmp [2010.10.01 14:51:45 | 000,002,329 | ---- | M] () -- C:\Dokumente und Einstellungen\sinthesis\Desktop\HiJackThis.lnk [2010.10.01 14:43:36 | 006,153,648 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\sinthesis\Desktop\mbam-setup.exe [2010.10.01 14:29:37 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\sinthesis\Desktop\OTL.exe [2010.09.30 20:21:52 | 000,137,960 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2010.09.30 20:21:37 | 000,235,248 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr [2010.09.30 19:20:21 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys [2010.09.30 18:51:08 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.09.30 18:29:33 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem9.PNF [2010.09.30 18:29:33 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem9.inf [2010.09.30 18:29:21 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem8.PNF [2010.09.30 18:29:21 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem8.inf [2010.09.30 18:28:40 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem7.PNF [2010.09.30 18:28:40 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem7.inf [2010.09.30 18:28:11 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem6.PNF [2010.09.30 18:28:11 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem6.inf [2010.09.30 18:28:04 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem5.PNF [2010.09.30 18:28:04 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem5.inf [2010.09.30 18:26:51 | 000,022,450 | ---- | M] () -- C:\WINDOWS\Ascd_tmp.ini [2010.09.30 18:26:46 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem4.PNF [2010.09.30 18:26:45 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\INF\oem4.inf [2010.09.30 18:26:39 | 000,001,769 | ---- | M] () -- C:\WINDOWS\Language_trs.ini [2010.09.29 13:02:01 | 000,285,480 | ---- | M] (COMODO) -- C:\WINDOWS\System32\guard32.dll [2010.09.29 13:02:01 | 000,091,560 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\inspect.sys [2010.09.29 13:02:00 | 000,239,240 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdGuard.sys [2010.09.29 13:02:00 | 000,025,240 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmdhlp.sys [2010.09.29 13:02:00 | 000,015,592 | ---- | M] (COMODO) -- C:\WINDOWS\System32\drivers\cmderd.sys [2010.09.28 14:57:25 | 000,050,176 | -H-- | M] () -- C:\WINDOWS\System32\clipantz.dll [2010.09.20 13:55:29 | 000,100,640 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.09.20 04:02:34 | 000,998,228 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.09.20 04:02:34 | 000,449,236 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.09.20 04:02:34 | 000,432,928 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.09.20 04:02:34 | 000,080,738 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.09.20 04:02:34 | 000,067,884 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.09.15 13:56:11 | 000,014,856 | ---- | M] () -- C:\Dokumente und Einstellungen\sinthesis\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT [2010.09.09 17:30:30 | 000,002,983 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2010.09.07 17:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr [2010.09.07 17:11:54 | 000,167,592 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe [2010.09.07 16:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys [2010.09.07 16:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys [2010.09.07 16:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2010.09.07 16:47:19 | 000,100,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys [2010.09.07 16:47:16 | 000,094,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2010.09.07 16:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys [2010.09.07 16:46:51 | 000,028,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.10.01 16:02:50 | 000,000,474 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.10.01 14:53:45 | 000,377,514 | ---- | C] () -- C:\Dokumente und Einstellungen\sinthesis\Desktop\avast.bmp [2010.10.01 14:50:55 | 000,002,329 | ---- | C] () -- C:\Dokumente und Einstellungen\sinthesis\Desktop\HiJackThis.lnk [2010.10.01 00:34:29 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2010.10.01 00:34:29 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisdecd.dll [2010.10.01 00:34:29 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\msdvbnp.ax [2010.10.01 00:34:29 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdvbnp.ax [2010.10.01 00:34:29 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\psisrndr.ax [2010.10.01 00:34:29 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisrndr.ax [2010.10.01 00:34:26 | 000,733,184 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qedwipes.dll [2010.10.01 00:34:25 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mpg2splt.ax [2010.10.01 00:34:25 | 000,034,304 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mciqtz32.dll [2010.10.01 00:34:25 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdmo.dll [2010.10.01 00:34:24 | 000,064,512 | ---- | C] () -- C:\WINDOWS\System32\dllcache\amstream.dll [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem9.PNF [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem9.inf [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem8.PNF [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem8.inf [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem7.PNF [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem7.inf [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem6.PNF [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem6.inf [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem5.PNF [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem5.inf [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem4.PNF [2010.09.30 18:29:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\INF\oem4.inf [2010.09.30 18:26:46 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2010.09.30 18:26:39 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini [2010.09.30 18:26:34 | 000,022,450 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2010.09.30 18:26:33 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2010.09.28 14:57:25 | 000,050,176 | -H-- | C] () -- C:\WINDOWS\System32\clipantz.dll [2010.08.07 17:15:08 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2010.08.06 23:32:33 | 000,000,308 | ---- | C] () -- C:\WINDOWS\d3xp.ini [2010.08.06 23:28:48 | 000,000,301 | ---- | C] () -- C:\WINDOWS\doom3.ini [2010.07.30 23:51:46 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2010.07.30 23:51:45 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2010.07.30 23:51:39 | 000,790,528 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2010.07.30 23:51:39 | 000,134,144 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2010.07.30 23:51:39 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2010.07.30 23:51:39 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2010.07.24 19:35:40 | 000,000,032 | ---- | C] () -- C:\WINDOWS\autorun.INI [2010.07.24 17:33:23 | 000,008,192 | ---- | C] () -- C:\Dokumente und Einstellungen\sinthesis\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.07.21 22:56:35 | 000,137,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys < End of report > Extras.txt: Code:
ATTFilter OTL Extras logfile created on: 01.10.2010 16:59:19 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Dokumente und Einstellungen\sinthesis\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 32,45 Gb Free Space | 66,46% Space Free | Partition Type: NTFS
Drive D: | 87,89 Gb Total Space | 9,45 Gb Free Space | 10,76% Space Free | Partition Type: NTFS
Drive E: | 96,16 Gb Total Space | 67,90 Gb Free Space | 70,61% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: AKBP-0218A09A15
Current User Name: sinthesis
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- D:\Mozilla\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"D:\ICQ7.2\ICQ.exe" = D:\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"D:\ICQ7.2\aolload.exe" = D:\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"D:\ICQ7.2\ICQ.exe" = D:\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"D:\ICQ7.2\aolload.exe" = D:\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{04347DFD-87B6-4E30-B14D-5DF2888AD8F5}" = DOOM 3: Resurrection of Evil
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.2 Build #3129 Banner Remover 1.0
"{0B25271C-C90B-056F-B4B1-84DFCC905497}" = ATI Catalyst Install Manager
"{141C141A-0DB8-E6E5-59AA-27576C20B75D}" = CCC Help English
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{1648DB98-AE62-6E92-F418-8A9ECCA078A9}" = Catalyst Control Center Graphics Previews Common
"{17200570-C3A0-DAAB-8232-491FEC0C1DF4}" = Catalyst Control Center Graphics Full Existing
"{17E83691-BC8E-BA2A-DE9B-AE845E1C2457}" = Catalyst Control Center Graphics Light
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{2BEB102E-F9CD-4881-984B-E288F66FD394}" = Quake Live Mozilla Plugin
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113 Gigabit/Fast Ethernet Driver
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D74A25E-F4A1-DD65-3327-FEE3C85A2565}" = Catalyst Control Center HydraVision Full
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{4442AB48-DEC4-4B39-B067-1F75BF8017E7}" = Creative Centrale
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{584267B8-0BB0-4D18-9FFA-726576619E9A}" = Doom 3
"{5DF9A98E-6295-4407-BB47-E19A2474D260}_is1" = Drakensang
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{605BE2E8-D0D4-C157-68FD-40A318258E54}" = ccc-core-preinstall
"{71E8DEC6-8785-B293-FA6D-7A37A3D3E773}" = ccc-core-static
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{86604C06-DA30-425E-AECE-47304FE81C45}" = Creative Software Update
"{88713CAC-8759-6FE4-D577-A823E5865CB9}" = ccc-utility
"{8969CD6F-5B75-40B9-8701-86ECA4C1F263}_is1" = VSO Image Resizer 4.0.0.30
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A03E4302-F387-47F3-8136-6D9D9286CD3B}" = SteelSeries Kinzu Optical Mouse
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8E2EF8F-73EF-4DD8-BB38-31FCCAF50103}" = Dark Messiah
"{A93FE10A-42C3-B498-2856-2BBE22481A7A}" = Catalyst Control Center Graphics Full New
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B2BAD2AF-A391-4306-96A3-BA1139630D84}" = Catalyst Control Center InstallProxy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CC6B1BB4-4E06-4A5B-A166-B371B551324B}" = COMODO Internet Security
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3
"{F029DBBC-FBBD-20CD-7038-6A703578EC79}" = Catalyst Control Center Core Implementation
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}" = Folder Size for Windows
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Mythology Expansion Pack 1.0" = Age of Mythology Gold
"avast5" = avast! Free Antivirus
"BitLord" = BitLord 1.1
"bxNewFolder" = bxNewFolder 1.0
"CCleaner" = CCleaner
"Creative Centrale" = Creative Centrale
"Creative Removable Disk Manager" = Creative-Manager für Wechseldatenträger
"DivX Setup.divx.com" = DivX-Setup
"Driver Cleaner" = Driver Cleaner 3
"Foxit Reader" = Foxit Reader
"GOM Player" = GOM Player
"ie8" = Windows Internet Explorer 8
"InstallShield_{04347DFD-87B6-4E30-B14D-5DF2888AD8F5}" = DOOM 3: Resurrection of Evil
"InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"InstallShield_{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}" = Doom 3
"IsoBuster_is1" = IsoBuster 2.8
"JDownloader" = JDownloader
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.2.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"MultiRes (remove only)" = MultiRes (remove only)
"PunkBusterSvc" = PunkBuster Services
"QLDT" = Quake Live Demo Tools
"SearchAnonymizer" = SearchAnonymizer
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TmUnited_is1" = TrackMania United 0.2.0.8
"VLC media player" = VLC media player 1.1.4
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZENMozaicUG" = Creative ZEN Mozaic-Benutzerhandbuch
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 30.09.2010 18:21:35 | Computer Name = AKBP-0218A09A15 | Source = MsiInstaller | ID = 11308
Description = Product: Age of Empires III -- Error 1308.Source file not found: I:\Games\Age
of Empires 3\Age.Of.Empires.III-RELOADED\CD1\Neuer Ordner\Age of Empires III\data\stringtable.xml.xmb.
Verify that the file exists and that you can access it.
Error - 30.09.2010 18:22:29 | Computer Name = AKBP-0218A09A15 | Source = MsiInstaller | ID = 11311
Description = Product: Age of Empires III -- Error 1311.Source file not found(cabinet):
I:\Games\Age of Empires 3\Age.Of.Empires.III-RELOADED\CD1\Neuer Ordner\Disk2C~1.cab.
Verify that the file exists and that you can access it.
Error - 30.09.2010 18:31:11 | Computer Name = AKBP-0218A09A15 | Source = MsiInstaller | ID = 11311
Description = Product: Age of Empires III -- Error 1311.Source file not found(cabinet):
I:\Games\Age of Empires 3\Age.Of.Empires.III-RELOADED\CD1\Disk2C~1.cab. Verify
that the file exists and that you can access it.
Error - 30.09.2010 18:32:56 | Computer Name = AKBP-0218A09A15 | Source = MsiInstaller | ID = 11311
Description = Product: Age of Empires III -- Error 1311.Source file not found(cabinet):
I:\Games\Age of Empires 3\Age.Of.Empires.III-RELOADED\CD1\Disk3C~1.cab. Verify
that the file exists and that you can access it.
Error - 30.09.2010 18:34:11 | Computer Name = AKBP-0218A09A15 | Source = MsiInstaller | ID = 11309
Description = Product: Age of Empires III -- Error 1309.Error reading from file:
I:\Games\Age of Empires 3\Age.Of.Empires.III-RELOADED\CD1\Age of Empires III\History
Channel Trailers\DiggingForTheTruth.wmv. System error 3. Verify that the file
exists and that you can access it.
Error - 30.09.2010 18:39:26 | Computer Name = AKBP-0218A09A15 | Source = FolderSize | ID = 0
Description =
Error - 30.09.2010 18:40:23 | Computer Name = AKBP-0218A09A15 | Source = FolderSize | ID = 0
Description =
Error - 30.09.2010 18:41:08 | Computer Name = AKBP-0218A09A15 | Source = FolderSize | ID = 0
Description =
Error - 30.09.2010 20:05:05 | Computer Name = AKBP-0218A09A15 | Source = FolderSize | ID = 0
Description =
Error - 30.09.2010 20:40:34 | Computer Name = AKBP-0218A09A15 | Source = FolderSize | ID = 0
Description =
[ System Events ]
Error - 30.09.2010 12:51:48 | Computer Name = AKBP-0218A09A15 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1055" aufgetreten, als der Dienst "netman"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
Error - 30.09.2010 13:09:13 | Computer Name = AKBP-0218A09A15 | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.33 für die Netzwerkkarte mit der Netzwerkadresse
90E6BA7B7DDD wurde durch den DHCP-Server 192.168.1.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 01.10.2010 10:43:02 | Computer Name = AKBP-0218A09A15 | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
< End of report >
Wäre sehr erfreut über Hilfe - möchte eine Formatierung, wenn möglich, vermeiden. gruß und danke schonmal für die Hilfe  ,plusminus Geändert von plusminus (01.10.2010 um 16:30 Uhr) |
|
01.10.2010, 16:36
| #2 |
| /// Malware-holic   |  avast - bösartige website, Objekt: "newporto.cn/cgi-bin/options.cgi?" • Starte bitte die OTL.exe.
__________________• Kopiere nun das Folgende in die Textbox. :OTL O36 - AppCertDlls: dfrgstrt - (C:\WINDOWS\system32\clipantz.dll) - C:\WINDOWS\system32\clipantz.dll () :FILES C:\WINDOWS\system32\clipantz.dll :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument dieses posten öffne arbeitsplatz, c: rechtsklick auf _OTL und zu _OTL.rar oder zip hinzufügen, archiv hochladen. http://www.trojaner-board.de/54791-a...ner-board.html macst du onlinebanking oder ähnliches? |
|
| Themen zu avast - bösartige website, Objekt: "newporto.cn/cgi-bin/options.cgi?" |
| 0x00000001, 0xc0000001, antivirus, avast!, bho, blockiert, bösartige website, combofix, components, error, firefox, flash player, google, hijack, hijackthis, hkus\s-1-5-18, home, homepage, jdownloader, location, logfile, msiinstaller, oldtimer, otl logfile, otl scan, plug-in, problem, realtek, registry, saver, security, service pack 1, shell32.dll, software, sptd.sys, system, system error, system restore, teamspeak, vista, vlc media player, windows, windows internet, windows internet explorer, windows xp |
Linear-Darstellung
