gmx-Konto versendet mails -> Win32/Genetik trojan?

Teebeutel · 05.11.2010, 10:26

Hallo!

Ich verwende den mozilla Thunderbird als Mailanwendung und sowohl einen gmx als auch einen web-de - Account, die ich darin verwalte.

Seit gestern bekam ich ca. 14 mailer-demon-Meldungen von mails, die ich nicht abgeschickt habe, dazu kommt, dass ich per gmx keine Mails mehr versenden kann, da mein Konto wegen Spam geperrt wurde.

Da ich mich wenig mit Netzwerk/Internet auskenne, weis ich nicht "wo hier der Wurm drin ist" und bitte euch um Hilfe

Ich habe in Wondows 2 Account, root und meinen Benutzer, den ich zu 95% nutze, damit will ich eventl. Schadprogrammen nicht alle Admin-Rechte über mein PC geben, die ich mir eventl. einfangen könnte. Installiert habe ich Kaspersky als Schutz und CCleaner zum sauberhalten des PCs.
Webbrowser ist Mozilla Firefox, Mailprogramm Thunderbird.
ESET hat nach einer Stunde Scannen "Win32/Genetik trojan" gefunden (für mich schleierhaft, ich halte mich vor unbekanntem Terrain im Internet zurück, keine Warez & co - seiten, keine zwielichten Downloads).
Bin ziemlich vor den Kopf gestoßen, wo das herkommen könnte.

Vier Fragen meinerseits, plus eine kleine (bisschen OT):

kleine: Kaspersky startet bei mir erst einige Sekunden nach Hochfahren und initialisieren des Desktops - besteht in der Zwischenzeit eine ungeschützte Verbindung mit dem Internet? Wenn ja, wie vermeidet man das?

1. Frage: Wie bekomme ich den Trojaner wieder weg? Er kopiert sich, soweit ich mich eingelesen habe, a mehrfach und reaktiviert sich per autostart wieder; außerdem trägt er etwas in die registry ein (das ich aber per [STRG]+R->regedit nicht finden konnte).

2. Frage: Kann mir jemand erklären, was da eigentlich bei mir ablief, der mehr davon versteh bzw. einen nette Seite kennt, die einem erklärt, wie so ein trojaner funktioniert? Wurde mein gmx-Account-PW erspäht und das ganze auf einem anderen PC ausgeführt, oder lief das auf meinem PC ab?

3. Frage: Sind eurer Meinung die Passwortmanager von Mozilla eigentlich sicher? Im grunde muss doch nur jemand an unsre PCs kommen, PW-Manager ausspähen und hat sämtliche PWs?

4. Frage: Wie schütze ich mich zukünftig besser vor so einem Trojaner - wie gesagt "ich bin mir keiner Schuld bewusst" ^^. Auf keinen fragwürdigen Seiten gewesen und für den Fall der Fälle dachte ich, dass Kaspersky so ein Schadprogramm abblockt

Hoffe, ihr blickt durch meine Fragen alle durch, habe versucht das einigermaßen zu strukturieren. Bedanke mich auf jeden Fall schonmal fürs Durchlesen.

mit freundlichem Gruß, Jon

PS: bisher getan:
- ESET Scan: "Infected Files: 1" - "probably a variant of Win32/Genetik trojan"
- Kaspersky Wiederherstellung aller vertrauenswürdiger Programme, um sie nun nochmals einzeln manuell zuzulassen bzw. zu verweigern

wird noch Folgen (sobald ESET fertig ist [sitzt seit 10min auf 99%])
- kompletter Kaspersky-Scan meines PCs

Anhang: ein Ausschnitt des

Zitat:

Hi. This is the qmail-send program at mail.gmx.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<[Mailadresse, geändert]@t-online.de>:
194.25.134.9_failed_after_I_sent_the_message./Remote_host_said:_550-5.7.0_Message_considered_as_spam_or_virus,_rejected/550-5.7.0_Your_IP:_213.165.64.22/550-5.7.0_Mailhost:_mailin19.aul.t-online.de/550-5.7.0_Timestamp:_2010-11-03T11:39:09Z/550-5.7.0_Expurgate-ID:_149288::1288784349-000073AD-0830FE45/3222638356-0/0-3/550-5.7.0_Authenticator:_49EB3E40233A44C29A00C146DFEC3B4164D200F4EA1F8819DC44A17502B590BF3B9D7103/550-5.7.0_/550-5.7.0_Your_message_has_been_rejected_due_to_spam_or_virus_classification./550-5.7.0_If_you_feel_this_is_inapplicable,_please_report_the_above_error_codes/550-5.7.0_back_to_FPR@RX.T-ONLINE.DE_to_help_us_fix_possible_misclassification./550-5.7.0_We_apologize_for_any_inconvenience_and_thank_you_for_your_assistance!/550-5.7.0_/550-5.7.0_Die_Annahme_Ihrer_Nachricht_wurde_abgelehnt,_da_sie_als_Spam_oder/550-5.7.0_Virus_eingestuft_wurde._Sollten_Sie_dies_als_unzutreffend_ansehen,/550-5.7.0_senden_Sie_bitte_obige_Fehlercodes_an_FPR@RX.T-ONLINE.DE,_damit_wir/550-5.7.0_die_Klassifizierung_untersuchen_k__nnen._Wir_entschuldigen_uns_f__r/550_5.7.0_etwaige_Unannehmlichkeiten_und_bedanken_uns_f__r_Ihre_Unterst__tung!/

--- Below this line is a copy of the message.

Return-Path: <[Mailadresse, geändert]@gmx.de>
Received: (qmail invoked by alias); 03 Nov 2010 11:39:06 -0000
Received: from hn.kd.ny.adsl (EHLO gh) [125.45.229.63]
by mail.gmx.net (mp066) with SMTP; 03 Nov 2010 12:39:06 +0100
X-Authenticated: #28244981
X-Provags-ID: V01U2FsdGVkX1+rUJAjAXeruLJy3f8F0JGeTP8GMAdpqD9jh6bBjk
OZtdrEQ93BtEcJ
Reply-To: <wowaccountadmin@blizzard.com>
Sender: [Mailadresse, geändert]@gmx.de
Message-ID: <E2D23A6F96018871A7B1352CCE358EE5@gh>
From: =?utf-8?B?QmxpenphcmQgRW50ZXJ0YWlubeKAi2VudA==?= <wowaccountadmin@blizzard.com>
To: <[Mailadresse, geändert]@t-online.de>
Subject: Battle.net Account - login validation
Date: Wed, 3 Nov 2010 19:38:41 +0800
MIME-Version: 1.0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512
X-Y-GMX-Trusted: 0
X-GMX-Antivirus: 0 (no virus found)

cosinus · 05.11.2010, 17:20

Hallo und

Zitat:

Ich habe in Wondows 2 Account, root und meinen Benutzer, den ich zu 95% nutze, damit will ich eventl. Schadprogrammen nicht alle Admin-Rechte über mein PC geben

Das ist eine sinnvolle Maßnahme, aber nur wenn der 2. Benutzer auch wirklich eingeschränkte Rechte hat. Welche Rechte hat er? Ist er Administrator, Hauptbenutzer, Benutzer oder Gast?

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Teebeutel · 05.11.2010, 23:04

so, dankeschön für die Hilfestellung!

Mein Benutzeraccount, mit dem ich arbeite, ist weder Gast noch Admin, ein Standardbenutzerkonto.
Kaspersky hat nichts gefunden.
Malwarebytes' Anti Malware habe ich installiert, Update gestartet und den vollständigen Scan durchgeführt (wow, 3.5h Dauer).
Das Ergebnis: 6 Dateien infiziert, aber alles im Grunde Kopien voneinander. In einem Forum habe ich über diese Datei (ein Tool) etwas gelesen und mehrere Nutzer dieses Programms haben dort geschrieben, dass einige Virenscanner dieses Programm als Virus einstuften (z.B. Mc Afee).
Hier der Bericht von Anti Malware:

Zitat:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5054

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

05.11.2010 22:33:22
mbam-log-2010-11-05 (22-33-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|J:\|)
Durchsuchte Objekte: 451459
Laufzeit: 3 Stunde(n), 34 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Spiele\Guild Wars\Visions\updater.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
C:\Spiele\Guild Wars\Visions\Visions.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
C:\Users\Gabriel_2\Desktop\usb-stick\Visions\updater.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
C:\Users\Gabriel_2\Desktop\usb-stick\Visions\Visions.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
J:\$RECYCLE.BIN\S-1-5-21-331218241-714689698-1037341905-1000\$RU7BRXG\updater.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
J:\$RECYCLE.BIN\S-1-5-21-331218241-714689698-1037341905-1000\$RU7BRXG\Visions.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.

leider weis ich nichtmehr genau, ob der ESET Scan von heute morgen die infizierte Datei entfernt hat und sie deshalb nicht beim Kaspersky-scan auftaucht, oder ob sie es durch die Kaspersky-heuristik geschafft hat - warsch. werd ich sicherheitshalber den ESET Scan nochmals durchführen müssen.

hier der Bericht von OTL:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 05.11.2010 22:46:38 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Gabriel\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 53,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 440,37 Gb Total Space | 188,41 Gb Free Space | 42,78% Space Free | Partition Type: NTFS
Drive D: | 25,38 Gb Total Space | 1,05 Gb Free Space | 4,13% Space Free | Partition Type: FAT32
Drive J: | 232,88 Gb Total Space | 44,54 Gb Free Space | 19,12% Space Free | Partition Type: NTFS
 
Computer Name: GABRIEL-PC | User Name: Gabriel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Gabriel\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\eigene Programme\Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\eigene Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\eigene Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\eigene Programme\TreeSize Free\TreeSizeFree.exe (JAM Software)
PRC - C:\eigene Programme\Alcohol 120\StarWind\StarWindServiceAE.exe (StarWind Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe ()
PRC - C:\Windows\tsnp2uvc.exe ()
PRC - C:\eigene Programme\Taskbar Shuffle\taskbarshuffle.exe (Jay Elaraj)
PRC - C:\Windows\System32\PSIService.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Gabriel\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
MOD - C:\eigene Programme\Kaspersky 2009\kloehk.dll (Kaspersky Lab)
MOD - C:\eigene Programme\Kaspersky 2009\adialhk.dll (Kaspersky Lab)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Hamachi2Svc) -- C:\eigene Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (aspnet_state) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetTcpActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetPipeActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetMsmqActivator) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (StarWindServiceAE) -- C:\eigene Programme\Alcohol 120\StarWind\StarWindServiceAE.exe (StarWind Software)
SRV - (AVP) -- C:\eigene Programme\Kaspersky 2009\avp.exe (Kaspersky Lab)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (resetWinService) -- C:\Program Files\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (WINIO) -- C:\Windows\System32\WinIo.sys ()
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (hwinterface) -- C:\Windows\System32\drivers\hwinterface.sys (Logix4u)
DRV - (ElbyCDIO) -- C:\Windows\System32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (klbg) -- C:\Windows\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (ACEDRV05) -- C:\Windows\System32\drivers\ACEDRV05.sys (Protect Software GmbH)
DRV - (VClone) -- C:\Windows\System32\drivers\VClone.sys (Elaborate Bytes AG)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (KLFLTDEV) -- C:\Windows\System32\drivers\klfltdev.sys (Kaspersky Lab)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.aldi.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\eigene Programme\Firefox\components [2010.11.05 19:49:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\eigene Programme\Firefox\plugins [2010.11.05 19:49:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\eigene Programme\Thunderbird\components [2010.11.05 19:49:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\eigene Programme\Thunderbird\plugins [2010.11.05 19:49:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\eigene Programme\Kaspersky 2009\THBExt [2009.10.30 08:42:55 | 000,000,000 | ---D | M]
 
[2009.07.30 14:36:13 | 000,000,000 | ---D | M] -- C:\Users\Gabriel\AppData\Roaming\mozilla\Extensions
[2010.11.05 09:15:08 | 000,000,000 | ---D | M] -- C:\Users\Gabriel\AppData\Roaming\mozilla\Firefox\Profiles\ysuz4r3e.default\extensions
[2010.08.29 15:01:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Gabriel\AppData\Roaming\mozilla\Firefox\Profiles\ysuz4r3e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\eigene Programme\Kaspersky 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\eigene Programme\Free Download Manager\iefdm2.dll ()
O4 - HKLM..\Run: [AVP] C:\eigene Programme\Kaspersky 2009\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\eigene Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\eigene Programme\Quick Time\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [tsnp2uvc] C:\Windows\tsnp2uvc.exe ()
O4 - HKCU..\Run: [Taskbar Shuffle] C:\eigene Programme\Taskbar Shuffle\taskbarshuffle.exe (Jay Elaraj)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\eigene Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Gabriel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\eigene Programme\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\eigene Programme\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\eigene Programme\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\eigene Programme\Kaspersky 2009\ie_banner_deny.htm ()
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\eigene Programme\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\eigene Programme\Kaspersky 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\EIGENE~1\KASPER~1\mzvkbd3.dll) - C:\eigene Programme\Kaspersky 2009\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\EIGENE~1\KASPER~1\adialhk.dll) - C:\eigene Programme\Kaspersky 2009\adialhk.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\EIGENE~1\KASPER~1\kloehk.dll) - C:\eigene Programme\Kaspersky 2009\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.08.21 11:50:32 | 000,000,672 | RH-- | M] () - D:\autoexec.bat -- [ FAT32 ]
O33 - MountPoints2\{3e5afe8f-7db6-11de-aba8-001f1617bb40}\Shell - "" = AutoRun
O33 - MountPoints2\{3e5afe8f-7db6-11de-aba8-001f1617bb40}\Shell\AutoRun\command - "" = H:\pushinst.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.05 22:45:51 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Gabriel\Desktop\OTL.exe
[2010.11.05 20:36:18 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Roaming\Unity
[2010.11.05 20:35:08 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Roaming\PACE Anti-Piracy
[2010.11.05 20:35:08 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Local\PACE Anti-Piracy
[2010.11.05 20:35:08 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\PACE Anti-Piracy
[2010.11.05 19:48:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010.11.05 19:36:43 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Roaming\Winamp
[2010.11.05 18:44:22 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Roaming\Malwarebytes
[2010.11.05 18:44:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.11.05 18:44:12 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.11.05 18:44:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.11.05 13:02:31 | 001,414,440 | ---- | C] (Nero AG) -- C:\Windows\System32\ShellManager310E2D762.dll
[2010.11.05 10:41:10 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Roaming\JAM Software
[2010.11.05 09:04:57 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2010.11.04 19:00:07 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Local\LogMeIn Hamachi
[2010.10.28 17:42:20 | 000,000,000 | ---D | C] -- C:\ProgramData\PACE Anti-Piracy
[2010.10.28 16:56:38 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Local\Unity
[2010.10.28 16:51:56 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Unity Projects
[2010.10.20 18:53:24 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Runic
[2010.10.17 13:05:17 | 000,000,000 | ---D | C] -- C:\Studium
[2010.10.15 15:51:02 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.10.15 15:50:37 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.10.15 15:49:33 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.10.15 15:49:06 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.10.15 15:46:11 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.10.15 15:46:11 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.10.15 15:46:11 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2010.10.15 15:46:10 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.10.15 15:46:10 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.10.15 15:46:09 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.10.15 15:46:09 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.10.15 15:46:09 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.10.15 15:46:09 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.10.15 15:46:09 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.10.15 15:46:08 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.10.15 15:46:08 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.10.15 15:46:08 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.10.15 15:46:08 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.10.15 15:46:08 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.10.15 15:46:08 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.10.15 15:46:07 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.10.15 15:46:01 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.10.15 15:45:59 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.10.15 15:45:42 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.10.15 15:45:38 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.10.15 15:45:34 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.10.15 15:28:51 | 000,000,000 | ---D | C] -- C:\Users\Gabriel\AppData\Roaming\TS3Client
[2009.02.27 18:17:28 | 000,225,280 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2009.02.27 18:17:27 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.05 22:48:42 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\crrtoptm.sys
[2010.11.05 22:45:52 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Gabriel\Desktop\OTL.exe
[2010.11.05 22:36:20 | 000,227,012 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.11.05 22:36:20 | 000,227,012 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.11.05 22:28:16 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.05 22:28:16 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.05 20:57:27 | 001,474,592 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox2.dat
[2010.11.05 20:48:21 | 000,007,168 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox2.idx
[2010.11.05 18:50:07 | 000,670,946 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.11.05 18:50:07 | 000,631,636 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.11.05 18:50:07 | 000,144,082 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.11.05 18:50:07 | 000,118,262 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.11.05 18:47:28 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{36A4F637-ABC2-4CBD-A139-C1A98D1913B7}.job
[2010.11.05 18:44:17 | 000,000,753 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.05 18:28:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.05 18:28:09 | 3215,851,520 | -HS- | M] () -- C:\hiberfil.sys
[2010.11.05 18:27:17 | 010,580,000 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox.dat
[2010.11.05 18:27:17 | 000,087,928 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox.idx
[2010.11.05 18:24:56 | 000,001,654 | ---- | M] () -- C:\Windows\System32\%LocalXml%
[2010.11.05 18:07:49 | 000,000,584 | ---- | M] () -- C:\Users\Gabriel\.xmaximarc
[2010.11.05 17:46:16 | 000,001,758 | ---- | M] () -- C:\Users\Gabriel\Documents\cc_20101105_174614.reg
[2010.11.05 17:45:59 | 000,023,974 | ---- | M] () -- C:\Users\Gabriel\Documents\cc_20101105_174556.reg
[2010.11.05 13:01:59 | 000,001,024 | ---- | M] () -- C:\Users\Gabriel\.rnd
[2010.11.05 13:01:45 | 000,000,000 | ---- | M] () -- C:\Windows\Irremote.ini
[2010.11.05 12:54:50 | 000,000,781 | ---- | M] () -- C:\Users\Gabriel\Desktop\CCleaner.lnk
[2010.11.05 12:51:38 | 000,000,818 | ---- | M] () -- C:\Users\Gabriel\Desktop\TreeSize Free (Administrator).lnk
[2010.11.05 12:50:24 | 000,001,649 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2010.11.05 12:49:26 | 000,000,745 | ---- | M] () -- C:\Users\Gabriel\Desktop\Autoruns.lnk
[2010.11.05 10:37:45 | 000,009,492 | ---- | M] () -- C:\Users\Gabriel\Documents\cc_20101105_103731.reg
[2010.11.01 06:27:52 | 000,364,472 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.10.19 11:41:44 | 000,222,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.10.15 15:57:16 | 000,010,842 | ---- | M] () -- C:\Users\Gabriel\Documents\cc_20101015_165710.reg
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.05 18:44:17 | 000,000,753 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.05 18:24:56 | 000,001,654 | ---- | C] () -- C:\Windows\System32\%LocalXml%
[2010.11.05 17:46:15 | 000,001,758 | ---- | C] () -- C:\Users\Gabriel\Documents\cc_20101105_174614.reg
[2010.11.05 17:45:58 | 000,023,974 | ---- | C] () -- C:\Users\Gabriel\Documents\cc_20101105_174556.reg
[2010.11.05 13:02:31 | 000,774,144 | ---- | C] () -- C:\Windows\System32\NEROINSTAEC43759.DB
[2010.11.05 13:01:58 | 000,001,024 | ---- | C] () -- C:\Users\Gabriel\.rnd
[2010.11.05 13:01:45 | 000,000,000 | ---- | C] () -- C:\Windows\Irremote.ini
[2010.11.05 12:54:50 | 000,000,781 | ---- | C] () -- C:\Users\Gabriel\Desktop\CCleaner.lnk
[2010.11.05 12:51:38 | 000,000,818 | ---- | C] () -- C:\Users\Gabriel\Desktop\TreeSize Free (Administrator).lnk
[2010.11.05 12:50:24 | 000,001,649 | ---- | C] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2010.11.05 12:49:26 | 000,000,745 | ---- | C] () -- C:\Users\Gabriel\Desktop\Autoruns.lnk
[2010.11.05 10:37:33 | 000,009,492 | ---- | C] () -- C:\Users\Gabriel\Documents\cc_20101105_103731.reg
[2010.10.31 18:22:19 | 000,000,584 | ---- | C] () -- C:\Users\Gabriel\.xmaximarc
[2010.10.15 15:57:12 | 000,010,842 | ---- | C] () -- C:\Users\Gabriel\Documents\cc_20101015_165710.reg
[2010.08.22 16:37:20 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2010.08.14 06:13:46 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.08.09 05:24:26 | 000,009,336 | ---- | C] () -- C:\Windows\System32\WinIo.sys
[2010.04.12 17:07:50 | 000,000,108 | ---- | C] () -- C:\Windows\GMouse.ini
[2010.04.02 14:23:05 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2009.12.29 22:00:28 | 000,000,146 | ---- | C] () -- C:\Windows\W2W.ini
[2009.12.29 21:47:58 | 000,000,008 | ---- | C] () -- C:\Windows\System32\PROTOCOL.INI
[2009.10.06 16:05:18 | 000,069,632 | ---- | C] () -- C:\Windows\System32\xmltok.dll
[2009.10.06 16:05:18 | 000,036,864 | ---- | C] () -- C:\Windows\System32\xmlparse.dll
[2009.08.05 21:07:23 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.07.30 11:23:05 | 000,045,056 | ---- | C] () -- C:\Users\Gabriel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.02.27 18:17:28 | 001,799,808 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2009.02.27 18:17:28 | 000,028,544 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2009.02.27 18:17:28 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2009.02.26 21:09:31 | 000,002,828 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2009.02.26 21:09:31 | 000,000,008 | RHS- | C] () -- C:\Windows\System32\F928A0FA17.sys
[2008.10.28 16:40:48 | 000,173,552 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2003.03.31 01:41:00 | 000,200,000 | ---- | C] () -- C:\Windows\System32\AckUtl.dll
[1997.06.14 12:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1305 bytes -> C:\Program Files\Common Files\microsoft shared:S3Y1bcOHHSjgCIocNaot8K
@Alternate Data Stream - 1168 bytes -> C:\ProgramData\Microsoft:rU76SpLTEktko9GRoSKFBiJG8
@Alternate Data Stream - 1167 bytes -> C:\ProgramData\Microsoft:QlivCheOQBsBy0XR6o3xjZmBwJx
@Alternate Data Stream - 1108 bytes -> C:\ProgramData\Microsoft:U8fX2xkUqcCqG0LrsglKWecC

< End of report >

--- --- ---

und Bericht Nr 2
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 05.11.2010 22:46:39 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Gabriel\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 53,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 440,37 Gb Total Space | 188,41 Gb Free Space | 42,78% Space Free | Partition Type: NTFS
Drive D: | 25,38 Gb Total Space | 1,05 Gb Free Space | 4,13% Space Free | Partition Type: FAT32
Drive J: | 232,88 Gb Total Space | 44,54 Gb Free Space | 19,12% Space Free | Partition Type: NTFS
 
Computer Name: GABRIEL-PC | User Name: Gabriel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\eigene Programme\Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\eigene Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\eigene Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02A36ED3-3074-41B1-8935-1AA1959DCD0B}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{0C361405-30BA-4E8A-AE95-C3CBB02FD4EE}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client | 
"{19D63C8E-D6C7-4118-BD32-91A44A1396BD}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{378DAE44-BD55-4540-978B-3C1C1B38128B}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client | 
"{3BF272C1-D001-4F12-9918-08D77557C2DC}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby | 
"{4DB5E03C-9D7D-4925-A705-6CC136889DA4}" = lport=8377 | protocol=17 | dir=in | name=league of legends launcher | 
"{570CA357-5D38-4A9C-B6C3-3C97E1000DF4}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{5E20D51B-4CF9-480F-BA7F-009FF0E86792}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{6140177E-5C38-42B5-B09A-FB3F82245F1F}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{633DAFCA-9F5E-4D9F-ABF2-65CFC32A671F}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{6530D62F-D0B4-4A3C-BA32-2F007CC5E473}" = lport=8378 | protocol=6 | dir=in | name=league of legends launcher | 
"{6BA16E17-3F36-473D-9166-32C9B25346A3}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{78EADD69-0E7F-48C7-9A51-4EE2A4430159}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7D8E6D0B-9226-4943-A340-4559B603926C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{84E88D2F-D8CD-4EC1-9A6D-4E92EC6F744B}" = lport=8377 | protocol=6 | dir=in | name=league of legends launcher | 
"{877F05D6-FECD-44FD-B64B-4AF561B74624}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby | 
"{939F8BF7-1D03-4315-96D3-2B892A69E1AB}" = lport=8378 | protocol=17 | dir=in | name=league of legends launcher | 
"{A564B61F-492E-4114-ABBD-25131B9652F3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{ABECAD0C-E3A4-4D26-8F1F-78879FA3A0CB}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{DB087BFF-D711-4ACD-B56F-C29C59970C05}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{E0D13F6F-F22B-4FBB-8307-7725ACD04E4F}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{F4C6E80B-DCF7-4768-B46E-69BDCFEA6D66}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{F6CD09F4-AC21-4DE7-A748-67985401FAA3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F73D6076-DACF-422F-BC3B-30EAA7DACE36}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{FECD3EC1-1CA7-423D-89FE-9F90A17CBA92}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{034615C7-6407-4695-9EA2-BABC8599B3AB}" = protocol=17 | dir=in | app=c:\spiele\league of legends\air\lolclient.exe | 
"{05613761-5A51-4BFE-BB81-A376EF4EB1EC}" = protocol=6 | dir=in | app=c:\spiele\ut 3\binaries\ut3.exe | 
"{08CA7C88-387D-4D1A-B524-5933F82606A4}" = protocol=17 | dir=in | app=c:\spiele\bf 2\bf2.exe | 
"{0C4A8DAB-A8AA-4624-A29F-679013C6AF40}" = dir=in | app=c:\eigene programme\skype\phone\skype.exe | 
"{0C9200AB-0E3E-4577-A9A4-9A477C725EB6}" = protocol=6 | dir=in | app=c:\windows\system32\dpnsvr.exe | 
"{0FEF4989-76E9-4FDA-841C-B651EA3B8943}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{141FE35A-BD5F-4031-A9D4-9572D6F81424}" = protocol=6 | dir=in | app=c:\spiele\league of legends\game\league of legends.exe | 
"{17C1650A-FC20-4E7B-9BEB-F759CACBA9AB}" = protocol=17 | dir=in | app=c:\windows\system32\dpnsvr.exe | 
"{1EB82B0B-D749-42ED-8D24-75A3AB875E89}" = dir=in | app=c:\eigene programme\skype\phone\skype.exe | 
"{246E82E0-A677-4FA8-87DA-FF2887EF83A5}" = protocol=17 | dir=in | app=c:\spiele\ds 2\dungeonsiege2.exe | 
"{28C15D13-16F3-4324-8BC7-745B8F1F13A7}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{2B01B10F-291F-441A-B486-083237B5C461}" = protocol=6 | dir=in | app=c:\spiele\league of legends\air\lolclient.exe | 
"{2B3C5397-901C-4DC4-9CC8-44CC3D962214}" = protocol=6 | dir=in | app=c:\spiele\league of legends\game\league of legends.exe | 
"{2BD97275-C29A-4A09-BF79-FEBD8D237FF4}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{32D66ED6-26BA-4E23-A6D1-B711BD49FF0A}" = dir=in | app=c:\eigene programme\skype\phone\skype.exe | 
"{3626A9DE-87E2-4EE2-B4EF-542B853535D2}" = protocol=17 | dir=in | app=c:\spiele\lol\game\league of legends.exe | 
"{39823453-6D8B-4D80-B53F-C342E2F09EE1}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{4451D569-1D70-48BF-A5FB-C38836F619A9}" = protocol=17 | dir=in | app=c:\spiele\anno 1701\anno1701.exe | 
"{595D39FA-A163-4353-A26F-29D3EB3F92D4}" = protocol=6 | dir=in | app=c:\spiele\ds 2\bw\dungeonsiege2.exe | 
"{5E6D0C49-70E8-4417-84AC-74AD1D18F721}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe | 
"{64FE32B1-37D6-41F8-A3F5-B2ABF249B092}" = protocol=17 | dir=in | app=c:\spiele\league of legends\game\league of legends.exe | 
"{6C70B0E0-4FAB-4E7A-B5A6-24AEE1E6D48C}" = protocol=6 | dir=in | app=c:\users\gabriel\appdata\local\apps\2.0\g3mqpml9.63e\my8woa8v.kbz\curs..tion_eee711038731a406_0004.0000_1829574f2226d088\curseclient.exe | 
"{77E6FA01-D772-4ABC-A54A-C0E7FFEB78E1}" = protocol=17 | dir=in | app=c:\spiele\league of legends\lol.launcher.exe | 
"{7E23386E-FC64-44C4-BDCF-71AEBE674367}" = protocol=17 | dir=in | app=c:\spiele\league of legends\game\league of legends.exe | 
"{7FA7D527-0432-4C28-8CA3-147A76767D37}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{86DBEB56-DD4D-46FA-BB19-2C2D984D020B}" = protocol=17 | dir=in | app=c:\spiele\sc\gpgnet\gpg.multiplayer.client.exe | 
"{87AB3327-47B5-4C6F-A5AD-1ABF116F91EB}" = protocol=6 | dir=in | app=c:\spiele\bf 2\bf2.exe | 
"{8B257715-6D3F-444E-BA37-B147AA0467CE}" = protocol=6 | dir=in | app=c:\spiele\league of legends\air\lolclient.exe | 
"{8F7266D4-354E-4059-8E2E-40DD07EB76CC}" = protocol=6 | dir=in | app=c:\spiele\ds 2\dungeonsiege2.exe | 
"{91808F67-1566-4023-BE38-8E02B0D84F50}" = protocol=17 | dir=in | app=c:\users\gabriel\appdata\local\apps\2.0\g3mqpml9.63e\my8woa8v.kbz\curs..tion_eee711038731a406_0004.0000_1829574f2226d088\curseclient.exe | 
"{996C8106-6A1A-4EA1-BF82-84A0CAAD3D95}" = protocol=6 | dir=in | app=c:\spiele\league of legends\lol.launcher.exe | 
"{A5E1F992-E5EE-4DB9-BC64-3430BB8D6994}" = protocol=6 | dir=in | app=c:\spiele\lol\game\league of legends.exe | 
"{A75BE258-908A-4810-A0E8-11CEAA6AEFF0}" = protocol=17 | dir=in | app=c:\spiele\ut 3\binaries\ut3.exe | 
"{A8032759-D093-44B5-997C-65A9405D62D5}" = protocol=6 | dir=in | app=c:\spiele\anno 1701\anno1701.exe | 
"{AC69E778-8A10-4C60-B55C-8D1FA6FC2DA3}" = protocol=17 | dir=in | app=c:\spiele\sum ii\game.dat | 
"{B4920954-88A8-43AA-A725-6CF63E05045C}" = protocol=17 | dir=in | app=c:\spiele\league of legends\air\lolclient.exe | 
"{B6D98CE6-A07C-471E-B5DE-BBA024303BAE}" = dir=in | app=c:\eigene programme\skype\phone\skype.exe | 
"{B8276A8F-8B82-4686-B463-A4F63BE94BAF}" = dir=in | app=c:\program files\homecinema\powerdvd8\powerdvd8.exe | 
"{BF2E2795-3598-492E-9353-0A8CEA6B776C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{BF6FB782-83CF-42BE-9D95-366E15CCC7DE}" = dir=in | app=c:\eigene programme\skype\phone\skype.exe | 
"{C6790DBC-E0DE-4FF7-BB32-04DE99ACB072}" = protocol=6 | dir=in | app=c:\spiele\sc\gpgnet\gpg.multiplayer.client.exe | 
"{CCC6E7FB-7C64-488B-9605-FA5BE62FC81D}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{D1ACF2DE-2190-4FD8-BB43-F82521E3C22E}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{D1F172C1-716A-4B4B-AA10-2293FA95E17D}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{DB872373-8577-4F9D-AFC4-6F74DEB8096B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{DCDD5BDD-0235-4305-9A87-1C91871E9EDB}" = protocol=17 | dir=in | app=c:\spiele\lol\air\lolclient.exe | 
"{DE757E9D-AC20-4EF4-A8EE-D941A3337A0B}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{E268743B-6806-420C-B237-42DD69B5E6D6}" = protocol=17 | dir=in | app=c:\spiele\ds 2\bw\dungeonsiege2.exe | 
"{ED31F70F-60E4-4684-9CD6-86A402E206BD}" = protocol=6 | dir=in | app=c:\spiele\demigod demo\bin\demigod.exe | 
"{F7E8761C-0560-4475-BA67-6B1A31EAEFE5}" = protocol=6 | dir=in | app=c:\spiele\lol\air\lolclient.exe | 
"{F92598EA-D875-4D2D-9ECB-85A3CC8BE16E}" = protocol=17 | dir=in | app=c:\spiele\demigod demo\bin\demigod.exe | 
"{FF76ED89-4C20-443A-B051-F8E7F1C83140}" = protocol=6 | dir=in | app=c:\spiele\sum ii\game.dat | 
"TCP Query User{0599BE44-DCF0-4DBF-BDE3-48313D465110}C:\spiele\dow 40k\soulstorm\soulstorm.exe" = protocol=6 | dir=in | app=c:\spiele\dow 40k\soulstorm\soulstorm.exe | 
"TCP Query User{063111DD-8071-4015-90F1-6765C5EFA755}C:\eigene programme\maxima-5.22.1\bin\xmaxima.exe" = protocol=6 | dir=in | app=c:\eigene programme\maxima-5.22.1\bin\xmaxima.exe | 
"TCP Query User{25C66307-782A-41BF-BB53-776FD056DA2E}C:\spiele\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\spiele\warcraft iii\war3.exe | 
"TCP Query User{372BFACF-88BE-4468-864E-044E25CDC96D}C:\spiele\c&c generäle - stunde null\game.dat" = protocol=6 | dir=in | app=c:\spiele\c&c generäle - stunde null\game.dat | 
"TCP Query User{4F16D218-9795-42D3-A700-6293435710CE}C:\spiele\dungeon siege i\dungeonsiege.exe" = protocol=6 | dir=in | app=c:\spiele\dungeon siege i\dungeonsiege.exe | 
"TCP Query User{893A9747-DC5F-4A35-BFE9-6AC3E6B3013F}C:\spiele\ds 2 bw\dungeonsiege2.exe" = protocol=6 | dir=in | app=c:\spiele\ds 2 bw\dungeonsiege2.exe | 
"TCP Query User{9E611B89-9D74-420E-9C3C-0A14FC24EAD3}C:\eigene programme\free download manager\fdm.exe" = protocol=6 | dir=in | app=c:\eigene programme\free download manager\fdm.exe | 
"TCP Query User{E503E9BB-6352-41A6-860F-A45B2215B7E9}C:\eigene programme\a6 3dgs\acknex.exe" = protocol=6 | dir=in | app=c:\eigene programme\a6 3dgs\acknex.exe | 
"TCP Query User{F00D9820-9825-4608-8BFB-4E2160FCF278}C:\eigene programme\miranda im\miranda32.exe" = protocol=6 | dir=in | app=c:\eigene programme\miranda im\miranda32.exe | 
"UDP Query User{137BFBAC-BEE0-474D-A4F9-711D3A1EE723}C:\eigene programme\free download manager\fdm.exe" = protocol=17 | dir=in | app=c:\eigene programme\free download manager\fdm.exe | 
"UDP Query User{16B24211-2D0B-4CC3-9DEE-0498A6D5BDDF}C:\spiele\dow 40k\soulstorm\soulstorm.exe" = protocol=17 | dir=in | app=c:\spiele\dow 40k\soulstorm\soulstorm.exe | 
"UDP Query User{48AFA68B-6334-4449-A3F0-D4B5342A74B9}C:\eigene programme\miranda im\miranda32.exe" = protocol=17 | dir=in | app=c:\eigene programme\miranda im\miranda32.exe | 
"UDP Query User{8B873C0C-163B-43AA-9A3A-E3B88E03E9A1}C:\eigene programme\maxima-5.22.1\bin\xmaxima.exe" = protocol=17 | dir=in | app=c:\eigene programme\maxima-5.22.1\bin\xmaxima.exe | 
"UDP Query User{8CA7B05B-2474-4035-BCD1-F0C929D405F7}C:\spiele\c&c generäle - stunde null\game.dat" = protocol=17 | dir=in | app=c:\spiele\c&c generäle - stunde null\game.dat | 
"UDP Query User{8D219DF6-452B-46EB-8E91-335271614D1C}C:\spiele\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\spiele\warcraft iii\war3.exe | 
"UDP Query User{DB90BE1F-C9BE-40DB-A6D8-3EE0219C9A08}C:\spiele\ds 2 bw\dungeonsiege2.exe" = protocol=17 | dir=in | app=c:\spiele\ds 2 bw\dungeonsiege2.exe | 
"UDP Query User{F28CC14B-6903-4B59-95BA-CB207670AC67}C:\eigene programme\a6 3dgs\acknex.exe" = protocol=17 | dir=in | app=c:\eigene programme\a6 3dgs\acknex.exe | 
"UDP Query User{F4C6C1BE-FE0D-478B-948D-DE76C805F4D3}C:\spiele\dungeon siege i\dungeonsiege.exe" = protocol=17 | dir=in | app=c:\spiele\dungeon siege i\dungeonsiege.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer(TM) Generäle
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20533183-D42D-4261-A125-956736FBEA8C}" = Dawn of War - Soulstorm
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 21
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB Video Device
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4723F199-FA64-4233-8E6E-9FCCC95A18EE}" = Python 2.6.5
"{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}" = Microsoft Games for Windows - LIVE 
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{7657BD05-EF70-4B49-AAC2-BBA6F91C6A4D}" = 3D GameStudio / A6
"{765E50AF-5550-4F7E-84F4-524D1BF2C49D}" = MSM2MSI_gstudio
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{936B67BE-1EB4-4D98-815A-EA1E75FFED2F}" = Counter-Strike Source Final 07102004
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95C5F81D-0779-4932-BE83-32AAF814F4B9}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A062A15F-9CAC-4B88-98DF-87628A0BD721}" = Corel MediaOne
"{A2B3C27C-1F09-47C6-9A90-9683BEFD7963}" = Dawn of War - Soulstorm
"{A334F1BA-0A1D-4ED6-B4F9-4066157CA15D}" = DE
"{A563C4F4-BE36-4956-BA0B-E02BDD9F70D5}" = Dungeon Siege 2 Broken World
"{A8314F91-FF66-4ACA-AC3A-2B06F4900A15}" = RenderMonkey 1.82
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{C53F001E-5912-4E76-AC49-9AC20B36B1A2}" = MSM2MSI_gstudio
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CC2422C9-F7B5-4175-B295-5EC2283AA674}" = Command & Conquer™ 3: Kanes Rache
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0B36BAF-3E9D-423E-8821-ED238C18DB0A}" = Warhammer 40,000: Dawn Of War - Gold Edition
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FD052FB9-FE90-4438-B355-15EDC89D8FB1}" = Microsoft Games for Windows - LIVE Redistributable
"{FDBBAF14-5ED8-49B7-A5BE-1C35668B074D}" = Unreal Tournament 3 (LG)
"{FF39FC01-819B-42E4-AE49-1968AF12DDD4}" = Dawn of War - Dark Crusade
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 4.65
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Age of Wonders Shadow Magic" = Age of Wonders Shadow Magic
"AutoHotkey" = AutoHotkey 1.0.48.05
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"DivX Setup.divx.com" = DivX-Setup
"DungeonSiege2" = Dungeon Siege 2
"Fraps" = Fraps
"Free Download Manager_is1" = Free Download Manager 3.0
"Free DVD Decrypter_is1" = Free DVD Decrypter version 1.4
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"Guild Wars" = GUILD WARS
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer(TM) Generäle
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"IrfanView" = IrfanView (remove only)
"League of Legends_is1" = League of Legends
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Miranda IM" = Miranda IM 0.8.8
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Runic Games Torchlight" = Torchlight
"SystemRequirementsLab" = System Requirements Lab
"Taskbar Shuffle_is1" = Taskbar Shuffle version 2.5
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TreeSize Free_is1" = TreeSize Free V2.4
"Uninstall_is1" = Uninstall 1.0.0.1
"Unity" = Unity
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.1
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite_Wave3" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"InstallShield_{FDBBAF14-5ED8-49B7-A5BE-1C35668B074D}" = Unreal Tournament 3 (LG)
"UnityWebPlayer" = Unity Web Player
"Warcraft III" = Warcraft III: All Products
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

ist ja übel was da teilweise für alte Sachen noch aufgelistet werden, danke schonmal für die Nennung der Programme, OTL muss ich mir mal genauer anschauen, gerade das mit den vielen offenen Ports überrascht mich etwas, aber das eher am Rande OT.
Danke für die Hilfe, wünsche eine angenehme Nacht.

cosinus · 06.11.2010, 15:48

Zitat:

In einem Forum habe ich über diese Datei (ein Tool) etwas gelesen und mehrere Nutzer dieses Programms haben dort geschrieben, dass einige Virenscanner dieses Programm als Virus einstuften (z.B. Mc Afee).

Was für ein Tool genau ist das denn? Und aus welcher Quelle ist das Spiel?

gmx-Konto versendet mails -> Win32/Genetik trojan?

Plagegeister aller Art und deren Bekämpfung: gmx-Konto versendet mails -> Win32/Genetik trojan?