bitdefender.com & kaspersky.com nicht aufrufbar - GMER Log

$un · 23.11.2010, 17:17

Hallo,

ich bin bereits über die Suche auf mein Problem gestoßen,
ich habe einen neuen Thread, anhand gesonderter GMER Logdatei eröffnet.

Ich beziehe mich auf: http://www.trojaner-board.de/70740-k...t-updaten.html

Die Anleitung von john.doe leuchtet mir ein, deswegen hier das GMER
Log. Ich bitte um die richtigen Zeilen fürs Skript, gerne auch mit
Begründung. Ich habe mir die Logdatei selbst einmal angeschaut,
konnte die Zeilen daraus aber leider nicht selbst ableiten.

...Logdatei kommt gleich, habe direkt gescannt und gerade Einschränkungen entdeckt,
werde jetzt erst die Netwerkverbindung kappen und vorher noch neustarten...

-> Avenger geladen, wartet auf Eingabe

Vielen Dank im Vorraus!

$un

markusg · 23.11.2010, 17:36

bitte nur das GMER log

und dann weiter hiermit:
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten

$un · 23.11.2010, 17:40

So, GMER Log diesmal richtig:

GMER Logfile:

Code:

ATTFilter

GMER 1.0.14.14536 - hxxp://www.gmer.net
Rootkit scan 2010-11-23 17:36:49
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT     F7F55DFC                                                                   ZwCreateThread
SSDT     F7F55DE8                                                                   ZwOpenProcess
SSDT     F7F55DED                                                                   ZwOpenThread
SSDT     F7F55DF7                                                                   ZwTerminateProcess
SSDT     F7F55DF2                                                                   ZwWriteVirtualMemory

---- User code sections - GMER 1.0.14 ----

.text    C:\WINDOWS\System32\svchost.exe[1236] ntdll.dll!NtQueryInformationProcess  7C91E01B 5 Bytes  JMP 00D1ADCD 
.text    C:\WINDOWS\System32\svchost.exe[1236] NETAPI32.dll!NetpwPathCanonicalize   597DA101 5 Bytes  JMP 00D1AD64 
.text    C:\WINDOWS\System32\svchost.exe[1388] ntdll.dll!NtQueryInformationProcess  7C91E01B 5 Bytes  JMP 007CADCD 

---- Services - GMER 1.0.14 ----

Service  C:\WINDOWS\system32\svchost.exe (*** hidden *** )                          [AUTO] ilkij                                                                                                                                                                                                                                                                                                                                 <-- ROOTKIT !!!

---- Registry - GMER 1.0.14 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@DisplayName                   Installer Center
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@Type                          32
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@Start                         2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@ErrorControl                  0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@ImagePath                     %SystemRoot%\system32\svchost.exe -k netsvcs
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@ObjectName                    LocalSystem
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij@Description                   Erm?glicht einem Benutzer, automatische Vorg?nge auf diesem Computer zu konfigurieren und zu planen. Wenn dieser Dienst beendet wird, werden diese Vorg?nge nicht zu den geplanten Zeiten ausgef?hrt werden. Wenn dieser Dienst deaktiviert wird, werden alle von diesem Dienst explizit abh?ngigen Dienste nicht gestartet werden k?nnen.
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij\Parameters                    
Reg      HKLM\SYSTEM\CurrentControlSet\Services\ilkij\Parameters@ServiceDll         C:\WINDOWS\system32\coiemqx.dll
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@DisplayName                       Installer Center
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@Type                              32
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@Start                             2
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@ErrorControl                      0
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@ImagePath                         %SystemRoot%\system32\svchost.exe -k netsvcs
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@ObjectName                        LocalSystem
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij@Description                       Erm?glicht einem Benutzer, automatische Vorg?nge auf diesem Computer zu konfigurieren und zu planen. Wenn dieser Dienst beendet wird, werden diese Vorg?nge nicht zu den geplanten Zeiten ausgef?hrt werden. Wenn dieser Dienst deaktiviert wird, werden alle von diesem Dienst explizit abh?ngigen Dienste nicht gestartet werden k?nnen.
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij\Parameters                        
Reg      HKLM\SYSTEM\ControlSet003\Services\ilkij\Parameters@ServiceDll             C:\WINDOWS\system32\coiemqx.dll

---- EOF - GMER 1.0.14 ----

--- --- ---

OTL.txtOTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.11.2010 17:42:54 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
479,00 Mb Total Physical Memory | 77,00 Mb Available Physical Memory | 16,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 56,00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 8,90 Gb Free Space | 23,88% Space Free | Partition Type: NTFS
 
Computer Name: MAERCHENSTUNDE | User Name: Julia Madeleine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Programme\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\Teleca Shared\CapabilityManager.exe (Popwire AB)
PRC - C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe (Sony Ericsson Mobile Communications AB)
PRC - C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe (Teleca Software Solutions)
PRC - C:\WINDOWS\system32\bmwebcfg.exe (Bytemobile, Inc.)
PRC - C:\WINDOWS\system32\LXSUPMON.EXE (Lexmark International Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirScheduler) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel(R) -- C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (bmwebcfg) -- C:\WINDOWS\System32\bmwebcfg.exe (Bytemobile, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MEMSWEEP2) -- C:\WINDOWS\System32\4.tmp File not found
DRV - (gmer) -- C:\WINDOWS\system32\drivers\gmer.sys (GMER)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (ewusbnet) -- C:\WINDOWS\system32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbdev) -- C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (VIAudio) Vinyl AC'97 Audio Controller (WDM) -- C:\WINDOWS\system32\drivers\vinyl97.sys (VIA Technologies, Inc.)
DRV - (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM) -- C:\WINDOWS\system32\drivers\se27unic.sys (MCCI)
DRV - (SE27obex) -- C:\WINDOWS\system32\drivers\SE27obex.sys (MCCI)
DRV - (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS) -- C:\WINDOWS\system32\drivers\se27nd5.sys (MCCI)
DRV - (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\SE27mgmt.sys (MCCI)
DRV - (SE27mdm) -- C:\WINDOWS\system32\drivers\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) -- C:\WINDOWS\system32\drivers\SE27mdfl.sys (MCCI)
DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) -- C:\WINDOWS\system32\drivers\SE27bus.sys (MCCI)
DRV - (w810obex) -- C:\WINDOWS\system32\drivers\w810obex.sys (MCCI)
DRV - (w810mdm) -- C:\WINDOWS\system32\drivers\w810mdm.sys (MCCI)
DRV - (w810mdfl) -- C:\WINDOWS\system32\drivers\w810mdfl.sys (MCCI)
DRV - (w810bus) Sony Ericsson W810 Driver driver (WDM) -- C:\WINDOWS\system32\drivers\w810bus.sys (MCCI)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (cs429x) -- C:\WINDOWS\system32\drivers\cwawdm.sys (Cirrus Logic Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/?o=101764&l=dis
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1757981266-764733703-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..network.proxy.type: 4
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.11.23 16:24:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.11.23 16:24:28 | 000,000,000 | ---D | M]
 
[2010.08.31 11:48:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Extensions
[2010.11.23 16:40:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\extensions
[2008.02.14 13:37:30 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.01.24 19:18:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010.11.23 16:36:19 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-1.xml
[2008.03.27 14:14:34 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-2.xml
[2008.04.27 11:48:57 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-3.xml
[2009.01.07 20:42:22 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin-4.xml
[2008.02.14 13:36:33 | 000,000,962 | ---- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\searchplugins\icqplugin.xml
[2010.11.23 16:36:18 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2008.09.04 01:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npbittorrent.dll
[2010.10.27 06:24:34 | 000,001,538 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010.10.27 06:24:34 | 000,000,947 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010.10.27 06:24:34 | 000,000,769 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010.10.27 06:24:34 | 000,001,135 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-en-GB.xml
 
O1 HOSTS File: ([2001.08.23 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (ICQ Toolbar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O3 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll File not found
O3 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..\Toolbar\WebBrowser: (ICQ Toolbar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O4 - HKLM..\Run: [AudioDeck] C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe (VIA Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [High Defination Audio] C:\WINDOWS\HDaudio.exe File not found
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE (Lexmark International Inc.)
O4 - HKLM..\Run: [Sony Ericsson PC Suite] C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe (Sony Ericsson Mobile Communications AB)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-1757981266-764733703-854245398-1003..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Cisco Systems VPN Client.lnk = C:\Programme\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 -  File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 -  File not found
O15 - HKU\S-1-5-21-1757981266-764733703-854245398-1003\..Trusted Domains:   ([]msn in Arbeitsplatz)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.11.24 15:35:57 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\AutoPlay\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\AutoRun\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\Explore\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\Open\command - "" = G:\USBFlash.exe -- File not found
O33 - MountPoints2\{05011080-ef05-11dc-9feb-000e359d1eb5}\Shell\Scan\command - "" = G:\
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{1819d5e0-3a97-11df-a3cb-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{1865e810-6650-11df-a3fa-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{1865e810-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1865e810-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{1865e814-6650-11df-a3fa-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{1865e814-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1865e814-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{1865e818-6650-11df-a3fa-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{1865e818-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1865e818-6650-11df-a3fa-000e359d1eb5}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{2e8db1a0-5900-11dd-a0c8-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{2e8db1a0-5900-11dd-a0c8-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{529e0010-01a1-11dd-a00e-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{570db990-fb5c-11dc-9ff8-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{87941590-e947-11dd-a1b1-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{959094b0-d9b6-11de-a341-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{959094b0-d9b6-11de-a341-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\AutoPlay\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\AutoRun\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\Explore\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\Open\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\{bcc77b30-6a12-11dd-a0ef-000e359d1eb5}\Shell\Scan\command - "" = F:\
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{cc2c5fb0-6032-11de-a285-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{cf5f6360-c790-11dc-9f9d-000e359d1eb5}\Shell\AutoRun\command - "" = gabptk6d.bat
O33 - MountPoints2\{cf5f6360-c790-11dc-9f9d-000e359d1eb5}\Shell\explore\Command - "" = gabptk6d.bat
O33 - MountPoints2\{cf5f6360-c790-11dc-9f9d-000e359d1eb5}\Shell\open\Command - "" = gabptk6d.bat
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{d5f76960-a4ad-11dc-9f39-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{d5f76961-a4ad-11dc-9f39-000e359d1eb5}\Shell - "" = AutoRun
O33 - MountPoints2\{d5f76961-a4ad-11dc-9f39-000e359d1eb5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dafb5850-6b9e-11de-a297-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{dcda24a0-cc73-11dd-a18a-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\AutoPlay\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\AutoRun\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\Explore\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\Open\command - "" = E:\USBFlash.exe -- File not found
O33 - MountPoints2\{fc98cf10-a46d-11df-a45c-000e359d1eb5}\Shell\Scan\command - "" = E:\
O33 - MountPoints2\F\Shell\AutoPlay\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\Explore\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\Open\command - "" = F:\USBFlash.exe -- File not found
O33 - MountPoints2\F\Shell\Scan\command - "" = F:\
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: ilkij - C:\WINDOWS\System32\coiemqx.dll File not found
 
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OneNote 2007 Screen Clipper and Launcher.lnk - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE - (Microsoft Corporation)
MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OpenOffice.org 2.3.lnk - C:\Programme\OpenOffice.org 2.3\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe Photo Downloader - hkey= - key= - C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Programme\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: Load - hkey= - key= - Reg Error: Value error. File not found
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Programme\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8D1D0E9A-C799-4D28-9E29-0061D1E66E43} - Microsoft .NET Framework 1.1 Hotfix (KB928366)
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player 9 ActiveX
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619756233228288)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.23 16:55:08 | 000,085,969 | ---- | C] (GMER) -- C:\WINDOWS\System32\drivers\gmer.sys
[2010.11.23 15:45:00 | 000,957,288 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Julia Madeleine\Desktop\Q815485_WXP_SP2_x86_DEU.exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.23 17:24:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.11.23 16:55:08 | 000,085,969 | ---- | M] (GMER) -- C:\WINDOWS\System32\drivers\gmer.sys
[2010.11.23 16:55:08 | 000,000,080 | ---- | M] () -- C:\WINDOWS\gmer_uninstall.cmd
[2010.11.23 16:55:07 | 000,884,736 | ---- | M] () -- C:\WINDOWS\gmer.dll
[2010.11.23 16:55:01 | 000,811,008 | ---- | M] () -- C:\WINDOWS\gmer.exe
[2010.11.23 16:24:39 | 000,001,566 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.11.23 16:17:28 | 000,075,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010.11.23 15:45:01 | 000,957,288 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Julia Madeleine\Desktop\Q815485_WXP_SP2_x86_DEU.exe
[2010.11.23 14:41:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.11.19 18:02:17 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.10.31 08:26:00 | 000,394,478 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.10.31 08:26:00 | 000,383,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.10.31 08:26:00 | 000,064,820 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.10.31 08:26:00 | 000,053,942 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.11.23 16:55:08 | 000,000,080 | ---- | C] () -- C:\WINDOWS\gmer_uninstall.cmd
[2010.11.23 16:55:07 | 000,884,736 | ---- | C] () -- C:\WINDOWS\gmer.dll
[2010.11.23 16:55:07 | 000,811,008 | ---- | C] () -- C:\WINDOWS\gmer.exe
[2010.11.23 16:24:39 | 000,001,566 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2008.05.22 21:37:19 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2008.04.13 14:32:14 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\lxazlcnp.dll
[2007.11.27 20:59:25 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.11.26 16:51:29 | 000,029,744 | ---- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2007.11.26 16:50:39 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007.11.26 16:50:37 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2007.11.26 16:10:31 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2007.11.26 16:05:27 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2007.11.26 14:23:42 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2007.11.26 12:49:31 | 000,115,200 | ---- | C] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.11.26 12:32:59 | 000,000,148 | ---- | C] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007.11.24 17:04:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2007.11.24 15:27:09 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001.12.03 14:48:36 | 000,503,808 | R--- | C] () -- C:\WINDOWS\System32\lt_xtrans.dll
[2001.12.03 14:48:36 | 000,286,720 | R--- | C] () -- C:\WINDOWS\System32\MrSIDD.dll
[2001.12.03 14:48:36 | 000,163,840 | R--- | C] () -- C:\WINDOWS\System32\lt_common.dll
[2001.12.03 14:48:36 | 000,126,976 | R--- | C] () -- C:\WINDOWS\System32\lt_trans.dll
[2001.12.03 14:48:36 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\lt_meta.dll
[2001.12.03 14:48:36 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\lt_encrypt.dll
[2001.12.03 14:48:36 | 000,020,480 | R--- | C] () -- C:\WINDOWS\System32\lt_messagetext.dll
[2001.12.03 14:48:32 | 000,006,688 | R--- | C] () -- C:\WINDOWS\System32\Digita.sys
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportUSB.dll
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportSerial.dll
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrDA.dll
[2001.12.03 14:48:30 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\TransportIrCOMM.dll
 
========== LOP Check ==========
 
[2007.11.24 16:04:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ACD Systems
[2007.11.26 15:10:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\adisoft AG
[2007.11.26 12:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
[2007.12.09 14:51:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ACD Systems
[2010.02.24 06:18:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\BitTorrent
[2010.11.23 16:32:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\DNA
[2008.02.12 20:17:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ
[2009.01.06 22:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ Toolbar
[2007.12.09 15:27:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Leadertech
[2007.11.26 12:24:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Teleca
[2007.11.26 15:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Bytemobile
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.10.15 18:03:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\.clamwin
[2007.12.09 14:51:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ACD Systems
[2007.11.26 12:29:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Adobe
[2007.11.24 19:08:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\AdobeUM
[2009.03.27 15:11:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Ahead
[2008.08.14 16:16:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Apple Computer
[2010.02.24 06:18:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\BitTorrent
[2010.11.23 16:32:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\DNA
[2010.11.12 22:08:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\dvdcss
[2007.12.02 01:47:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Google
[2007.12.05 23:43:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Help
[2008.02.12 20:17:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ
[2009.01.06 22:54:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\ICQ Toolbar
[2007.11.24 15:41:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Identities
[2008.02.12 20:12:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\InstallShield
[2007.11.24 17:14:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Intel
[2007.12.09 15:27:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Leadertech
[2007.12.01 20:24:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Macromedia
[2010.05.23 10:55:48 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft
[2010.11.23 16:23:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla
[2007.11.24 19:08:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\MSN6
[2009.05.05 20:11:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\OpenOffice.org2
[2007.11.26 12:24:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Sony Ericsson
[2007.12.11 16:19:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Sun
[2007.11.26 12:24:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Teleca
[2007.11.26 16:27:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\vlc
[2007.11.26 16:29:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2007.11.24 16:04:22 | 000,053,248 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\ACDSee_Dsktp_Shtcut.exe
[2007.11.24 16:04:22 | 000,053,248 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\ACDSee_PM_Shtcut.exe
[2007.11.24 16:04:22 | 002,592,768 | R--- | M] (ACD Systems, Ltd.) -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\ARPPRODUCTICON.exe
[2007.11.24 16:04:22 | 000,012,062 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\FotoCanvasLite_Dsktp_Shtcut.exe
[2007.11.24 16:04:22 | 000,012,062 | R--- | M] () -- C:\Dokumente und Einstellungen\Julia Madeleine\Anwendungsdaten\Microsoft\Installer\{24561814-4815-4387-AC59-05DDEC5AF013}\FotoCanvasLite_PM_Shtcut.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2004.08.03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2002.08.29 03:52:58 | 010,180,476 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2002.08.29 01:27:50 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll
[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll
[2002.08.29 03:43:22 | 000,049,152 | ---- | M] (Microsoft Corporation) MD5=B9358A1FB66CF656328FD8B792B2CCC4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2002.08.29 03:43:36 | 001,007,104 | ---- | M] (Microsoft Corporation) MD5=22B0A56E6C5847292437078B484EC61B -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\explorer.exe
[2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\explorer.exe
[2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\system32\dllcache\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll
[2002.08.29 03:43:26 | 000,399,360 | ---- | M] (Microsoft Corporation) MD5=BCA549B21E651111CE7BAD0FC8C45F4B -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004.08.04 00:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2004.08.04 00:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\system32\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll
[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll
[2002.08.29 03:43:30 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=ADD49C10F5DADFA81912D124FE1C9A99 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\dllcache\user32.dll
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\user32.dll
[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll
[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2007.03.08 16:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll
[2002.08.29 03:43:32 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=E3DAFFDB1C86C1AEAC1B205F6CF67009 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe
[2002.08.29 03:43:42 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=BEBD3F08461F9A88E5ABCE0CB9707000 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe
[2002.08.29 03:43:42 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2001.08.23 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2007.11.24 16:25:15 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2007.11.24 16:25:15 | 000,630,784 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2007.11.24 16:25:15 | 000,401,408 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >

--- --- ---

Extras.txtOTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 23.11.2010 17:42:54 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Dokumente und Einstellungen\Julia Madeleine\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
479,00 Mb Total Physical Memory | 77,00 Mb Available Physical Memory | 16,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 56,00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 8,90 Gb Free Space | 23,88% Space Free | Partition Type: NTFS
 
Computer Name: MAERCHENSTUNDE | User Name: Julia Madeleine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
":TCP" = :TCP:*:Enabled:Explorer
"9357:TCP" = 9357:TCP:*:Enabled:daxekgk
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Programme\BitTorrent\bittorrent.exe" = C:\Programme\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\WINDOWS\HDaudio.exe" = C:\WINDOWS\HDaudio.exe:*:Enabled:Explorer -- File not found
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{24561814-4815-4387-AC59-05DDEC5AF013}" = ACDSee 4.0.1 Standard
"{29FB1084-25B5-4F29-9BC0-16BBB6ECB52B}" = OpenOffice.org 2.3
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35B91753-5789-4517-9CF1-2CCE3A8CF4F1}" = Apple Mobile Device Support
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{52809086-618D-4F0B-8BF1-B75A5BB817A4}" = Sony Ericsson PC Suite
"{5624C000-B109-11D4-9DB4-00E0290FCAC5}" = VPN Client
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EF6C4600-306D-4F6A-A119-C2A877D25B4A}" = iTunes
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FFAB5ABB-8AAB-42E2-847F-1743E51E01E9}" = Disc2Phone
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"Ask Toolbar_is1" = Ask Toolbar
"Connection Manager" = Connection Manager deinstallieren
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Lexmark Supplies Monitor" = Lexmark Supplies Monitor
"Lexmark Z45" = Lexmark Z45
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"ProInst" = Intel(R) PROSet/Wireless Software
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"VLC media player" = VideoLAN VLC media player 0.8.6c
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR
"WinZip" = WinZip
"XTTB00001.XTTB00001Toolbar" = ICQ Toolbar
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1757981266-764733703-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 22.11.2009 11:10:32 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.3156, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 06.02.2010 16:08:31 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung wmplayer.exe, Version 9.0.0.3250, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 10.08.2010 05:08:04 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung HDaudio.exe, Version 4.1.0.24, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 04.09.2010 08:58:47 | Computer Name = MAERCHENSTUNDE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.3156, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 04.09.2010 09:02:44 | Computer Name = MAERCHENSTUNDE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung capabilitymanager.exe, Version 1.2.0.70,
 fehlgeschlagenes Modul wininet.dll, Version 6.0.2900.3462, Fehleradresse 0x00003670.
 
Error - 04.09.2010 12:06:37 | Computer Name = MAERCHENSTUNDE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung drwtsn32.exe, Version 5.1.2600.0, fehlgeschlagenes
 Modul dbghelp.dll, Version 5.1.2600.2180, Fehleradresse 0x0001295d.
 
Error - 25.10.2010 09:17:35 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung HDaudio.exe, Version 4.1.0.24, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 25.10.2010 09:18:19 | Computer Name = MAERCHENSTUNDE | Source = Microsoft Office 12 | ID = 5000
Description = EventType officelifeboathang, P1 winword.exe, P2 12.0.4518.1014, P3
 ntdll.dll, P4 5.1.2600.2180, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 NIL, P10 NIL.
 
Error - 25.10.2010 09:18:39 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 12.0.4518.1014, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 25.10.2010 09:19:23 | Computer Name = MAERCHENSTUNDE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 12.0.4518.1014, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ OSession Events ]
Error - 01.01.2008 20:41:15 | Computer Name = MAERCHENSTUNDE | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session 
lasted 8112 seconds with 7920 seconds of active time.  This session ended with a
 crash.
 
[ System Events ]
Error - 23.11.2010 10:15:05 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 31012
Description = Es ist ein Fehler bei der Übertragung der lokalen Liste der  Namensauflösungsserver
 zum DNS-Proxy-Agenten aufgetreten.  Einige DNS- oder WINS-Server sind für Clients
 des lokalen Netzwerks nicht erreichbar.  Die Daten enthalten den Fehlercode.
 
Error - 23.11.2010 10:15:12 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.20 deaktiviert, 
da  die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt,  von der 
die Adressen DHCP-Clients zu gewiesen werden. Ändern  Sie den Bereich, sodass die 
IP-Adresse mit einbezogen wird,  oder ändern Sie die IP-Adresse, sodass sie innerhalb
 dieses  Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
 
Error - 23.11.2010 10:15:29 | Computer Name = MAERCHENSTUNDE | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
 Peer  "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
 Minuten  wiederholt.  Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
 (0x80072751)
 
Error - 23.11.2010 10:15:29 | Computer Name = MAERCHENSTUNDE | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
 Zeitquellen  konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb  der
 nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung  mit der Quelle
 herzustellen.  Der NtpClient verfügt über keine Quelle mit genauer Zeit.
 
Error - 23.11.2010 10:42:40 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.55 deaktiviert, 
da  die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt,  von der 
die Adressen DHCP-Clients zu gewiesen werden. Ändern  Sie den Bereich, sodass die 
IP-Adresse mit einbezogen wird,  oder ändern Sie die IP-Adresse, sodass sie innerhalb
 dieses  Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
 
Error - 23.11.2010 11:11:42 | Computer Name = MAERCHENSTUNDE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Installer Center" wurde mit folgendem Fehler beendet: 
  %%1114
 
Error - 23.11.2010 11:12:01 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.55 deaktiviert, 
da  die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt,  von der 
die Adressen DHCP-Clients zu gewiesen werden. Ändern  Sie den Bereich, sodass die 
IP-Adresse mit einbezogen wird,  oder ändern Sie die IP-Adresse, sodass sie innerhalb
 dieses  Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
 
Error - 23.11.2010 11:40:23 | Computer Name = MAERCHENSTUNDE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst AntiVirScheduler.
 
Error - 23.11.2010 12:24:57 | Computer Name = MAERCHENSTUNDE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Installer Center" wurde mit folgendem Fehler beendet: 
  %%1114
 
Error - 23.11.2010 12:37:41 | Computer Name = MAERCHENSTUNDE | Source = ipnathlp | ID = 30013
Description = Die DHCP-Zuweisung wurde für IP-Adresse 192.168.1.55 deaktiviert, 
da  die IP-Adresse außerhalb des Bereichs 192.168.0.0/255.255.255.0 liegt,  von der 
die Adressen DHCP-Clients zu gewiesen werden. Ändern  Sie den Bereich, sodass die 
IP-Adresse mit einbezogen wird,  oder ändern Sie die IP-Adresse, sodass sie innerhalb
 dieses  Bereichs liegt, um die DHCP-Zuweisung zu aktivieren.
 
 
< End of report >

--- --- ---

markusg · 23.11.2010, 17:46

ok da ist nen rootkit.
das killen wir dann :-) aber erst verschaffen wir uns nen überblick mit otl.

$un · 23.11.2010, 17:58

Alle 3 Logs weiter oben!
Danke!

markusg · 23.11.2010, 18:20

avira 8, aktuell wäre avira 10... kommt später.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

$un · 23.11.2010, 19:19

Super danke für die weiteren Schritte, es ist ein Laptop einer Freundin,
ich komme da wohl erst morgen per Teamviewer wieder ran.
Dann folgen weitere Infos.

Die massive Verseuchung des PCs bezieht sich leider auch auf ein USB Stick, der auf Grund sensibler
Daten nicht formatiert werden kann, als auch auf eine externe Festplatte.
Eine Infektion erfolgt beim Anschließen, ich habe ihr nahegelegt, USB-Stick, als auch Festplatte erstmal
nicht zu benutzen. So dass ich den Lap mit eurer Hilfe sauber bekomme.

Allerdings bin ich mir über weitere Schritte unklar. Wie gehe ich bei der Desinfizierung von Stick und externer
Platte am Besten vor?

Edit: Gerne auch auf "Fachchinesisch", ich melde mich zu Wort, wenn ich etwas nicht verstehen sollte ; )

markusg · 23.11.2010, 19:26

wir werden einfach die autorun funktion deaktivieren, befor das nächste mal angeschlossen wird. dann sollte ne neuinfektion verhindert werden.
bzw kann sie auch beim combofix durchlauf mal die beiden anschließen dann bereinigen wir sie mit.

$un · 24.11.2010, 12:29

Ok, ich habe Autoplay deaktiviert, anhand:
hxxp://www.wintotal.de/tipparchiv/?id=548

Da es ein XP Rechner ist habe ich über gpedit.msc Autoplay deaktiviert,
damit deaktiviert man laut der Aussage auf der obigen Seite auch Autorun.
Habe Gott sei dank noch per regedit in den Schlüssel geschaut.
Dort war es noch an, also habe ich das DWORD manuell von Hex 91 auf ff
geändert, was laut Anleitung das Autoplay für alles ausstellt.

USB Stick angesteckt, nichts ist passiert, Platte angeschlossen, Antivir schlug
an, weil die Platte seither nicht angeschlossen war, autorun.inf ab in die Quarantäne.

Combofix tut abgearbeitet...

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-11-23.04 - Julia Madeleine 24.11.2010  11:53:15.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.479.257 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Julia Madeleine\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\Julia Madeleine\Anwendungsdaten\ACD Systems\ACDSee\ImageDB.ddf
c:\programme\AskSearch\bin\DefaultSearch.dll
c:\windows\autorun.inf
c:\windows\par.txt

.
(((((((((((((((((((((((   Dateien erstellt von 2010-10-24 bis 2010-11-24  ))))))))))))))))))))))))))))))
.

2010-11-24 10:23 . 2010-11-24 10:23	--------	d--h--w-	c:\windows\system32\GroupPolicy
2010-11-24 08:36 . 2010-11-24 08:40	--------	d-----w-	c:\windows\LastGood
2010-11-23 17:02 . 2010-11-24 10:14	--------	d-----w-	c:\dokumente und einstellungen\Julia Madeleine\Anwendungsdaten\TeamViewer
2010-11-23 15:55 . 2010-11-23 15:55	300544	----a-w-	c:\programme\Mozilla Firefox\Tralala.dll
2010-11-23 15:24 . 2010-10-27 06:13	25048	----a-w-	c:\programme\Mozilla Firefox\components\browserdirprovider.dll
2010-11-23 15:24 . 2010-10-27 06:13	140248	----a-w-	c:\programme\Mozilla Firefox\components\brwsrcmp.dll
2010-11-23 15:24 . 2010-10-27 06:13	89048	----a-w-	c:\programme\Mozilla Firefox\nssutil3.dll
2010-11-23 15:24 . 2010-10-27 06:13	492504	----a-w-	c:\programme\Mozilla Firefox\sqlite3.dll
2010-11-23 15:24 . 2010-10-27 06:13	16856	----a-w-	c:\programme\Mozilla Firefox\plugin-container.exe
2010-11-23 15:24 . 2010-10-27 06:13	11744216	----a-w-	c:\programme\Mozilla Firefox\xul.dll
2010-11-23 15:24 . 2010-10-27 04:49	98304	----a-w-	c:\programme\Mozilla Firefox\nssdbm3.dll
2010-11-23 15:24 . 2010-10-27 06:13	719832	----a-w-	c:\programme\Mozilla Firefox\mozcrt19.dll
2010-11-23 15:24 . 2010-10-27 06:13	719832	----a-w-	c:\programme\Mozilla Firefox\mozcpp19.dll
2010-11-23 15:24 . 2010-10-27 06:13	107480	----a-w-	c:\programme\Mozilla Firefox\crashreporter.exe

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-23 15:17 . 2008-09-04 17:12	75096	----a-w-	c:\windows\system32\drivers\avipbb.sys
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-11 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\programme\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\programme\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"Sony Ericsson PC Suite"="c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"AudioDeck"="c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 528384]
"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2002-02-04 886272]
"avgnt"="c:\programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Cisco Systems VPN Client.lnk - c:\programme\Cisco Systems\VPN Client\vpngui.exe [2007-11-26 1537064]

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OneNote 2007 Screen Clipper and Launcher.lnk]

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OpenOffice.org 2.3.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-23 19:33	57344	----a-w-	c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16	39792	----a-w-	c:\programme\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2008-07-10 07:47	116040	----a-w-	c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-07-10 08:51	289064	----a-w-	c:\programme\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50	155648	----a-w-	c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-05-27 08:50	413696	----a-w-	c:\programme\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-12-11 16:00	68856	----a-w-	c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\ICQ6\\ICQ.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Programme\\BitTorrent\\bittorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
":TCP"= :TCP:Explorer
"9357:TCP"= 9357:TCP:daxekgk

S2 ilkij;Installer Center;c:\windows\system32\svchost.exe -k netsvcs [23.08.2001 13:00 14336]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [23.05.2010 10:48 114432]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [23.05.2010 10:48 100736]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4.tmp --> c:\windows\system32\4.tmp [?]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ilkij
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.ask.com/?o=101764&l=dis
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\programme\Mozilla Firefox\plugins\npbittorrent.dll

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\programme\AskBarDis\bar\bin\askBar.dll
HKLM-Run-High Defination Audio - c:\windows\HDaudio.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-11-24 11:59
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  AudioDeck = c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe 1???????????????????????????????????????????? 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\4.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB938464]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB938464)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB938464$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=938464"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB938464"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB946648]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB946648)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB946648$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=946648"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB946648"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB950974]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB950974)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB950974$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=950974"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB950974"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951066]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB951066)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951066$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951066"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951066"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951072-v2]
@DACL=(02 0000)
"DisplayName"="Update für Windows XP (KB951072-v2)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951072-v2$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951072"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="2"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951072-v2"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951376-v2]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB951376-v2)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951376-v2$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951376"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="2"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951376-v2"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951748]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB951748)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951748$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090124"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951748"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951748"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB952069_WM9]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows Media Player (KB952069)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB952069_WM9$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com/?kbid=952069"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayIcon"=expand:"\"%ProgramFiles%\\windows media player\\wmplayer.exe\""
"ParentKeyName"="OperatingSystem"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB952287]
@DACL=(02 0000)
"DisplayName"="Hotfix für Windows XP (KB952287)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB952287$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=952287"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Hotfix"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB952287"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB952954]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB952954)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB952954$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=952954"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB952954"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB954211]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB954211)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB954211$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=954211"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB954211"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB954600]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB954600)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB954600$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=954600"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB954600"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB955069]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB955069)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB955069$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=955069"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB955069"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB955839]
@DACL=(02 0000)
"DisplayName"="Update für Windows XP (KB955839)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB955839$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=955839"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB955839"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956390]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956390)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956390$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956390"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956390"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956391]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956391)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956391$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956391"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956391"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956802]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956802)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956802$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956802"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956802"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956803]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956803)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956803$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956803"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956803"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956841]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956841)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956841$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956841"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956841"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB957095]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB957095)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB957095$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=957095"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB957095"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB957097]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB957097)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB957097$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=957097"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB957097"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB958215]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB958215)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB958215$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=958215"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB958215"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB958644]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB958644)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB958644$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=958644"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB958644"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB958687]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB958687)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB958687$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090124"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=958687"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB958687"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB960714]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB960714)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB960714$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=960714"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB960714"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1212)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'lsass.exe'(1268)
c:\windows\system32\bmnet.dll
.
Zeit der Fertigstellung: 2010-11-24  12:01:27
ComboFix-quarantined-files.txt  2010-11-24 11:01

Vor Suchlauf: 8.946.089.984 Bytes frei
Nach Suchlauf: 9.858.338.816 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - E1344E387440AB2CE8BCAAF649AE307E

--- --- ---

Hat Combofix auch die angeschlossenen Datenträger gescannt?

EDIT: Antivir 10 installiert - XP_SP2_UpdatePack von winfuture gezogen und installiert

Grüße

markusg · 24.11.2010, 13:08

Start programme zubehör editor, kopiere folgendes ein.

Killall::
Rootkit::
Driver::
ilkij
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9357:TCP"=-
":TCP"=-
Netsvc::
ilkij

datei speichern unter, ort, dort wo sich combofix befindet, typ alle dateien, name
cfscript.txt

ziehe cfscript auf combofix, programm startet, log posten.

$un · 24.11.2010, 18:48

Ok erledigt.

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-11-23.04 - Julia Madeleine 24.11.2010  18:27:10.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.479.226 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Julia Madeleine\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Julia Madeleine\Desktop\cfscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ILKIJ
-------\Service_ilkij


(((((((((((((((((((((((   Dateien erstellt von 2010-10-24 bis 2010-11-24  ))))))))))))))))))))))))))))))
.

2010-11-24 15:33 . 2010-11-24 15:33	--------	d-----w-	c:\dokumente und einstellungen\Julia Madeleine\Lokale Einstellungen\Anwendungsdaten\PCHealth
2010-11-24 15:30 . 2010-11-24 15:30	--------	d-sh--w-	c:\dokumente und einstellungen\NetworkService\IETldCache
2010-11-24 15:10 . 2010-06-14 14:30	743936	-c----w-	c:\windows\system32\dllcache\helpsvc.exe
2010-11-24 15:08 . 2010-04-20 05:46	285696	-c----w-	c:\windows\system32\dllcache\atmfd.dll
2010-11-24 15:06 . 2010-03-05 14:54	65536	-c----w-	c:\windows\system32\dllcache\asycfilt.dll
2010-11-24 14:59 . 2010-03-05 18:59	465920	-c----w-	c:\windows\system32\dllcache\smtpsvc.dll
2010-11-24 14:54 . 2010-01-13 14:08	86016	-c----w-	c:\windows\system32\dllcache\cabview.dll
2010-11-24 14:53 . 2009-12-24 07:05	177664	-c----w-	c:\windows\system32\dllcache\wintrust.dll
2010-11-24 14:51 . 2009-10-23 14:27	3555328	-c----w-	c:\windows\system32\dllcache\moviemk.exe
2010-11-24 14:50 . 2009-11-27 17:33	17920	-c----w-	c:\windows\system32\dllcache\msyuv.dll
2010-11-24 14:49 . 2009-11-27 16:37	8704	-c----w-	c:\windows\system32\dllcache\tsbyuv.dll
2010-11-24 14:49 . 2009-11-27 16:37	85504	-c----w-	c:\windows\system32\dllcache\avifil32.dll
2010-11-24 14:49 . 2009-11-27 16:37	48128	-c----w-	c:\windows\system32\dllcache\iyuv_32.dll
2010-11-24 14:49 . 2009-11-27 16:37	11264	-c----w-	c:\windows\system32\dllcache\msrle32.dll
2010-11-24 14:47 . 2009-12-14 07:35	33280	-c----w-	c:\windows\system32\dllcache\csrsrv.dll
2010-11-24 14:46 . 2009-12-17 07:57	346624	-c----w-	c:\windows\system32\dllcache\mspaint.exe
2010-11-24 14:45 . 2009-10-15 20:50	119808	-c----w-	c:\windows\system32\dllcache\t2embed.dll
2010-11-24 14:43 . 2009-10-12 13:51	69632	-c----w-	c:\windows\system32\dllcache\raschap.dll
2010-11-24 14:43 . 2009-10-12 13:51	113152	-c----w-	c:\windows\system32\dllcache\rastls.dll
2010-11-24 14:42 . 2009-10-13 10:44	271360	-c----w-	c:\windows\system32\dllcache\oakley.dll
2010-11-24 14:39 . 2009-09-11 14:31	133632	-c----w-	c:\windows\system32\dllcache\msv1_0.dll
2010-11-24 14:38 . 2009-09-04 20:45	58880	-c----w-	c:\windows\system32\dllcache\msasn1.dll
2010-11-24 14:37 . 2009-09-06 07:20	126976	-c----w-	c:\windows\system32\dllcache\ftpsvc2.dll
2010-11-24 14:34 . 2009-06-21 22:05	153088	-c----w-	c:\windows\system32\dllcache\triedit.dll
2010-11-24 14:31 . 2009-06-05 07:42	655872	-c----w-	c:\windows\system32\dllcache\mstscax.dll
2010-11-24 14:30 . 2009-06-15 11:27	82944	-c----w-	c:\windows\system32\dllcache\tlntsess.exe
2010-11-24 14:30 . 2009-06-15 11:26	78848	-c----w-	c:\windows\system32\dllcache\telnet.exe
2010-11-24 14:28 . 2009-06-25 18:34	225280	-c----w-	c:\windows\system32\dllcache\mqoa.dll
2010-11-24 14:28 . 2009-06-25 18:34	123392	-c----w-	c:\windows\system32\dllcache\mqrtdep.dll
2010-11-24 14:28 . 2009-06-25 18:34	517120	-c----w-	c:\windows\system32\dllcache\mqsnap.dll
2010-11-24 14:28 . 2009-06-25 18:34	169472	-c----w-	c:\windows\system32\dllcache\msmqocm.dll
2010-11-24 14:28 . 2009-06-22 11:49	19968	-c----w-	c:\windows\system32\dllcache\mqbkup.exe
2010-11-24 14:28 . 2009-06-22 11:49	117248	-c----w-	c:\windows\system32\dllcache\mqtgsvc.exe
2010-11-24 14:28 . 2009-06-22 11:49	4608	-c----w-	c:\windows\system32\dllcache\mqsvc.exe
2010-11-24 14:28 . 2009-06-25 18:34	186880	-c----w-	c:\windows\system32\dllcache\mqtrig.dll
2010-11-24 14:27 . 2009-08-05 09:05	206336	-c----w-	c:\windows\system32\dllcache\mswebdvd.dll
2010-11-24 14:25 . 2009-07-17 18:56	58880	-c----w-	c:\windows\system32\dllcache\atl.dll
2010-11-24 14:25 . 2009-07-13 21:43	286208	-c----w-	c:\windows\system32\dllcache\wmpdxm.dll
2010-11-24 14:25 . 2009-07-13 21:43	10841088	-c----w-	c:\windows\system32\dllcache\wmp.dll
2010-11-24 14:23 . 2009-05-07 15:42	346624	-c----w-	c:\windows\system32\dllcache\localspl.dll
2010-11-24 14:22 . 2009-05-21 18:19	268288	-c----w-	c:\windows\system32\dllcache\httpext.dll
2010-11-24 14:22 . 2009-02-03 19:52	56320	-c----w-	c:\windows\system32\dllcache\secur32.dll
2010-11-24 14:21 . 2008-12-16 12:47	351232	-c----w-	c:\windows\system32\dllcache\winhttp.dll
2010-11-24 14:19 . 2009-03-06 13:59	286720	-c----w-	c:\windows\system32\dllcache\pdh.dll
2010-11-24 14:19 . 2009-02-10 16:31	453120	-c----w-	c:\windows\system32\dllcache\wmiprvsd.dll
2010-11-24 14:19 . 2009-02-09 10:00	401408	-c----w-	c:\windows\system32\dllcache\rpcss.dll
2010-11-24 14:19 . 2009-02-09 09:48	111104	-c----w-	c:\windows\system32\dllcache\services.exe
2010-11-24 14:19 . 2009-02-06 09:41	227840	-c----w-	c:\windows\system32\dllcache\wmiprvse.exe
2010-11-24 14:19 . 2009-02-09 10:00	740864	-c----w-	c:\windows\system32\dllcache\ntdll.dll
2010-11-24 14:19 . 2009-02-09 10:00	678912	-c----w-	c:\windows\system32\dllcache\advapi32.dll
2010-11-24 14:19 . 2009-02-09 10:00	473088	-c----w-	c:\windows\system32\dllcache\fastprox.dll
2010-11-24 14:19 . 2005-07-26 04:29	60416	-c----w-	c:\windows\system32\dllcache\colbact.dll
2010-11-24 14:18 . 2008-06-12 13:47	956928	-c----w-	c:\windows\system32\dllcache\msdtctm.dll
2010-11-24 14:18 . 2008-06-12 13:47	91648	-c----w-	c:\windows\system32\dllcache\mtxoci.dll
2010-11-24 14:18 . 2008-06-12 13:47	66560	-c----w-	c:\windows\system32\dllcache\mtxclu.dll
2010-11-24 14:18 . 2008-06-12 13:47	161792	-c----w-	c:\windows\system32\dllcache\msdtcuiu.dll
2010-11-24 14:18 . 2008-06-12 13:47	58880	-c----w-	c:\windows\system32\dllcache\msdtclog.dll
2010-11-24 14:18 . 2008-06-12 13:47	428032	-c----w-	c:\windows\system32\dllcache\msdtcprx.dll
2010-11-24 14:17 . 2008-04-21 21:25	217600	-c----w-	c:\windows\system32\dllcache\wordpad.exe
2010-11-24 14:15 . 2008-08-28 08:00	74752	-c----w-	c:\windows\system32\dllcache\msw3prt.dll
2010-11-24 14:15 . 2008-08-28 08:00	104448	-c----w-	c:\windows\system32\dllcache\win32spl.dll
2010-11-24 14:11 . 2010-11-24 14:11	--------	d-----w-	c:\programme\Windows Media Connect 2
2010-11-24 14:09 . 2010-11-24 14:09	--------	d-----w-	c:\windows\system32\drivers\umdf
2010-11-24 14:03 . 2010-11-24 14:03	--------	d-sh--w-	c:\dokumente und einstellungen\Julia Madeleine\IETldCache
2010-11-24 13:54 . 2010-11-24 13:57	--------	dc-h--w-	c:\windows\ie8
2010-11-24 13:54 . 2010-11-24 13:56	--------	d-----w-	c:\windows\system32\de-DE
2010-11-24 13:22 . 2010-05-06 10:31	599040	-c----w-	c:\windows\system32\dllcache\msfeeds.dll
2010-11-24 13:22 . 2010-05-06 10:31	55296	-c----w-	c:\windows\system32\dllcache\msfeedsbs.dll
2010-11-24 13:21 . 2010-05-06 10:31	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2010-11-24 13:21 . 2010-05-06 10:31	247808	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2010-11-24 13:21 . 2010-05-06 10:31	743424	-c----w-	c:\windows\system32\dllcache\iedvtool.dll
2010-11-24 13:21 . 2010-05-06 10:31	1985536	-c----w-	c:\windows\system32\dllcache\iertutil.dll
2010-11-24 13:21 . 2010-05-06 10:31	11076096	-c----w-	c:\windows\system32\dllcache\ieframe.dll
2010-11-24 13:20 . 2006-12-03 23:34	27648	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-11-24 13:20 . 2006-12-03 23:34	14048	------w-	c:\windows\system32\spmsg2.dll
2010-11-24 13:19 . 2006-12-03 23:34	1698048	-c----w-	c:\windows\system32\dllcache\XpsSvcs.dll
2010-11-24 13:19 . 2006-12-03 23:34	1698048	------w-	c:\windows\system32\XpsSvcs.dll
2010-11-24 13:19 . 2006-12-03 23:34	580352	-c----w-	c:\windows\system32\dllcache\XPSSHHDR.dll
2010-11-24 13:19 . 2006-12-03 23:34	580352	------w-	c:\windows\system32\XPSSHHDR.dll
2010-11-24 13:19 . 2006-12-03 23:34	671744	-c----w-	c:\windows\system32\dllcache\PrintFilterPipelineSvc.exe
2010-11-24 13:19 . 2006-12-03 23:34	671744	------w-	c:\windows\system32\Spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe
2010-11-24 13:19 . 2006-12-03 23:34	124416	------w-	c:\windows\system32\prntvpt.dll
2010-11-24 13:19 . 2006-12-03 23:34	27648	-c----w-	c:\windows\system32\dllcache\FilterPipelinePrintProc.dll
2010-11-24 13:18 . 2006-10-04 13:38	36352	-c----w-	c:\windows\system32\dllcache\umandlg.dll
2010-11-24 13:18 . 2006-10-04 13:33	73216	-c----w-	c:\windows\system32\dllcache\magnify.exe
2010-11-24 13:18 . 2006-10-04 13:33	50176	-c----w-	c:\windows\system32\dllcache\utilman.exe
2010-11-24 13:18 . 2006-10-04 13:33	216576	-c----w-	c:\windows\system32\dllcache\osk.exe
2010-11-24 13:18 . 2006-10-04 13:32	55296	-c----w-	c:\windows\system32\dllcache\narrator.exe
2010-11-24 13:16 . 2006-10-31 10:26	36864	-c----w-	c:\windows\system32\dllcache\hidclass.sys
2010-11-24 13:12 . 2006-10-11 16:24	58880	-c----w-	c:\windows\system32\dllcache\pnrpnsp.dll
2010-11-24 13:12 . 2006-10-11 16:24	313344	-c----w-	c:\windows\system32\dllcache\p2pgraph.dll
2010-11-24 13:12 . 2006-10-11 16:24	153088	-c----w-	c:\windows\system32\dllcache\p2p.dll
2010-11-24 13:12 . 2006-10-11 16:24	116224	-c----w-	c:\windows\system32\dllcache\p2pnetsh.dll
2010-11-24 13:12 . 2006-10-11 16:24	104960	-c----w-	c:\windows\system32\dllcache\p2pgasvc.dll
2010-11-24 13:12 . 2006-10-11 07:24	553984	-c----w-	c:\windows\system32\dllcache\p2psvc.dll
2010-11-24 13:11 . 2006-11-08 08:51	62336	------w-	c:\windows\system32\drivers\rspndr.sys
2010-11-24 13:11 . 2006-11-08 08:51	10752	------w-	c:\windows\system32\rspndr.exe
2010-11-24 13:09 . 2006-10-23 11:14	30208	-c----w-	c:\windows\system32\dllcache\usbehci.sys
2010-11-24 13:09 . 2006-10-23 11:14	17152	-c----w-	c:\windows\system32\dllcache\usbohci.sys
2010-11-24 13:06 . 2006-08-18 12:38	476160	-c----w-	c:\windows\system32\dllcache\wzcsvc.dll
2010-11-24 13:06 . 2006-08-18 12:38	52736	-c----w-	c:\windows\system32\dllcache\wzcsapi.dll
2010-11-24 13:06 . 2006-08-18 12:38	384512	-c----w-	c:\windows\system32\dllcache\wzcdlg.dll
2010-11-24 13:06 . 2006-08-18 12:38	1724416	-c----w-	c:\windows\system32\dllcache\netshell.dll
2010-11-24 13:06 . 2006-08-18 09:36	14592	-c----w-	c:\windows\system32\dllcache\ndisuio.sys
2010-11-24 12:58 . 2010-11-24 12:58	--------	d-----w-	c:\windows\system32\de
2010-11-24 12:57 . 2006-01-11 01:20	33792	------w-	c:\windows\system32\mmcperf.exe
2010-11-24 12:57 . 2006-01-09 23:11	106496	------w-	c:\windows\system32\mmcfxcommon.dll
2010-11-24 12:57 . 2006-01-09 13:11	397312	------w-	c:\windows\system32\mmcex.dll
2010-11-24 12:57 . 2006-01-09 23:10	184320	------w-	c:\windows\system32\microsoft.managementconsole.dll
2010-11-24 12:48 . 2006-05-12 04:04	6144	------w-	c:\windows\system32\kbdpash.dll
2010-11-24 12:48 . 2006-05-12 04:04	6144	------w-	c:\windows\system32\kbdnepr.dll
2010-11-24 12:48 . 2006-05-12 04:04	6144	------w-	c:\windows\system32\kbdiultn.dll
2010-11-24 12:48 . 2006-05-12 04:04	6144	------w-	c:\windows\system32\kbdbhc.dll
2010-11-24 12:11 . 2010-11-24 12:11	--------	d-----w-	c:\dokumente und einstellungen\Julia Madeleine\Anwendungsdaten\Avira
2010-11-24 11:41 . 2010-08-02 15:09	60936	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-11-24 11:41 . 2010-08-02 15:09	126856	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-11-24 11:41 . 2010-06-17 14:27	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2010-11-24 11:41 . 2010-06-17 14:27	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2010-11-24 11:41 . 2010-11-24 11:41	--------	d-----w-	c:\programme\Avira
2010-11-24 11:41 . 2010-11-24 11:41	--------	d-----w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira
2010-11-24 10:23 . 2010-11-24 10:23	--------	d--h--w-	c:\windows\system32\GroupPolicy
2010-11-23 17:02 . 2010-11-24 10:14	--------	d-----w-	c:\dokumente und einstellungen\Julia Madeleine\Anwendungsdaten\TeamViewer
2010-11-23 15:55 . 2010-11-23 15:55	300544	----a-w-	c:\programme\Mozilla Firefox\Tralala.dll
2010-11-23 15:24 . 2010-10-27 06:13	25048	----a-w-	c:\programme\Mozilla Firefox\components\browserdirprovider.dll
2010-11-23 15:24 . 2010-10-27 06:13	140248	----a-w-	c:\programme\Mozilla Firefox\components\brwsrcmp.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDeck"="c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 528384]
"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496]
"LXSUPMON"="c:\windows\system32\LXSUPMON.EXE" [2002-02-04 886272]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"IntelZeroConfig"="c:\programme\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\programme\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Cisco Systems VPN Client.lnk - c:\programme\Cisco Systems\VPN Client\vpngui.exe [2007-11-26 1537064]

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OneNote 2007 Screen Clipper and Launcher.lnk]

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Julia Madeleine^Startmenü^Programme^Autostart^OpenOffice.org 2.3.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-23 19:33	57344	----a-w-	c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 20:16	39792	----a-w-	c:\programme\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2008-07-10 07:47	116040	----a-w-	c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-07-10 08:51	289064	----a-w-	c:\programme\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50	155648	----a-w-	c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-05-27 08:50	413696	----a-w-	c:\programme\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 16:17	159744	----a-r-	c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-12-11 16:00	68856	----a-w-	c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\ICQ6\\ICQ.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Programme\\BitTorrent\\bittorrent.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [24.11.2010 12:41 135336]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [23.05.2010 10:48 114432]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [23.05.2010 10:48 100736]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\4.tmp --> c:\windows\system32\4.tmp [?]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.ask.com/?o=101764&l=dis
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: bmnet.dll
TCP: {E4E20040-499B-4AB3-9B74-99919B8B881A} = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\Julia Madeleine\Anwendungsdaten\Mozilla\Firefox\Profiles\cqzw0epa.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\programme\Mozilla Firefox\plugins\npbittorrent.dll

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-11-24 18:37
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  AudioDeck = c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe 1???????????????????????????????????????????? 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\4.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB938464]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB938464)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB938464$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=938464"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB938464"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB946648]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB946648)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB946648$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=946648"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB946648"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB950974]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB950974)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB950974$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=950974"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB950974"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951066]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB951066)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951066$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951066"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951066"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951072-v2]
@DACL=(02 0000)
"DisplayName"="Update für Windows XP (KB951072-v2)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951072-v2$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951072"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="2"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951072-v2"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951376-v2]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB951376-v2)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951376-v2$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951376"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="2"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951376-v2"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB951748]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB951748)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB951748$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090124"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=951748"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB951748"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB952069_WM9]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows Media Player (KB952069)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB952069_WM9$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com/?kbid=952069"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayIcon"=expand:"\"%ProgramFiles%\\windows media player\\wmplayer.exe\""
"ParentKeyName"="OperatingSystem"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB952287]
@DACL=(02 0000)
"DisplayName"="Hotfix für Windows XP (KB952287)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB952287$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=952287"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Hotfix"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB952287"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB952954]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB952954)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB952954$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=952954"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB952954"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB954211]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB954211)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB954211$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=954211"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB954211"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB954600]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB954600)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB954600$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=954600"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB954600"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB955069]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB955069)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB955069$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=955069"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB955069"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB955839]
@DACL=(02 0000)
"DisplayName"="Update für Windows XP (KB955839)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB955839$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=955839"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB955839"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956390]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956390)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956390$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956390"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956390"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956391]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956391)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956391$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956391"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956391"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956802]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956802)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956802$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956802"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956802"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956803]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956803)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956803$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956803"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956803"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB956841]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB956841)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB956841$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=956841"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB956841"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB957095]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB957095)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB957095$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=957095"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB957095"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB957097]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB957097)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB957097$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=957097"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB957097"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB958215]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB958215)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB958215$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=958215"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB958215"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB958644]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB958644)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB958644$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20081208"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=958644"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB958644"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB958687]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB958687)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB958687$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090124"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=958687"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB958687"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Uninstall\KB960714]
@DACL=(02 0000)
"DisplayName"="Sicherheitsupdate für Windows XP (KB960714)"
"UninstallString"="\"c:\\WINDOWS\\$NtUninstallKB960714$\\spuninst\\spuninst.exe\""
"TSAware"=dword:00000001
"NoModify"=dword:00000001
"InstallDate"="20090105"
"Publisher"="Microsoft Corporation"
"NoRepair"=dword:00000001
"HelpLink"="hxxp://support.microsoft.com?kbid=960714"
"URLInfoAbout"="hxxp://support.microsoft.com"
"DisplayVersion"="1"
"ParentKeyName"="OperatingSystem"
"ParentDisplayName"="Windows XP - Softwareupdates"
"ReleaseType"="Security Update"
"RegistryLocation"="HKLM\\SOFTWARE\\Microsoft\\Updates\\Windows XP\\SP4\\KB960714"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1280)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'lsass.exe'(1336)
c:\windows\system32\bmnet.dll

- - - - - - - > 'explorer.exe'(508)
c:\programme\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll
c:\programme\Sony Ericsson\Mobile2\File Manager\fmgrguil.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\netprovcredman.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\bmwebcfg.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Cisco Systems\VPN Client\cvpnd.exe
c:\programme\Intel\Wireless\Bin\EvtEng.exe
c:\programme\Intel\Wireless\Bin\RegSrvc.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\programme\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-11-24  18:44:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-11-24 17:44
ComboFix2.txt  2010-11-24 11:01

Vor Suchlauf: 5.041.590.272 Bytes frei
Nach Suchlauf: 6.930.018.304 Bytes frei

- - End Of File - - 145A8B1EEB26D60E7F25AAC1B140710C

--- --- ---

markusg · 24.11.2010, 19:01

öffne mal den arbeitsplatz, c: rechtsklick auf qoobox, zu qoobox.rar oder zip hinzufügen und archiv hochladen
dateiupload:
http://www.trojaner-board.de/54791-a...ner-board.html

neustart und testen ob die beiden seiten laufen.

$un · 24.11.2010, 19:42

Super, die Seiten gehen!

Die Datei ist hochgeladen.

Vielen vielen Dank!

Sind USB-Stick und die externe Festplatte damit auch sauber?

Grüße

markusg · 24.11.2010, 19:44

mal gucken.
schließe sie an.
download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

$un · 27.11.2010, 15:15

Ok, hier ist das Malwarebyteslog, entschuldige hat dieses Mal etwas länger
gedauert bis ich da ran kam ; )

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 5184

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

24.11.2010 21:36:06
mbam-log-2010-11-24 (21-36-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|)
Durchsuchte Objekte: 207192
Laufzeit: 1 Stunde(n), 2 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
E:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx (Worm.Conficker) -> Quarantined and deleted successfully.
C:\Programme\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.

EDIT: Sieht sauber aus, oder?

Vielen vielen Dank für deine Hilfe!

23.11.2010, 18:20	#6
markusg /// Malware-holic	bitdefender.com & kaspersky.com nicht aufrufbar - GMER Log avira 8, aktuell wäre avira 10... kommt später. bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix __________________ --> bitdefender.com & kaspersky.com nicht aufrufbar - GMER Log

bitdefender.com & kaspersky.com nicht aufrufbar - GMER Log

Plagegeister aller Art und deren Bekämpfung: bitdefender.com & kaspersky.com nicht aufrufbar - GMER Log