| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows Security Alert - wie bekomm ich den weg ?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.01.2011, 19:46
| #1 |
 |  Windows Security Alert - wie bekomm ich den weg ? Moin Leute, ich hatte aufeinmal den "Windows Security Alert" auf meinem PC  - keine Ahnung wie. Ich habe schon herausgefunden das dies wohl ein Trojaner ist der sich als "Antivurs Scan" ausgibt. Wie bekomm ich den weg ?  Ich habe hier schonmal einen Scan mit HiJack gemacht: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:37:20, on 09.01.2011 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Programme\Application Updater\ApplicationUpdater.exe C:\Programme\Avira\AntiVir Desktop\avshadow.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\windows\system32\svchost.exe C:\Programme\Tunngle\TnglCtrl.exe C:\Programme\refogkl\MPK.exe C:\windows\Explorer.EXE C:\windows\RTHDCPL.EXE C:\windows\system32\RUNDLL32.EXE C:\Programme\Razer\DeathAdder\razerhid.exe C:\Programme\Java\jre6\bin\jusched.exe C:\windows\system32\mmrtkrnl.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe C:\Programme\Search Settings\SearchSettings.exe C:\windows\vsnpstd3.exe C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe E:\iTunes\iTunesHelper.exe C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe C:\Programme\Razer\DeathAdder\razerofa.exe C:\Programme\DNA\btdna.exe C:\Programme\Pando Networks\Media Booster\PMB.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\PC Connectivity Solution\ServiceLayer.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\lxcecoms.exe C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe C:\Programme\Xfire\Xfire.exe C:\Programme\iPod\bin\iPodService.exe C:\windows\System32\svchost.exe C:\windows\system32\wuauclt.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\WinRAR\WinRAR.exe C:\DOKUME~1\Name\LOKALE~1\Temp\Rar$EX00.000\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074 R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll R3 - URLSearchHook: TECHNO4EVER Toolbar - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll R3 - URLSearchHook: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,C:\Programme\refogkl\MPK.exe O1 - Hosts: 88.198.16.154 status.wow-europe.com O1 - Hosts: 88.198.16.154 launcher.worldofwarcraft.com O1 - Hosts: 88.198.16.154 eu.logon.worldofwarcraft.com O1 - Hosts: 88.198.16.154 eu.version.worldofwarcraft.com O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: TECHNO4EVER Toolbar - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll O2 - BHO: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: TECHNO4EVER Toolbar - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programme\Styler\TB\StylerTB.dll O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll O3 - Toolbar: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [DeathAdder] C:\Programme\Razer\DeathAdder\razerhid.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Realtime Audio Engine] "mmrtkrnl.exe" /i O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [snpstd3] C:\windows\vsnpstd3.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Programme\DNA\btdna.exe" O4 - HKCU\..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [iymoxksp] C:\DOKUME~1\Name\LOKALE~1\Temp\tknmgbxqg\cmfoeoklajb.exe O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MSI" TRANSFORMS="C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISC5C1C0F0D62F4DBF81D4D7EF397C228B_9_09_0814.MST" WISE_SETUP_EXE_PATH="c:\nvidia\displaydriver\190.62\international\PhysX_9.09.0814_SystemSoftware.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: CurseClientStartup.ccip O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Save YouTube Video as MP3 - res://C:\Programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} (Perparer Class) - hxxp://www.fiaa.eu/OPLauncher.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Application Updater - Spigot, Inc. - C:\Programme\Application Updater\ApplicationUpdater.exe O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TunngleService - Tunngle.net GmbH - C:\Programme\Tunngle\TnglCtrl.exe -- End of file - 13821 bytes |
|
09.01.2011, 20:03
| #2 |
| /// Malware-holic   |  Windows Security Alert - wie bekomm ich den weg ? Systemscan mit OTL
__________________download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten
__________________ |
|
09.01.2011, 23:52
| #3 |
| | Windows Security Alert - wie bekomm ich den weg ? Oke, hier der OTL report:OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 09.01.2011 23:57:40 - Run 1 OTL by OldTimer - Version 3.2.20.1 Folder = C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Programme Drive C: | 49,81 Gb Total Space | 1,28 Gb Free Space | 2,58% Space Free | Partition Type: NTFS Drive E: | 99,23 Gb Total Space | 6,86 Gb Free Space | 6,91% Space Free | Partition Type: NTFS Computer Name: NAME-1 | User Name: Name | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.01.09 23:51:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads\OTL.exe PRC - [2010.12.10 16:12:42 | 000,435,368 | ---- | M] (Avira GmbH) -- c:\Programme\Avira\AntiVir Desktop\avscan.exe PRC - [2010.12.10 16:12:42 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.11.02 17:44:29 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.11.02 17:44:28 | 000,389,288 | ---- | M] (Avira GmbH) -- c:\Programme\Avira\AntiVir Desktop\avcenter.exe PRC - [2010.11.02 17:44:28 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2010.09.21 19:37:40 | 000,932,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe PRC - [2010.09.14 12:47:24 | 000,716,024 | ---- | M] (Tunngle.net GmbH) -- C:\Programme\Tunngle\TnglCtrl.exe PRC - [2010.08.25 14:28:58 | 002,937,528 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe PRC - [2010.07.09 20:04:34 | 003,493,776 | ---- | M] (Xfire Inc.) -- C:\Programme\Xfire\Xfire.exe PRC - [2010.04.01 19:00:17 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2010.02.08 14:47:04 | 001,248,024 | ---- | M] () -- C:\Programme\refogkl\MPK.exe PRC - [2010.01.19 20:59:15 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\DNA\btdna.exe PRC - [2010.01.14 20:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2010.01.08 00:36:58 | 000,974,848 | ---- | M] (Spigot, Inc.) -- C:\Programme\Search Settings\SearchSettings.exe PRC - [2010.01.07 23:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) -- C:\Programme\Application Updater\ApplicationUpdater.exe PRC - [2009.11.23 21:40:22 | 000,070,144 | ---- | M] (AlcaTech) -- C:\WINDOWS\system32\mmrtkrnl.exe PRC - [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.09.07 14:54:54 | 000,159,744 | ---- | M] () -- C:\Programme\Razer\DeathAdder\razerhid.exe PRC - [2007.06.01 09:21:30 | 001,209,904 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2007.06.01 09:21:30 | 000,271,920 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe PRC - [2007.06.01 09:21:08 | 000,153,136 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe PRC - [2007.05.07 14:35:14 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Programme\Razer\DeathAdder\razerofa.exe PRC - [2007.01.19 11:49:04 | 000,049,152 | ---- | M] (Wireless Service) -- C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe PRC - [2006.11.08 13:27:54 | 000,222,208 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe PRC - [2006.11.06 14:21:10 | 000,210,432 | ---- | M] (Nokia.) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe PRC - [2006.09.19 09:07:28 | 000,827,392 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe PRC - [2005.07.06 11:14:12 | 000,471,040 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\lxcecoms.exe PRC - [2004.06.16 06:03:04 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe ========== Modules (SafeList) ========== MOD - [2011.01.09 23:51:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads\OTL.exe MOD - [2010.07.09 20:04:44 | 000,970,640 | ---- | M] (Xfire Inc.) -- C:\Programme\Xfire\xfire_toucan_43094.dll MOD - [2010.02.08 14:48:00 | 000,082,712 | ---- | M] () -- C:\Programme\refogkl\Mpk.dll MOD - [2008.04.14 06:52:34 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wsock32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- C:\windows\System32\hidserv.dll -- (HidServ) SRV - [2010.12.10 16:12:42 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.11.02 17:44:29 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2010.09.14 12:47:24 | 000,716,024 | ---- | M] (Tunngle.net GmbH) [Auto | Running] -- C:\Programme\Tunngle\TnglCtrl.exe -- (TunngleService) SRV - [2010.04.28 16:27:00 | 003,522,800 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\windows\System32\GameMon.des -- (npggsvc) SRV - [2010.01.07 23:51:02 | 000,380,928 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Programme\Application Updater\ApplicationUpdater.exe -- (Application Updater) SRV - [2007.06.01 09:21:30 | 000,271,920 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2007.01.19 11:49:26 | 000,049,152 | ---- | M] (Wireless Service) [Auto | Stopped] -- C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe -- (ANIWZCSdService) SRV - [2006.11.06 14:21:10 | 000,210,432 | ---- | M] (Nokia.) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2005.07.06 11:14:12 | 000,471,040 | ---- | M] (Lexmark International, Inc.) [On_Demand | Running] -- C:\windows\System32\lxcecoms.exe -- (lxce_device) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\PCAMPR5.SYS -- (PCAMPR5) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\drivers\EagleXNt.sys -- (EagleXNt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\windows\System32\drivers\EagleNT.sys -- (EagleNT) DRV - [2010.12.21 16:21:46 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2010.11.23 17:25:26 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.11.29 12:02:31 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2009.09.16 07:02:40 | 000,027,136 | ---- | M] (Tunngle.net) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tap0901t.sys -- (tap0901t) TAP-Win32 Adapter V9 (Tunngle) DRV - [2009.08.30 09:35:47 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv) DRV - [2009.08.16 23:57:00 | 007,729,568 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2009.05.11 08:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.12.11 10:24:20 | 004,959,232 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008.07.10 02:49:14 | 000,242,712 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RsFx0102.sys -- (RsFx0102) DRV - [2008.04.13 21:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2007.08.02 16:32:26 | 000,022,784 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dadder.sys -- (DAdderFltr) DRV - [2007.05.12 14:49:54 | 000,380,928 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt61.sys -- (RT61) DRV - [2007.03.27 18:19:36 | 010,252,544 | ---- | M] (Sonix Co. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3) DRV - [2007.01.26 01:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB) DRV - [2007.01.26 01:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmeject.sys -- (avmeject) DRV - [2006.11.27 15:33:54 | 000,019,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006.11.27 15:33:50 | 000,058,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006.10.18 15:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\windows\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006.10.10 08:54:34 | 000,138,240 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (Nokia USB Phone Parent) DRV - [2006.10.10 08:54:32 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (Nokia USB Port) DRV - [2006.10.10 08:54:32 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (Nokia USB Modem) DRV - [2006.10.10 08:54:32 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (Nokia USB Generic) DRV - [2006.07.01 22:30:28 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005.12.11 11:55:38 | 000,028,195 | ---- | M] (Alpha Networks Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\ANIO.sys -- (ANIO) DRV - [2004.09.08 09:10:00 | 000,017,018 | R--- | M] (Intellon, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PLCNDIS5.SYS -- (PLCNDIS5) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.) IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.) IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8074 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Yahoo" FF - prefs.js..browser.search.defaultthis.engineName: "techno4ever Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=867034" FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://home.sweetim.com" FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.1.0014 FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:6.6.0.1 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.1.0.0 FF - prefs.js..extensions.enabledItems: {33b974a8-e892-4f5f-bd17-f7b0331843d5}:2.5.6.0 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: dealio@mybrowserbar.com:4.0.2 FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3 FF - prefs.js..extensions.enabledItems: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}:0.8.6.1 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3 FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "chrome://browser-region/locale/region.properties" FF - prefs.js..browser.startup.homepage: "resource:/browserconfig.properties" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties" FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.01.08 01:30:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.13 15:44:47 | 000,000,000 | ---D | M] [2009.09.05 17:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Extensions [2010.12.20 07:17:01 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions [2009.09.05 21:44:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.02.13 16:46:00 | 000,000,000 | ---D | M] (techno4ever Toolbar) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{33b974a8-e892-4f5f-bd17-f7b0331843d5} [2010.05.16 20:17:19 | 000,000,000 | ---D | M] (Html Validator) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} [2010.03.02 20:44:25 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2010.07.16 11:54:17 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.07.16 11:54:17 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.08.24 13:34:31 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.10.12 08:55:40 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847} [2009.11.29 12:02:46 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\extensions\DTToolbar@toolbarnet.com [2010.04.09 11:12:38 | 000,002,331 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\bigseekpro.xml [2010.01.27 13:15:12 | 000,000,923 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\conduit.xml [2009.11.29 12:02:42 | 000,002,055 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\daemon-search.xml [2010.10.12 08:55:16 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\searchplugins\sweetim.xml [2010.08.24 17:48:00 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.12.29 17:23:22 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.04.18 12:49:39 | 000,000,000 | ---D | M] (Dealio Toolbar Plugin) -- C:\PROGRAMME\DEALIO TOOLBAR\FF [2009.09.29 12:57:54 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2010.04.18 12:49:43 | 000,000,000 | ---D | M] (Search Settings Plugin) -- C:\PROGRAMME\SEARCH SETTINGS\FF [2010.08.25 14:28:57 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Programme\Mozilla Firefox\plugins\npPandoWebInst.dll [2010.04.01 17:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.04.01 17:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.04.01 17:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.04.01 17:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.04.01 17:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.01.09 13:56:42 | 000,372,092 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 88.198.16.154 status.wow-europe.com O1 - Hosts: 88.198.16.154 launcher.worldofwarcraft.com O1 - Hosts: 88.198.16.154 eu.logon.worldofwarcraft.com O1 - Hosts: 88.198.16.154 eu.version.worldofwarcraft.com O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 12822 more lines... O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll (Spigot, Inc.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (TECHNO4EVER Toolbar) - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll () O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\SearchSettings.dll (Spigot, Inc.) O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll (Spigot, Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll () O3 - HKLM\..\Toolbar: (TECHNO4EVER Toolbar) - {33b974a8-e892-4f5f-bd17-f7b0331843d5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (StylerToolBar) - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programme\Styler\TB\StylerTB.dll (StyleFantasist) O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (TECHNO4EVER Toolbar) - {33B974A8-E892-4F5F-BD17-F7B0331843D5} - C:\Programme\techno4ever\tbtec1.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\windows\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DeathAdder] C:\Programme\Razer\DeathAdder\razerhid.exe () O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [LXCECATS] C:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL () O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe () O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia) O4 - HKLM..\Run: [Realtime Audio Engine] C:\windows\System32\mmrtkrnl.exe (AlcaTech) O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Spigot, Inc.) O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe () O4 - HKU\.DEFAULT..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.) O4 - HKU\S-1-5-18..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe (Time Information Services Ltd.) O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [BitTorrent DNA] C:\Programme\DNA\btdna.exe (BitTorrent, Inc.) O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [iymoxksp] C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Temp\tknmgbxqg\cmfoeoklajb.exe () O4 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe () O4 - Startup: C:\Dokumente und Einstellungen\Name\Startmenü\Programme\Autostart\CurseClientStartup.ccip () O4 - Startup: C:\Dokumente und Einstellungen\Name\Startmenü\Programme\Autostart\Xfire.lnk = C:\Programme\Xfire\Xfire.exe (Xfire Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Toolband.dll () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm () O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Programme\refogkl\MPK.exe) - C:\Programme\refogkl\MPK.exe () O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Desktop-Hintergrund.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Desktop-Hintergrund.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.08.30 05:01:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - Unable to obtain root file information for disk E:\ O33 - MountPoints2\{13c81eba-006f-11df-9b5b-00241d6a8a52}\Shell\AutoRun\command - "" = F:\Get_Started_for_Win.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: HidServ - C:\windows\System32\hidserv.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpReg: D-Link AirPlus G DWL-G510 - hkey= - key= - C:\Programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe (D-Link) MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Programme\DivX\DivX Update\DivXUpdate.exe () MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: vsmon - Service SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Reg Error: Value error. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lhacm - C:\windows\System32\lhacm.acm (Microsoft Corporation) Drivers32: msacm.sl_anet - C:\windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\windows\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: msacm.vorbis - C:\windows\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/) Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\windows\System32\DivX.dll (DivX, Inc.) Drivers32: VIDC.FPS1 - C:\windows\System32\frapsvid.dll (Beepa P/L) Drivers32: vidc.iv31 - C:\windows\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\windows\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\windows\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\windows\System32\ir50_32.dll (Intel Corporation) Drivers32: VIDC.XFR1 - C:\windows\System32\xfcodec.dll () Drivers32: vidc.yv12 - C:\windows\System32\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point (16902053519425536) ========== Files/Folders - Created Within 30 Days ========== [2011.01.09 19:53:36 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Name\Recent [2010.12.18 21:35:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\softonic-de3 [2010.12.18 21:35:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\techno4ever [2010.12.18 21:35:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\DVDVideoSoftTB [2010.12.18 21:35:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Apple [2010.12.18 16:48:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PhotoScape [2010.12.18 16:48:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PhotoScape [2010.12.18 16:48:38 | 000,000,000 | ---D | C] -- C:\Programme\PhotoScape [2010.12.18 16:48:17 | 017,327,195 | ---- | C] (Mooii) -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScapeSetup_V3.5.exe [2010.12.18 01:22:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\ICQ [2010.12.16 22:18:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Desktop\Bewerbungsmappe [2010.12.13 16:13:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Desktop\Virus ;) [2010.12.13 15:45:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Apple Computer [2010.12.13 15:45:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\iTunes [2010.12.13 15:45:41 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\windows\System32\GEARAspi.dll [2010.12.13 15:45:21 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2010.12.13 15:45:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2010.12.13 15:44:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\QuickTime [2010.12.13 15:44:32 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime [2010.12.13 15:44:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer [2010.12.13 15:44:13 | 000,000,000 | ---D | C] -- C:\Programme\Apple Software Update [2010.12.13 15:43:36 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [2010.12.13 15:43:22 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Apple [2010.12.13 15:43:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple [2010.12.11 22:13:23 | 000,431,616 | ---- | C] (Fatih Kodak) -- C:\Dokumente und Einstellungen\Name\Desktop\Bat_To_Exe_Converter.exe [2007.09.21 18:42:42 | 000,019,008 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\Programme\markfun.a64 [2007.08.21 18:49:28 | 000,017,912 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Programme\markfun.w32 [2007.03.12 11:41:52 | 000,061,440 | ---- | C] ( ) -- C:\windows\System32\vsnpstd3.dll [2005.11.23 12:55:32 | 000,053,248 | ---- | C] ( ) -- C:\windows\System32\csnpstd3.dll [4 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.01.09 23:59:00 | 000,001,088 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job [2011.01.09 23:46:02 | 000,000,007 | ---- | M] () -- C:\windows\System32\ANIWZCSUSERNAME [2011.01.09 23:45:57 | 000,249,324 | ---- | M] () -- C:\windows\System32\NvApps.xml [2011.01.09 23:45:52 | 000,001,084 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job [2011.01.09 23:45:35 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat [2011.01.09 23:45:33 | 000,135,664 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2011.01.09 19:58:22 | 000,105,872 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\cc_20110109_195808.reg [2011.01.09 19:22:16 | 000,000,000 | ---- | M] () -- C:\windows\System32\Access.dat [2011.01.09 18:27:33 | 000,000,069 | ---- | M] () -- C:\windows\NeroDigital.ini [2011.01.08 21:35:04 | 000,000,276 | ---- | M] () -- C:\windows\tasks\AppleSoftwareUpdate.job [2011.01.08 16:05:04 | 000,002,206 | ---- | M] () -- C:\windows\System32\wpa.dbl [2011.01.07 13:49:26 | 000,000,005 | ---- | M] () -- C:\windows\System32\ANIWZCSUSERNAME{BBAFD89B-C226-4E03-BF2F-86CA54489D29} [2011.01.06 22:43:13 | 000,003,284 | ---- | M] () -- C:\windows\System32\ANIWZCS{BBAFD89B-C226-4E03-BF2F-86CA54489D29} [2010.12.31 01:41:09 | 000,858,651 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Nordkurve-Bayern-Doppelhalter.JPG [2010.12.31 01:28:06 | 000,195,146 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Unbenannt3.jpg [2010.12.31 01:15:20 | 003,625,649 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Linkin Park - Numb Techno Remix.mp3 [2010.12.30 00:21:31 | 000,025,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\12.jpg [2010.12.30 00:16:37 | 000,117,776 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_30122010_001627.png [2010.12.28 01:41:36 | 011,214,976 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Dj NeXt - Hit Leta (Electro 2010).mp3 [2010.12.28 00:32:43 | 000,686,194 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\hot-girls-sexy-girls.jpg [2010.12.26 23:52:11 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\klasse_1c tobias & marcel.jpg [2010.12.26 23:51:23 | 000,008,879 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-4a65b476d5be0b9c.jpg [2010.12.21 16:39:05 | 013,029,654 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\kalle.bmp [2010.12.21 16:21:46 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys [2010.12.20 19:59:47 | 001,620,426 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\svz2 xD.bmp [2010.12.18 16:49:02 | 000,059,392 | -H-- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\photothumb.db [2010.12.18 16:48:46 | 000,000,688 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScape.lnk [2010.12.18 16:48:27 | 017,327,195 | ---- | M] (Mooii) -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScapeSetup_V3.5.exe [2010.12.18 16:42:21 | 000,009,536 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-53a0fed14bd4aae2.jpg [2010.12.15 22:08:25 | 000,107,625 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03411.jpg [2010.12.15 22:08:08 | 000,049,027 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03387.JPG [2010.12.15 22:07:55 | 000,040,017 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03003.JPG [2010.12.15 22:03:11 | 000,543,190 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_15122010_220154.png [2010.12.15 21:47:19 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\sirksfeld_4b_05_239.jpg [2010.12.15 19:56:16 | 000,022,136 | -H-- | M] () -- C:\windows\System32\mlfcache.dat [2010.12.15 18:56:55 | 007,378,437 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\01 My Life Would Suck Without You.m4a [2010.12.15 18:42:32 | 002,972,426 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Ciara feat. Usher - Turn It Up.mp3 [2010.12.15 18:42:17 | 000,677,293 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\G35 konfigurieren.png [2010.12.15 17:15:49 | 000,021,418 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Paladin Asoka.odt [2010.12.14 17:05:30 | 000,396,288 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!2.ppt [2010.12.13 21:00:41 | 000,001,787 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk [2010.12.13 20:57:41 | 003,173,941 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_13122010_202900.png [2010.12.13 19:32:26 | 000,000,235 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\virus1.bat [2010.12.13 18:45:30 | 000,420,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!.pps [2010.12.13 16:18:22 | 000,022,309 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\TowerDefence.rar [2010.12.13 16:00:05 | 001,537,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Bodem Brothers.jpg [2010.12.13 15:45:43 | 000,001,362 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2010.12.13 15:44:38 | 000,001,594 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk [2010.12.12 21:37:42 | 000,001,697 | ---- | M] () -- C:\WarRock.ini [2010.12.12 00:10:09 | 007,260,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kat DeLuna feat. Akon - Push Push.mp3 [2010.12.11 23:56:23 | 000,597,786 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0189.JPG [2010.12.11 23:56:20 | 000,866,931 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0249.JPG [2010.12.11 23:56:02 | 000,703,869 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0242.JPG [2010.12.11 23:51:08 | 003,320,605 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_3977.JPG [2010.12.11 21:25:11 | 000,001,500 | ---- | M] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kalle.jpg.lnk [4 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.01.09 19:58:13 | 000,105,872 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Eigene Dateien\cc_20110109_195808.reg [2011.01.03 23:32:49 | 000,003,284 | ---- | C] () -- C:\windows\System32\ANIWZCS{BBAFD89B-C226-4E03-BF2F-86CA54489D29} [2010.12.31 01:40:34 | 000,858,651 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Nordkurve-Bayern-Doppelhalter.JPG [2010.12.31 01:27:57 | 000,195,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Unbenannt3.jpg [2010.12.31 01:07:55 | 003,625,649 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Linkin Park - Numb Techno Remix.mp3 [2010.12.30 00:21:29 | 000,025,752 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\12.jpg [2010.12.30 00:16:35 | 000,117,776 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_30122010_001627.png [2010.12.28 01:32:22 | 011,214,976 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Dj NeXt - Hit Leta (Electro 2010).mp3 [2010.12.28 00:31:51 | 000,686,194 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\hot-girls-sexy-girls.jpg [2010.12.26 23:51:22 | 000,008,879 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-4a65b476d5be0b9c.jpg [2010.12.20 19:23:50 | 001,620,426 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\svz2 xD.bmp [2010.12.20 19:23:39 | 013,029,654 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\kalle.bmp [2010.12.18 16:49:02 | 000,059,392 | -H-- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\photothumb.db [2010.12.18 16:48:46 | 000,000,688 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\PhotoScape.lnk [2010.12.18 16:42:21 | 000,009,536 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\6-53a0fed14bd4aae2.jpg [2010.12.15 22:08:21 | 000,107,625 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03411.jpg [2010.12.15 22:08:07 | 000,049,027 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03387.JPG [2010.12.15 22:07:54 | 000,040,017 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\DSC03003.JPG [2010.12.15 22:02:28 | 000,543,190 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_15122010_220154.png [2010.12.15 21:47:48 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\klasse_1c tobias & marcel.jpg [2010.12.15 21:47:19 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\sirksfeld_4b_05_239.jpg [2010.12.15 19:56:16 | 000,022,136 | -H-- | C] () -- C:\windows\System32\mlfcache.dat [2010.12.15 18:59:42 | 007,378,437 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\01 My Life Would Suck Without You.m4a [2010.12.15 18:41:50 | 000,677,293 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\G35 konfigurieren.png [2010.12.15 18:20:44 | 002,972,426 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Ciara feat. Usher - Turn It Up.mp3 [2010.12.15 17:15:48 | 000,021,418 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Paladin Asoka.odt [2010.12.14 17:05:27 | 000,396,288 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!2.ppt [2010.12.13 20:57:03 | 003,173,941 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_13122010_202900.png [2010.12.13 19:26:21 | 000,000,884 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\towerdefence.jnlp [2010.12.13 18:45:16 | 000,420,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Such den roten punkt!.pps [2010.12.13 16:16:56 | 000,002,238 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\pzqst2.ico [2010.12.13 16:11:31 | 000,022,309 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\TowerDefence.rar [2010.12.13 15:45:43 | 000,001,362 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk [2010.12.13 15:44:38 | 000,001,594 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\QuickTime Player.lnk [2010.12.13 15:44:18 | 000,000,276 | ---- | C] () -- C:\windows\tasks\AppleSoftwareUpdate.job [2010.12.12 21:37:42 | 000,001,697 | ---- | C] () -- C:\WarRock.ini [2010.12.11 23:57:53 | 007,260,752 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kat DeLuna feat. Akon - Push Push.mp3 [2010.12.11 23:53:38 | 000,597,786 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0189.JPG [2010.12.11 23:52:39 | 000,703,869 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0242.JPG [2010.12.11 23:52:33 | 000,866,931 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_0249.JPG [2010.12.11 23:48:56 | 003,320,605 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\IMG_3977.JPG [2010.12.11 23:34:15 | 001,537,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Bodem Brothers.jpg [2010.12.11 22:13:56 | 000,000,235 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\virus1.bat [2010.12.11 21:24:18 | 000,001,500 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Desktop\Kalle.jpg.lnk [2010.12.10 16:30:47 | 001,970,176 | ---- | C] () -- C:\windows\System32\d3dx9.dll [2010.11.03 18:45:41 | 000,049,152 | ---- | C] () -- C:\windows\System32\JJAKEn.dll [2010.09.08 19:11:05 | 000,000,035 | ---- | C] () -- C:\windows\System32\FIOALL.INI [2010.07.09 20:04:40 | 000,041,872 | ---- | C] () -- C:\windows\System32\xfcodec.dll [2010.05.16 17:06:44 | 000,000,326 | ---- | C] () -- C:\windows\ULEAD32.INI [2010.04.18 12:49:24 | 000,290,816 | ---- | C] () -- C:\windows\System32\decdll.dll [2010.04.17 00:08:10 | 000,115,160 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2010.04.16 19:53:51 | 000,027,648 | ---- | C] () -- C:\windows\System32\AVSredirect.dll [2010.03.27 21:42:38 | 000,000,121 | ---- | C] () -- C:\windows\SMM_HCEditor.INI [2010.03.25 21:19:25 | 001,108,482 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\NMM-MetaData.db [2010.01.31 00:29:16 | 000,000,151 | ---- | C] () -- C:\windows\PhotoSnapViewer.INI [2009.11.23 15:06:12 | 000,000,073 | ---- | C] () -- C:\windows\cdplayer.ini [2009.11.23 15:06:05 | 000,001,074 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ss.ini [2009.10.22 13:41:25 | 000,000,029 | ---- | C] () -- C:\windows\DEBUGSM.INI [2009.10.22 13:38:27 | 000,000,072 | ---- | C] () -- C:\windows\System32\epDPE.ini [2009.10.22 13:38:26 | 000,096,768 | ---- | C] () -- C:\windows\SlantAdj.dll [2009.09.29 13:02:21 | 000,040,960 | ---- | C] () -- C:\windows\System32\lxcevs.dll [2009.09.29 13:02:14 | 000,139,264 | ---- | C] () -- C:\windows\System32\lxcejswr.dll [2009.09.29 13:02:13 | 000,102,400 | ---- | C] () -- C:\windows\System32\lxceinsr.dll [2009.09.29 13:02:12 | 000,036,864 | ---- | C] () -- C:\windows\System32\lxcecur.dll [2009.09.13 18:59:14 | 000,036,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.09.12 15:46:00 | 000,138,464 | ---- | C] () -- C:\windows\System32\drivers\PnkBstrK.sys [2009.09.06 19:44:08 | 000,000,000 | ---- | C] () -- C:\windows\OpPrintServer.INI [2009.09.05 21:41:50 | 000,000,069 | ---- | C] () -- C:\windows\NeroDigital.ini [2009.09.05 21:26:52 | 000,691,696 | ---- | C] () -- C:\windows\System32\drivers\sptd.sys [2009.08.30 08:30:26 | 000,003,972 | ---- | C] () -- C:\windows\System32\drivers\PciBus.sys [2009.08.30 05:53:58 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI [2009.08.29 23:29:18 | 000,000,400 | ---- | C] () -- C:\windows\ODBC.INI [2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\windows\System32\physxcudart_20.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelTraditionalChinese.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSwedish.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSpanish.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelSimplifiedChinese.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelPortugese.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelKorean.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelJapanese.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelGerman.dll [2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\windows\System32\AgCPanelFrench.dll [2008.02.14 13:28:56 | 000,000,029 | ---- | C] () -- C:\Programme\version.ini [2008.02.14 13:23:12 | 000,231,944 | ---- | C] () -- C:\Programme\gwflash.exe [2007.08.21 18:49:36 | 000,125,504 | ---- | C] () -- C:\Programme\MarkFunDrv.dll [2007.04.05 03:31:22 | 000,248,640 | ---- | C] () -- C:\Programme\update.exe [2007.03.30 03:36:28 | 000,000,301 | ---- | C] () -- C:\Programme\update.ini [2007.03.02 03:48:50 | 000,240,448 | ---- | C] () -- C:\Programme\gwf32.exe [2006.11.23 22:47:50 | 000,207,680 | ---- | C] () -- C:\Programme\BIOS_Run.exe [2006.11.23 22:40:30 | 000,060,224 | ---- | C] () -- C:\Programme\HUADRV.DLL [2006.11.03 17:09:40 | 000,000,528 | ---- | C] () -- C:\Programme\CONFIG.INI [2005.12.07 11:31:00 | 000,202,752 | R--- | C] () -- C:\windows\System32\CddbCdda.dll [2005.04.27 18:40:26 | 000,006,800 | ---- | C] () -- C:\Programme\W95_HUA.vxd [2004.02.27 16:36:18 | 000,015,498 | ---- | C] () -- C:\windows\snpstd3.ini ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.03.07 20:20:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\AccurateRip [2009.09.05 17:27:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Adobe [2009.09.06 10:16:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Ahead [2009.12.13 14:03:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\AlcaTech [2010.01.10 21:34:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\AntMe [2010.12.13 15:47:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Apple Computer [2010.04.15 19:31:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Avira [2009.09.16 18:28:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\CD-LabelPrint [2010.01.09 13:52:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\CheckPoint [2009.11.29 12:06:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DAEMON Tools Lite [2009.09.05 21:32:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DAEMON Tools Pro [2010.04.18 12:49:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Dealio [2010.05.23 22:40:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Desktopicon [2010.07.07 12:03:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DivX [2011.01.09 23:56:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DNA [2010.07.16 11:54:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers [2010.08.31 19:31:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\FileZilla [2010.04.18 12:49:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\FreeVideoConverter [2010.07.31 19:51:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Google [2010.10.10 01:00:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\gtk-2.0 [2010.01.06 14:51:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Help [2010.12.18 12:26:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\ICQ [2009.08.30 05:05:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Identities [2009.08.30 05:08:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\InstallShield [2010.02.21 06:26:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Macromedia [2010.09.10 19:47:27 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft [2009.09.05 17:29:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Mozilla [2010.03.15 20:29:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\MrJobs [2010.06.27 21:19:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\NCH Swift Sound [2010.03.25 21:25:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Nokia [2010.03.25 21:39:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Nokia Multimedia Player [2009.09.29 13:26:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\OpenOffice.org [2010.03.25 21:13:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PC Suite [2010.12.18 16:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\PhotoScape [2010.04.18 12:49:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Search Settings [2011.01.09 23:47:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Skype [2011.01.09 16:01:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\skypePM [2010.02.17 18:42:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Styler [2009.09.29 12:57:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Sun [2010.01.03 17:40:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\teamspeak2 [2010.02.08 17:00:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TeamViewer [2009.10.02 21:02:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Teeworlds [2010.05.31 14:59:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Toolbar4 [2010.06.20 18:10:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TS3Client [2009.12.29 02:52:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\TuneUp Software [2010.12.29 02:45:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Tunngle [2009.09.05 22:29:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Ubisoft [2009.08.30 08:16:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\vlc [2010.03.16 20:26:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Webocton - Scriptly [2011.01.09 20:06:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Xfire < %APPDATA%\*.exe /s > [2009.04.09 12:47:36 | 000,089,088 | ---- | M] (AD ON Multimedia Advertising GmbH) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Desktopicon\eBayShortcuts.exe [2009.08.29 23:15:14 | 001,961,720 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe [2010.02.22 22:19:40 | 001,923,880 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe [2010.03.15 20:27:50 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe [2010.03.15 20:27:50 | 000,000,766 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe [2010.02.17 18:45:03 | 000,015,086 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2010.02.17 18:45:03 | 000,015,086 | R--- | M] () -- C:\Dokumente und Einstellungen\Name\Anwendungsdaten\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_7b12541d.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008.04.13 23:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\agp440.sys [2008.04.13 23:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < MD5 for: ATAPI.SYS > [2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008.04.13 23:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\atapi.sys [2008.04.13 23:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004.08.03 21:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [2004.08.03 21:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 06:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\eventlog.dll [2008.04.14 06:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2004.08.03 23:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: EXPLORER.EXE > [2004.08.03 23:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\explorer.exe [2010.04.09 10:58:19 | 000,004,608 | ---- | M] () MD5=562CC71724C20DC9AFF1C935492A26F0 -- C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Xenocode\ApplianceCaches\GameCamV2.exe_v7AC6EAFE\Native\STUBEXE\@WINDIR@\explorer.exe < MD5 for: NETLOGON.DLL > [2008.04.14 06:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\netlogon.dll [2008.04.14 06:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2004.08.03 23:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: NVATA.SYS > [2006.10.18 15:31:38 | 000,105,472 | ---- | M] (NVIDIA Corporation) MD5=EF9941593B2E9B436F64A87DDB570D1A -- C:\WINDOWS\system32\drivers\nvata.sys < MD5 for: SCECLI.DLL > [2008.04.14 06:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\scecli.dll [2008.04.14 06:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2004.08.03 23:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < MD5 for: USER32.DLL > [2004.08.03 23:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2008.04.14 06:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\user32.dll [2008.04.14 06:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\userinit.exe [2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004.08.03 23:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2004.08.03 23:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\winlogon.exe [2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2001.08.18 11:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2001.08.18 11:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > [2009.11.29 12:02:31 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys < %systemroot%\System32\config\*.sav > [2009.08.30 06:52:06 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2009.08.30 06:52:06 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2009.08.30 06:52:05 | 000,425,984 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2008.04.14 06:52:10 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll [2009.03.08 03:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll [2009.03.08 03:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll [2001.08.18 11:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\eventcls.dll [2010.02.25 07:14:59 | 000,184,320 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll [1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ] < End of report > Und hier den Extras report:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 09.01.2011 23:57:40 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Dokumente und Einstellungen\Name\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Programme
Drive C: | 49,81 Gb Total Space | 1,28 Gb Free Space | 2,58% Space Free | Partition Type: NTFS
Drive E: | 99,23 Gb Total Space | 6,86 Gb Free Space | 6,91% Space Free | Partition Type: NTFS
Computer Name: NAME-1 | User Name: Name | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_USERS\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56764:TCP" = 56764:TCP:*:Enabled:Pando Media Booster
"56764:UDP" = 56764:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"56764:TCP" = 56764:TCP:*:Enabled:Pando Media Booster
"56764:UDP" = 56764:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"58759:TCP" = 58759:TCP:*:Enabled:Pando Media Booster
"58759:UDP" = 58759:UDP:*:Enabled:Pando Media Booster
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\GIGABYTE\@BIOS\gwflash.exe" = C:\Programme\GIGABYTE\@BIOS\gwflash.exe:*:Enabled:gwflash -- ()
"C:\Programme\GIGABYTE\@BIOS\update.exe" = C:\Programme\GIGABYTE\@BIOS\update.exe:*:Enabled:update -- ()
"C:\Programme\gwflash.exe" = C:\Programme\gwflash.exe:*:Enabled:gwflash -- ()
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\Xfire\Xfire.exe" = C:\Programme\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)
"C:\Programme\Valve\hl.exe" = C:\Programme\Valve\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Programme\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe" = C:\Programme\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe:*:Enabled:Tom Clancy's H.A.W.X -- ()
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Dokumente und Einstellungen\Name\Eigene Dateien\Games\teeworlds-0.5.1-win32\teeworlds_srv.exe" = C:\Dokumente und Einstellungen\Name\Eigene Dateien\Games\teeworlds-0.5.1-win32\teeworlds_srv.exe:*:Enabled:teeworlds_srv -- ()
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"E:\prototypef.exe" = E:\prototypef.exe:*:Enabled:Prototype(TM) -- File not found
"C:\Programme\TmNationsForever\TmForever.exe" = C:\Programme\TmNationsForever\TmForever.exe:*:Enabled:TmForever -- ()
"E:\Age of Empires\Empires.exe" = E:\Age of Empires\Empires.exe:*:Enabled:Age of Empires -- (Microsoft Corporation)
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"E:\cod\Call of Duty - World at War\Call of Duty - World at War\CoDWaWmp.exe" = E:\cod\Call of Duty - World at War\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty(R): World at War Multiplayer -- (Activision Blizzard, Inc.)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Messenger\update\sweetimsetup.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SweetIM\Messenger\update\sweetimsetup.exe:*:Enabled:SweetIM Installer -- File not found
"E:\1234\Warcraft 3 & Frozen Throne\Warcraft III.exe" = E:\1234\Warcraft 3 & Frozen Throne\Warcraft III.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"E:\Empire Earth\Empire Earth.exe" = E:\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth -- ()
"C:\Programme\Tunngle\tnglctrl.exe" = C:\Programme\Tunngle\tnglctrl.exe:*:Enabled:Tunngle Service -- (Tunngle.net GmbH)
"C:\Programme\Tunngle\tunngle.exe" = C:\Programme\Tunngle\tunngle.exe:*:Enabled:Tunngle Client -- (Tunngle.net GmbH)
"E:\iTunes\iTunes.exe" = E:\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"E:\1234\Call of Duty 4 - Modern Warfare\iw3mp.exe" = E:\1234\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:iw3mp -- ()
"C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Apps\2.0\Z6NKCKRW.P12\9ZKH9C2D.JMP\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\CurseClient.exe" = C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Apps\2.0\Z6NKCKRW.P12\9ZKH9C2D.JMP\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\CurseClient.exe:*:Enabled:Curse Client 4.0 -- (Curse)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4C590030-7469-453E-8589-D15DA9D03F52}" = ANIWZCS2 Service
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{7B5CE976-C7A9-4E38-A7F3-6C8EF025DD8E}" = ANIO Service
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B128562-681D-4FFA-BEBF-A825985B2CB9}" = AirPlus G DWL-G510
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.4 - Deutsch
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F93D2591-8201-4692-BD8D-67A0BFAC9C14}" = SweetIM Toolbar for Internet Explorer 3.9
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"DivX Setup.divx.com" = DivX-Setup
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"FL Studio 8" = FL Studio 8
"Google Chrome" = Google Chrome
"IL Download Manager" = IL Download Manager
"MSNINST" = MSN
"Neffy" = Neffy 1,3,29,0
"PhotoScape" = PhotoScape
"PoiZone" = PoiZone
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Toxic Biohazard" = Toxic Biohazard
"Tunngle beta_is1" = Tunngle beta
"WavePad" = WavePad Sound Editor
"WinGimp-2.0_is1" = GIMP 2.6.10
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-2000478354-1123561945-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"BitTorrent DNA" = DNA
"CreepSmash.com" = CreepSmash.com
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 09.01.2011 13:30:35 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6000
Error - 09.01.2011 13:30:37 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 09.01.2011 13:30:37 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7953
Error - 09.01.2011 13:30:37 | Computer Name = NAME-1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7953
Error - 09.01.2011 14:17:38 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 09.01.2011 14:18:07 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 09.01.2011 14:18:36 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 09.01.2011 14:19:43 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
Error - 09.01.2011 14:53:18 | Computer Name = NAME-1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung ClearProg.exe, Version 1.6.0.1, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 09.01.2011 18:53:59 | Computer Name = NAME-1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x00000000.
[ System Events ]
Error - 28.12.2010 23:08:26 | Computer Name = NAME-1 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 29.12.2010 08:46:46 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.12.2010 08:46:46 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.12.2010 08:46:46 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.12.2010 08:55:27 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.12.2010 08:55:27 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.12.2010 08:55:39 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 29.12.2010 08:55:39 | Computer Name = NAME-1 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "PCAMPR5 NDIS Protocol Driver" wurde aufgrund folgenden
Fehlers nicht gestartet: %%2
Error - 31.12.2010 10:49:54 | Computer Name = NAME-1 | Source = DCOM | ID = 10010
Description = Der Server "{0002DF01-0000-0000-C000-000000000046}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 31.12.2010 11:24:59 | Computer Name = NAME-1 | Source = Dhcp | ID = 1001
Description = Diesem Computer konnte keine Netzwerkadresse durch den DHCP-Server
für die Netzwerkkarte mit der Netzwerkadresse 00240113E872 zugeteilt werden. Der
folgende Fehler ist aufgetreten: %%121. Es wird weiterhin im Hintergrund versucht,
eine Adresse vom Netzwerkadressserver (DHCP) zugeteilt zu bekommen.
< End of report >
Geändert von Xtremx3 (10.01.2011 um 00:09 Uhr) |
|
10.01.2011, 14:02
| #4 |
| /// Malware-holic | Windows Security Alert - wie bekomm ich den weg ? bitte füge in meinem script deinen benutzernamen ein, sonst klappts nicht :-) • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. :OTL :Files C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Temp\tknmgbxqg :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. öffne den internet explorer, extras, internet optionen, dort verbindung, lanverbindung. lösche den eintrag bei proxy server. wähle dann, keinen proxy verwenden. übernehmen, ok. öffne den arbeitsplatz, c: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. lade das archiv in unserem upload channel hoch. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.01.2011, 14:51
| #5 |
| | Windows Security Alert - wie bekomm ich den weg ? Oke, ich habs hochgeladen. Ähm, ich verwende Mozilla Firefox nicht den Internet Explorer. Ich hab den zwar installiert aber da kommt immer eine Fehlermeldung mit Problem Senden & Problem nicht senden. Deswegen benutze ich den nie... Aber hier das Textdokument: All processes killed ========== OTL ========== ========== FILES ========== C:\Dokumente und Einstellungen\Name\Lokale Einstellungen\Temp\tknmgbxqg folder moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: Administrator User: All Users User: Default User User: LocalService User: Name ->Flash cache emptied: 17598137 bytes User: NetworkService Total Flash Files Cleaned = 17,00 mb [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 116131 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 1064168 bytes ->Temporary Internet Files folder emptied: 580565 bytes User: Name ->Temp folder emptied: 37828134 bytes ->Temporary Internet Files folder emptied: 2180557 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 111232126 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: NetworkService ->Temp folder emptied: 2132184 bytes ->Temporary Internet Files folder emptied: 667424 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2134333 bytes %systemroot%\System32 .tmp files removed: 2951 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 151,00 mb OTL by OldTimer - Version 3.2.20.1 log created on 01102011_144443 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
10.01.2011, 15:20
| #6 |
| /// Malware-holic | Windows Security Alert - wie bekomm ich den weg ? dann öffne mal den arbeitsplatz, systemsteuerung, internet optionen, lanverbindung und dann mit den proxy einstellungen so verfahren wie beschrieben bitte.
__________________ --> Windows Security Alert - wie bekomm ich den weg ? |
|
10.01.2011, 15:36
| #7 |
| | Windows Security Alert - wie bekomm ich den weg ? Oke, hab ich gemacht. |
|
10.01.2011, 15:39
| #8 |
| /// Malware-holic | Windows Security Alert - wie bekomm ich den weg ? sehr gut. download malwarebytes: Malwarebytes instalieren, öffnen, registerkarte aktualisierung, programm updaten. schalte alle laufenden programme ab, trenne die internetverbindung. registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.01.2011, 23:18
| #9 |
| | Windows Security Alert - wie bekomm ich den weg ? Oke, hab ich auch gemacht : ) Hier der Log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5495 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 10.01.2011 23:17:12 mbam-log-2011-01-10 (23-17-12).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|) Durchsuchte Objekte: 344766 Laufzeit: 6 Stunde(n), 43 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 2 Infizierte Speichermodule: 1 Infizierte Registrierungsschlüssel: 16 Infizierte Registrierungswerte: 17 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 19 Infizierte Dateien: 333 Infizierte Speicherprozesse: c:\programme\application updater\applicationupdater.exe (PUP.Dealio) -> 676 -> Unloaded process successfully. c:\programme\search settings\searchsettings.exe (PUP.Dealio) -> 2104 -> Unloaded process successfully. Infizierte Speichermodule: c:\programme\search settings\searchsettingsres409.dll (PUP.Dealio) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\SearchSettings.BHO.1 (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\SearchSettings.BHO (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\qni8hj710fdl (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Dealio (PUP.Dealio) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Refog Software (Refog.Keylogger) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\APPLICATION UPDATER\APPLICATIONUPDATER.EXE (PUP.Dealio) -> Value: APPLICATIONUPDATER.EXE -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\SEARCHSETTINGS.EXE (PUP.Dealio) -> Value: SEARCHSETTINGS.EXE -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchSettings (PUP.Dealio) -> Value: SearchSettings -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\SEARCHSETTINGSRES409.DLL (PUP.Dealio) -> Value: SEARCHSETTINGSRES409.DLL -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Value: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\SEARCHSETTINGS.DLL (PUP.Dealio) -> Value: SEARCHSETTINGS.DLL -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Value: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\COMPONENTS\DEALIOTOOLBARFF.DLL (Adware.WidgiToolbar) -> Value: DEALIOTOOLBARFF.DLL -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\SEARCH SETTINGS\FF\COMPONENTS\SEARCHSETTINGSFF.DLL (PUP.Dealio) -> Value: SEARCHSETTINGSFF.DLL -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\SEARCHSETTINGS@SPIGOT.COM (PUP.Dealio) -> Value: SEARCHSETTINGS@SPIGOT.COM -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\MOZILLA FIREFOX\EXTENSIONS\DEALIO@MYBROWSERBAR.COM (PUP.Dealio) -> Value: DEALIO@MYBROWSERBAR.COM -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\iymoxksp (Trojan.FakeAlert.Gen) -> Value: iymoxksp -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\CHROME.MANIFEST (PUP.Dealio) -> Value: CHROME.MANIFEST -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\INSTALL.RDF (PUP.Dealio) -> Value: INSTALL.RDF -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAMME\DEALIO TOOLBAR\FF\CHROME\LOCALE\EN-US\WIDGITOOLBARPLUGIN.PROPERTIES (PUP.Dealio) -> Value: WIDGITOOLBARPLUGIN.PROPERTIES -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Refog.Keylogger) -> Bad: (c:\windows\system32\userinit.exe,C:\Programme\refogkl\MPK.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully. Infizierte Verzeichnisse: c:\dokumente und einstellungen\all users\anwendungsdaten\MPK (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\2 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\CPDA (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\CPDM (Refog.Keylogger) -> Quarantined and deleted successfully. c:\programme\dealio toolbar (PUP.Dealio) -> Delete on reboot. c:\programme\dealio toolbar\FF (PUP.Dealio) -> Delete on reboot. c:\programme\dealio toolbar\FF\chrome (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\locale (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\locale\EN-US (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\components (PUP.Dealio) -> Delete on reboot. c:\programme\dealio toolbar\IE (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\IE\4.0.2 (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res (PUP.Dealio) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio (PUP.Dealio) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\res (PUP.Dealio) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\temp (PUP.Dealio) -> Quarantined and deleted successfully. Infizierte Dateien: c:\programme\application updater\applicationupdater.exe (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\search settings\searchsettings.exe (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\search settings\searchsettingsres409.dll (PUP.Dealio) -> Delete on reboot. c:\programme\dealio toolbar\IE\4.0.2\dealiotoolbarie.dll (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\search settings\searchsettings.dll (PUP.Dealio) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\anwendungsdaten\desktopicon\ebayshortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\Desktop\Virus  \towerdefence.exe (Backdoor.Bot) -> Quarantined and deleted successfully.c:\dokumente und einstellungen\Name\eigene dateien\dvdvideosoft\downloads\account hacker 1.3.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\widgihelper.exe (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\components\dealiotoolbarff.dll (Adware.WidgiToolbar) -> Delete on reboot. c:\programme\search settings\FF\components\searchsettingsff.dll (PUP.Dealio) -> Delete on reboot. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240037.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240038.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240040.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240048.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240050.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240059.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240060.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\system volume information\_restore{8b5ee441-9696-4622-8e01-81e0abbcef98}\RP263\A0240061.exe (Backdoor.Bot) -> Quarantined and deleted successfully. c:\_OTL\movedfiles\01102011_144443\c_dokumente und einstellungen\Name\lokale einstellungen\Temp\tknmgbxqg\cmfoeoklajb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\programme\mozilla firefox\extensions\searchsettings@spigot.com (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\mozilla firefox\extensions\dealio@mybrowserbar.com (PUP.Dealio) -> Quarantined and deleted successfully. c:\WINDOWS\system32\winsvncs.txt (Malware.Trace) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\refog free keylogger.lnk (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40463_9251980208 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6054426273 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6064181019 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6070328009 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6070391204 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6070420139 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654241782 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654579977 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654712037 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6654853009 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6655015856 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6655176736 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656475232 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656605440 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656697685 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656724769 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656751968 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656779051 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656802546 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40464_6656907407 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40465_9599229514 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40467_7066974074 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40467_8949918518 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40467_8950327315 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6765342824 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817314005 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817565394 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817681134 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40470_6817876505 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_7600414120 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_7609740278 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_8128855556 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9681360301 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9682899306 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9683646181 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9683776389 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684071181 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684306250 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684432870 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40471_9684528704 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6117379167 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6254909838 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255000347 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255027431 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255058218 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255083449 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255108796 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6255291435 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_6546070139 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_9422799074 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_9423095602 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40472_9935020602 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_0831237269 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_0831324074 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_0831542940 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_6973600232 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40473_7399323611 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0538279398 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0669806134 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0670028472 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0670489699 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0670974306 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0995576505 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996128009 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996196759 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996307060 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_0996513310 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_1007014931 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_1008756481 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_1009494329 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_5742390046 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9028680093 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9028826620 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9029115972 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9029956944 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40474_9030085301 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0244026620 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0347303588 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0347421065 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0347808102 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0926906019 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_0927405208 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1197081134 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1198209606 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1198858796 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199133681 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199274769 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199392361 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199511690 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1199665394 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1200253125 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1200801042 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1201410532 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1201493750 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1325307407 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1325479167 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1325884259 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1326012732 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1326175463 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1326363542 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_1327112269 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6564203472 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6564400579 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6564574190 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6565069792 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6624001736 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6624515278 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6625000000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6629501157 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6629613310 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6633751042 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6634324306 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6634532292 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6634982639 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6635261111 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6635722222 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6635970023 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636101968 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636364236 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636545139 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636722338 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6636879630 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637058681 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637228704 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637561458 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6637868866 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6638250463 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40475_6658685880 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40477_7367616088 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40481_4763550694 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40482_6390116782 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40483_6119267130 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40487_6231315046 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40494_8202963542 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7524929398 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7578441435 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7580953356 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7581481481 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7582199421 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7582515856 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40504_7582747338 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339049769 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339301157 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339621296 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9339785880 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9340015509 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9340557986 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9341749769 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9342762500 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9343880208 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9343963310 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9344091782 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40506_9344200231 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40510_6517321296 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7246994329 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7274600231 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7274954745 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40512_7275159144 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7434935532 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931524884 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931633333 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931740046 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_7931980556 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40514_8050768519 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6219231019 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6219471528 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6219896528 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6220046644 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6220294329 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6220838657 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6221097338 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6221337847 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6495609028 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6499963773 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6500802893 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6500981944 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6501123032 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6501524421 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6516048148 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6587290162 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6587516204 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40515_6603797685 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_6521840625 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_7610479861 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8251090394 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8486045949 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8909031366 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910027778 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910190509 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910335185 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_8910461806 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40516_9936960995 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40518_6821659722 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40518_6822101042 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40523_7593153819 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40523_7594088773 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40523_7833531019 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40524_8432819676 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8515666551 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8527204398 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8528985764 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8532116204 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8533005903 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8533696759 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8537953819 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8552020023 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8552358218 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40529_8556839468 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40531_0077803704 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40539_6500694444 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40539_6502685532 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40539_6503061690 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679835764 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679882755 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679900810 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679918981 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679958681 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6679976852 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40542_6685286458 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40543_0597965394 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40543_0599739583 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40549_8920549306 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40550_6630224537 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40550_6631221065 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7096175926 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7170985532 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7207157060 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\i40552_7207511458 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\2\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\2\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\MPK\CPDM\cpfm.bin (Refog.Keylogger) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome.manifest (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\install.rdf (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\chevron.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\chevron.xul (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\login.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\login.xul (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\parser.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\rsstickerwidget.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\searchbox.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\searchbox.xul (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgichevron.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgicomm.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgihandling.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgilisteners.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgitoolbarplugin.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgitoolbarplugin.xul (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\content\widgiui.js (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\locale\EN-US\searchbox.dtd (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\locale\EN-US\yahoo-search.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\apple.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\barnes.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\bestbuy.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\dealio_logo.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\dealio_logo_hover.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\icon_settings.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\macys.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\newegg.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\overstock.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search-button-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search-button.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search-chevron-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search-chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\searchbox.css (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search_amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search_dealio.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search_ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\search_yahoo.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\separator.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\target.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\walmart.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\chrome\skin\widgitoolbarplugin.css (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\components\config.ini (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\components\ifbhohelperwidgitoolbar.xpt (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\FF\components\ifbhowidgitoolbar.xpt (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\IE\4.0.2\config.ini (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\apple.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\barnes.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\bestbuy.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\dealio_logo.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\dealio_logo_hover.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\icon_settings.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\macys.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\newegg.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\overstock.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search-button-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search-button.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search-chevron-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search-chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search_amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search_dealio.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search_ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\search_yahoo.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\target.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\walmart.gif (PUP.Dealio) -> Quarantined and deleted successfully. c:\programme\dealio toolbar\Res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Name\anwendungsdaten\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml (PUP.Dealio) -> Quarantined and deleted successfully. |
|
11.01.2011, 14:48
| #10 |
| /// Malware-holic | Windows Security Alert - wie bekomm ich den weg ? bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
11.01.2011, 16:31
| #11 |
| | Windows Security Alert - wie bekomm ich den weg ? Oke. Hier ist es: Combofix Logfile: Code:
ATTFilter ComboFix 11-01-10.07 - Name 11.01.2011 15:33:53.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2047.1203 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Name\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
* Neuer Wiederherstellungspunkt wurde erstellt
Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\dokumente und einstellungen\Name\Anwendungsdaten\Desktopicon
c:\dokumente und einstellungen\Name\Anwendungsdaten\Desktopicon\config.ini
c:\programme\Search Settings
c:\programme\Search Settings\FF\chrome.manifest
c:\programme\Search Settings\FF\chrome\content\plugin.js
c:\programme\Search Settings\FF\chrome\content\plugin.xul
c:\programme\Search Settings\FF\chrome\content\protection.js
c:\programme\Search Settings\FF\chrome\content\utils.js
c:\programme\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
c:\programme\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
c:\programme\Search Settings\FF\components\IFBHOSearch.xpt
c:\programme\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
c:\programme\Search Settings\FF\components\IFHelperPreferences.xpt
c:\programme\Search Settings\FF\install.rdf
c:\programme\update.exe
E:\autorun.inf
E:\install.exe
.
((((((((((((((((((((((( Dateien erstellt von 2010-12-11 bis 2011-01-11 ))))))))))))))))))))))))))))))
.
2011-01-11 14:25 . 2011-01-11 14:25 -------- d-----w- c:\dokumente und einstellungen\Name\Lokale Einstellungen\Anwendungsdaten\Babylon
2011-01-11 14:25 . 2010-10-17 14:12 142336 ----a-w- c:\programme\Mozilla Firefox\BabyFox.dll
2011-01-11 14:25 . 2011-01-11 14:25 -------- d-----w- c:\programme\Babylon
2011-01-11 14:25 . 2011-01-11 14:35 -------- d-----w- c:\dokumente und einstellungen\Name\Anwendungsdaten\Babylon
2011-01-11 14:25 . 2011-01-11 14:34 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Babylon
2011-01-10 15:21 . 2011-01-10 15:21 -------- d-----w- c:\dokumente und einstellungen\Name\Anwendungsdaten\Malwarebytes
2011-01-10 15:21 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-10 15:20 . 2011-01-10 15:20 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-01-10 15:20 . 2011-01-10 15:21 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2011-01-10 15:20 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-10 13:44 . 2011-01-10 13:49 -------- d-----w- C:\_OTL
2010-12-18 20:35 . 2010-12-18 20:35 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\softonic-de3
2010-12-18 20:35 . 2010-12-18 20:35 -------- d-sh--w- c:\dokumente und einstellungen\NetworkService\IETldCache
2010-12-18 20:35 . 2010-12-18 20:35 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\techno4ever
2010-12-18 20:35 . 2010-12-18 20:35 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\DVDVideoSoftTB
2010-12-18 20:35 . 2010-12-18 20:35 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Apple
2010-12-18 15:48 . 2010-12-18 15:48 -------- d-----w- c:\dokumente und einstellungen\Name\Anwendungsdaten\PhotoScape
2010-12-18 15:48 . 2010-12-18 15:48 -------- d-----w- c:\programme\PhotoScape
2010-12-13 14:45 . 2010-12-13 14:47 -------- d-----w- c:\dokumente und einstellungen\Name\Anwendungsdaten\Apple Computer
2010-12-13 14:45 . 2009-05-18 12:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-12-13 14:45 . 2008-04-17 11:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-12-13 14:45 . 2010-12-13 14:45 -------- d-----w- c:\programme\iPod
2010-12-13 14:45 . 2010-12-13 14:45 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-12-13 14:43 . 2010-12-13 14:43 -------- d-----w- c:\programme\Bonjour
2010-12-13 14:43 . 2010-12-13 14:45 -------- d-----w- c:\programme\Gemeinsame Dateien\Apple
2010-12-13 14:43 . 2010-12-13 14:43 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 15:21 . 2010-01-21 19:13 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-28 15:18 . 2009-09-12 14:46 138464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-11-28 15:17 . 2009-09-12 14:45 111928 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-23 16:25 . 2009-08-29 22:15 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2008-02-14 12:23 . 2008-02-14 12:23 231944 ----a-w- c:\programme\gwflash.exe
2007-09-21 17:42 . 2007-09-21 17:42 19008 ----a-w- c:\programme\markfun.a64
2007-08-21 17:49 . 2007-08-21 17:49 125504 ----a-w- c:\programme\MarkFunDrv.dll
2007-08-21 17:49 . 2007-08-21 17:49 17912 ----a-w- c:\programme\markfun.w32
2007-03-02 02:48 . 2007-03-02 02:48 240448 ----a-w- c:\programme\gwf32.exe
2006-11-23 21:47 . 2006-11-23 21:47 207680 ----a-w- c:\programme\BIOS_Run.exe
2006-11-23 21:40 . 2006-11-23 21:40 60224 ----a-w- c:\programme\HUADRV.DLL
2005-04-27 17:40 . 2005-04-27 17:40 6800 ----a-w- c:\programme\W95_HUA.vxd
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2010-06-13 138552]
"{33b974a8-e892-4f5f-bd17-f7b0331843d5}"= "c:\programme\techno4ever\tbtec1.dll" [2010-06-24 2515552]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\programme\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
[HKEY_CLASSES_ROOT\clsid\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]
2010-06-24 13:34 2515552 ----a-w- c:\programme\techno4ever\tbtec1.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 09:08 2393184 ----a-w- c:\programme\DVDVideoSoftTB\tbDVDV.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-06-03 17:24 2736736 ----a-w- c:\programme\softonic-de3\tbsoft.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2010-06-13 16:25 1438520 ----a-r- c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-06-13 1438520]
"{33b974a8-e892-4f5f-bd17-f7b0331843d5}"= "c:\programme\techno4ever\tbtec1.dll" [2010-06-24 2515552]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\programme\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
[HKEY_CLASSES_ROOT\clsid\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-06-13 1438520]
"{33B974A8-E892-4F5F-BD17-F7B0331843D5}"= "c:\programme\techno4ever\tbtec1.dll" [2010-06-24 2515552]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\programme\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
"{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
[HKEY_CLASSES_ROOT\clsid\{33b974a8-e892-4f5f-bd17-f7b0331843d5}]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"BitTorrent DNA"="c:\programme\DNA\btdna.exe" [2010-01-19 323392]
"Pando Media Booster"="c:\programme\Pando Networks\Media Booster\PMB.exe" [2010-08-25 2937528]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2010-12-03 14944136]
"msnmsgr"="c:\programme\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]
"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2009-08-12 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-09-29 148888]
"Realtime Audio Engine"="mmrtkrnl.exe" [2009-11-23 70144]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]
"PCSuiteTrayApplication"="c:\programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 222208]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"ANIWZCS2Service"="c:\programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="e:\itunes\iTunesHelper.exe" [2010-11-17 421160]
"DeathAdder"="c:\programme\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"BabylonToolbar"="c:\programme\BabylonToolbar\BabylonToolbar\1.4.19.5\BabylonToolbarsrv.exe" [2010-11-07 286720]
"Babylon Client"="c:\programme\Babylon\Babylon-Pro\Babylon.exe" [2010-10-17 3825080]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"PcSync"="c:\programme\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]
c:\dokumente und einstellungen\Name\Startmen\Programme\Autostart\
CurseClientStartup.ccip [2010-11-14 0]
Xfire.lnk - c:\programme\Xfire\Xfire.exe [2010-7-9 3493776]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G DWL-G510]
2007-10-24 13:30 1552384 ----a-w- c:\programme\D-Link\AirPlus G DWL-G510\AirGCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-06-03 00:50 1144104 ----a-w- c:\programme\DivX\DivX Update\DivXUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 15:44 3883840 ----a-w- c:\programme\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\GIGABYTE\\@BIOS\\gwflash.exe"=
"c:\\Programme\\GIGABYTE\\@BIOS\\update.exe"=
"c:\\Programme\\gwflash.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Xfire\\Xfire.exe"=
"c:\\Programme\\Valve\\hl.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Dokumente und Einstellungen\\Name\\Eigene Dateien\\Games\\teeworlds-0.5.1-win32\\teeworlds_srv.exe"=
"c:\\Programme\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Programme\\TmNationsForever\\TmForever.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\Age of Empires\\Empires.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"e:\\cod\\Call of Duty - World at War\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Programme\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"e:\\1234\\Warcraft 3 & Frozen Throne\\Warcraft III.exe"=
"e:\\Empire Earth\\Empire Earth.exe"=
"c:\\Programme\\Tunngle\\tnglctrl.exe"=
"c:\\Programme\\Tunngle\\tunngle.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"e:\\iTunes\\iTunes.exe"=
"e:\\1234\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Dokumente und Einstellungen\\Name\\Lokale Einstellungen\\Apps\\2.0\\Z6NKCKRW.P12\\9ZKH9C2D.JMP\\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\\CurseClient.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56764:TCP"= 56764:TCP:Pando Media Booster
"56764:UDP"= 56764:UDP:Pando Media Booster
"58759:TCP"= 58759:TCP:Pando Media Booster
"58759:UDP"= 58759:UDP:Pando Media Booster
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [21.01.2010 20:13 135336]
R2 TunngleService;TunngleService;c:\programme\Tunngle\TnglCtrl.exe [12.09.2009 20:02 716024]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [09.09.2009 15:50 22784]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [12.09.2009 20:02 27136]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [08.02.2010 16:52 135664]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [05.02.2010 19:27 4352]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [05.02.2010 19:26 265088]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [08.09.2004 09:10 17018]
S4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\programme\Microsoft SQL Server\100\Shared\sqladhlp.exe [11.07.2008 01:27 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [10.07.2008 02:49 242712]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [05.09.2009 21:26 691696]
S4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11.07.2008 01:27 369688]
.
Inhalt des "geplante Tasks" Ordners
2011-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]
2011-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-08 15:52]
2011-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-02-08 15:52]
2010-07-02 c:\windows\Tasks\wavepadShakeIcon.job
- c:\programme\NCH Swift Sound\WavePad\wavepad.exe [2010-06-27 20:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.babylon.com/home?AF=16511
mStart Page = hxxp://home.sweetim.com
uInternet Settings,ProxyOverride = <local>
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\Name\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Save YouTube Video as MP3 - c:\programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Translate this web page with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} - hxxp://www.fiaa.eu/OPLauncher.cab
FF - ProfilePath - c:\dokumente und einstellungen\Name\Anwendungsdaten\Mozilla\Firefox\Profiles\rlivjw60.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://home.sweetim.com
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: techno4ever Toolbar: {33b974a8-e892-4f5f-bd17-f7b0331843d5} - %profile%\extensions\{33b974a8-e892-4f5f-bd17-f7b0331843d5}
FF - Ext: Html Validator: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} - %profile%\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
FF - Ext: iMacros for Firefox: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} - %profile%\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: softonic-de3 Toolbar: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - %profile%\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
FF - Ext: Elf 1 Community Toolbar: {22e03916-85c5-44b0-8dc9-1830c11238d9} - %profile%\extensions\{22e03916-85c5-44b0-8dc9-1830c11238d9}
FF - Ext: Babylon: ffxtlbr@babylon.com - %profile%\extensions\ffxtlbr@babylon.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-01-11 15:37
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Zeit der Fertigstellung: 2011-01-11 15:39:22
ComboFix-quarantined-files.txt 2011-01-11 14:39
Vor Suchlauf: 1.211.969.536 Bytes frei
Nach Suchlauf: 1.245.741.056 Bytes frei
- - End Of File - - AEF5B1D1BB97A9F034466DD49FA7148E
|
|
11.01.2011, 17:35
| #12 |
| /// Malware-holic | Windows Security Alert - wie bekomm ich den weg ? lade den CCleaner slim: Piriform - Builds falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
11.01.2011, 21:50
| #13 |
| | Windows Security Alert - wie bekomm ich den weg ? Hier die Liste: Adobe Flash Player 10 Plugin Adobe Systems Incorporated 10.1.102.64 ->Notwendig Adobe Reader 8.2.4 - Deutsch Adobe Systems Incorporated 8.2.4 ->Notwendig AirPlus G DWL-G510 D-Link ->Unbekannt ANIO Service ->Unbekannt ANIWZCS2 Service ->Unbekannt Apple Application Support Apple Inc. 1.4.1 ->Unnötig Apple Mobile Device Support Apple Inc. 3.3.0.69 ->Unnötig Apple Software Update Apple Inc. 2.1.2.120 ->Unnötig Babylon Babylon -> Unnötig Babylon toolbar -> Unnötig Bonjour Apple Inc. 2.0.4.0 -> Unnötig Canon PhotoRecord -> Notwendig Cheat Engine 5.6.1 Dark Byte -> Unnötig CreepSmash.com 2010 CreepSmash.com GNU General Public License Version 3 -> Notwendig Curse Client Curse 4.0.1.104 -> Notwendig Dealio Toolbar v4.0.2 ->Unnötig DivX-Setup DivX, Inc. 1.0.2.22 ->Unnötig DNA BitTorrent Inc. 2.2.4 (16502) ->Unbekannt DVDVideoSoftTB Toolbar ->Unnötig FL Studio 8 Image-Line bvba ->Unnötig GIMP 2.6.10 The GIMP Team 2.6.10 ->Notwendig Google Chrome Google Inc. 8.0.552.224 ->Notwendig Google Earth Google 5.2.1.1588 ->Notwendig IL Download Manager Image-Line bvba ->Unnötig iTunes Apple Inc. 10.1.0.56 ->Notwendig Java(TM) 6 Update 13 ->Notwendig Malwarebytes' Anti-Malware Malwarebytes Corporation ->Notwendig Microsoft .NET Framework 2.0 Service Pack 2 ------ Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU | Microsoft .NET Framework 3.0 Service Pack 2 | Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU | Microsoft .NET Framework 3.5 Language Pack SP1 - deu | Microsoft .NET Framework 3.5 SP1 | Microsoft Application Error Reporting | Microsoft Choice Guard | Microsoft Office XP Professional mit FrontPage | Microsoft Silverlight Microsoft Corporation 3.0.50106.0 |------ Unbekannt(, aber ich denke mal das die Notwendig sind) Microsoft SQL Server 2008 Common Files | Microsoft SQL Server 2008 Database Engine Services | Microsoft SQL Server 2008 Database Engine Shared | Microsoft SQL Server 2008 Management Objects | Microsoft SQL Server 2008 Native Client | Microsoft SQL Server 2008 RsFx Driver | Microsoft SQL Server 2008 Setup Support Files (English) | Microsoft SQL Server 2008-Browser | Microsoft SQL Server Compact 3.5 SP1 (Deutsch) | Microsoft SQL Server Compact 3.5 SP1 Design Tools (Deutsch) | Microsoft SQL Server VSS Writer ------ Microsoft Visual C# 2008 Express Edition with SP1 - DEU ->Unnötig Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 ->Unnötig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 ->Unnötig Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - deu ->Unnötig Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32 -> Unnötig MSN ->Unnötig MSVCRT ->Unbekannt MSXML 4.0 SP2 (KB954430) ->Unbekannt MSXML 4.0 SP2 (KB973688) ->Unbekannt MSXML 6.0 Parser (KB933579) ->Unbekannt Neffy 1,3,29,0 CDNetworks 1,3,29,0 -> Unbekannt Nero 7 Essentials ->Notwendig neroxml ->Unbekannt Nokia Connectivity Cable Driver ->Unnötig Nokia PC Suite -> Unnötig NVIDIA PhysX ->Unbekannt OpenOffice.org 3.1 ->Notwendig Pando Media Booster Pando Networks Inc. 2.3.3.6 ->Unbekannt PC Connectivity Solution ->Unbekannt Phase 5 HTML-Editor ->Notwendig PhotoScape ->Notwendig PoiZone Image-Line bvba ->Unbekannt Prototype(TM) ->Notwendig QuickTime Apple Inc. 7.68.75.0 -> Unbekannt Search Settings v1.2.3 ->Unbekannt Segoe UI ->Unbekannt Skype Toolbars Skype Technologies S.A. 5.0.4137 ->Unnötig Skype™ 5.0 Skype Technologies S.A. 5.0.156 ->Notwendig softonic-de3 Toolbar softonic-de3 5.7.1.1 ->Unnötig Sql Server Customer Experience Improvement Program ->Unbekannt SQL Server System CLR Types ->Unbekannt Styler ->Unnötig SweetIM Toolbar for Internet Explorer 3.9 SweetIM Technologies Ltd. 3.9.0009 ->Unnötig TeamSpeak 3 Client TeamSpeak Systems GmbH ->Notwendig Toxic Biohazard Image-Line bvba ->Unbekannt Tunngle beta Tunngle.net GmbH ->Notwendig WavePad Sound Editor NCH Software ->Notwendig WebFldrs XP ->Unbekannt Windows Live Anmelde-Assistent ->Unnötig Windows Live Call ->Unnötig Windows Live Communications Platform ->Unnötig Windows Live Essentials ->Unnötig Windows Live Messenger ->Unnötig Windows Live-Uploadtool ->Unnötig Windows Media Player Firefox Plugin ->Notwendig |
|
12.01.2011, 14:22
| #14 |
| /// Malware-holic | Windows Security Alert - wie bekomm ich den weg ? Adobe Reader 8 ersetzen: Adobe - Adobe Reader herunterladen - Alle Versionen bitte den mcafee security scan nicht mit instalieren. öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus. so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden. unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken. unter update, auf instalieren stellen. klicke übernehmen /ok deinstaliere: Babylon beide Bonjour Cheat Engine Dealio Toolbar DivX DNA DVDVideoSoftTB Toolbar -> FL Studio IL Download Manager Microsoft Silverlight Microsoft SQL Server falls nich verwendet, alle weg. Microsoft Windows SDK for Visual Studio Microsoft Windows SDK for Visual Studio 2008 SP1 MSN Nokia beide PC Connectivity Solution Search Settings Skype Toolbars softonic Sql Server beide Styler SweetIM Toolbar windows live, alle bereinige dann dateien + registry mit dem ccleaner
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.01.2011, 16:19
| #15 |
| | Windows Security Alert - wie bekomm ich den weg ? Hab ich gemacht : ) |
|
| Themen zu Windows Security Alert - wie bekomm ich den weg ? |
| ahnung, alert, antivurs, aufeinmal, canon, hkus\s-1-5-18, leute, msiexec, pando media booster, plug-in, scan, security, security alert, spigot, troja, trojaner, windows, windows security, windows security alert |
Linear-Darstellung
