windows security alert trojaner virus

fred.werk · 14.05.2011, 11:42

Hallo,

ich habe genau das gleiche Problem wie hier geschildert:
http://www.trojaner-board.de/98891-w...-trojaner.html

Habe alles wie beschrieben mit OTL gescannt...
Nun weiß was ich nach dem Scan in die OTL Textbox kopieren soll, da bei mir natürlich nicht die 2 gleichen Textdateien wie bei ihm erstellt hat..

bitte um hilfe.

Danke schon mal im vorraus

mfg
fred.werk

fred.werk · 14.05.2011, 11:53

Hier mein OTL.txt Datei:

Code:

ATTFilter

OTL logfile created on: 14.05.2011 11:53:48 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Andi\Documents\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 73,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,99 Gb Total Space | 193,19 Gb Free Space | 64,83% Space Free | Partition Type: NTFS
 
Computer Name: ANDI-PC | User Name: Andi | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Andi\Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Andi\Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Radio.fx) -- C:\Programme\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (Akamai) -- c:\Programme\Common Files\Akamai\netsession_win_3f211bc.dll ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (MyWebSearchService) -- C:\Programme\MyWebSearch\bar\2.bin\MWSSVC.EXE (MyWebSearch.com)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (Application Updater) -- C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (UleadBurningHelper) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (NAUpdate) -- C:\Program Files\Nero\Update\NASvc.exe (Nero AG)
SRV - (Norton Internet Security) -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (ASUSRDVDService) -- C:\Programme\ASUS\AI Recovery\ServiceSimple2.exe ()
SRV - (ASLDRService) -- C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe ()
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (ADSMService) -- C:\Programme\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)
SRV - (ATKGFNEXSrv) -- C:\Programme\ATKGFNEX\GFNEXSrv.exe ()
SRV - (spmgr) -- C:\Programme\ASUS\NB Probe\SPM\spmgr.exe ()
SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS (Symantec Corporation)
DRV - (SRTSP) -- C:\Windows\System32\drivers\NIS\1000000.07D\srtsp.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS (Symantec Corporation)
DRV - (SRTSPX) -- C:\Windows\System32\drivers\NIS\1000000.07D\srtspx.sys (Symantec Corporation)
DRV - (AsDsm) -- C:\Windows\System32\drivers\AsDsm.sys (ASUSTek Computer Inc)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (Beep) -- C:\Windows\System32\beep.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (VIAHdAudAddService) -- C:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (SRS_PremiumSound_Service) -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys ()
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (L1E) -- C:\Windows\System32\drivers\L1E60x86.sys (Atheros Communications, Inc.)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (lullaby) -- C:\Windows\system32\DRIVERS\lullaby.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (CRFILTER) -- C:\Windows\System32\drivers\CRFILTER.sys (Generic)
DRV - (ghaio) -- C:\Programme\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (ASMMAP) -- C:\Programme\ATKGFNEX\ASMMAP.sys ()
DRV - (ElbyCDFL) -- C:\Windows\System32\drivers\ElbyCDFL.sys (SlySoft, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKU\.DEFAULT\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKU\S-1-5-18\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/sk27211/
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5B C1 BD 11 30 F2 CB 01  [binary data]
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\..\URLSearchHook: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.3\dealioToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
FF - HKLM\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\2.bin [2011.04.05 21:19:51 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.3\dealioToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Engine\16.0.0.125\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Engine\16.0.0.125\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Programme\Dealio Toolbar\IE\4.3\dealioToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\16.0.0.125\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ACMON] C:\Programme\ASUS\Splendid\ACMON.exe (ATK)
O4 - HKLM..\Run: [ADSMTray] C:\Programme\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [AmIcoSinglun] C:\Programme\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)
O4 - HKLM..\Run: [ASUS Camera ScreenSaver]  File not found
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Programme\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4 - HKLM..\Run: [HControlUser] C:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] C:\Programme\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\Programme\MyWebSearch\bar\2.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [Standby] c:\Program Files\Common Files\Corel\Standby\Standby.exe (Corel)
O4 - HKLM..\Run: [TrayServer] C:\Programme\MAGIX\Video_deluxe_16_Download-Version\Trayserver.exe (MAGIX AG)
O4 - HKLM..\Run: [Wireless Console 3] C:\Programme\ASUS\Wireless Console 3\wcourier.exe ()
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [{2FD4436C-35CE-82F6-3A79-695BE8991817}] C:\Users\Andi\AppData\Roaming\Fegyo\suohe.exe (Apple Computer, Inc.)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [{8D69C444-C59B-509E-28CD-81A8013FB9FC}] C:\Users\Andi\AppData\Roaming\Polar\mili.exe (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [Jfafaquh]  File not found
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [Meebo Notifier] C:\Users\Andi\AppData\Local\Meebo\Meebo Notifier\MeeboNotifier.exe (Meebo, Inc.)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [MyWebSearch Email Plugin] C:\Programme\MyWebSearch\bar\2.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [rfxsrvtray] C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [SRS Premium Sound] C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe (SRS Labs, Inc.)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [vKLuVrOIsaEYCN] C:\ProgramData\vKLuVrOIsaEYCN.exe (QNP)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} hxxp://www.lokalisten.de/iup/ImageUploader4.cab (Image Uploader Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{033981c7-f17d-11de-9930-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{033981c7-f17d-11de-9930-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1B04E893-65FC-74B1-51CC-022FE01EBAC7} - Internet Explorer
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7B1B3A11-0652-B943-F7F3-DA27015A26D3} - Internet Explorer
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.dvacm - c:\Programme\Common Files\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (hxxp://www.mp3dev.org/)
Drivers32: msacm.mpegacm - C:\Programme\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.ulmp3acm - C:\Programme\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.14 11:04:16 | 000,000,000 | -H-D | C] -- C:\Users\Andi\Desktop\Neuer Ordner
[2011.05.13 20:35:53 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011.05.13 20:30:22 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\beep.sys
[2011.05.13 20:27:22 | 000,334,848 | -H-- | C] (QNP) -- C:\ProgramData\vKLuVrOIsaEYCN.exe
[2011.05.10 18:18:33 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Local\{EF113030-CAF6-4AA0-80ED-D8790A2F0D85}
[2011.04.30 14:37:59 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MinecraftAlpha
[2011.04.30 14:37:56 | 000,000,000 | ---D | C] -- C:\Programme\MinecraftAlpha
[2011.04.30 14:11:23 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Roaming\.minecraft
[2011.04.27 19:12:29 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Roaming\muvee Technologies
[2011.04.27 19:11:10 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\muvee Reveal
[2011.04.27 19:10:50 | 000,000,000 | ---D | C] -- C:\Programme\muvee Technologies
[2011.04.27 19:09:58 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\muvee Technologies
[2011.04.27 19:06:31 | 000,000,000 | -H-D | C] -- C:\ProgramData\muvee Technologies
[2011.04.24 16:43:27 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Local\{6F844C49-CC63-49E2-AD07-739B3F072E3D}
[2011.04.23 14:11:00 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Local\{5F85E6C5-7370-409B-B5B1-1D547582EBFD}
[2011.04.22 22:42:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.04.22 22:42:35 | 000,000,000 | ---D | C] -- C:\Programme\ICQ6Toolbar
[2011.04.22 22:42:13 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Roaming\Mozilla
[2011.04.22 22:42:12 | 000,000,000 | -H-D | C] -- C:\ProgramData\ICQ
[2011.04.22 22:41:43 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Roaming\ICQ
[2011.04.22 22:41:29 | 000,000,000 | -H-D | C] -- C:\Programme\ICQ7.5
[2011.04.22 13:46:46 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Local\{5CA395DE-4DF3-43C1-8C31-DB17426ACA9C}
[2011.04.22 13:32:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CamStudio
[2011.04.22 13:31:59 | 000,000,000 | ---D | C] -- C:\Programme\CamStudio
[2011.04.20 23:24:22 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Local\{FA3A1B81-1708-4FFC-871B-4B3FA103EB8E}
[2011.04.19 21:29:55 | 000,000,000 | -H-D | C] -- C:\Users\Andi\AppData\Local\{5E923C56-47D8-4CF6-9765-6BB32FBBF3D4}
[2011.04.15 15:52:25 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.15 15:52:24 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.15 15:52:17 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.15 15:52:14 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.15 15:52:13 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.15 15:52:02 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.15 15:52:02 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.15 15:52:02 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.04.15 15:52:01 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.15 15:52:01 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.04.15 15:52:01 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.04.15 15:52:01 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.04.15 15:52:00 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.04.15 15:52:00 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.15 15:52:00 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.04.15 15:52:00 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.04.15 15:45:30 | 002,331,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.15 15:44:55 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2011.04.15 15:44:43 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011.04.15 15:36:36 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.04.15 15:36:35 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.04 20:44:41 | 003,002,471 | -H-- | C] (MyWebSearch.com) -- C:\Users\Andi\AppData\Local\mwsautSp.exe
[2010.08.25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2009.12.25 21:20:38 | 000,013,880 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
[2007.08.13 18:46:00 | 000,102,912 | -H-- | C] (Albert L Faber) -- C:\Users\Andi\AppData\Local\CDRip.dll
[2007.01.18 22:09:54 | 000,623,616 | -H-- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Andi\AppData\Local\No23 Recorder.exe
[2006.12.11 20:13:14 | 000,013,872 | -H-- | C] (Un4seen Developments) -- C:\Users\Andi\AppData\Local\basscd.dll
[2006.12.11 20:13:12 | 000,097,336 | -H-- | C] (Un4seen Developments) -- C:\Users\Andi\AppData\Local\bass.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.14 11:47:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.14 11:47:33 | 1583,153,152 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.14 11:46:39 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.14 11:46:39 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.14 11:18:55 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2011.05.13 20:35:46 | 296,224,887 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.05.13 20:30:30 | 000,000,472 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Andi.job
[2011.05.13 20:27:11 | 000,334,848 | -H-- | M] (QNP) -- C:\ProgramData\vKLuVrOIsaEYCN.exe
[2011.05.11 16:57:32 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.11 16:57:32 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.11 16:57:32 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.11 16:57:32 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.10 21:23:51 | 002,650,300 | -H-- | M] () -- C:\Users\Andi\Desktop\HSF - trick 1 - double flip.wmv
[2011.05.07 17:15:54 | 000,003,417 | -H-- | M] () -- C:\Users\Andi\.recently-used.xbel
[2011.05.06 15:34:57 | 000,005,642 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys
[2011.05.06 15:20:27 | 000,001,470 | -H-- | M] () -- C:\Users\Andi\AppData\Local\RecConfig.xml
[2011.05.01 14:55:41 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011.05.01 14:55:41 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2011.04.30 14:37:59 | 000,001,966 | -H-- | M] () -- C:\Users\Andi\Desktop\Minecraft+Updater.lnk
[2011.04.27 19:32:53 | 000,012,800 | -H-- | M] () -- C:\Users\Andi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.20 11:37:10 | 002,297,784 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.16 21:41:38 | 000,000,041 | -HS- | M] () -- C:\ProgramData\.zreglib
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.13 20:35:46 | 296,224,887 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.05.10 21:23:32 | 002,650,300 | -H-- | C] () -- C:\Users\Andi\Desktop\HSF - trick 1 - double flip.wmv
[2011.05.07 17:15:54 | 000,003,417 | -H-- | C] () -- C:\Users\Andi\.recently-used.xbel
[2011.05.01 14:55:41 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011.05.01 14:55:41 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011.04.30 14:37:59 | 000,001,966 | -H-- | C] () -- C:\Users\Andi\Desktop\Minecraft+Updater.lnk
[2011.01.30 17:11:14 | 000,000,000 | -H-- | C] () -- C:\Users\Andi\AppData\Local\Ubogakipipadaxuv.bin
[2011.01.30 17:11:13 | 000,000,120 | -H-- | C] () -- C:\Users\Andi\AppData\Local\Mtorivok.dat
[2011.01.24 19:08:41 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010.11.30 22:38:00 | 000,000,008 | -H-- | C] () -- C:\Users\Andi\AppData\Roaming\abpzlw.dat
[2010.11.30 21:54:44 | 000,000,004 | -H-- | C] () -- C:\Users\Andi\AppData\Roaming\avdrn.dat
[2010.11.13 18:20:44 | 000,000,088 | RHS- | C] () -- C:\ProgramData\940A4C5EB7.sys
[2010.11.13 18:20:43 | 000,005,642 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010.08.25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010.08.25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010.08.25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010.08.25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010.08.25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010.08.10 11:38:41 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010.08.10 11:38:41 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.08.10 11:38:37 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.08.10 11:38:36 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.08.10 11:38:34 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.05.16 12:20:55 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2010.04.05 14:56:48 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2010.01.14 16:58:36 | 000,012,800 | -H-- | C] () -- C:\Users\Andi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.31 14:48:25 | 000,001,470 | -H-- | C] () -- C:\Users\Andi\AppData\Local\RecConfig.xml
[2009.12.30 17:23:00 | 000,290,816 | ---- | C] () -- C:\Windows\System32\decdll.dll
[2009.12.26 18:40:46 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.12.26 14:02:36 | 000,056,832 | ---- | C] () -- C:\Windows\System32\Iyvu9_32.dll
[2009.12.26 14:00:54 | 000,000,020 | ---- | C] () -- C:\Windows\Ulead32.ini
[2009.12.26 13:49:39 | 000,006,537 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2009.12.26 12:31:29 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2009.12.25 21:30:42 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe
[2009.12.25 21:30:12 | 000,230,952 | ---- | C] () -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys
[2009.12.25 21:26:43 | 000,057,344 | ---- | C] () -- C:\Windows\System32\LogonStart.dll
[2009.11.28 23:49:01 | 000,095,245 | ---- | C] () -- C:\Windows\System32\dtnet.dat
[2009.07.14 10:47:43 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 002,297,784 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.07.14 00:09:19 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009.06.05 19:14:40 | 001,766,592 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2009.06.05 19:14:40 | 000,035,264 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.12.23 14:36:14 | 000,106,496 | ---- | C] () -- C:\Programme\Common Files\CPInstallAction.dll
[2008.05.22 09:35:54 | 000,051,962 | ---- | C] () -- C:\Programme\Common Files\banner.jpg
[2008.04.07 08:00:46 | 000,005,120 | ---- | C] () -- C:\Windows\System32\CRFILTER.dll
[2007.08.13 18:46:00 | 000,155,136 | -H-- | C] () -- C:\Users\Andi\AppData\Local\lame_enc.dll
[2006.10.26 02:06:48 | 000,064,000 | -H-- | C] () -- C:\Users\Andi\AppData\Local\vorbisenc.dll
[2006.10.26 02:06:48 | 000,019,456 | -H-- | C] () -- C:\Users\Andi\AppData\Local\vorbisfile.dll
[2006.10.26 02:06:46 | 000,143,872 | -H-- | C] () -- C:\Users\Andi\AppData\Local\vorbis.dll
[2006.10.26 02:06:36 | 000,015,872 | -H-- | C] () -- C:\Users\Andi\AppData\Local\ogg.dll
[2005.08.23 23:34:06 | 000,029,184 | -H-- | C] () -- C:\Users\Andi\AppData\Local\no23xwrapper.dll
[2005.02.05 21:46:00 | 000,004,608 | ---- | C] () -- C:\Windows\fgexec.dll
[2002.09.18 00:45:00 | 000,119,808 | ---- | C] () -- C:\Windows\lsb_un20.exe
 
========== LOP Check ==========
 
[2011.05.01 14:57:30 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\.minecraft
[2010.12.05 18:57:18 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\AnvSoft
[2010.02.05 15:32:59 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Facebook
[2010.02.13 09:08:30 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Fegyo
[2010.12.02 23:01:50 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\FreeHDConverter
[2009.12.30 17:23:42 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\FreeVideoConverter
[2011.05.07 17:15:54 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\gtk-2.0
[2011.05.09 18:11:50 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\ICQ
[2011.01.23 15:10:53 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\ImgBurn
[2010.12.15 19:36:35 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Loozs
[2010.04.05 15:01:18 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\MAGIX
[2010.08.03 23:45:22 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\ManyCam
[2010.08.08 23:29:51 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Meebo
[2011.04.27 19:35:20 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\muvee Technologies
[2010.12.15 19:35:21 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Polar
[2010.05.09 21:46:11 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Publish Providers
[2010.02.28 14:55:24 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\r2 Studios
[2011.04.20 11:42:27 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Ripu
[2010.12.15 19:36:35 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Roafme
[2010.12.09 23:27:07 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Screaming Bee
[2010.11.15 22:46:18 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Sony
[2010.11.15 22:49:52 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Sony Creative Software Inc
[2010.02.28 14:50:39 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Souptoys
[2010.05.23 14:03:30 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\SynthMaker
[2010.05.16 12:21:31 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Tobit
[2010.11.13 18:49:16 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Ulead Systems
[2011.05.14 11:30:16 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\uTorrent
[2010.08.10 11:18:40 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Video DVD Maker FREE
[2010.12.15 19:58:15 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Voof
[2010.03.15 20:50:04 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\WebcamMax
[2010.08.09 23:00:46 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Youtube Downloader HD
[2010.05.30 21:24:45 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.01 14:57:30 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\.minecraft
[2011.04.26 23:22:16 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Adobe
[2010.12.05 18:57:18 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\AnvSoft
[2009.12.26 13:30:03 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Apple Computer
[2010.04.06 22:40:52 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Avira
[2010.11.13 18:20:46 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Corel
[2010.08.29 18:00:52 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\DivX
[2010.02.05 15:32:59 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Facebook
[2010.02.13 09:08:30 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Fegyo
[2010.12.02 23:01:50 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\FreeHDConverter
[2009.12.30 17:23:42 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\FreeVideoConverter
[2011.05.07 17:15:54 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\gtk-2.0
[2011.05.09 18:11:50 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\ICQ
[2009.12.25 19:53:48 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Identities
[2011.01.23 15:10:53 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\ImgBurn
[2009.12.25 21:23:43 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\InstallShield
[2010.12.15 19:36:35 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Loozs
[2009.12.25 20:00:14 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Macromedia
[2010.04.05 15:01:18 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\MAGIX
[2010.08.03 23:45:22 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\ManyCam
[2009.07.14 10:56:41 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Media Center Programs
[2010.08.10 11:39:28 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Media Player Classic
[2010.08.08 23:29:51 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Meebo
[2010.12.05 15:11:08 | 000,000,000 | --SD | M] -- C:\Users\Andi\AppData\Roaming\Microsoft
[2011.04.22 22:42:13 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Mozilla
[2011.04.27 19:35:20 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\muvee Technologies
[2010.08.04 12:25:36 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\NCH Software
[2010.08.10 12:14:02 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Nero
[2010.12.15 19:35:21 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Polar
[2010.05.09 21:46:11 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Publish Providers
[2010.02.28 14:55:24 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\r2 Studios
[2011.04.20 11:42:27 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Ripu
[2010.12.15 19:36:35 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Roafme
[2010.12.09 23:27:07 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Screaming Bee
[2011.05.14 11:16:57 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Skype
[2011.05.14 08:01:50 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\skypePM
[2010.11.15 22:46:18 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Sony
[2010.11.15 22:49:52 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Sony Creative Software Inc
[2010.02.28 14:50:39 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Souptoys
[2010.05.23 14:03:30 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\SynthMaker
[2010.05.16 12:21:31 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Tobit
[2010.11.13 18:49:16 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Ulead Systems
[2011.05.14 11:30:16 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\uTorrent
[2010.08.10 11:18:40 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Video DVD Maker FREE
[2010.12.15 19:58:15 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Voof
[2010.03.15 20:50:04 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\WebcamMax
[2010.03.21 17:29:57 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\WinRAR
[2010.08.09 23:00:46 | 000,000,000 | -H-D | M] -- C:\Users\Andi\AppData\Roaming\Youtube Downloader HD
 
< %APPDATA%\*.exe /s >
[2010.02.05 15:32:59 | 000,050,354 | -H-- | M] (Facebook, Inc.) -- C:\Users\Andi\AppData\Roaming\Facebook\uninstall.exe
[2010.02.13 09:08:30 | 000,224,256 | -H-- | M] (Apple Computer, Inc.) -- C:\Users\Andi\AppData\Roaming\Fegyo\suohe.exe
[2010.04.30 22:28:35 | 000,147,968 | -H-- | M] (Realtek Semiconductor Corp.) -- C:\Users\Andi\AppData\Roaming\Loozs\omeh.exe
[2010.07.25 21:13:15 | 000,038,784 | -H-- | M] () -- C:\Users\Andi\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2009.12.31 14:28:33 | 000,003,262 | RH-- | M] () -- C:\Users\Andi\AppData\Roaming\Microsoft\Installer\{22B0E143-2B0B-435B-9F56-136A3D16065F}\controlPanelIcon.exe
[2009.12.31 14:28:33 | 000,010,134 | RH-- | M] () -- C:\Users\Andi\AppData\Roaming\Microsoft\Installer\{22B0E143-2B0B-435B-9F56-136A3D16065F}\SystemFolder_msiexec.exe
[2010.09.27 09:17:15 | 000,147,968 | -H-- | M] (Realtek Semiconductor Corp.) -- C:\Users\Andi\AppData\Roaming\Polar\mili.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009.02.11 11:11:50 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Windows\System32\drivers\iaStor.sys
[2009.02.11 11:11:50 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_e0c941a8b0e04b56\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\Windows:0655984505137236
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86

< End of report >

markusg · 14.05.2011, 12:28

hiho
• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [vKLuVrOIsaEYCN] C:\ProgramData\vKLuVrOIsaEYCN.exe (QNP)

C:\Users\Andi\AppData\Roaming\Polar

:Files
C:\ProgramData\vKLuVrOIsaEYCN.exe

:Commands
[purity]
[EMPTYFLASH]
[resethosts]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

lade unhide:
http://www.trojaner-board.de/54791-a...ner-board.html

fred.werk · 14.05.2011, 13:00

Hier die Textdatei:

Code:

ATTFilter

 
User: Public
 
Total Flash Files Cleaned = 1,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Andi
->Temp folder emptied: 1195244504 bytes
->Temporary Internet Files folder emptied: 179460419 bytes
->Java cache emptied: 1214655 bytes
->Google Chrome cache emptied: 75004026 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 110645142 bytes
RecycleBin emptied: 2399044912 bytes
 
Total Files Cleaned = 3.777,00 mb
 
 
OTL by OldTimer - Version 3.2.22.3 log created on 05142011_134905

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

fred.werk · 14.05.2011, 14:25

Hat alles geklappt .. DANKE

Allerdings fehlt bei mir noch etwas.. unzwar zeigt es bei mir wenn ich Start öffne, dann zeigt es bei mir dennoch keine Programme mehr an.. also nur auf dem Desktop sind sie jetzt wieder sichtbar.

Wäre cool wenn du mir das auch noch sagen könntest

und danke nochmal

markusg · 14.05.2011, 14:25

hi, kannst du mal folgendes otl script ausführen?
:OTL
O4 - HKU\S-1-5-21-3398456508-2000778745-2680457543-1000..\Run: [vKLuVrOIsaEYCN] C:\ProgramData\vKLuVrOIsaEYCN.exe (QNP)

:Files
C:\ProgramData\vKLuVrOIsaEYCN.exe
C:\Users\Andi\AppData\Roaming\Polar

:Commands
[purity]
[EMPTYFLASH]
[resethosts]
[emptytemp]
[Reboot]

ich benötige dann noch mal einen erneuten upload von moved files, also erneut packen und hochladen bitte.

fred.werk · 14.05.2011, 14:41

ja aber .. dann sind die programme ja trotzdem alle nicht da wenn ich start öffne.. kannst du mir sagen was ich da machen muss?

markusg · 14.05.2011, 14:49

die programme sind dein geringstes problem. lass uns doch erst mal das bearbeiten was dringend ist, die trojaner.

markusg · 14.05.2011, 16:18

kannst du das mit dem upload noch mal probieren? das hat nicht geklappt

markusg · 14.05.2011, 18:13

hmm lad die datei mal bei
File-Upload.net - Ihr kostenloser File Hoster!
hoch und sende mir den link als private nachicht

markusg · 15.05.2011, 15:01

ok hat geklappt.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

fred.werk · 16.05.2011, 17:30

hats nun funktioniert?

markusg · 16.05.2011, 17:38

jo, steht doch auch schon da wies weiter geht :-)

fred.werk · 16.05.2011, 19:35

hier der LOG:

Code:

ATTFilter

ComboFix 11-05-16.01 - Andi 16.05.2011  19:45:34.1.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.2013.623 [GMT 2:00]
ausgeführt von:: c:\users\Andi\Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
AV: Norton Internet Security *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
 ADS - Windows: deleted 24 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\malacuxatx.exe
c:\malacuxatx.exe\config.bin
c:\progra~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
c:\program files\Dealio Toolbar
c:\program files\Dealio Toolbar\IE\4.3\config.ini
c:\program files\Dealio Toolbar\IE\4.3\deALiotoolbarie.dll
c:\program files\Dealio Toolbar\Res\amazon.gif
c:\program files\Dealio Toolbar\Res\apple.gif
c:\program files\Dealio Toolbar\Res\barnes.gif
c:\program files\Dealio Toolbar\Res\bestbuy.gif
c:\program files\Dealio Toolbar\Res\dealio_logo.gif
c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
c:\program files\Dealio Toolbar\Res\ebay.gif
c:\program files\Dealio Toolbar\Res\icon_settings.gif
c:\program files\Dealio Toolbar\Res\macys.gif
c:\program files\Dealio Toolbar\Res\newegg.gif
c:\program files\Dealio Toolbar\Res\overstock.gif
c:\program files\Dealio Toolbar\Res\search-button-hover.gif
c:\program files\Dealio Toolbar\Res\search-button.gif
c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
c:\program files\Dealio Toolbar\Res\search-chevron.gif
c:\program files\Dealio Toolbar\Res\search_amazon.gif
c:\program files\Dealio Toolbar\Res\search_dealio.gif
c:\program files\Dealio Toolbar\Res\search_ebay.gif
c:\program files\Dealio Toolbar\Res\search_yahoo.gif
c:\program files\Dealio Toolbar\Res\target.gif
c:\program files\Dealio Toolbar\Res\walmart.gif
c:\program files\Dealio Toolbar\Res\widgets.xml
c:\program files\Dealio Toolbar\WidgiHelper.exe
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\CHROME.MANIFEST
c:\program files\MyWebSearch\bar\2.bin\chrome\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\2.bin\F3CJpeg.dll
c:\program files\MyWebSearch\bar\2.bin\F3DTactl.dll
c:\program files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\2.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\2.bin\F3SCrctr.dll
c:\program files\MyWebSearch\bar\2.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\2.bin\INSTALL.RDF
c:\program files\MyWebSearch\bar\2.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\2.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\2.bin\M3HTml.dll
c:\program files\MyWebSearch\bar\2.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\2.bin\M3MSg.dll
c:\program files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\2.bin\M3TPINST.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSMLBTN.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\2.bin\MWSUABTN.DLL
c:\program files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Overlay\COMMON.F3S
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\users\Andi\AppData\Local\{AD7E98CB-9B59-4CF0-9BE4-C27EC5A6AED5}
c:\users\Andi\AppData\Local\{AD7E98CB-9B59-4CF0-9BE4-C27EC5A6AED5}\chrome.manifest
c:\users\Andi\AppData\Local\{AD7E98CB-9B59-4CF0-9BE4-C27EC5A6AED5}\chrome\content\_cfg.js
c:\users\Andi\AppData\Local\{AD7E98CB-9B59-4CF0-9BE4-C27EC5A6AED5}\chrome\content\overlay.xul
c:\users\Andi\AppData\Local\{AD7E98CB-9B59-4CF0-9BE4-C27EC5A6AED5}\install.rdf
c:\users\Andi\AppData\Local\lame_enc.dll
c:\users\Andi\AppData\Local\mwsautSp.exe
c:\users\Andi\AppData\Local\no23xwrapper.dll
c:\users\Andi\AppData\Local\ogg.dll
c:\users\Andi\AppData\Local\vorbis.dll
c:\users\Andi\AppData\Local\vorbisenc.dll
c:\users\Andi\AppData\Local\vorbisfile.dll
c:\users\Andi\AppData\Roaming\avdrn.dat
c:\users\Andi\AppData\Roaming\Fegyo
c:\users\Andi\AppData\Roaming\Fegyo\suohe.exe
c:\users\Andi\AppData\Roaming\Loozs
c:\users\Andi\AppData\Roaming\Loozs\omeh.exe
c:\users\Andi\AppData\Roaming\Polar\mili.exe
c:\windows\system32\f3PSSavr.scr
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_MyWebSearchService
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-16 bis 2011-05-16  ))))))))))))))))))))))))))))))
.
.
2011-05-16 18:11 . 2011-05-16 18:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-05-15 11:55 . 2011-05-15 11:56	--------	d-----w-	c:\users\Andi\AppData\Local\{B5EFD50F-51DB-4268-9000-F710A4FDC0A6}
2011-05-14 11:49 . 2011-05-14 14:01	--------	d-----w-	C:\_OTL
2011-05-14 03:40 . 2011-04-09 05:56	123904	----a-w-	c:\windows\system32\poqexec.exe
2011-05-13 19:25 . 2011-02-18 05:33	31232	----a-w-	c:\windows\system32\prevhost.exe
2011-05-13 19:25 . 2011-03-12 11:31	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-05-13 19:25 . 2011-02-26 05:33	2614784	----a-w-	c:\windows\explorer.exe
2011-05-13 19:19 . 2011-04-11 07:04	7071056	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DEE1C856-46CA-42AC-A44F-608816746E44}\mpengine.dll
2011-05-13 18:30 . 2009-07-13 23:45	6144	----a-w-	c:\windows\system32\beep.sys
2011-05-10 16:18 . 2011-05-10 16:18	--------	d-----w-	c:\users\Andi\AppData\Local\{EF113030-CAF6-4AA0-80ED-D8790A2F0D85}
2011-04-30 12:37 . 2011-04-30 12:37	--------	d-----w-	c:\program files\MinecraftAlpha
2011-04-30 12:11 . 2011-05-01 12:57	--------	d-----w-	c:\users\Andi\AppData\Roaming\.minecraft
2011-04-27 17:12 . 2011-04-27 17:35	--------	d-----w-	c:\users\Andi\AppData\Roaming\muvee Technologies
2011-04-27 17:10 . 2011-04-27 17:10	--------	d-----w-	c:\program files\muvee Technologies
2011-04-27 17:09 . 2011-04-27 17:11	--------	d-----w-	c:\program files\Common Files\muvee Technologies
2011-04-27 17:06 . 2011-04-27 17:12	--------	d-----w-	c:\programdata\muvee Technologies
2011-04-24 14:43 . 2011-04-24 14:43	--------	d-----w-	c:\users\Andi\AppData\Local\{6F844C49-CC63-49E2-AD07-739B3F072E3D}
2011-04-23 12:11 . 2011-04-23 12:11	--------	d-----w-	c:\users\Andi\AppData\Local\{5F85E6C5-7370-409B-B5B1-1D547582EBFD}
2011-04-22 20:42 . 2011-05-13 18:35	--------	d-----w-	c:\program files\ICQ6Toolbar
2011-04-22 20:42 . 2011-04-22 20:44	--------	d-----w-	c:\programdata\ICQ
2011-04-22 20:41 . 2011-05-09 16:11	--------	d-----w-	c:\users\Andi\AppData\Roaming\ICQ
2011-04-22 20:41 . 2011-05-05 15:03	--------	d-----w-	c:\program files\ICQ7.5
2011-04-22 11:46 . 2011-04-22 11:47	--------	d-----w-	c:\users\Andi\AppData\Local\{5CA395DE-4DF3-43C1-8C31-DB17426ACA9C}
2011-04-22 11:31 . 2011-04-22 11:32	--------	d-----w-	c:\program files\CamStudio
2011-04-20 21:24 . 2011-04-20 21:24	--------	d-----w-	c:\users\Andi\AppData\Local\{FA3A1B81-1708-4FFC-871B-4B3FA103EB8E}
2011-04-19 19:29 . 2011-04-19 19:30	--------	d-----w-	c:\users\Andi\AppData\Local\{5E923C56-47D8-4CF6-9765-6BB32FBBF3D4}
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-16 18:15 . 2009-12-26 10:31	45056	----a-w-	c:\windows\system32\acovcnt.exe
2011-05-06 13:34 . 2010-11-13 16:20	5642	--sha-w-	c:\programdata\KGyGaAvL.sys
2011-04-05 19:19 . 2010-06-24 10:33	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-23 15:08 . 2010-05-16 10:20	3528024	----a-w-	c:\windows\RXSUnins.exe
2011-03-23 15:08 . 2010-05-16 10:20	3528024	----a-w-	c:\windows\RXCUnins.exe
2011-03-17 17:58 . 2010-01-01 16:22	137656	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-03-11 05:40 . 2011-04-15 13:36	1137664	----a-w-	c:\windows\system32\mfc42.dll
2011-03-11 05:40 . 2011-04-15 13:36	1164288	----a-w-	c:\windows\system32\mfc42u.dll
2011-03-08 05:38 . 2011-04-15 13:36	740864	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-03 05:29 . 2011-04-15 13:52	132608	----a-w-	c:\windows\system32\dnsrslvr.dll
2011-03-03 05:27 . 2011-04-15 13:52	28672	----a-w-	c:\windows\system32\dnscacheugc.exe
2011-03-03 03:31 . 2011-04-15 13:45	2331136	----a-w-	c:\windows\system32\win32k.sys
2011-02-24 05:32 . 2011-04-15 13:44	288256	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-02-24 05:32 . 2011-04-15 13:52	981504	----a-w-	c:\windows\system32\wininet.dll
2011-02-24 05:30 . 2011-04-15 13:52	44544	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-24 04:23 . 2011-04-15 13:52	386048	----a-w-	c:\windows\system32\html.iec
2011-02-24 03:50 . 2011-04-15 13:52	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2011-02-23 05:06 . 2011-04-15 13:52	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-23 05:05 . 2011-04-15 13:52	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-02-23 05:05 . 2011-04-15 13:52	113664	----a-w-	c:\windows\system32\drivers\srvnet.sys
2011-02-23 05:05 . 2011-04-15 13:36	221696	----a-w-	c:\windows\system32\drivers\mrxsmb10.sys
2011-02-23 05:05 . 2011-04-15 13:36	95744	----a-w-	c:\windows\system32\drivers\mrxsmb20.sys
2011-02-23 05:05 . 2011-04-15 13:36	123392	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-23 05:05 . 2011-04-15 13:36	69632	----a-w-	c:\windows\system32\drivers\bowser.sys
2011-02-21 18:08 . 2011-01-30 15:11	0	----a-w-	c:\users\Andi\AppData\Local\Ubogakipipadaxuv.bin
2011-02-19 05:33 . 2011-03-09 16:27	802304	----a-w-	c:\windows\system32\FntCache.dll
2011-02-19 05:32 . 2011-03-09 16:27	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-02-19 05:32 . 2011-03-09 16:27	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-02-19 05:32 . 2011-04-15 13:52	34304	----a-w-	c:\windows\system32\atmlib.dll
2011-02-19 03:37 . 2011-04-15 13:52	294912	----a-w-	c:\windows\system32\atmfd.dll
2011-02-18 05:36 . 2011-04-15 13:52	428032	----a-w-	c:\windows\system32\vbscript.dll
2008-12-23 12:36 . 2008-12-23 12:36	106496	----a-w-	c:\program files\Common Files\CPInstallAction.dll
.
.
------- Sigcheck -------
.
[7] 2009-07-13 . 505506526A9D467307B3C393DEDAF858 . 6144 . . [6.1.7600.16385] . . c:\windows\System32\beep.sys
.
c:\windows\System32\drivers\beep.sys ... Fehlt !!
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-02-01 17:17	1487240	----a-w-	c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-01 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-01 16:08	143360	----a-w-	c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SRS Premium Sound"="c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSoundBig_Small.exe" [2009-03-19 3261688]
"rfxsrvtray"="c:\program files\Tobit Radio.fx\Client\rfx-tray.exe" [2010-01-13 686344]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-28 322352]
"Meebo Notifier"="c:\users\Andi\AppData\Local\Meebo\Meebo Notifier\MeeboNotifier.exe" [2010-07-14 818888]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040]
"ICQ"="c:\program files\ICQ7.5\ICQ.exe" [2011-05-01 124216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-03-23 17149952]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-12-29 159744]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-03-31 266240]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-09-30 851968]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-02-06 1593344]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-12-25 3054136]
"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2009-12-25 47672]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-03-06 424352]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2011-01-28 526336]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-02 149280]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_16_Download-Version\TrayServer.exe" [2008-08-07 90112]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"Standby"="c:\program files\Common Files\Corel\Standby\Standby.exe" [2010-06-26 105632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"VX1000"="c:\windows\vVX1000.exe" [2009-06-30 762208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 ASUSRDVDService;ASUSRDVD Service;c:\program files\ASUS\AI Recovery\ServiceSimple2.exe [2008-12-03 109112]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ASUSProcObsrv;ASUS Process Creation/Termination Observer;d:\i386\AsProcOb.sys [x]
R3 CRFILTER;USB Mass Storage Filter;c:\windows\system32\DRIVERS\CRFILTER.sys [2008-04-07 6656]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [2008-05-29 15416]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2011-01-28 387072]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-05-06 1220608]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2011-02-28 247096]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [2009-12-25 115560]
S2 Radio.fx;Radio.fx Server;c:\program files\Tobit Radio.fx\Server\rfx-server.exe [2011-05-11 3590488]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-03-13 140800]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-11-26 34384]
S3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\system32\drivers\srs_PremiumSound_i386.sys [2009-01-14 230952]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-03-20 984064]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
Akamai	REG_MULTI_SZ   	Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-16 c:\windows\Tasks\Norton Security Scan for Andi.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-08-22 07:48]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/sk27211/
uInternet Settings,ProxyOverride = *.local
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-{2FD4436C-35CE-82F6-3A79-695BE8991817} - c:\users\Andi\AppData\Roaming\Fegyo\suohe.exe
HKCU-Run-{8D69C444-C59B-509E-28CD-81A8013FB9FC} - c:\users\Andi\AppData\Roaming\Polar\mili.exe
HKCU-Run-Jfafaquh - c:\users\Andi\AppData\Local\odakelikufev.dll
AddRemove-(smiley) 1.00 - c:\program files\ICQ6.5\Packages\Uninstall.exe
AddRemove-Gemalt 2 1.00 - c:\program files\ICQ6.5\Packages\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(588)
c:\program files\ASUS\ASUS Data Security Manager\ASPWDFLT.DLL
.
- - - - - - - > 'Explorer.exe'(3996)
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\program files\ASUS\ATK Hotkey\ASLDRSrv.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\windows\system32\conhost.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\program files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\16.0.0.125\InstStub.exe
c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe
c:\program files\ASUS\ATK Hotkey\HControl.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\ASUS CopyProtect\aspg.exe
c:\program files\ASUS\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\ATK Hotkey\KBFiltr.exe
c:\program files\ASUS\ATK Hotkey\WDC.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\RunDll32.exe
c:\program files\windows defender\MpCmdRun.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-05-16  20:30:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-05-16 18:30
.
Vor Suchlauf: 15 Verzeichnis(se), 206.474.665.984 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 205.994.487.808 Bytes frei
.
- - End Of File - - 4B5A7C40D916DF4084FD3931DDB539B3

markusg · 16.05.2011, 19:41

öffne mal computer c: qoobox, rechtsklick mit winrar oder zip packen. versuchs mal im upload channel hochzuladen:
http://www.trojaner-board.de/54791-a...ner-board.html
könnte aber zu groß sein. falls ja:
File-Upload.net - Ihr kostenloser File Hoster!
dort hochladen, link an mich als private nachicht.

16.05.2011, 17:38	#13
markusg /// Malware-holic	windows security alert trojaner virus jo, steht doch auch schon da wies weiter geht :-) __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

windows security alert trojaner virus

Log-Analyse und Auswertung: windows security alert trojaner virus