Trojaner-Board - Googlelinks führen zu nicht erwünschten Seiten

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Googlelinks führen zu nicht erwünschten Seiten (https://www.trojaner-board.de/108257-googlelinks-fuehren-erwuenschten-seiten.html)

Googlelinks führen zu nicht erwünschten Seiten

Hallo,

seit heute habe ich ein Problem mit google.
Wenn ich nach einer Suche auf die Links klicke werde ich nicht zu der gewünschten Seite geführt sondern zu irgendwelchen Werbeseiten.

Ich verwende:

Windows XP
Firefox 9.0.1

Vielen Dank für Eure Mühe, mir zu helfen.

Hier die gewünschten Logs. Das Programm OTL hat bei mir kein Extra-Log erstellt! :confused:

OTL-Log

Code:

OTL logfile created on: 18.01.2012 15:11:39 - Run 6

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Dokumente und Einstellungen\Andreas\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 77,25% Memory free

5,09 Gb Paging File | 4,43 Gb Available in Paging File | 87,02% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 30,40 Gb Total Space | 15,72 Gb Free Space | 51,72% Space Free | Partition Type: NTFS

Drive D: | 4,00 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Drive E: | 465,76 Gb Total Space | 343,50 Gb Free Space | 73,75% Space Free | Partition Type: NTFS

 

Computer Name: ANDI | User Name: Andreas | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.18 11:58:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe

PRC - [2012.01.06 09:36:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011.12.24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.06.28 20:03:01 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.05.01 08:51:30 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.11.24 10:04:41 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.09.05 16:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE

PRC - [2009.08.18 10:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE

PRC - [2009.08.09 10:49:26 | 003,986,552 | ---- | M] (Almico Software (www.almico.com)) -- C:\Programme\SpeedFan\speedfan.exe

PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.02.01 16:17:08 | 000,565,248 | ---- | M] (3S-Smart Software Solutions GmbH) -- C:\Programme\3S Software\CoDeSys ENI Server\ENI.exe

PRC - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.01.18 15:09:25 | 000,192,512 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Temp\sfamcc00001.dll

MOD - [2012.01.18 15:09:25 | 000,172,032 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Temp\sfareca00001.dll

MOD - [2012.01.06 09:36:50 | 002,124,760 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll

MOD - [2011.11.09 21:45:32 | 000,270,336 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

MOD - [2011.08.29 18:40:43 | 006,277,280 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

MOD - [2010.03.16 12:22:12 | 000,014,848 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll

MOD - [2010.02.10 23:33:10 | 011,791,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\System.Web.ni.dll

MOD - [2010.02.10 23:33:04 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3736ba3ecac186f9c5d85f01bda2be98\System.Runtime.Remoting.ni.dll

MOD - [2010.02.10 23:32:37 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\Accessibility.ni.dll

MOD - [2010.02.10 23:32:36 | 012,428,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll

MOD - [2010.02.10 23:32:29 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll

MOD - [2010.02.10 23:32:08 | 005,449,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll

MOD - [2010.02.10 23:32:05 | 000,970,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\System.Configuration.ni.dll

MOD - [2010.02.10 23:32:03 | 007,867,392 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll

MOD - [2010.02.10 23:31:57 | 011,485,184 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll

MOD - [2010.01.28 13:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2009.10.22 12:00:29 | 000,311,296 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009.10.22 12:00:27 | 000,430,080 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll

MOD - [2005.02.01 16:17:10 | 000,069,632 | ---- | M] () -- C:\Programme\3S Software\CoDeSys ENI Server\Drivers\ENIDrvFileSystem.edd

MOD - [2005.01.06 17:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll

MOD - [2001.10.28 15:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] --  -- (HidServ)

SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.06.28 20:03:01 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.05.01 08:51:30 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2005.02.01 16:17:08 | 000,565,248 | ---- | M] (3S-Smart Software Solutions GmbH) [Auto | Running] -- C:\Programme\3S Software\CoDeSys ENI Server\ENI.exe -- (ENI Server)

SRV - [2004.12.16 13:33:24 | 000,544,825 | ---- | M] (3S-Smart Software Solutions GmbH) [On_Demand | Stopped] -- C:\Programme\3S Software\CoDeSys SP RTE\RTService.exe -- (RTService)

SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.15 12:58:28 | 007,493,120 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.06.28 20:03:02 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 20:03:02 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.02.24 11:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\acedrv11.sys -- (acedrv11)

DRV - [2009.07.09 16:23:03 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.07.09 16:23:02 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2007.07.07 07:13:10 | 000,012,032 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)

DRV - [2006.09.24 14:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2005.03.03 18:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)

DRV - [2005.02.23 16:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)

DRV - [2004.12.16 12:38:26 | 000,298,043 | ---- | M] (3S - Smart Software Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\3SRTE.sys -- (3SRTE)

DRV - [2004.12.16 07:27:42 | 000,023,618 | ---- | M] (3S) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvAPIC.sys -- (RTIOdrvAPIC)

DRV - [2004.12.16 07:24:40 | 000,300,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvAutomata.sys -- (RTIOdrvAutomata)

DRV - [2004.12.06 14:56:40 | 000,057,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvHilscherDPM.sys -- (RTIOdrvHilscherDPM)

DRV - [2004.12.03 11:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)

DRV - [2004.10.22 09:25:58 | 000,203,176 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvFC310x.sys -- (RTIOdrvFC310x)

DRV - [2004.10.18 06:43:28 | 000,030,268 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvHMS.sys -- (RTIOdrvHMS)

DRV - [2004.08.03 21:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)

DRV - [2004.06.29 09:39:14 | 000,108,796 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvSJA.sys -- (RTIOdrvSJA)

DRV - [2004.04.14 10:08:00 | 000,044,064 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmXlCore.sys -- (WmXlCore)

DRV - [2004.04.14 10:08:00 | 000,021,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmFilter.sys -- (WmFilter)

DRV - [2004.04.14 10:08:00 | 000,010,144 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmBEnum.sys -- (WmBEnum)

DRV - [2004.04.14 10:08:00 | 000,005,600 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmVirHid.sys -- (WmVirHid)

DRV - [2003.09.24 07:21:48 | 000,398,712 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvCP5613.sys -- (RTIOdrvCP5613)

DRV - [2002.07.29 10:31:16 | 000,218,956 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvApplicom.sys -- (RTIOdrvApplicom)

DRV - [2002.07.22 10:25:18 | 000,264,124 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ibpcimpm.sys -- (ibpcimpm)

DRV - [2002.07.17 07:35:22 | 000,080,756 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvDAMP.sys -- (RTIOdrvDAMP)

DRV - [2001.08.17 12:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)

DRV - [1996.04.03 20:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.heute.de/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.heute.de/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10

FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.5.3

FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.01

FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:5.0.3

FF - prefs.js..extensions.enabledItems: de_DE@dicts.j3e.de:20110321

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..network.proxy.autoconfig_url: "hxxp://www.bib.h-bonn-rhein-sieg.de/bibmedia/Downloads/bibliothek/proxy_pac-p-6656.pac"

FF - prefs.js..network.proxy.type: 2

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.06 09:36:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.06.02 00:01:27 | 000,000,000 | ---D | M]

 

[2011.02.11 22:03:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Extensions

[2011.02.11 22:03:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.01.14 11:38:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\extensions

[2012.01.14 11:38:40 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\extensions\de-DE@dictionaries.addons.mozilla.org

[2011.11.05 16:10:09 | 000,000,000 | ---D | M] (Ghostery) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\extensions\firefox@ghostery.com

[2011.11.09 18:16:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.03.05 14:44:54 | 000,000,000 | ---D | M] ("Citavi Picker") -- C:\Programme\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI

[2012.01.06 09:36:51 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2011.03.22 19:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\mozilla firefox\plugins\npwachk.dll

[2011.05.06 10:12:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.05.06 10:12:24 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.05.06 10:12:24 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.05.06 10:12:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.05.06 10:12:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.05.06 10:12:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.04 16:52:50 | 000,307,229 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 127.0.0.1        1-2005-search.com

O1 - Hosts: 10574 more lines...

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [ATICustomerCare] C:\Programme\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\Andreas\Startmenü\Programme\Autostart\SpeedFan.lnk = C:\Programme\SpeedFan\speedfan.exe (Almico Software (www.almico.com))

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B922220B-3C7C-40AE-BD0F-5ECA4D0B7886}: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.04 15:45:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{59e0c8f4-1fe4-11df-8b4c-0030843a9633}\Shell\AutoRun\command - "" = G:\Menu.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Flash Player 8

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

NetSvcs: 6to4 -  File not found

NetSvcs: HidServ -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Exif Launcher S.lnk -  - File not found

MsConfig - StartUpReg: Buskb - hkey= - key= -  File not found

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= -  File not found

MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()

MsConfig - StartUpReg: ENISysTray - hkey= - key= - C:\Programme\3S Software\CoDeSys ENI Server\ENISysTray.exe (3S-Smart Software Solutions GmbH)

MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= -  File not found

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 0

MsConfig - State: "startup" - 2

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.18 15:07:58 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Andreas\Recent

[2012.01.18 15:02:32 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe

[2012.01.18 03:04:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch

[2012.01.17 00:07:44 | 000,000,000 | ---D | C] -- C:\Programme\Sierra On-Line

[2012.01.15 02:10:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Eigene Dateien\DemolitionInc

[2012.01.14 00:09:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Eigene Dateien\Tilted Mill

[2012.01.13 14:14:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\Somalian Syndrome

[2012.01.13 14:13:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Xvid

[2012.01.13 14:13:26 | 000,000,000 | ---D | C] -- C:\Programme\Xvid

[2012.01.04 19:59:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\dm-Fotowelt

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.18 15:09:11 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.18 15:09:10 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\Lrdqlhgvek.job

[2012.01.18 15:09:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.01.18 15:02:33 | 000,004,820 | ---- | M] () -- C:\WINDOWS\wincmd.ini

[2012.01.18 13:37:08 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\9y23y0kk.exe

[2012.01.18 13:27:16 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\defogger_reenable

[2012.01.18 11:58:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe

[2012.01.18 03:04:48 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\perfprocg.dll

[2012.01.18 02:42:51 | 000,015,866 | ---- | M] () -- C:\monkey.s00

[2012.01.18 02:37:37 | 000,022,660 | ---- | M] () -- C:\atlantis.s01

[2012.01.18 02:33:59 | 000,024,103 | ---- | M] () -- C:\atlantis.s00

[2012.01.18 02:24:45 | 000,017,624 | ---- | M] () -- C:\zak.s01

[2012.01.18 02:22:48 | 000,016,167 | ---- | M] () -- C:\zak.s00

[2012.01.18 02:17:14 | 000,000,032 | ---- | M] () -- C:\WINDOWS\CD_Start.INI

[2012.01.17 01:40:54 | 000,000,249 | ---- | M] () -- C:\WINDOWS\SIERRA.INI

[2012.01.17 00:42:25 | 000,021,840 | ---- | M] () -- C:\WINDOWS\System32\SIntfNT.dll

[2012.01.17 00:42:25 | 000,017,212 | ---- | M] () -- C:\WINDOWS\System32\SIntf32.dll

[2012.01.17 00:42:25 | 000,012,067 | ---- | M] () -- C:\WINDOWS\System32\SIntf16.dll

[2012.01.16 09:30:19 | 000,000,882 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini

[2012.01.15 02:10:20 | 000,444,952 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll

[2012.01.11 14:13:38 | 000,049,707 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\Lebenslauf von ***.pdf

[2012.01.09 11:17:23 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.01.18 13:39:33 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\9y23y0kk.exe

[2012.01.18 13:27:16 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\defogger_reenable

[2012.01.18 03:04:49 | 000,000,322 | ---- | C] () -- C:\WINDOWS\tasks\Lrdqlhgvek.job

[2012.01.18 03:04:48 | 000,118,784 | RHS- | C] () -- C:\WINDOWS\System32\perfprocg.dll

[2012.01.18 02:42:51 | 000,015,866 | ---- | C] () -- C:\monkey.s00

[2012.01.18 02:37:37 | 000,022,660 | ---- | C] () -- C:\atlantis.s01

[2012.01.18 02:33:59 | 000,024,103 | ---- | C] () -- C:\atlantis.s00

[2012.01.18 02:24:45 | 000,017,624 | ---- | C] () -- C:\zak.s01

[2012.01.18 02:22:48 | 000,016,167 | ---- | C] () -- C:\zak.s00

[2012.01.18 02:16:57 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI

[2012.01.17 00:27:48 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll

[2012.01.17 00:27:48 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll

[2012.01.17 00:27:48 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll

[2012.01.16 22:56:42 | 000,000,249 | ---- | C] () -- C:\WINDOWS\SIERRA.INI

[2012.01.13 14:13:27 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2012.01.13 14:13:27 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2012.01.13 14:13:27 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax

[2012.01.11 14:13:37 | 000,049,707 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\Lebenslauf von Andreas Lang.pdf

[2011.11.09 22:39:44 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll

[2011.11.09 22:39:32 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll

[2011.07.28 19:45:56 | 000,393,256 | ---- | C] () -- C:\WINDOWS\System32\CNQ2414N.DAT

[2011.05.28 01:59:31 | 000,300,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvAutomata.sys

[2011.05.28 01:59:31 | 000,264,124 | ---- | C] () -- C:\WINDOWS\System32\drivers\ibpcimpm.sys

[2011.05.28 01:59:31 | 000,203,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvFC310x.sys

[2011.05.28 01:59:31 | 000,108,796 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvSJA.sys

[2011.05.28 01:59:31 | 000,030,268 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvHMS.sys

[2011.05.28 01:59:30 | 000,398,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvCP5613.sys

[2011.05.28 01:59:30 | 000,218,956 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvApplicom.sys

[2011.05.28 01:59:30 | 000,080,756 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvDAMP.sys

[2011.05.28 01:59:30 | 000,057,936 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvHilscherDPM.sys

[2011.05.28 01:59:15 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\callrproxy.dll

[2011.05.28 01:59:15 | 000,060,416 | ---- | C] () -- C:\WINDOWS\System32\OPCENUM.EXE

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat

[2011.03.13 02:39:19 | 001,872,916 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-527237240-1220945662-839522115-1003-0.dat

[2011.03.13 02:39:18 | 000,289,054 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.03.01 19:55:51 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\PnkBstrK.sys

[2011.03.01 19:55:31 | 002,434,856 | ---- | C] () -- C:\WINDOWS\System32\pbsvc_bc2.exe

[2011.01.10 22:52:45 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2010.07.07 23:13:49 | 000,002,070 | ---- | C] () -- C:\WINDOWS\aopr.ini

[2010.06.19 22:38:26 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2010.06.19 22:38:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe

[2010.04.27 18:22:08 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll

[2010.02.15 00:23:03 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2010.02.15 00:23:02 | 000,243,168 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2010.02.15 00:23:02 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2010.02.15 00:10:21 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2010.02.10 22:03:16 | 000,612,608 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.02.10 11:32:13 | 000,000,882 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini

[2009.10.13 18:47:04 | 000,062,976 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.10.02 21:14:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\FE.INI

[2009.08.30 02:56:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009.08.11 15:31:53 | 000,000,144 | ---- | C] () -- C:\WINDOWS\PG3prefs.ini

[2009.06.11 11:01:35 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2009.06.08 15:49:27 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys

[2009.06.08 15:49:27 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys

[2009.06.04 22:49:07 | 000,139,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys

[2009.06.04 22:49:02 | 000,111,928 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe

[2009.06.04 22:46:26 | 000,075,136 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe

[2009.06.04 22:15:44 | 000,000,910 | ---- | C] () -- C:\WINDOWS\eReg.dat

[2009.06.04 19:53:11 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009.06.04 19:07:41 | 000,002,120 | R--- | C] () -- C:\WINDOWS\System32\SETUP.INI

[2009.06.04 17:11:01 | 000,004,610 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2009.06.04 17:10:57 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2009.06.04 16:35:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009.06.04 16:35:23 | 000,004,820 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2009.06.04 16:34:39 | 000,308,400 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009.06.04 16:14:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin

[2009.06.04 16:08:00 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat

[2009.06.04 15:46:35 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009.06.04 15:42:29 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll

[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll

[2008.08.05 22:14:12 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ATIBRTMON.EXE

[2004.08.02 13:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2003.02.20 16:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.09.02 14:30:50 | 000,520,090 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2001.09.02 14:30:50 | 000,496,094 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.09.02 14:30:50 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.09.02 14:30:50 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2001.09.02 14:30:50 | 000,101,506 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2001.09.02 14:30:50 | 000,084,578 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.09.02 14:30:50 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2001.09.02 14:30:50 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.09.02 14:30:40 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2001.09.02 14:30:20 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.09.02 14:30:18 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.09.02 14:29:32 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.09.02 14:29:12 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 
 ========== LOP Check ==========

 

[2009.08.05 23:25:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo

[2011.07.28 19:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ

[2011.07.28 19:47:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan

[2009.12.08 15:35:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

[2009.07.14 22:54:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Pro

[2011.11.27 23:50:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbg

[2011.06.06 00:03:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Logs

[2010.06.19 22:38:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF

[2009.07.09 16:39:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tages

[2012.01.04 20:52:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp

[2010.03.05 19:56:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Academic Software Zurich

[2009.08.05 23:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Ashampoo

[2011.07.28 19:47:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Canon

[2011.03.12 13:09:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Dev-Cpp

[2011.10.12 21:46:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoft

[2011.10.12 21:46:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoftIEHelpers

[2009.09.28 13:37:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\FUJIFILM

[2011.06.06 00:00:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Kalypso Media

[2011.08.31 01:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mount&Blade

[2011.04.16 18:55:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\ProtectDISC

[2011.11.29 13:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\QuickScan

[2010.12.21 23:50:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Serif

[2012.01.03 11:19:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\The Creative Assembly

[2011.11.30 13:26:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Tropico 3

[2012.01.18 15:09:10 | 000,000,322 | ---- | M] () -- C:\WINDOWS\Tasks\Lrdqlhgvek.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2010.02.14 23:58:51 | 000,000,000 | ---D | M] -- C:\Arbeit

[2010.02.15 00:22:11 | 000,000,000 | ---D | M] -- C:\ATI

[2010.02.14 23:58:54 | 000,000,000 | ---D | M] -- C:\Bewerbung

[2011.03.12 13:01:32 | 000,000,000 | ---D | M] -- C:\Dev-Cpp

[2011.11.29 10:06:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen

[2011.05.29 22:56:50 | 000,000,000 | ---D | M] -- C:\ENI

[2011.05.28 01:59:13 | 000,000,000 | ---D | M] -- C:\lm.dat

[2009.09.10 21:54:02 | 000,000,000 | ---D | M] -- C:\Netgear

[2011.11.08 13:21:13 | 000,000,000 | ---D | M] -- C:\OpenSSL-Win32

[2012.01.18 12:20:13 | 000,000,000 | R--D | M] -- C:\Programme

[2010.01.11 20:38:38 | 000,000,000 | ---D | M] -- C:\Raid

[2011.11.29 10:35:22 | 000,000,000 | -HSD | M] -- C:\RECYCLER

[2012.01.18 03:08:40 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2010.02.14 22:39:18 | 000,000,000 | ---D | M] -- C:\Systemtools

[2011.11.08 13:16:35 | 000,000,000 | ---D | M] -- C:\totalcmd

[2011.12.08 13:09:26 | 000,000,000 | ---D | M] -- C:\Users

[2012.01.18 12:29:02 | 000,000,000 | ---D | M] -- C:\WINDOWS

 
 < %PROGRAMFILES%\*.exe >

 

Invalid Environment Variable: LOCALAPPDATA

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.manifest /3 >

[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 

 
 < MD5 for: AFD.SYS  >

[2008.04.14 00:49:24 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\ServicePackFiles\i386\afd.sys

[2008.04.14 00:49:24 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\system32\drivers\afd.sys

[2004.08.03 22:14:16 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E -- C:\WINDOWS\$NtServicePackUninstall$\afd.sys

 
 < MD5 for: EXPLORER.EXE  >

[2004.08.03 23:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe

[2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

 
 < MD5 for: IPSEC.SYS  >

[2008.04.14 00:49:44 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\ServicePackFiles\i386\ipsec.sys

[2008.04.14 00:49:44 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys

[2004.08.03 22:14:30 | 000,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\$NtServicePackUninstall$\ipsec.sys

 
 < MD5 for: REGEDIT.EXE  >

[2004.08.03 23:58:10 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe

[2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe

[2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.03 23:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.03 23:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2008.04.14 07:23:18 | 001,845,760 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 

< End of report >

gmer-Log

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-01-18 14:44:39

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800JB-00JJA0 rev.05.01C05

Running: 9y23y0kk.exe; Driver: C:\DOKUME~1\Andreas\LOKALE~1\Temp\pxtdrpod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT    F7A9E21C                                      ZwClose

SSDT    F7A9E1D6                                      ZwCreateKey

SSDT    F7A9E226                                      ZwCreateSection

SSDT    F7A9E1CC                                      ZwCreateThread

SSDT    F7A9E1DB                                      ZwDeleteKey

SSDT    F7A9E1E5                                      ZwDeleteValueKey

SSDT    F7A9E217                                      ZwDuplicateObject

SSDT    F7A9E1EA                                      ZwLoadKey

SSDT    F7A9E1B8                                      ZwOpenProcess

SSDT    F7A9E1BD                                      ZwOpenThread

SSDT    F7A9E1F4                                      ZwReplaceKey

SSDT    F7A9E1EF                                      ZwRestoreKey

SSDT    F7A9E22B                                      ZwSetContextThread

SSDT    F7A9E1E0                                      ZwSetValueKey

SSDT    F7A9E1C7                                      ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text   ntoskrnl.exe!ZwYieldExecution + 1FE           804E4A28 4 Bytes  [EA, E1, A9, F7]

.text   C:\WINDOWS\system32\DRIVERS\ati2mtag.sys      section is writeable [0xB9613000, 0x2C28EE, 0xE8000020]

.vmp2   C:\WINDOWS\system32\drivers\acedrv11.sys      entry point in ".vmp2" section [0xA948C69D]

.text   C:\WINDOWS\system32\DRIVERS\atksgt.sys        section is writeable [0xA9422300, 0x3B6D8, 0xE8000020]

.text   C:\WINDOWS\system32\DRIVERS\lirsgt.sys        section is writeable [0xF77EF300, 0x1BEE, 0xE8000020]
 

---- Devices - GMER 1.0.15 ----
 

Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3   sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort0            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort1            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort2            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort3            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-19  sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-e   sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
 

---- EOF - GMER 1.0.15 ----

Maleware-Log

Code:

2012/01/18 11:10:09 +0100        ANDI        Andreas        MESSAGE        Executing scheduled update:  Daily

2012/01/18 11:10:16 +0100        ANDI        Andreas        MESSAGE        Scheduled update executed successfully:  database updated from version v2012.01.18.01 to version v2012.01.18.02

2012/01/18 12:48:36 +0100        ANDI        Andreas        MESSAGE        Starting protection

2012/01/18 12:48:41 +0100        ANDI        Andreas        MESSAGE        Protection started successfully

2012/01/18 12:48:44 +0100        ANDI        Andreas        MESSAGE        Starting IP protection

2012/01/18 12:48:45 +0100        ANDI        Andreas        MESSAGE        IP Protection started successfully

2012/01/18 12:49:02 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 12:50:36 +0100        ANDI                MESSAGE        Starting protection

2012/01/18 12:50:43 +0100        ANDI                MESSAGE        Protection started successfully

2012/01/18 12:50:46 +0100        ANDI        Andreas        MESSAGE        Starting IP protection

2012/01/18 12:50:49 +0100        ANDI        Andreas        MESSAGE        IP Protection started successfully

2012/01/18 12:52:29 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 12:52:32 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 12:52:38 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 12:57:28 +0100        ANDI                MESSAGE        Starting protection

2012/01/18 12:57:35 +0100        ANDI                MESSAGE        Protection started successfully

2012/01/18 12:57:38 +0100        ANDI        Andreas        MESSAGE        Starting IP protection

2012/01/18 12:57:43 +0100        ANDI        Andreas        MESSAGE        IP Protection started successfully

2012/01/18 12:59:22 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 12:59:25 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 12:59:31 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 14:20:27 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:27 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:27 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:27 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:27 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:30 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:30 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:30 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:30 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:36 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:36 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 14:20:36 +0100        ANDI        Andreas        IP-BLOCK        94.198.240.149 (Type: outgoing)

2012/01/18 15:09:23 +0100        ANDI                MESSAGE        Starting protection

2012/01/18 15:09:30 +0100        ANDI                MESSAGE        Protection started successfully

2012/01/18 15:09:33 +0100        ANDI        Andreas        MESSAGE        Starting IP protection

2012/01/18 15:09:37 +0100        ANDI        Andreas        MESSAGE        IP Protection started successfully

2012/01/18 15:11:18 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 15:11:21 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

2012/01/18 15:11:27 +0100        ANDI        Andreas        IP-BLOCK        195.88.209.15 (Type: outgoing)

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Ich habe genau noch ein anderes Log vom 29.11.2011

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8269
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512
 

29.11.2011 13:33:57

mbam-log-2011-11-29 (13-33-57).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 178275

Laufzeit: 3 Minute(n), 48 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 4

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Hallo,

hier die gewünschte Log-Datei von Malwarebytes

Code:

Malwarebytes Anti-Malware (Test) 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.18.02
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 6.0.2900.5512

Andreas :: ANDI [Administrator]
 

Schutz: Aktiviert
 

18.01.2012 23:36:35

mbam-log-2012-01-18 (23-36-35).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 345520

Laufzeit: 46 Minute(n), 12 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

und die Log-Datei von ESET

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=5914d444672ada46a9e0c1135a63c892

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-18 10:19:53

# local_time=2012-01-18 11:19:53 (+0100, Westeuropäische Normalzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16775125 100 100 44005 101818080 47642 0

# compatibility_mode=8192 67108863 100 0 3746 3746 0 0

# scanned=180501

# found=2

# cleaned=0

# scan_time=3677

E:\Betriebsprogramme\Unlocker1.9.1.exe        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I

${Memory}        probably a variant of Win32/Ponmocup.AA trojan        00000000000000000000000000000000        I

Ziemlich unauffällig.

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hier das gewünschte neue OTL-Log:

Code:

OTL logfile created on: 19.01.2012 10:31:29 - Run 7

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Dokumente und Einstellungen\Andreas\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,25 Gb Total Physical Memory | 2,72 Gb Available Physical Memory | 83,65% Memory free

5,09 Gb Paging File | 4,60 Gb Available in Paging File | 90,29% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 30,40 Gb Total Space | 15,57 Gb Free Space | 51,21% Space Free | Partition Type: NTFS

Drive D: | 4,00 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Drive E: | 465,76 Gb Total Space | 343,54 Gb Free Space | 73,76% Space Free | Partition Type: NTFS

 

Computer Name: ANDI | User Name: Andreas | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.01.18 11:58:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe

PRC - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011.12.24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.06.28 20:03:01 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.05.01 08:51:30 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.11.24 10:04:41 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.09.05 16:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE

PRC - [2009.08.18 10:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE

PRC - [2009.08.09 10:49:26 | 003,986,552 | ---- | M] (Almico Software (www.almico.com)) -- C:\Programme\SpeedFan\speedfan.exe

PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.02.01 16:17:08 | 000,565,248 | ---- | M] (3S-Smart Software Solutions GmbH) -- C:\Programme\3S Software\CoDeSys ENI Server\ENI.exe

PRC - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.01.19 09:38:03 | 000,192,512 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Temp\sfamcc00001.dll

MOD - [2012.01.19 09:38:03 | 000,172,032 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Temp\sfareca00001.dll

MOD - [2011.11.09 21:45:32 | 000,270,336 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

MOD - [2011.05.28 22:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2010.07.04 22:32:38 | 000,010,752 | ---- | M] () -- E:\Betriebsprogramme\Unlocker\UnlockerCOM.dll

MOD - [2010.03.16 12:22:12 | 000,014,848 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\AxInterop.WBOCXLib.dll

MOD - [2010.02.10 23:33:10 | 011,791,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\System.Web.ni.dll

MOD - [2010.02.10 23:33:04 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3736ba3ecac186f9c5d85f01bda2be98\System.Runtime.Remoting.ni.dll

MOD - [2010.02.10 23:32:37 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\Accessibility.ni.dll

MOD - [2010.02.10 23:32:36 | 012,428,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll

MOD - [2010.02.10 23:32:29 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll

MOD - [2010.02.10 23:32:08 | 005,449,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll

MOD - [2010.02.10 23:32:05 | 000,970,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\System.Configuration.ni.dll

MOD - [2010.02.10 23:32:03 | 007,867,392 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll

MOD - [2010.02.10 23:31:57 | 011,485,184 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll

MOD - [2010.01.28 13:57:53 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2009.10.22 12:00:29 | 000,311,296 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009.10.22 12:00:27 | 000,430,080 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll

MOD - [2009.04.27 11:55:12 | 000,678,400 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll

MOD - [2009.02.27 17:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU

MOD - [2005.02.16 00:44:24 | 000,412,672 | ---- | M] () -- C:\Programme\WinUHA\shellwinuha.dll

MOD - [2005.02.01 16:17:10 | 000,069,632 | ---- | M] () -- C:\Programme\3S Software\CoDeSys ENI Server\Drivers\ENIDrvFileSystem.edd

MOD - [2005.01.06 17:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll

MOD - [2001.10.28 15:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] --  -- (HidServ)

SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.06.28 20:03:01 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.05.01 08:51:30 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.08.18 10:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2005.02.01 16:17:08 | 000,565,248 | ---- | M] (3S-Smart Software Solutions GmbH) [Auto | Running] -- C:\Programme\3S Software\CoDeSys ENI Server\ENI.exe -- (ENI Server)

SRV - [2004.12.16 13:33:24 | 000,544,825 | ---- | M] (3S-Smart Software Solutions GmbH) [On_Demand | Stopped] -- C:\Programme\3S Software\CoDeSys SP RTE\RTService.exe -- (RTService)

SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.12.15 12:58:28 | 007,493,120 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.06.28 20:03:02 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 20:03:02 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010.02.24 11:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\acedrv11.sys -- (acedrv11)

DRV - [2009.07.09 16:23:03 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)

DRV - [2009.07.09 16:23:02 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2008.04.14 00:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2007.07.07 07:13:10 | 000,012,032 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)

DRV - [2006.09.24 14:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan)

DRV - [2005.03.03 18:53:57 | 000,048,640 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)

DRV - [2005.02.23 16:59:54 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)

DRV - [2004.12.16 12:38:26 | 000,298,043 | ---- | M] (3S - Smart Software Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\3SRTE.sys -- (3SRTE)

DRV - [2004.12.16 07:27:42 | 000,023,618 | ---- | M] (3S) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvAPIC.sys -- (RTIOdrvAPIC)

DRV - [2004.12.16 07:24:40 | 000,300,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvAutomata.sys -- (RTIOdrvAutomata)

DRV - [2004.12.06 14:56:40 | 000,057,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvHilscherDPM.sys -- (RTIOdrvHilscherDPM)

DRV - [2004.12.03 11:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)

DRV - [2004.10.22 09:25:58 | 000,203,176 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvFC310x.sys -- (RTIOdrvFC310x)

DRV - [2004.10.18 06:43:28 | 000,030,268 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvHMS.sys -- (RTIOdrvHMS)

DRV - [2004.08.03 21:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)

DRV - [2004.06.29 09:39:14 | 000,108,796 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvSJA.sys -- (RTIOdrvSJA)

DRV - [2004.04.14 10:08:00 | 000,044,064 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmXlCore.sys -- (WmXlCore)

DRV - [2004.04.14 10:08:00 | 000,021,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmFilter.sys -- (WmFilter)

DRV - [2004.04.14 10:08:00 | 000,010,144 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\WmBEnum.sys -- (WmBEnum)

DRV - [2004.04.14 10:08:00 | 000,005,600 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WmVirHid.sys -- (WmVirHid)

DRV - [2003.09.24 07:21:48 | 000,398,712 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvCP5613.sys -- (RTIOdrvCP5613)

DRV - [2002.07.29 10:31:16 | 000,218,956 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvApplicom.sys -- (RTIOdrvApplicom)

DRV - [2002.07.22 10:25:18 | 000,264,124 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\ibpcimpm.sys -- (ibpcimpm)

DRV - [2002.07.17 07:35:22 | 000,080,756 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTIOdrvDAMP.sys -- (RTIOdrvDAMP)

DRV - [2001.08.17 12:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)

DRV - [1996.04.03 20:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.heute.de/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.heute.de/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10

FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:2.5.3

FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.01

FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:5.0.3

FF - prefs.js..extensions.enabledItems: de_DE@dicts.j3e.de:20110321

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..network.proxy.autoconfig_url: "hxxp://***/bibmedia/Downloads/bibliothek/proxy_pac-p-6656.pac"

FF - prefs.js..network.proxy.type: 2

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.01.06 09:36:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.06.02 00:01:27 | 000,000,000 | ---D | M]

 

[2011.02.11 22:03:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Extensions

[2011.02.11 22:03:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.01.14 11:38:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\extensions

[2012.01.14 11:38:40 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\extensions\de-DE@dictionaries.addons.mozilla.org

[2011.11.05 16:10:09 | 000,000,000 | ---D | M] (Ghostery) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\extensions\firefox@ghostery.com

[2011.11.09 18:16:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2010.03.05 14:44:54 | 000,000,000 | ---D | M] ("Citavi Picker") -- C:\Programme\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI

() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\ANDREAS\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\NH7RZRGL.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI

[2012.01.06 09:36:51 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2011.03.22 19:38:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\mozilla firefox\plugins\npwachk.dll

[2011.05.06 10:12:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.05.06 10:12:24 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.05.06 10:12:24 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.05.06 10:12:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.05.06 10:12:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.05.06 10:12:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.04 16:52:50 | 000,307,229 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 127.0.0.1        1-2005-search.com

O1 - Hosts: 10574 more lines...

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [ATICustomerCare] C:\Programme\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\Andreas\Startmenü\Programme\Autostart\SpeedFan.lnk = C:\Programme\SpeedFan\speedfan.exe (Almico Software (www.almico.com))

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B922220B-3C7C-40AE-BD0F-5ECA4D0B7886}: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.04 15:45:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{59e0c8f4-1fe4-11df-8b4c-0030843a9633}\Shell\AutoRun\command - "" = G:\Menu.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: HidServ -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Exif Launcher S.lnk -  - File not found

MsConfig - StartUpReg: Buskb - hkey= - key= -  File not found

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= -  File not found

MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()

MsConfig - StartUpReg: ENISysTray - hkey= - key= - C:\Programme\3S Software\CoDeSys ENI Server\ENISysTray.exe (3S-Smart Software Solutions GmbH)

MsConfig - StartUpReg: KernelFaultCheck - hkey= - key= -  File not found

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - State: "system.ini" - 0

MsConfig - State: "win.ini" - 0

MsConfig - State: "bootini" - 0

MsConfig - State: "services" - 0

MsConfig - State: "startup" - 2

 

SafeBootMin: 35679699.sys - Driver

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: 35679699.sys - Driver

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: UploadMgr - Service

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Flash Player 8

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.01.19 00:43:07 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Andreas\Recent

[2012.01.18 22:16:10 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2012.01.18 22:15:46 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Andreas\Desktop\esetsmartinstaller_enu.exe

[2012.01.18 15:02:32 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe

[2012.01.18 03:04:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch

[2012.01.17 00:07:44 | 000,000,000 | ---D | C] -- C:\Programme\Sierra On-Line

[2012.01.15 02:10:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Eigene Dateien\DemolitionInc

[2012.01.14 00:09:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Eigene Dateien\Tilted Mill

[2012.01.13 14:14:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\Somalian Syndrome

[2012.01.13 14:13:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Xvid

[2012.01.13 14:13:26 | 000,000,000 | ---D | C] -- C:\Programme\Xvid

[2012.01.04 19:59:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\dm-Fotowelt

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.01.19 09:37:47 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012.01.19 09:37:46 | 000,000,322 | ---- | M] () -- C:\WINDOWS\tasks\Lrdqlhgvek.job

[2012.01.19 09:37:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.01.18 23:35:28 | 000,004,548 | ---- | M] () -- C:\WINDOWS\wincmd.ini

[2012.01.18 22:15:48 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Andreas\Desktop\esetsmartinstaller_enu.exe

[2012.01.18 20:37:32 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\umdf\Msft_User_WpdMtpDr_01_00_00.Wdf

[2012.01.18 13:37:08 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\9y23y0kk.exe

[2012.01.18 13:27:16 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\defogger_reenable

[2012.01.18 11:58:00 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Andreas\Desktop\OTL.exe

[2012.01.18 03:04:48 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\perfprocg.dll

[2012.01.18 02:42:51 | 000,015,866 | ---- | M] () -- C:\monkey.s00

[2012.01.18 02:37:37 | 000,022,660 | ---- | M] () -- C:\atlantis.s01

[2012.01.18 02:33:59 | 000,024,103 | ---- | M] () -- C:\atlantis.s00

[2012.01.18 02:24:45 | 000,017,624 | ---- | M] () -- C:\zak.s01

[2012.01.18 02:22:48 | 000,016,167 | ---- | M] () -- C:\zak.s00

[2012.01.18 02:17:14 | 000,000,032 | ---- | M] () -- C:\WINDOWS\CD_Start.INI

[2012.01.17 01:40:54 | 000,000,249 | ---- | M] () -- C:\WINDOWS\SIERRA.INI

[2012.01.17 00:42:25 | 000,021,840 | ---- | M] () -- C:\WINDOWS\System32\SIntfNT.dll

[2012.01.17 00:42:25 | 000,017,212 | ---- | M] () -- C:\WINDOWS\System32\SIntf32.dll

[2012.01.17 00:42:25 | 000,012,067 | ---- | M] () -- C:\WINDOWS\System32\SIntf16.dll

[2012.01.16 09:30:19 | 000,000,882 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini

[2012.01.15 02:10:20 | 000,444,952 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll

[2012.01.11 14:13:38 | 000,049,707 | ---- | M] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\Lebenslauf von Andreas Lang.pdf

[2012.01.09 11:17:23 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.01.18 13:39:33 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\9y23y0kk.exe

[2012.01.18 13:27:16 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\defogger_reenable

[2012.01.18 03:04:49 | 000,000,322 | ---- | C] () -- C:\WINDOWS\tasks\Lrdqlhgvek.job

[2012.01.18 03:04:48 | 000,118,784 | RHS- | C] () -- C:\WINDOWS\System32\perfprocg.dll

[2012.01.18 02:42:51 | 000,015,866 | ---- | C] () -- C:\monkey.s00

[2012.01.18 02:37:37 | 000,022,660 | ---- | C] () -- C:\atlantis.s01

[2012.01.18 02:33:59 | 000,024,103 | ---- | C] () -- C:\atlantis.s00

[2012.01.18 02:24:45 | 000,017,624 | ---- | C] () -- C:\zak.s01

[2012.01.18 02:22:48 | 000,016,167 | ---- | C] () -- C:\zak.s00

[2012.01.18 02:16:57 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI

[2012.01.17 00:27:48 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll

[2012.01.17 00:27:48 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll

[2012.01.17 00:27:48 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll

[2012.01.16 22:56:42 | 000,000,249 | ---- | C] () -- C:\WINDOWS\SIERRA.INI

[2012.01.13 14:13:27 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2012.01.13 14:13:27 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2012.01.13 14:13:27 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax

[2012.01.11 14:13:37 | 000,049,707 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Desktop\Lebenslauf von Andreas Lang.pdf

[2011.11.09 22:39:44 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\OpenVideo.dll

[2011.11.09 22:39:32 | 000,054,784 | ---- | C] () -- C:\WINDOWS\System32\OVDecode.dll

[2011.07.28 19:45:56 | 000,393,256 | ---- | C] () -- C:\WINDOWS\System32\CNQ2414N.DAT

[2011.05.28 01:59:31 | 000,300,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvAutomata.sys

[2011.05.28 01:59:31 | 000,264,124 | ---- | C] () -- C:\WINDOWS\System32\drivers\ibpcimpm.sys

[2011.05.28 01:59:31 | 000,203,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvFC310x.sys

[2011.05.28 01:59:31 | 000,108,796 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvSJA.sys

[2011.05.28 01:59:31 | 000,030,268 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvHMS.sys

[2011.05.28 01:59:30 | 000,398,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvCP5613.sys

[2011.05.28 01:59:30 | 000,218,956 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvApplicom.sys

[2011.05.28 01:59:30 | 000,080,756 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvDAMP.sys

[2011.05.28 01:59:30 | 000,057,936 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTIOdrvHilscherDPM.sys

[2011.05.28 01:59:15 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\callrproxy.dll

[2011.05.28 01:59:15 | 000,060,416 | ---- | C] () -- C:\WINDOWS\System32\OPCENUM.EXE

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat

[2011.03.13 02:39:19 | 001,872,916 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-527237240-1220945662-839522115-1003-0.dat

[2011.03.13 02:39:18 | 000,289,054 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.03.01 19:55:51 | 000,138,056 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\PnkBstrK.sys

[2011.03.01 19:55:31 | 002,434,856 | ---- | C] () -- C:\WINDOWS\System32\pbsvc_bc2.exe

[2011.01.10 22:52:45 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2010.07.07 23:13:49 | 000,002,070 | ---- | C] () -- C:\WINDOWS\aopr.ini

[2010.06.19 22:38:26 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2010.06.19 22:38:26 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe

[2010.04.27 18:22:08 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll

[2010.02.15 00:23:03 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat

[2010.02.15 00:23:02 | 000,243,168 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat

[2010.02.15 00:23:02 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat

[2010.02.15 00:10:21 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2010.02.10 22:03:16 | 000,612,608 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.02.10 11:32:13 | 000,000,882 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini

[2009.10.13 18:47:04 | 000,062,976 | ---- | C] () -- C:\Dokumente und Einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.10.02 21:14:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\FE.INI

[2009.08.30 02:56:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009.08.11 15:31:53 | 000,000,144 | ---- | C] () -- C:\WINDOWS\PG3prefs.ini

[2009.06.11 11:01:35 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll

[2009.06.08 15:49:27 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys

[2009.06.08 15:49:27 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys

[2009.06.04 22:49:07 | 000,139,152 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys

[2009.06.04 22:49:02 | 000,111,928 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe

[2009.06.04 22:46:26 | 000,075,136 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe

[2009.06.04 22:15:44 | 000,000,910 | ---- | C] () -- C:\WINDOWS\eReg.dat

[2009.06.04 19:53:11 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009.06.04 19:07:41 | 000,002,120 | R--- | C] () -- C:\WINDOWS\System32\SETUP.INI

[2009.06.04 17:11:01 | 000,004,610 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2009.06.04 17:10:57 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2009.06.04 16:35:33 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009.06.04 16:35:23 | 000,004,548 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2009.06.04 16:34:39 | 000,308,400 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009.06.04 16:14:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin

[2009.06.04 16:08:00 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat

[2009.06.04 15:46:35 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009.06.04 15:42:29 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll

[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll

[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll

[2008.08.05 22:14:12 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ATIBRTMON.EXE

[2004.08.02 13:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2003.02.20 16:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.09.02 14:30:50 | 000,520,090 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2001.09.02 14:30:50 | 000,496,094 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.09.02 14:30:50 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.09.02 14:30:50 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2001.09.02 14:30:50 | 000,101,506 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2001.09.02 14:30:50 | 000,084,578 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.09.02 14:30:50 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2001.09.02 14:30:50 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.09.02 14:30:40 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2001.09.02 14:30:20 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.09.02 14:30:18 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.09.02 14:29:32 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.09.02 14:29:12 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

 
 ========== LOP Check ==========

 

[2009.08.05 23:25:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo

[2011.07.28 19:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ

[2011.07.28 19:47:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan

[2009.12.08 15:35:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

[2009.07.14 22:54:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Pro

[2011.11.27 23:50:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbg

[2011.06.06 00:03:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EA Logs

[2010.06.19 22:38:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF

[2009.07.09 16:39:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tages

[2012.01.04 20:52:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp

[2010.03.05 19:56:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Academic Software Zurich

[2009.08.05 23:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Ashampoo

[2011.07.28 19:47:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Canon

[2011.03.12 13:09:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Dev-Cpp

[2011.10.12 21:46:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoft

[2011.10.12 21:46:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoftIEHelpers

[2009.09.28 13:37:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\FUJIFILM

[2011.06.06 00:00:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Kalypso Media

[2011.08.31 01:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mount&Blade

[2011.04.16 18:55:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\ProtectDISC

[2011.11.29 13:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\QuickScan

[2010.12.21 23:50:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Serif

[2012.01.03 11:19:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\The Creative Assembly

[2011.11.30 13:26:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Tropico 3

[2012.01.19 09:37:46 | 000,000,322 | ---- | M] () -- C:\WINDOWS\Tasks\Lrdqlhgvek.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2010.03.05 19:56:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Academic Software Zurich

[2009.07.22 13:22:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Adobe

[2009.08.05 23:28:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Ashampoo

[2010.02.15 00:26:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\ATI

[2011.05.07 13:03:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Avira

[2011.07.28 19:47:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Canon

[2009.06.04 19:01:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\CyberLink

[2011.03.12 13:09:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Dev-Cpp

[2010.05.10 18:29:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DivX

[2011.10.12 21:46:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoft

[2011.10.12 21:46:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\DVDVideoSoftIEHelpers

[2009.09.28 13:37:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\FUJIFILM

[2011.11.08 13:49:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Google

[2009.10.02 21:11:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Help

[2009.06.04 15:48:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Identities

[2009.06.04 17:11:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\InstallShield

[2011.06.06 00:00:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Kalypso Media

[2012.01.19 10:31:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Macromedia

[2011.11.29 12:44:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Malwarebytes

[2010.08.30 15:40:53 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft

[2011.03.13 12:29:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft Corporation

[2011.08.31 01:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mount&Blade

[2009.08.30 02:57:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Mozilla

[2011.04.16 18:55:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\ProtectDISC

[2011.11.29 13:16:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\QuickScan

[2009.10.30 01:40:15 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\SecuROM

[2010.12.21 23:50:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Serif

[2010.04.11 18:17:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Sun

[2012.01.03 11:19:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\The Creative Assembly

[2011.11.30 13:26:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Tropico 3

[2011.06.06 13:26:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Winamp

[2010.05.18 23:30:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\WinRAR

 
 < %APPDATA%\*.exe /s >

[2011.11.08 18:13:05 | 000,020,742 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{038936C2-9156-4FFC-A9E8-BB0E401AF01D}\_21F3885A18D238E15AAE81.exe

[2011.11.08 18:13:06 | 000,020,742 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{038936C2-9156-4FFC-A9E8-BB0E401AF01D}\_4926E6BE86013F20D231BA.exe

[2011.11.08 18:13:05 | 000,020,742 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{038936C2-9156-4FFC-A9E8-BB0E401AF01D}\_6FEFF9B68218417F98F549.exe

[2011.11.08 18:13:06 | 000,003,262 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{038936C2-9156-4FFC-A9E8-BB0E401AF01D}\_8811A8B8685F4F8E155515.exe

[2011.11.08 18:13:06 | 000,020,742 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{038936C2-9156-4FFC-A9E8-BB0E401AF01D}\_93173674FA5661DBD59935.exe

[2009.06.05 00:45:52 | 000,040,960 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{322699FF-9732-4146-AA83-17FADE68CE98}\ARPPRODUCTICON.exe

[2009.07.09 21:33:01 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe

[2009.06.05 00:45:27 | 000,040,960 | R--- | M] (Macrovision Corporation) -- C:\Dokumente und Einstellungen\Andreas\Anwendungsdaten\Microsoft\Installer\{BBD49DF4-8156-4A5B-9C8D-285B37ED7ECF}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys

[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

[2004.08.03 22:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2004.08.04 00:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys

[2008.04.14 08:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.03 21:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.03 23:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.03 23:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: NVGTS.SYS  >

[2008.08.18 18:54:52 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=37954CD1D0AFC11BECD149F7C3EC88C2 -- C:\Raid\TreiberNEU\Floppy_IN73W\XP2K_RAID\nvgts.sys

[2008.08.18 18:54:52 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=37954CD1D0AFC11BECD149F7C3EC88C2 -- C:\Raid\TreiberNEU\SATA2_XP(NF_1611_SATA)\IDE\WinXP\sataraid\nvgts.sys

[2007.10.31 04:22:06 | 000,107,008 | ---- | M] (NVIDIA Corporation) MD5=C59D85C0DBCCF4610C58B599083D454D -- C:\Raid\Drivers\ALL in 1\nVIDIA\XP_2K(NF_1611_Novga)\IDE\WinXP\sata_ide\nvgts.sys

[2007.10.31 04:22:06 | 000,107,008 | ---- | M] (NVIDIA Corporation) MD5=C59D85C0DBCCF4610C58B599083D454D -- C:\Raid\Drivers\ALL in 1\nVIDIA\XP_2K(NF_1611_Novga)\IDE\WinXP\sataraid\nvgts.sys

[2007.10.31 04:22:06 | 000,107,008 | ---- | M] (NVIDIA Corporation) MD5=C59D85C0DBCCF4610C58B599083D454D -- C:\Raid\Drivers\Serial ATA For Floppy Disk\nVIDIA\XP2K_AHCI\nvgts.sys

[2007.10.31 04:22:06 | 000,107,008 | ---- | M] (NVIDIA Corporation) MD5=C59D85C0DBCCF4610C58B599083D454D -- C:\Raid\Drivers\Serial ATA For Floppy Disk\nVIDIA\XP2K_RAID\nvgts.sys

[2008.08.18 18:54:24 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=EA98BFE4931BD13D747D647C1859796E -- C:\Raid\TreiberNEU\Floppy_IN73W\XP2K_AHCI\nvgts.sys

[2008.08.18 18:54:24 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=EA98BFE4931BD13D747D647C1859796E -- C:\Raid\TreiberNEU\SATA2_XP(NF_1611_SATA)\IDE\WinXP\sata_ide\nvgts.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2008.08.18 18:58:42 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=2A0CC26D67B38460CC7563BC8313C1D6 -- C:\Raid\TreiberNEU\Floppy_IN73W\VISTA_RAID\nvstor32.sys

[2007.10.31 04:23:20 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=4876E7C3184BDF50EDE043FEF616B867 -- C:\Raid\Drivers\Serial ATA For Floppy Disk\nVIDIA\VISTA_AHCI\nvstor32.sys

[2007.10.31 04:23:20 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=4876E7C3184BDF50EDE043FEF616B867 -- C:\Raid\i386\AHCI_Vista\nvstor32.sys

[2008.08.18 18:58:16 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\Raid\TreiberNEU\Floppy_IN73W\VISTA_AHCI\nvstor32.sys

[2007.10.31 04:23:22 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=9D2BD672C0461185D6EA1AE8BD3AE3F4 -- C:\Raid\Drivers\Serial ATA For Floppy Disk\nVIDIA\VISTA_RAID\nvstor32.sys

[2007.10.31 04:23:22 | 000,115,744 | ---- | M] (NVIDIA Corporation) MD5=9D2BD672C0461185D6EA1AE8BD3AE3F4 -- C:\Raid\i386\RAID_Vista\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.03 23:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2004.08.03 23:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.03 23:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.03 23:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2001.09.02 14:31:52 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2001.09.02 14:31:52 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2009.06.04 17:33:57 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2009.06.04 17:33:57 | 000,634,880 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2009.06.04 17:33:57 | 000,417,792 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2012.01.18 03:04:48 | 000,118,784 | RHS- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\perfprocg.dll

[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 

< End of report >

Zitat:

DhcpNameServer = 192.168.1.1

Du hast einen Router.
Wurde da das Adminpasswort geändert?
Wenn nicht, setz diesen Router auf Werkseinstellungen zurück und konfiguriere ihn neu. Wichtig ist, dass du das unsichere vordefinierte Adminkennwort zum Router änderst!

Zitat:

Zitat von cosinus (Beitrag 757089)

Das Passwort hatte ich damals geändert.
Dennoch habe ich es eben noch mal geändert.

Von den Werkseinstellungen erwähnst du leider garnix

Sorry, hatte ich vergessen zu erwähnen.

Ich habe den Router zurückgesetzt und ein neues Passwort eingerichtet.

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hallo,

hier das gewünschte TDSS-Log:

Nebenbei möchte ich mich bei Dir bedanken, dass Du dich meines Problems annimmst. Danke!

Code:

13:20:56.0000 3632        TDSS rootkit removing tool 2.7.5.0 Jan 18 2012 09:26:24

13:20:56.0046 3632        ============================================================

13:20:56.0046 3632        Current date / time: 2012/01/19 13:20:56.0046

13:20:56.0046 3632        SystemInfo:

13:20:56.0046 3632        

13:20:56.0046 3632        OS Version: 5.1.2600 ServicePack: 3.0

13:20:56.0046 3632        Product type: Workstation

13:20:56.0046 3632        ComputerName: ANDI

13:20:56.0046 3632        UserName: Andreas

13:20:56.0046 3632        Windows directory: C:\WINDOWS

13:20:56.0046 3632        System windows directory: C:\WINDOWS

13:20:56.0046 3632        Processor architecture: Intel x86

13:20:56.0046 3632        Number of processors: 4

13:20:56.0046 3632        Page size: 0x1000

13:20:56.0046 3632        Boot type: Normal boot

13:20:56.0046 3632        ============================================================

13:20:57.0109 3632        Drive \Device\Harddisk0\DR0 - Size: 0x12A1F16000 (74.53 Gb), SectorSize: 0x200, Cylinders: 0x2601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

13:20:57.0125 3632        Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

13:20:57.0187 3632        Initialize success

13:21:31.0171 3348        ============================================================

13:21:31.0171 3348        Scan started

13:21:31.0171 3348        Mode: Manual; SigCheck; TDLFS; 

13:21:31.0171 3348        ============================================================

13:21:31.0484 3348        3SRTE           (75c4f529679d9862fa5fb306a357af35) C:\WINDOWS\system32\drivers\3SRTE.sys

13:21:31.0609 3348        3SRTE ( UnsignedFile.Multi.Generic ) - warning

13:21:31.0609 3348        3SRTE - detected UnsignedFile.Multi.Generic (1)

13:21:31.0625 3348        Abiosdsk - ok

13:21:31.0640 3348        abp480n5 - ok

13:21:31.0671 3348        acedrv11        (e6f53d6c0dea3d375362265e175ca638) C:\WINDOWS\system32\drivers\acedrv11.sys

13:21:31.0734 3348        acedrv11 - ok

13:21:31.0765 3348        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys

13:21:32.0343 3348        ACPI - ok

13:21:32.0390 3348        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys

13:21:32.0484 3348        ACPIEC - ok

13:21:32.0500 3348        adpu160m - ok

13:21:32.0531 3348        aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

13:21:32.0625 3348        aec - ok

13:21:32.0640 3348        AFD             (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys

13:21:32.0718 3348        AFD - ok

13:21:32.0734 3348        Aha154x - ok

13:21:32.0750 3348        aic78u2 - ok

13:21:32.0750 3348        aic78xx - ok

13:21:32.0765 3348        AliIde - ok

13:21:32.0781 3348        amsint - ok

13:21:32.0796 3348        asc - ok

13:21:32.0812 3348        asc3350p - ok

13:21:32.0812 3348        asc3550 - ok

13:21:32.0843 3348        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

13:21:32.0921 3348        AsyncMac - ok

13:21:32.0953 3348        atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

13:21:33.0031 3348        atapi - ok

13:21:33.0046 3348        Atdisk - ok

13:21:33.0250 3348        ati2mtag        (c832bf76f003999d2e91e5115583c69e) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

13:21:33.0578 3348        ati2mtag - ok

13:21:33.0656 3348        atksgt          (f0d933b42cd0594048e4d5200ae9e417) C:\WINDOWS\system32\DRIVERS\atksgt.sys

13:21:33.0656 3348        atksgt - ok

13:21:33.0703 3348        Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

13:21:33.0781 3348        Atmarpc - ok

13:21:33.0812 3348        audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

13:21:33.0890 3348        audstub - ok

13:21:33.0937 3348        avgio           (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys

13:21:33.0937 3348        avgio - ok

13:21:33.0968 3348        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

13:21:33.0968 3348        avgntflt - ok

13:21:33.0984 3348        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys

13:21:34.0000 3348        avipbb - ok

13:21:34.0015 3348        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

13:21:34.0093 3348        Beep - ok

13:21:34.0125 3348        cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

13:21:34.0218 3348        cbidf2k - ok

13:21:34.0296 3348        cd20xrnt - ok

13:21:34.0312 3348        Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

13:21:34.0406 3348        Cdaudio - ok

13:21:34.0437 3348        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

13:21:34.0515 3348        Cdfs - ok

13:21:34.0546 3348        Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

13:21:34.0625 3348        Cdrom - ok

13:21:34.0640 3348        Changer - ok

13:21:34.0656 3348        CmdIde - ok

13:21:34.0671 3348        Cpqarray - ok

13:21:34.0718 3348        cpuz130 - ok

13:21:34.0734 3348        dac2w2k - ok

13:21:34.0750 3348        dac960nt - ok

13:21:34.0765 3348        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

13:21:34.0828 3348        Disk - ok

13:21:34.0875 3348        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys

13:21:34.0984 3348        dmboot - ok

13:21:35.0015 3348        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys

13:21:35.0109 3348        dmio - ok

13:21:35.0125 3348        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

13:21:35.0203 3348        dmload - ok

13:21:35.0234 3348        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

13:21:35.0296 3348        DMusic - ok

13:21:35.0375 3348        dpti2o - ok

13:21:35.0406 3348        drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

13:21:35.0484 3348        drmkaud - ok

13:21:35.0515 3348        ENTECH          (16ebd8bf1d5090923694cc972c7ce1b4) C:\WINDOWS\system32\DRIVERS\ENTECH.sys

13:21:35.0515 3348        ENTECH - ok

13:21:35.0546 3348        es1371          (a55dd7d8ced5d2624a9ee2dda7be0319) C:\WINDOWS\system32\drivers\es1371mp.sys

13:21:35.0640 3348        es1371 - ok

13:21:35.0671 3348        Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

13:21:35.0750 3348        Fastfat - ok

13:21:35.0765 3348        Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

13:21:35.0859 3348        Fdc - ok

13:21:35.0875 3348        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys

13:21:35.0953 3348        Fips - ok

13:21:35.0968 3348        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

13:21:36.0046 3348        Flpydisk - ok

13:21:36.0078 3348        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

13:21:36.0156 3348        FltMgr - ok

13:21:36.0171 3348        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

13:21:36.0250 3348        Fs_Rec - ok

13:21:36.0265 3348        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

13:21:36.0343 3348        Ftdisk - ok

13:21:36.0359 3348        gameenum        (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys

13:21:36.0437 3348        gameenum - ok

13:21:36.0453 3348        giveio          (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

13:21:36.0468 3348        giveio ( UnsignedFile.Multi.Generic ) - warning

13:21:36.0468 3348        giveio - detected UnsignedFile.Multi.Generic (1)

13:21:36.0546 3348        Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

13:21:36.0625 3348        Gpc - ok

13:21:36.0656 3348        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

13:21:36.0734 3348        HDAudBus - ok

13:21:36.0750 3348        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

13:21:36.0828 3348        HidUsb - ok

13:21:36.0828 3348        hpn - ok

13:21:36.0843 3348        hpt3xx - ok

13:21:36.0875 3348        HTTP            (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys

13:21:36.0937 3348        HTTP - ok

13:21:36.0953 3348        i2omgmt - ok

13:21:36.0968 3348        i2omp - ok

13:21:36.0984 3348        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

13:21:37.0062 3348        i8042prt - ok

13:21:37.0109 3348        ibpcimpm        (e3dfd445aa6f1d52a0d1e7c1a936f374) C:\WINDOWS\system32\drivers\ibpcimpm.sys

13:21:37.0125 3348        ibpcimpm ( UnsignedFile.Multi.Generic ) - warning

13:21:37.0125 3348        ibpcimpm - detected UnsignedFile.Multi.Generic (1)

13:21:37.0140 3348        Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

13:21:37.0218 3348        Imapi - ok

13:21:37.0234 3348        ini910u - ok

13:21:37.0250 3348        IntelIde - ok

13:21:37.0281 3348        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys

13:21:37.0343 3348        intelppm - ok

13:21:37.0375 3348        ip6fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

13:21:37.0453 3348        ip6fw - ok

13:21:37.0484 3348        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

13:21:37.0578 3348        IpFilterDriver - ok

13:21:37.0593 3348        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

13:21:37.0671 3348        IpInIp - ok

13:21:37.0687 3348        IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

13:21:37.0765 3348        IpNat - ok

13:21:37.0843 3348        IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

13:21:37.0921 3348        IPSec - ok

13:21:37.0937 3348        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

13:21:38.0015 3348        IRENUM - ok

13:21:38.0046 3348        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys

13:21:38.0125 3348        isapnp - ok

13:21:38.0140 3348        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

13:21:38.0218 3348        Kbdclass - ok

13:21:38.0250 3348        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

13:21:38.0328 3348        kbdhid - ok

13:21:38.0343 3348        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

13:21:38.0421 3348        kmixer - ok

13:21:38.0437 3348        KSecDD          (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys

13:21:38.0515 3348        KSecDD - ok

13:21:38.0515 3348        lbrtfdc - ok

13:21:38.0546 3348        lirsgt          (f8a7212d0864ef5e9185fb95e6623f4d) C:\WINDOWS\system32\DRIVERS\lirsgt.sys

13:21:38.0562 3348        lirsgt - ok

13:21:38.0578 3348        MBAMProtector   (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys

13:21:38.0578 3348        MBAMProtector - ok

13:21:38.0609 3348        mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

13:21:38.0687 3348        mnmdd - ok

13:21:38.0718 3348        Modem           (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys

13:21:38.0796 3348        Modem - ok

13:21:38.0812 3348        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys

13:21:38.0875 3348        Mouclass - ok

13:21:38.0906 3348        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys

13:21:39.0000 3348        mouhid - ok

13:21:39.0078 3348        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

13:21:39.0156 3348        MountMgr - ok

13:21:39.0171 3348        mraid35x - ok

13:21:39.0187 3348        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

13:21:39.0265 3348        MRxDAV - ok

13:21:39.0296 3348        MRxSmb          (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

13:21:39.0375 3348        MRxSmb - ok

13:21:39.0390 3348        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

13:21:39.0484 3348        Msfs - ok

13:21:39.0500 3348        MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

13:21:39.0578 3348        MSKSSRV - ok

13:21:39.0609 3348        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

13:21:39.0671 3348        MSPCLOCK - ok

13:21:39.0687 3348        MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

13:21:39.0765 3348        MSPQM - ok

13:21:39.0796 3348        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

13:21:39.0875 3348        mssmbios - ok

13:21:39.0875 3348        Mup             (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

13:21:39.0953 3348        Mup - ok

13:21:39.0968 3348        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

13:21:40.0046 3348        NDIS - ok

13:21:40.0062 3348        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

13:21:40.0140 3348        NdisTapi - ok

13:21:40.0156 3348        Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

13:21:40.0250 3348        Ndisuio - ok

13:21:40.0265 3348        NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

13:21:40.0328 3348        NdisWan - ok

13:21:40.0343 3348        NDProxy         (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

13:21:40.0421 3348        NDProxy - ok

13:21:40.0484 3348        NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

13:21:40.0562 3348        NetBIOS - ok

13:21:40.0593 3348        NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

13:21:40.0671 3348        NetBT - ok

13:21:40.0687 3348        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

13:21:40.0765 3348        Npfs - ok

13:21:40.0796 3348        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

13:21:40.0890 3348        Ntfs - ok

13:21:40.0921 3348        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

13:21:41.0000 3348        Null - ok

13:21:41.0031 3348        nvsmu           (7ec12a73067baca25a8e3e2a58ae83d8) C:\WINDOWS\system32\DRIVERS\nvsmu.sys

13:21:41.0062 3348        nvsmu - ok

13:21:41.0093 3348        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

13:21:41.0171 3348        NwlnkFlt - ok

13:21:41.0187 3348        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

13:21:41.0281 3348        NwlnkFwd - ok

13:21:41.0296 3348        Parport         (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys

13:21:41.0375 3348        Parport - ok

13:21:41.0406 3348        PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

13:21:41.0468 3348        PartMgr - ok

13:21:41.0500 3348        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys

13:21:41.0578 3348        ParVdm - ok

13:21:41.0640 3348        PCI             (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys

13:21:41.0718 3348        PCI - ok

13:21:41.0734 3348        PCIDump - ok

13:21:41.0750 3348        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys

13:21:41.0828 3348        PCIIde - ok

13:21:41.0859 3348        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys

13:21:41.0937 3348        Pcmcia - ok

13:21:41.0953 3348        PDCOMP - ok

13:21:41.0968 3348        PDFRAME - ok

13:21:41.0968 3348        PDRELI - ok

13:21:41.0984 3348        PDRFRAME - ok

13:21:42.0000 3348        perc2 - ok

13:21:42.0015 3348        perc2hib - ok

13:21:42.0062 3348        pnicml - ok

13:21:42.0093 3348        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

13:21:42.0171 3348        PptpMiniport - ok

13:21:42.0187 3348        Processor       (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys

13:21:42.0265 3348        Processor - ok

13:21:42.0281 3348        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

13:21:42.0359 3348        PSched - ok

13:21:42.0375 3348        Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

13:21:42.0468 3348        Ptilink - ok

13:21:42.0484 3348        PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys

13:21:42.0500 3348        PxHelp20 - ok

13:21:42.0500 3348        ql1080 - ok

13:21:42.0515 3348        Ql10wnt - ok

13:21:42.0515 3348        ql12160 - ok

13:21:42.0531 3348        ql1240 - ok

13:21:42.0546 3348        ql1280 - ok

13:21:42.0562 3348        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

13:21:42.0656 3348        RasAcd - ok

13:21:42.0671 3348        Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

13:21:42.0750 3348        Rasl2tp - ok

13:21:42.0765 3348        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

13:21:42.0828 3348        RasPppoe - ok

13:21:42.0859 3348        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

13:21:42.0937 3348        Raspti - ok

13:21:43.0015 3348        Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

13:21:43.0109 3348        Rdbss - ok

13:21:43.0125 3348        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

13:21:43.0203 3348        RDPCDD - ok

13:21:43.0234 3348        rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

13:21:43.0312 3348        rdpdr - ok

13:21:43.0359 3348        RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

13:21:43.0453 3348        RDPWD - ok

13:21:43.0468 3348        redbook         (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys

13:21:43.0546 3348        redbook - ok

13:21:43.0593 3348        RTIOdrvAPIC     (283afeacb5bfbaf3f837950cced74790) C:\WINDOWS\system32\drivers\RTIOdrvAPIC.sys

13:21:43.0609 3348        RTIOdrvAPIC ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0609 3348        RTIOdrvAPIC - detected UnsignedFile.Multi.Generic (1)

13:21:43.0640 3348        RTIOdrvApplicom (62717d3b4cadf16a44b15260a05e9cb0) C:\WINDOWS\system32\drivers\RTIOdrvApplicom.sys

13:21:43.0656 3348        RTIOdrvApplicom ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0656 3348        RTIOdrvApplicom - detected UnsignedFile.Multi.Generic (1)

13:21:43.0703 3348        RTIOdrvAutomata (c48a8ef4d156332793b6200c44c2c74c) C:\WINDOWS\system32\drivers\RTIOdrvAutomata.sys

13:21:43.0703 3348        RTIOdrvAutomata ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0703 3348        RTIOdrvAutomata - detected UnsignedFile.Multi.Generic (1)

13:21:43.0796 3348        RTIOdrvCP5613   (c1d2c371f81ce63ebd3d5122f5f13807) C:\WINDOWS\system32\drivers\RTIOdrvCP5613.sys

13:21:43.0812 3348        RTIOdrvCP5613 ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0812 3348        RTIOdrvCP5613 - detected UnsignedFile.Multi.Generic (1)

13:21:43.0843 3348        RTIOdrvDAMP     (328da1f5d31f59af2175bb01d037dbdf) C:\WINDOWS\system32\drivers\RTIOdrvDAMP.sys

13:21:43.0859 3348        RTIOdrvDAMP ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0859 3348        RTIOdrvDAMP - detected UnsignedFile.Multi.Generic (1)

13:21:43.0906 3348        RTIOdrvFC310x   (e54a12f9ea1bad183685b2d6c253f828) C:\WINDOWS\system32\drivers\RTIOdrvFC310x.sys

13:21:43.0921 3348        RTIOdrvFC310x ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0921 3348        RTIOdrvFC310x - detected UnsignedFile.Multi.Generic (1)

13:21:43.0953 3348        RTIOdrvHilscherDPM (67c113528a8c15d4339c7e48967fb53a) C:\WINDOWS\system32\drivers\RTIOdrvHilscherDPM.sys

13:21:43.0968 3348        RTIOdrvHilscherDPM ( UnsignedFile.Multi.Generic ) - warning

13:21:43.0968 3348        RTIOdrvHilscherDPM - detected UnsignedFile.Multi.Generic (1)

13:21:44.0000 3348        RTIOdrvHMS      (f0dbb33048d66857ce4033ee5abc6f31) C:\WINDOWS\system32\drivers\RTIOdrvHMS.sys

13:21:44.0015 3348        RTIOdrvHMS ( UnsignedFile.Multi.Generic ) - warning

13:21:44.0015 3348        RTIOdrvHMS - detected UnsignedFile.Multi.Generic (1)

13:21:44.0046 3348        RTIOdrvSJA      (5fce4a4eda4b8c0f7cdcd65b36d5f7a0) C:\WINDOWS\system32\drivers\RTIOdrvSJA.sys

13:21:44.0062 3348        RTIOdrvSJA ( UnsignedFile.Multi.Generic ) - warning

13:21:44.0062 3348        RTIOdrvSJA - detected UnsignedFile.Multi.Generic (1)

13:21:44.0078 3348        rtl8139         (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

13:21:44.0156 3348        rtl8139 - ok

13:21:44.0187 3348        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

13:21:44.0265 3348        Secdrv - ok

13:21:44.0328 3348        serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

13:21:44.0390 3348        serenum - ok

13:21:44.0421 3348        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys

13:21:44.0500 3348        Serial - ok

13:21:44.0531 3348        sfdrv01         (00de597b81b381053cb5b21a7f20e365) C:\WINDOWS\system32\drivers\sfdrv01.sys

13:21:44.0546 3348        sfdrv01 ( UnsignedFile.Multi.Generic ) - warning

13:21:44.0546 3348        sfdrv01 - detected UnsignedFile.Multi.Generic (1)

13:21:44.0562 3348        sfhlp02         (64b9ab76f1b16eb059cb6cdd906c067a) C:\WINDOWS\system32\drivers\sfhlp02.sys

13:21:44.0578 3348        sfhlp02 ( UnsignedFile.Multi.Generic ) - warning

13:21:44.0578 3348        sfhlp02 - detected UnsignedFile.Multi.Generic (1)

13:21:44.0593 3348        Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

13:21:44.0656 3348        Sfloppy - ok

13:21:44.0671 3348        sfsync02        (798d918d8f20380008277ce3ce5319d1) C:\WINDOWS\system32\drivers\sfsync02.sys

13:21:44.0687 3348        sfsync02 ( UnsignedFile.Multi.Generic ) - warning

13:21:44.0687 3348        sfsync02 - detected UnsignedFile.Multi.Generic (1)

13:21:44.0703 3348        Simbad - ok

13:21:44.0718 3348        Sparrow - ok

13:21:44.0734 3348        speedfan        (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys

13:21:44.0734 3348        speedfan ( UnsignedFile.Multi.Generic ) - warning

13:21:44.0734 3348        speedfan - detected UnsignedFile.Multi.Generic (1)

13:21:44.0765 3348        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

13:21:44.0843 3348        splitter - ok

13:21:44.0859 3348        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys

13:21:44.0953 3348        sr - ok

13:21:44.0968 3348        Srv             (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys

13:21:45.0062 3348        Srv - ok

13:21:45.0078 3348        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

13:21:45.0093 3348        ssmdrv - ok

13:21:45.0109 3348        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

13:21:45.0187 3348        swenum - ok

13:21:45.0203 3348        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

13:21:45.0296 3348        swmidi - ok

13:21:45.0359 3348        symc810 - ok

13:21:45.0375 3348        symc8xx - ok

13:21:45.0390 3348        sym_hi - ok

13:21:45.0390 3348        sym_u3 - ok

13:21:45.0421 3348        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

13:21:45.0500 3348        sysaudio - ok

13:21:45.0531 3348        Tcpip           (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys

13:21:45.0609 3348        Tcpip - ok

13:21:45.0640 3348        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

13:21:45.0718 3348        TDPIPE - ok

13:21:45.0750 3348        TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

13:21:45.0828 3348        TDTCP - ok

13:21:45.0828 3348        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

13:21:45.0906 3348        TermDD - ok

13:21:45.0921 3348        TosIde - ok

13:21:45.0937 3348        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

13:21:46.0015 3348        Udfs - ok

13:21:46.0031 3348        ultra - ok

13:21:46.0062 3348        UnlockerDriver5 (bb879dcfd22926efbeb3298129898cbb) E:\Betriebsprogramme\Unlocker\UnlockerDriver5.sys

13:21:46.0078 3348        UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning

13:21:46.0078 3348        UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)

13:21:46.0109 3348        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

13:21:46.0187 3348        Update - ok

13:21:46.0218 3348        usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

13:21:46.0296 3348        usbehci - ok

13:21:46.0312 3348        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

13:21:46.0375 3348        usbhub - ok

13:21:46.0406 3348        usbohci         (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys

13:21:46.0468 3348        usbohci - ok

13:21:46.0484 3348        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

13:21:46.0562 3348        usbprint - ok

13:21:46.0578 3348        usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

13:21:46.0656 3348        usbscan - ok

13:21:46.0687 3348        USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

13:21:46.0750 3348        USBSTOR - ok

13:21:46.0812 3348        VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

13:21:46.0890 3348        VgaSave - ok

13:21:46.0906 3348        ViaIde - ok

13:21:46.0937 3348        VolSnap         (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys

13:21:47.0015 3348        VolSnap - ok

13:21:47.0031 3348        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

13:21:47.0109 3348        Wanarp - ok

13:21:47.0125 3348        WDICA - ok

13:21:47.0140 3348        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

13:21:47.0218 3348        wdmaud - ok

13:21:47.0265 3348        WmBEnum         (bc3ecbcb40147bdae3ad2fd0b4b346d8) C:\WINDOWS\system32\drivers\WmBEnum.sys

13:21:47.0281 3348        WmBEnum - ok

13:21:47.0296 3348        WmFilter        (19f9881d8b3484fedb605d0216876898) C:\WINDOWS\system32\drivers\WmFilter.sys

13:21:47.0328 3348        WmFilter - ok

13:21:47.0343 3348        WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys

13:21:47.0421 3348        WmiAcpi - ok

13:21:47.0437 3348        WmVirHid        (7a51545a6409a25eedbdbd97d019e8cc) C:\WINDOWS\system32\drivers\WmVirHid.sys

13:21:47.0468 3348        WmVirHid - ok

13:21:47.0468 3348        WmXlCore        (1f083b3bc73017e60c3ca85cf4a70753) C:\WINDOWS\system32\drivers\WmXlCore.sys

13:21:47.0484 3348        WmXlCore - ok

13:21:47.0515 3348        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

13:21:47.0546 3348        WpdUsb - ok

13:21:47.0625 3348        WS2IFSL         (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

13:21:47.0718 3348        WS2IFSL - ok

13:21:47.0750 3348        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

13:21:47.0781 3348        WudfPf - ok

13:21:47.0796 3348        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

13:21:47.0812 3348        WudfRd - ok

13:21:47.0843 3348        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0

13:21:48.0000 3348        \Device\Harddisk0\DR0 - ok

13:21:48.0000 3348        MBR (0x1B8)     (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk1\DR1

13:21:48.0046 3348        \Device\Harddisk1\DR1 - ok

13:21:48.0046 3348        Boot (0x1200)   (c68d34be5dd1b83621ae3960b5517a1b) \Device\Harddisk0\DR0\Partition0

13:21:48.0046 3348        \Device\Harddisk0\DR0\Partition0 - ok

13:21:48.0046 3348        Boot (0x1200)   (d665c0c9469b691eb7741a5b366e7121) \Device\Harddisk1\DR1\Partition0

13:21:48.0046 3348        \Device\Harddisk1\DR1\Partition0 - ok

13:21:48.0046 3348        ============================================================

13:21:48.0046 3348        Scan finished

13:21:48.0046 3348        ============================================================

13:21:48.0156 3340        Detected object count: 17

13:21:48.0156 3340        Actual detected object count: 17

13:22:24.0703 3340        3SRTE ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        3SRTE ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        giveio ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        giveio ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        ibpcimpm ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        ibpcimpm ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvAPIC ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvAPIC ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvApplicom ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvApplicom ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvAutomata ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvAutomata ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvCP5613 ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvCP5613 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvDAMP ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvDAMP ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvFC310x ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvFC310x ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvHilscherDPM ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvHilscherDPM ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvHMS ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvHMS ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        RTIOdrvSJA ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        RTIOdrvSJA ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0703 3340        sfdrv01 ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0703 3340        sfdrv01 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0718 3340        sfhlp02 ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0718 3340        sfhlp02 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0718 3340        sfsync02 ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0718 3340        sfsync02 ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0718 3340        speedfan ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0718 3340        speedfan ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:22:24.0718 3340        UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user

13:22:24.0718 3340        UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Alles ziemlich unauffällig. Hast du das Problem nur dem Firefox oder auch mit anderen Browser?

Ich habe da eine weitere interessante Beobachtung gemacht.

Da ich nur den Firefox auf meinem Rechner habe, holte ich mir Chrome von chip.de, um deine Frage beantworten zu können.

Ich installierte Chrome und testete gleich mal google. Hier wurden keine Falschweiterleitungen durchgeführt. Bei Firefox blieb der Fehler bestehen.

Ich startet meinen Computer neu, um es gleich nochmal auszuprobieren. Doch jetzt war der Fehler auch in Chrome vorhanden. Verdammt, dachte ich und deinstallierte Chrome sofort.

und jetzt kommst...

Als ich direkt nach der Deinstallation von Chrome Firefox benutzte um zu googeln, war der Fehler weg!

Erst mit einem weiteren Neustart des Systems war der Fehler wieder vorhanden. Jedoch lässt sich das oben beschriebene Prozedere beliebig oft mit Erfolg wiederholen.

Ich hoffe, das hilft uns irgendwie weiter.

Erstell dir mal ein neues Profil und teste => Profile verwalten | Anleitung | Firefox-Hilfe

Ich habe ein neues Profil ohne Erfolg erstellt und getestet. Googleergebnisse werden weiterhin fehlgeleitet.

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hier die gewünschte ComboFix-Log.

Code:

ComboFix 12-01-19.02 - Andreas 20.01.2012  15:13:02.1.4 - x86

ausgeführt von:: c:\dokumente und einstellungen\Andreas\Desktop\ComboFix.exe

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokume~1\Andreas\LOKALE~1\Temp\sfamcc00001.dll

c:\dokume~1\Andreas\LOKALE~1\Temp\sfareca00001.dll

c:\dokumente und einstellungen\Andreas\Desktop\Scanner.lnk

c:\dokumente und einstellungen\Andreas\Lokale Einstellungen\Temp\sfamcc00001.dll

c:\dokumente und einstellungen\Andreas\Lokale Einstellungen\Temp\sfareca00001.dll

c:\dokumente und einstellungen\Andreas\WINDOWS

c:\windows\IsUn0407.exe

c:\windows\iun6002.exe

c:\windows\pkunzip.pif

c:\windows\pkzip.pif

c:\windows\system\Wing32.dll

c:\windows\system32\setup.ini

c:\windows\system32\tmp25.tmp

c:\windows\system32\tmp3F.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-20 bis 2012-01-20  ))))))))))))))))))))))))))))))

.

.

2012-01-18 02:04 . 2012-01-18 02:04        118784        --sha-r-        c:\windows\system32\perfprocg.dll

2012-01-16 23:27 . 2012-01-16 23:42        21840        ----atw-        c:\windows\system32\SIntfNT.dll

2012-01-16 23:27 . 2012-01-16 23:42        17212        ----atw-        c:\windows\system32\SIntf32.dll

2012-01-16 23:27 . 2012-01-16 23:42        12067        ----atw-        c:\windows\system32\SIntf16.dll

2012-01-16 23:07 . 2012-01-16 23:07        --------        d-----w-        c:\programme\Sierra On-Line

2012-01-13 13:14 . 2012-01-13 13:32        --------        d-----w-        c:\dokumente und einstellungen\Andreas\Lokale Einstellungen\Anwendungsdaten\Somalian Syndrome

2012-01-13 13:13 . 2008-04-27 09:35        180224        ----a-w-        c:\windows\system32\xvidvfw.dll

2012-01-13 13:13 . 2008-04-27 09:33        765952        ----a-w-        c:\windows\system32\xvidcore.dll

2012-01-13 13:13 . 2007-06-28 17:55        77824        ----a-w-        c:\windows\system32\xvid.ax

2012-01-13 13:13 . 2012-01-13 13:13        --------        d-----w-        c:\programme\Xvid

2012-01-06 08:36 . 2012-01-06 08:36        626688        ----a-w-        c:\programme\Mozilla Firefox\msvcr80.dll

2012-01-06 08:36 . 2012-01-06 08:36        548864        ----a-w-        c:\programme\Mozilla Firefox\msvcp80.dll

2012-01-06 08:36 . 2012-01-06 08:36        479232        ----a-w-        c:\programme\Mozilla Firefox\msvcm80.dll

2012-01-06 08:36 . 2012-01-06 08:36        43992        ----a-w-        c:\programme\Mozilla Firefox\mozutils.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-15 01:10 . 2009-06-09 10:36        444952        ----a-w-        c:\windows\system32\wrap_oal.dll

2012-01-15 01:10 . 2009-06-09 10:36        109080        ----a-w-        c:\windows\system32\OpenAL32.dll

2011-12-15 11:59 . 2010-02-14 23:23        19210240        ----a-w-        c:\windows\system32\atioglxx.dll

2011-12-15 11:59 . 2010-02-14 23:23        884736        ----a-w-        c:\windows\system32\ati2cqag.dll

2011-12-15 11:59 . 2010-02-14 23:23        118784        ----a-w-        c:\windows\system32\atibtmon.exe

2011-12-15 11:59 . 2010-02-14 23:23        7196672        ----a-w-        c:\windows\system32\aticaldd.dll

2011-12-15 11:58 . 2010-02-14 23:23        806912        ----a-w-        c:\windows\system32\atikvmag.dll

2011-12-15 11:58 . 2010-02-14 23:23        53248        ----a-w-        c:\windows\system32\aticalcl.dll

2011-12-15 11:58 . 2010-02-14 23:23        24064        ----a-w-        c:\windows\system32\ativcoxx.dll

2011-12-15 11:58 . 2010-02-14 23:23        294912        ----a-w-        c:\windows\system32\ATIODE.exe

2011-12-15 11:58 . 2010-02-14 23:23        192512        ----a-w-        c:\windows\system32\ati2evxx.dll

2011-12-15 11:58 . 2011-03-25 10:19        956160        ----a-w-        c:\windows\system32\ativvamv.dll

2011-12-15 11:58 . 2010-02-14 23:23        45056        ----a-w-        c:\windows\system32\ATIODCLI.exe

2011-12-15 11:58 . 2010-02-14 23:23        212992        ----a-w-        c:\windows\system32\atipdlxx.dll

2011-12-15 11:58 . 2010-02-14 23:23        7493120        ----a-w-        c:\windows\system32\drivers\ati2mtag.sys

2011-12-15 11:58 . 2010-02-14 23:23        65024        ----a-w-        c:\windows\system32\atimpc32.dll

2011-12-15 11:58 . 2010-02-14 23:23        65024        ----a-w-        c:\windows\system32\amdpcom32.dll

2011-12-15 11:58 . 2010-02-14 23:23        602112        ----a-w-        c:\windows\system32\atiok3x2.dll

2011-12-15 11:58 . 2010-02-14 23:23        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2011-12-15 11:58 . 2010-02-14 23:23        5266624        ----a-w-        c:\windows\system32\ati3duag.dll

2011-12-15 11:58 . 2010-02-14 23:23        311296        ----a-w-        c:\windows\system32\atiiiexx.dll

2011-12-15 11:58 . 2010-02-14 23:23        304640        ----a-w-        c:\windows\system32\ati2dvag.dll

2011-12-15 11:58 . 2010-02-14 23:23        3303040        ----a-w-        c:\windows\system32\ativvaxx.dll

2011-12-15 11:58 . 2010-02-14 23:23        17408        ----a-w-        c:\windows\system32\atitvo32.dll

2011-12-15 11:58 . 2010-02-14 23:23        57344        ----a-w-        c:\windows\system32\aticalrt.dll

2011-12-15 11:58 . 2010-02-14 23:23        643072        ----a-w-        c:\windows\system32\ati2evxx.exe

2011-12-15 11:58 . 2010-02-14 23:23        53248        ----a-w-        c:\windows\system32\ATIDDC.DLL

2011-12-15 11:58 . 2010-02-28 01:48        159744        ----a-w-        c:\windows\system32\atiapfxx.exe

2011-12-15 11:58 . 2010-02-14 23:23        466944        ----a-w-        c:\windows\system32\ATIDEMGX.dll

2011-12-15 11:58 . 2010-02-14 23:23        155648        ----a-w-        c:\windows\system32\Oemdspif.dll

2011-12-15 11:58 . 2010-02-14 23:23        43520        ----a-w-        c:\windows\system32\ati2edxx.dll

2011-12-15 11:58 . 2010-02-14 23:23        26112        ----a-w-        c:\windows\system32\Ati2mdxx.exe

2011-12-15 11:58 . 2010-02-14 23:23        233472        ----a-w-        c:\windows\system32\atiadlxx.dll

2011-12-10 14:24 . 2011-11-29 11:44        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-02 00:52 . 2011-12-02 00:12        107888        ----a-w-        c:\windows\system32\CmdLineExt.dll

2011-11-09 21:39 . 2011-11-09 21:39        59904        ----a-w-        c:\windows\system32\OpenVideo.dll

2011-11-09 21:39 . 2011-11-09 21:39        54784        ----a-w-        c:\windows\system32\OVDecode.dll

2011-11-09 21:38 . 2011-11-09 21:38        14375936        ----a-w-        c:\windows\system32\amdocl.dll

2011-11-09 21:37 . 2011-11-09 21:37        44032        ----a-w-        c:\windows\system32\OpenCL.dll

2012-01-06 08:36 . 2011-05-06 09:12        121816        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

2006-05-03 10:06        163328        --sh--r-        c:\windows\system32\flvDX.dll

2007-02-21 11:47        31232        --sh--r-        c:\windows\system32\msfDX.dll

2008-03-16 13:30        216064        --sh--r-        c:\windows\system32\nbDX.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]

"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2009-09-05 385024]

"ATICustomerCare"="c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Malwarebytes' Anti-Malware"="e:\betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-09 98304]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

.

c:\dokumente und einstellungen\Andreas\Startmenü\Programme\Autostart\

SpeedFan.lnk - c:\programme\SpeedFan\speedfan.exe [2009-8-9 3986552]

.

c:\dokumente und einstellungen\Andreas\Startmenü\Programme\Autostart\

SpeedFan.lnk - c:\programme\SpeedFan\speedfan.exe [2009-8-9 3986552]

.

c:\dokumente und einstellungen\Andreas\Startmenü\Programme\Autostart\

SpeedFan.lnk - c:\programme\SpeedFan\speedfan.exe [2009-8-9 3986552]

.

c:\dokumente und einstellungen\Andreas\Startmenü\Programme\Autostart\

SpeedFan.lnk - c:\programme\SpeedFan\speedfan.exe [2009-8-9 3986552]

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoRecentDocsNetHood"= 1 (0x1)

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Exif Launcher S.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Exif Launcher S.lnk

backup=c:\windows\pss\Exif Launcher S.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2010-06-03 00:50        1144104        ----a-w-        c:\programme\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ENISysTray]

2005-02-01 15:17        245760        ----a-w-        c:\programme\3S Software\CoDeSys ENI Server\ENISysTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-10-29 13:49        249064        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"c:\\totalcmd\\TOTALCMD.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"e:\\Internetgutes\\Toll\\BF1942\\BF1942.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Programme\\Winamp\\winamp.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\napoleon total war\\Napoleon.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\empire total war\\Empire.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\sid meier's civilization v\\Launcher.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\pt boats knights of the sea\\PT-Boats.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\pt boats south gambit\\PTBoatsSG.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\Children of the Nile Alexandria\\CoTN.exe"=

"e:\\Betriebsprogramme\\Steam\\SteamApps\\common\\Children of the Nile\\CoTN.exe"=

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [19.01.2012 18:14 36000]

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [24.02.2010 11:22 185472]

R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [19.01.2012 18:14 86224]

R2 ENI Server;ENI Server;c:\programme\3S Software\CoDeSys ENI Server\ENI.exe [28.05.2011 01:59 565248]

R2 MBAMService;MBAMService;e:\betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe [29.11.2011 12:44 652872]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [29.11.2011 12:44 20464]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]

S2 gupdate;Google Update-Dienst (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [08.11.2011 13:47 136176]

S3 3SRTE;RTE 3S System Driver;c:\windows\system32\drivers\3SRTE.sys [28.05.2011 01:59 298043]

S3 cpuz130;cpuz130;\??\c:\dokume~1\Andreas\LOKALE~1\Temp\cpuz130\cpuz_x32.sys --> c:\dokume~1\Andreas\LOKALE~1\Temp\cpuz130\cpuz_x32.sys [?]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [08.11.2011 13:47 136176]

S3 ibpcimpm;ibpcimpm;c:\windows\system32\drivers\ibpcimpm.sys [28.05.2011 01:59 264124]

S3 pnicml;pnicml;\??\c:\dokume~1\Andreas\LOKALE~1\Temp\pnicml.sys --> c:\dokume~1\Andreas\LOKALE~1\Temp\pnicml.sys [?]

S3 RTIOdrvAPIC;RTIOdrvAPIC;c:\windows\system32\drivers\RTIOdrvAPIC.sys [28.05.2011 01:59 23618]

S3 RTIOdrvApplicom;RTIOdrvApplicom;c:\windows\system32\drivers\RTIOdrvApplicom.sys [28.05.2011 01:59 218956]

S3 RTIOdrvAutomata;RTIOdrvAutomata;c:\windows\system32\drivers\RTIOdrvAutomata.sys [28.05.2011 01:59 300264]

S3 RTIOdrvCP5613;RTIOdrvCP5613;c:\windows\system32\drivers\RTIOdrvCP5613.sys [28.05.2011 01:59 398712]

S3 RTIOdrvDAMP;RTIOdrvDAMP;c:\windows\system32\drivers\RTIOdrvDAMP.sys [28.05.2011 01:59 80756]

S3 RTIOdrvFC310x;RTIOdrvFC310x;c:\windows\system32\drivers\RTIOdrvFC310x.sys [28.05.2011 01:59 203176]

S3 RTIOdrvHilscherDPM;RTIOdrvHilscherDPM;c:\windows\system32\drivers\RTIOdrvHilscherDPM.sys [28.05.2011 01:59 57936]

S3 RTIOdrvHMS;RTIOdrvHMS;c:\windows\system32\drivers\RTIOdrvHMS.sys [28.05.2011 01:59 30268]

S3 RTIOdrvSJA;RTIOdrvSJA;c:\windows\system32\drivers\RTIOdrvSJA.sys [28.05.2011 01:59 108796]

S3 RTService;RT Service 3S KM;c:\programme\3S Software\CoDeSys SP RTE\RTService.exe [28.05.2011 01:59 544825]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]

.

Inhalt des "geplante Tasks" Ordners

.

2012-01-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2011-11-08 12:47]

.

2012-01-20 c:\windows\Tasks\Lrdqlhgvek.job

- c:\windows\system32\perfprocg.dll [2012-01-18 02:04]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.heute.de/

IE: Free YouTube to MP3 Converter - c:\dokumente und einstellungen\Andreas\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\dokumente und einstellungen\Andreas\Anwendungsdaten\Mozilla\Firefox\Profiles\nh7rzrgl.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.heute.de/

FF - prefs.js: network.proxy.type - 2

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-35679699.sys

MSConfigStartUp-Buskb - c:\dokumente und einstellungen\Andreas\Anwendungsdaten\Atlmon\comnew.exe

MSConfigStartUp-DAEMON Tools Lite - c:\programme\DAEMON Tools Lite\DTLite.exe

AddRemove-Pharaoh - c:\windows\IsUn0407.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-01-20 15:18

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-527237240-1220945662-839522115-1003\Software\SecuROM\License information*]

"datasecu"=hex:a7,cf,e8,f2,2c,dc,26,f3,41,92,b6,b0,d7,84,32,6a,26,d2,1b,f8,80,

   84,76,33,04,ae,f9,bd,07,29,f8,06,46,49,5f,c5,dd,4b,e6,55,a9,a2,85,72,e8,f5,\

"rkeysecu"=hex:bd,25,01,60,dc,54,17,78,c2,50,55,66,42,35,ba,3d

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(544)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\atiadlxx.dll

.

- - - - - - - > 'explorer.exe'(1724)

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\rundll32.exe

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\PnkBstrA.exe

c:\programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\windows\System32\wbem\wmiapsrv.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-01-20  15:21:12 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-01-20 14:21

.

Vor Suchlauf: 16 Verzeichnis(se), 16.286.900.224 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 16.738.082.816 Bytes frei

.

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

.

- - End Of File - - 7C045CEFDA0D4DB7C8A1EA0B754EE751

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Guten Morgen! Hier die gewünschten Logs.

gmer.log

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-01-21 08:14:12

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800JB-00JJA0 rev.05.01C05

Running: 9y23y0kk.exe; Driver: C:\DOKUME~1\Andreas\LOKALE~1\Temp\pxtdrpod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT    B911606C                                      ZwClose

SSDT    B9116026                                      ZwCreateKey

SSDT    B9116076                                      ZwCreateSection

SSDT    B911601C                                      ZwCreateThread

SSDT    B911602B                                      ZwDeleteKey

SSDT    B9116035                                      ZwDeleteValueKey

SSDT    B9116067                                      ZwDuplicateObject

SSDT    B911603A                                      ZwLoadKey

SSDT    B9116008                                      ZwOpenProcess

SSDT    B911600D                                      ZwOpenThread

SSDT    B911608F                                      ZwQueryValueKey

SSDT    B9116044                                      ZwReplaceKey

SSDT    B9116080                                      ZwRequestWaitReplyPort

SSDT    B911603F                                      ZwRestoreKey

SSDT    B911607B                                      ZwSetContextThread

SSDT    B9116085                                      ZwSetSecurityObject

SSDT    B9116030                                      ZwSetValueKey

SSDT    B911608A                                      ZwSystemDebugControl

SSDT    B9116017                                      ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text   C:\WINDOWS\system32\DRIVERS\ati2mtag.sys      section is writeable [0xB9247000, 0x2C28EE, 0xE8000020]

.vmp2   C:\WINDOWS\system32\drivers\acedrv11.sys      entry point in ".vmp2" section [0xA98B869D]

.text   C:\WINDOWS\system32\DRIVERS\atksgt.sys        section is writeable [0xA984E300, 0x3B6D8, 0xE8000020]

.text   C:\WINDOWS\system32\DRIVERS\lirsgt.sys        section is writeable [0xF77B7300, 0x1BEE, 0xE8000020]
 

---- Devices - GMER 1.0.15 ----
 

Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3   sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort0            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort1            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort2            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdePort3            sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-19  sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device  \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-e   sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
 

---- EOF - GMER 1.0.15 ----

Hier das Osam-Log.

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 08:22:54 on 21.01.2012
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Unable to get information
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Lrdqlhgvek.job" - ? - C:\WINDOWS\system32\perfprocg.dll  (File is exclusively opened, access blocked | File found, but it contains no detailed information)
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\PhysX.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\acedrv11.sys

"atksgt" (atksgt) - ? - C:\WINDOWS\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"cpuz130" (cpuz130) - ? - C:\DOKUME~1\Andreas\LOKALE~1\Temp\cpuz130\cpuz_x32.sys  (File not found)

"ENTECH" (ENTECH) - "EnTech Taiwan" - C:\WINDOWS\system32\DRIVERS\ENTECH.sys

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"ibpcimpm" (ibpcimpm) - ? - C:\WINDOWS\system32\drivers\ibpcimpm.sys  (File found, but it contains no detailed information)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\WINDOWS\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"pnicml" (pnicml) - ? - C:\DOKUME~1\Andreas\LOKALE~1\Temp\pnicml.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"pxtdrpod" (pxtdrpod) - ? - C:\DOKUME~1\Andreas\LOKALE~1\Temp\pxtdrpod.sys  (Hidden registry entry, rootkit activity | File not found)

"RTE 3S System Driver" (3SRTE) - "3S - Smart Software Solutions GmbH" - C:\WINDOWS\system32\drivers\3SRTE.sys

"RTIOdrvAPIC" (RTIOdrvAPIC) - "3S" - C:\WINDOWS\system32\drivers\RTIOdrvAPIC.sys

"RTIOdrvApplicom" (RTIOdrvApplicom) - ? - C:\WINDOWS\system32\drivers\RTIOdrvApplicom.sys  (File found, but it contains no detailed information)

"RTIOdrvAutomata" (RTIOdrvAutomata) - ? - C:\WINDOWS\system32\drivers\RTIOdrvAutomata.sys  (File found, but it contains no detailed information)

"RTIOdrvCP5613" (RTIOdrvCP5613) - ? - C:\WINDOWS\system32\drivers\RTIOdrvCP5613.sys  (File found, but it contains no detailed information)

"RTIOdrvDAMP" (RTIOdrvDAMP) - ? - C:\WINDOWS\system32\drivers\RTIOdrvDAMP.sys  (File found, but it contains no detailed information)

"RTIOdrvFC310x" (RTIOdrvFC310x) - ? - C:\WINDOWS\system32\drivers\RTIOdrvFC310x.sys  (File found, but it contains no detailed information)

"RTIOdrvHilscherDPM" (RTIOdrvHilscherDPM) - ? - C:\WINDOWS\system32\drivers\RTIOdrvHilscherDPM.sys  (File found, but it contains no detailed information)

"RTIOdrvHMS" (RTIOdrvHMS) - ? - C:\WINDOWS\system32\drivers\RTIOdrvHMS.sys  (File found, but it contains no detailed information)

"RTIOdrvSJA" (RTIOdrvSJA) - ? - C:\WINDOWS\system32\drivers\RTIOdrvSJA.sys  (File found, but it contains no detailed information)

"speedfan" (speedfan) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\System32\speedfan.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfdrv01.sys

"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp02.sys

"StarForce Protection Synchronization Driver (version 2.x)" (sfsync02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfsync02.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll

{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682} "IZArc DragDrop Menu" - ? - C:\Programme\IZArc\IZArcCM.dll

{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5} "IZArc Shell Context Menu" - ? - C:\Programme\IZArc\IZArcCM.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - E:\Betriebsprogramme\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{2170E0A4-42F2-4EB5-911F-ABC2717F6566} "WebPlus Thumbnail Handler" - "Serif (Europe) Ltd" - C:\Programme\Serif\WebPlus\X2\Program\ThumbnailProvider.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Andreas\Startmenü\Programme\Autostart\desktop.ini

"SpeedFan.lnk" - "Almico Software (www.almico.com)" - C:\Programme\SpeedFan\speedfan.exe  (Shortcut exists | File exists)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"ATICustomerCare" - "Advanced Micro Devices, Inc." - "C:\Programme\ATI\ATICustomerCare\ATICustomerCare.exe"

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"RemoteControl" - "Cyberlink Corp." - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll

"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"ENI Server" (ENI Server) - "3S-Smart Software Solutions GmbH" - C:\Programme\3S Software\CoDeSys ENI Server\ENI.exe

"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"RT Service 3S KM" (RTService) - "3S-Smart Software Solutions GmbH" - C:\Programme\3S Software\CoDeSys SP RTE\RTService.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Und hier das aswMBR-Log

Code:

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-21 08:24:01

-----------------------------

08:24:01.781    OS Version: Windows 5.1.2600 Service Pack 3

08:24:01.781    Number of processors: 4 586 0x1707

08:24:01.781    ComputerName: ANDI  UserName: 

08:24:02.265    Initialize success

08:25:14.578    AVAST engine defs: 12012001

08:39:14.921    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

08:39:14.921    Disk 0 Vendor: WDC_WD800JB-00JJA0 05.01C05 Size: 76319MB BusType: 3

08:39:14.937    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-e

08:39:14.937    Disk 1 Vendor: SAMSUNG_HD502IJ 1AA01113 Size: 476940MB BusType: 3

08:39:14.937    Disk 0 MBR read successfully

08:39:14.937    Disk 0 MBR scan

08:39:14.953    Disk 0 Windows XP default MBR code

08:39:14.984    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        31133 MB offset 63

08:39:15.031    Disk 0 scanning sectors +63761985

08:39:15.093    Disk 0 scanning C:\WINDOWS\system32\drivers

08:39:26.343    Service scanning

08:39:27.125    Modules scanning

08:39:31.843    Disk 0 trace - called modules:

08:39:31.859    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys pciide.sys PCIIDEX.SYS 

08:39:31.859    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a2cbab8]

08:39:31.859    3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\00000073[0x8a2e6f18]

08:39:31.859    5 ACPI.sys[f75ad620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a293940]

08:39:31.875    \Driver\atapi[0x8a336d20] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> sfsync02.sys[0xf7717d60]

08:39:32.062    AVAST engine scan C:\WINDOWS

08:39:37.859    AVAST engine scan C:\WINDOWS\system32

08:43:05.421    File: C:\WINDOWS\system32\perfprocg.dll  **INFECTED** Win32:Diller-B [Trj]

08:45:26.703    AVAST engine scan C:\WINDOWS\system32\drivers

08:46:14.031    AVAST engine scan C:\Dokumente und Einstellungen\Andreas

08:51:35.640    AVAST engine scan C:\Dokumente und Einstellungen\All Users

08:53:04.906    Scan finished successfully

09:00:20.125    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Andreas\Desktop\MBR.dat"

09:00:20.125    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Andreas\Desktop\aswMBR.txt"

Zitat:

"Lrdqlhgvek.job" - ? - C:\WINDOWS\system32\perfprocg.dll (File is exclusively opened, access blocked | File found, but it contains no detailed information)

Bitte mit OSAM deaktivieren und löschen (delete from storage) siehe Anleitung zu osam
Mach anschließend einen Windows-Neustart und wieder ein neues Log mit OSAM

Hi,

hier das neue OSAM-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 11:43:00 on 23.01.2012
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Unable to get information
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\PhysX.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\acedrv11.sys

"atksgt" (atksgt) - ? - C:\WINDOWS\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"cpuz130" (cpuz130) - ? - C:\DOKUME~1\Andreas\LOKALE~1\Temp\cpuz130\cpuz_x32.sys  (File not found)

"ENTECH" (ENTECH) - "EnTech Taiwan" - C:\WINDOWS\system32\DRIVERS\ENTECH.sys

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"ibpcimpm" (ibpcimpm) - ? - C:\WINDOWS\system32\drivers\ibpcimpm.sys  (File found, but it contains no detailed information)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\WINDOWS\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"pnicml" (pnicml) - ? - C:\DOKUME~1\Andreas\LOKALE~1\Temp\pnicml.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"RTE 3S System Driver" (3SRTE) - "3S - Smart Software Solutions GmbH" - C:\WINDOWS\system32\drivers\3SRTE.sys

"RTIOdrvAPIC" (RTIOdrvAPIC) - "3S" - C:\WINDOWS\system32\drivers\RTIOdrvAPIC.sys

"RTIOdrvApplicom" (RTIOdrvApplicom) - ? - C:\WINDOWS\system32\drivers\RTIOdrvApplicom.sys  (File found, but it contains no detailed information)

"RTIOdrvAutomata" (RTIOdrvAutomata) - ? - C:\WINDOWS\system32\drivers\RTIOdrvAutomata.sys  (File found, but it contains no detailed information)

"RTIOdrvCP5613" (RTIOdrvCP5613) - ? - C:\WINDOWS\system32\drivers\RTIOdrvCP5613.sys  (File found, but it contains no detailed information)

"RTIOdrvDAMP" (RTIOdrvDAMP) - ? - C:\WINDOWS\system32\drivers\RTIOdrvDAMP.sys  (File found, but it contains no detailed information)

"RTIOdrvFC310x" (RTIOdrvFC310x) - ? - C:\WINDOWS\system32\drivers\RTIOdrvFC310x.sys  (File found, but it contains no detailed information)

"RTIOdrvHilscherDPM" (RTIOdrvHilscherDPM) - ? - C:\WINDOWS\system32\drivers\RTIOdrvHilscherDPM.sys  (File found, but it contains no detailed information)

"RTIOdrvHMS" (RTIOdrvHMS) - ? - C:\WINDOWS\system32\drivers\RTIOdrvHMS.sys  (File found, but it contains no detailed information)

"RTIOdrvSJA" (RTIOdrvSJA) - ? - C:\WINDOWS\system32\drivers\RTIOdrvSJA.sys  (File found, but it contains no detailed information)

"speedfan" (speedfan) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\System32\speedfan.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfdrv01.sys

"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp02.sys

"StarForce Protection Synchronization Driver (version 2.x)" (sfsync02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfsync02.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll

{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682} "IZArc DragDrop Menu" - ? - C:\Programme\IZArc\IZArcCM.dll

{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5} "IZArc Shell Context Menu" - ? - C:\Programme\IZArc\IZArcCM.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - E:\Betriebsprogramme\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{2170E0A4-42F2-4EB5-911F-ABC2717F6566} "WebPlus Thumbnail Handler" - "Serif (Europe) Ltd" - C:\Programme\Serif\WebPlus\X2\Program\ThumbnailProvider.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Andreas\Startmenü\Programme\Autostart\desktop.ini

"SpeedFan.lnk" - "Almico Software (www.almico.com)" - C:\Programme\SpeedFan\speedfan.exe  (Shortcut exists | File exists)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"ATICustomerCare" - "Advanced Micro Devices, Inc." - "C:\Programme\ATI\ATICustomerCare\ATICustomerCare.exe"

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"RemoteControl" - "Cyberlink Corp." - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll

"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"ENI Server" (ENI Server) - "3S-Smart Software Solutions GmbH" - C:\Programme\3S Software\CoDeSys ENI Server\ENI.exe

"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - E:\Betriebsprogramme\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"RT Service 3S KM" (RTService) - "3S-Smart Software Solutions GmbH" - C:\Programme\3S Software\CoDeSys SP RTE\RTService.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

ok sieht gut aus.
Machst du auch bitte noch ein neues Log mit aswMBR?

hier das aswMBR-Log:

Code:

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software

Run date: 2012-01-23 12:55:05

-----------------------------

12:55:05.796    OS Version: Windows 5.1.2600 Service Pack 3

12:55:05.796    Number of processors: 4 586 0x1707

12:55:05.796    ComputerName: ANDI  UserName: 

12:55:06.234    Initialize success

12:57:45.687    AVAST engine defs: 12012300

12:58:20.843    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

12:58:20.843    Disk 0 Vendor: WDC_WD800JB-00JJA0 05.01C05 Size: 76319MB BusType: 3

12:58:20.843    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-e

12:58:20.843    Disk 1 Vendor: SAMSUNG_HD502IJ 1AA01113 Size: 476940MB BusType: 3

12:58:20.859    Disk 0 MBR read successfully

12:58:20.859    Disk 0 MBR scan

12:58:20.875    Disk 0 Windows XP default MBR code

12:58:20.875    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        31133 MB offset 63

12:58:20.875    Disk 0 scanning sectors +63761985

12:58:20.937    Disk 0 scanning C:\WINDOWS\system32\drivers

12:58:28.781    Service scanning

12:58:29.578    Modules scanning

12:58:32.812    Disk 0 trace - called modules:

12:58:32.828    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys pciide.sys PCIIDEX.SYS 

12:58:32.828    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a252ab8]

12:58:32.828    3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\00000073[0x8a2cef18]

12:58:32.828    5 ACPI.sys[f75ad620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a255940]

12:58:32.828    \Driver\atapi[0x8a2dcf38] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> sfsync02.sys[0xf7717d60]

12:58:33.281    AVAST engine scan C:\WINDOWS

12:58:37.484    AVAST engine scan C:\WINDOWS\system32

13:00:13.406    AVAST engine scan C:\WINDOWS\system32\drivers

13:00:23.984    AVAST engine scan C:\Dokumente und Einstellungen\Andreas

13:01:52.906    AVAST engine scan C:\Dokumente und Einstellungen\All Users

13:02:15.015    Scan finished successfully

13:10:47.015    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Andreas\Desktop\MBR.dat"

13:10:47.015    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Andreas\Desktop\aswMBRneu.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Ich habe ganz vergessen zu sagen, dass Google wieder problemlos funktioniert.:applaus:
Ich war wohl zu sehr im Freudenrausch, um diese Info auch auf die Tastatur zu bringen! Sorry!:balla:

Soll ich die weiteren Logs trotzdem ausführen?

Ja das sind Kontrollscans! Mach die bitte

Hier die 3 gewünschten Logs:

Malewarebytes-Log

Code:

Malwarebytes Anti-Malware (Test) 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.24.02
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 6.0.2900.5512

Andreas :: ANDI [Administrator]
 

Schutz: Aktiviert
 

24.01.2012 10:34:01

mbam-log-2012-01-24 (10-34-01).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 190491

Laufzeit: 4 Minute(n), 21 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Superantispyware-Log

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 01/24/2012 at 11:58 AM
 

Application Version : 5.0.1142
 

Core Rules Database Version : 8159

Trace Rules Database Version: 5971
 

Scan type       : Complete Scan

Total Scan Time : 01:13:51
 

Operating System Information

Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)

Administrator
 

Memory items scanned      : 639

Memory threats detected   : 0

Registry items scanned    : 22674

Registry threats detected : 0

File items scanned        : 187761

File threats detected     : 20
 

Adware.Tracking Cookie

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@2o7[2].txt [ /2o7 ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@accounts[2].txt [ /accounts ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@ad.360yield[2].txt [ /ad.360yield ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@adfarm1.adition[1].txt [ /adfarm1.adition ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@adform[2].txt [ /adform ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@adx.chip[1].txt [ /adx.chip ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@atdmt[2].txt [ /atdmt ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@bs.serving-sys[1].txt [ /bs.serving-sys ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@comvelgmbh.112.2o7[1].txt [ /comvelgmbh.112.2o7 ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@germanwings.112.2o7[1].txt [ /germanwings.112.2o7 ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@im.banner.t-online[1].txt [ /im.banner.t-online ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@microsoftsto.112.2o7[1].txt [ /microsoftsto.112.2o7 ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@serving-sys[2].txt [ /serving-sys ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@smartadserver[1].txt [ /smartadserver ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@specificclick[1].txt [ /specificclick ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@track.adform[2].txt [ /track.adform ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@tracking.mindshare[2].txt [ /tracking.mindshare ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@www.etracker[1].txt [ /www.etracker ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@karstadt[2].txt [ /de.sitestat.com ]

        C:\Dokumente und Einstellungen\Andreas\Cookies\andreas@karstadt-de[1].txt [ /de.sitestat.com ]

ESET-Log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=5914d444672ada46a9e0c1135a63c892

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-18 10:19:53

# local_time=2012-01-18 11:19:53 (+0100, Westeuropäische Normalzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16775125 100 100 44005 101818080 47642 0

# compatibility_mode=8192 67108863 100 0 3746 3746 0 0

# scanned=180501

# found=2

# cleaned=0

# scan_time=3677

E:\Betriebsprogramme\Unlocker1.9.1.exe        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I

${Memory}        probably a variant of Win32/Ponmocup.AA trojan        00000000000000000000000000000000        I

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=5914d444672ada46a9e0c1135a63c892

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-01-24 12:58:55

# local_time=2012-01-24 01:58:55 (+0100, Westeuropäische Normalzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1792 16777175 100 0 413277 413277 0 0

# compatibility_mode=8192 67108863 100 0 485179 485179 0 0

# scanned=183259

# found=1

# cleaned=0

# scan_time=6986

E:\Betriebsprogramme\Unlocker1.9.1.exe        Win32/Adware.ADON application (unable to clean)        00000000000000000000000000000000        I

Zitat:

Art des Suchlaufs: Quick-Scan

Sry aber ich wollte einen Vollscan sehen...bitte nachholen und Log posten!
Denk dran vorher die Signaturen von Malwarebytes zu aktualisieren, da gibt es sehr häufig neue Updates!

Malewarebyte-Vollscan-Log

Code:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org
 

Datenbank Version: v2012.01.24.02
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 6.0.2900.5512

Andreas :: ANDI [Administrator]
 

Schutz: Aktiviert
 

24.01.2012 14:48:18

mbam-log-2012-01-24 (14-48-18).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 349999

Laufzeit: 1 Stunde(n), 16 Minute(n), 9 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Sieht ok aus, da wurden nur Cookies gefunden. (und ein Fehlalarm im Unlocker)
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Mein System funktioniert nun wieder wie vor dem Vorfall.

Ich möchte mich ganz herzlich und mit aller Deutlichkeit bei Dir bedanken. Ohne Deine Hilfe und Anleitung hätte ich wohl das ganze System neu aufsetzen müssen.

DANKESCHÖN!

Ihr macht hier ein prima Job oder besser gesagt ein prima Ehrenamt. Ich ziehe meinen Hut vor Leuten wie euch, die neben dem Job noch Zeit und Lust finden anderen Menschen zu helfen - unentgeltlich!

DANKESCHÖN!

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.