Trojaner-Board - HiJackThis Logfile bitte um Hilfe (gad-network.com / pc-on-internet.com)

Hallo habe plötzlich das Problem, dass ich konstante Werbepopups unter IE erhlate und im Firefox sich ständig neue Fenster öffnen. Das System ist auch etwas langsamer. Hinundwieder öffnet sich ein FEsnter, dass mir mitteilt, dass ich mir auf pc-on-internet.com/gad-network.com ein Antispywareproggi besorgen soll. Ich traue dem nicht wirklich, etwas googeln hat mir das auch noch unterstrichen. Bisher habe ich Malwarebytes laufen lassen, stürzt aber leider ab. Dann habe ich SuperAntispyware laufen lassen und nur Cookies finden können und diese vernichtet. Schlussendlich habe ich DSS gestartet und nun poste ich das Log hier. Wäre super, wenn ich nicht "format" anwenden müsste. Vielen Dank für eure Mühen.
Code:
Deckard's System Scanner v20071014.68

Run by NAME on 2008-07-21 08:03:11

Computer is in Normal Mode.

--------------------------------------------------------------------------------
 
 
 

-- HijackThis (run as NAME.exe) ---------------------------------------------
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:03:41, on 21.07.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\ASUS\ATK Media\DMedia.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Users\NAME\AppData\Local\ydozehbm.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\AirLive WL-5480USB WLAN USB\AirLive WL-5480USB WLAN USB\WlanUtil.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Users\NAME\Downloads\dss.exe

C:\PROGRA~1\TRENDM~1\HIJACK~1\NAME.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/ig?hl=de

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ydozehbm] c:\users\NAME\appdata\local\ydozehbm.exe ydozehbm

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: AirLive WL-5480USB WLAN USB Utility.lnk = C:\Program Files\AirLive WL-5480USB WLAN USB\AirLive WL-5480USB WLAN USB\WlanUtil.exe

O4 - Global Startup: VPN Client.lnk = ?

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O13 - Gopher Prefix: 

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - h**p://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - h**p://www.adobe.com/products/acrobat/nos/gp.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: SoundMovieServer - SoundMovieServer - C:\Windows\system32\snmvtsvc.exe
 

--

End of file - 9430 bytes
 

-- Files created between 2008-06-21 and 2008-07-21 -----------------------------
 

2008-07-20 21:46:39         0 d-------- C:\Users\All Users\SUPERAntiSpyware.com

2008-07-20 21:46:18         0 d-------- C:\Program Files\SUPERAntiSpyware

2008-07-20 21:45:49         0 d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-07-20 21:39:22         0 -rahs---- C:\MSDOS.SYS

2008-07-20 21:39:22         0 -rahs---- C:\IO.SYS

2008-07-20 20:57:23         0 d-------- C:\Users\All Users\Malwarebytes

2008-07-20 20:57:22         0 d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-07-20 20:44:04         0 d-------- C:\Program Files\Trend Micro

2008-07-19 19:53:31         0 d-------- C:\Users\All Users\Spybot - Search & Destroy

2008-07-19 12:00:10         0 d-------- C:\PerfLogs

2008-07-14 23:13:41         0 d-------- C:\Program Files\WebMediaPlayer

2008-07-07 19:41:28         0 d-------- C:\Program Files\POI-Warner 3 GoPal Edition

2008-07-06 20:18:59         0 d-------- C:\Program Files\VideoLAN

2008-06-26 15:32:54         0 d-------- C:\GS

2008-06-26 15:32:53         0 d-------- C:\Program Files\Common Files\MAYComputer

2008-06-23 13:57:43         0 d-------- C:\Users\All Users\Apple
 
 

-- Find3M Report ---------------------------------------------------------------
 

2008-07-21 08:03:20    618430 --a------ C:\Windows\system32\perfh007.dat

2008-07-21 08:03:20    122648 --a------ C:\Windows\system32\perfc007.dat

2008-07-21 07:58:55     49445 --a------ C:\Users\NAME\AppData\Roaming\nvModes.dat

2008-07-21 07:58:53     49445 --a------ C:\Users\NAME\AppData\Roaming\nvModes.001

2008-07-21 00:48:35         0 d-------- C:\Users\NAME\AppData\Roaming\Skype

2008-07-20 23:46:54       836 --a------ C:\Windows\bthservsdp.dat

2008-07-20 23:46:10         0 d-------- C:\Program Files\GV Everest Pokernet

2008-07-20 21:46:18         0 d-------- C:\Users\NAME\AppData\Roaming\SUPERAntiSpyware.com

2008-07-20 21:45:49         0 d-------- C:\Program Files\Common Files

2008-07-20 20:57:29         0 d-------- C:\Users\NAME\AppData\Roaming\Malwarebytes

2008-07-20 20:37:31         0 d-------- C:\Users\NAME\AppData\Roaming\Real

2008-07-20 16:03:07         0 d-------- C:\Users\NAME\AppData\Roaming\skypePM

2008-07-20 15:22:11        40 ---hs---- C:\Users\NAME\AppData\Roaming\.zreglib

2008-07-19 12:10:34       174 --ahs---- C:\Program Files\desktop.ini

2008-07-19 12:02:12         0 d-------- C:\Program Files\Windows Sidebar

2008-07-19 12:02:12         0 d-------- C:\Program Files\Windows Calendar

2008-07-19 12:02:12         0 d-------- C:\Program Files\Movie Maker

2008-07-19 12:02:11         0 d-------- C:\Program Files\Windows Mail

2008-07-19 12:02:10         0 d-------- C:\Program Files\Windows Photo Gallery

2008-07-19 12:02:10         0 d-------- C:\Program Files\Windows Collaboration

2008-07-19 12:02:09         0 d-------- C:\Program Files\Windows Journal

2008-07-19 12:02:04         0 d-------- C:\Program Files\Windows Defender

2008-07-09 21:37:03         0 d-------- C:\Users\NAME\AppData\Roaming\Mozilla

2008-07-06 20:21:38         0 d-------- C:\Users\NAME\AppData\Roaming\vlc

2008-07-03 08:42:11         0 d-------- C:\Program Files\Java

2008-06-26 15:33:34         0 d-------- C:\Users\NAME\AppData\Roaming\eDocPrintPro

2008-06-23 13:57:43         0 d-------- C:\Program Files\Apple Software Update

2008-06-11 17:33:51         0 d-------- C:\Users\NAME\AppData\Roaming\Adobe

2008-05-27 20:43:55         0 d-------- C:\Program Files\Common Files\Skype
 
 

-- Registry Dump ---------------------------------------------------------------
 

*Note* empty entries & legit default entries are not shown
 
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [19.01.2008 09:38]

"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [09.10.2006 13:43]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [22.11.2006 07:27]

"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [18.07.2008 08:28]

"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [02.11.2006 08:27]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22.02.2008 04:25]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [12.01.2006 15:40]

"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [14.12.2004 02:12]

"@"="" []

"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [16.03.2007 11:45]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [29.06.2007 06:24]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02.04.2008 22:20]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [19.12.2006 07:38]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [19.12.2006 07:38]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [19.12.2006 07:38]
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [19.01.2008 09:33]

"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [23.04.2008 17:45]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [15.01.2007 16:14]

"ydozehbm"="c:\users\NAME\appdata\local\ydozehbm.exe" [14.07.2008 23:13]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07.07.2008 09:42]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [28.05.2008 10:33]
 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [15.05.2007 13:39:40]

Adobe Reader - Schnellstart.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [23.10.2006 01:48:20]

Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [23.10.2006 00:01:50]

AirLive WL-5480USB WLAN USB Utility.lnk - C:\Program Files\AirLive WL-5480USB WLAN USB\AirLive WL-5480USB WLAN USB\WlanUtil.exe [15.05.2008 12:42:35]

VPN Client.lnk - C:\Windows\Installer\{871DF2BE-41D2-4334-AC33-839AF16FC8FE}\Icon3E5562ED7.ico [15.05.2008 14:55:22]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"=2 (0x2)

"EnableUIADesktopToggle"=0 (0x0)
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [13.05.2008 10:13 77824]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19.04.2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

@="Driver"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

@="Driver"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

@="IEEE 1394 Bus host controllers"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

@="SBP2 IEEE 1394 Devices"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

@="SecurityDevices"
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalService        nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry Winh**pAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient SstpSvc

LocalSystemNetworkRestricted        hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc CscService TabletInputService UmRdpService wlansvc WPDBusEnum EMDMgmt

LocalServiceNoNetwork        PLA DPS BFE mpssvc

LocalServiceNetworkRestricted        DHCP eventlog AudioSrv LmHosts wscsvc p2pimsvc PNRPSvc p2psvc PnrpAutoReg

bthsvcs        BthServ
 
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38faf3a0-429e-11dd-9890-0018f3d8517c}]

AutoRun\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe

open\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d67f93b-4422-11dd-9b66-0018f3d8517c}]

AutoRun\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

open\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53d468e3-4939-11dd-a5ca-004f660037a2}]

AutoRun\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe

open\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b0f0f13-3b0b-11dd-a1f1-0018f3d8517c}]

AutoRun\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe

open\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

C:\Windows\system32\unregmp2.exe /ShowWMP
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
 
 
 

-- End of Deckard's System Scanner: finished at 2008-07-21 08:04:07 ------------