Trojaner-Board - Firefox, Google, Ebay, MySpace

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Firefox, Google, Ebay, MySpace (https://www.trojaner-board.de/72195-firefox-google-ebay-myspace.html)

Code:

Logfile of random's system information tool 1.06 (written by random/random)

Run by ICH at 2009-04-19 17:57:13

Microsoft Windows XP Professional Service Pack 2

System drive C: has 13 GB (63%) free of 20 GB

Total RAM: 1024 MB (53% free)
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:57:18, on 19.04.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe

C:\WINDOWS\system32\wscntfy.exe

C:\ADVANC~1\wh_exec.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\explorer.exe

D:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Dokumente und Einstellungen\ICH\Desktop\RSIT.exe

D:\Programme\HiJackThis\ICH.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe Reader\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O20 - Winlogon Notify: !SASWinLogon - D:\Programme\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
 

--

End of file - 4862 bytes
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-29 61440]

"avgnt"=C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]

"AudioDeck"=C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe [2009-03-09 528384]

"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-08-05 57344]

"NeroFilterCheck"=C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

"QuickTime Task"=C:\Programme\QuickTime\QTTask.exe [2009-01-05 413696]

"WheelMouse"=C:\ADVANC~1\wh_exec.exe [2007-11-10 98304]

"Adobe Photo Downloader"=C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [2007-03-15 57344]

"Adobe Reader Speed Launcher"=D:\Programme\Adobe Reader\Reader\Reader_sl.exe [2009-02-27 35696]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe [2007-06-01 153136]

"SUPERAntiSpyware"=D:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-03-23 1830128]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

D:\Programme\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

C:\WINDOWS\system32\Ati2evxx.dll [2008-10-29 143360]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=D:\Programme\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoDriveAutoRun"=67108863

"NoDrives"=0
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveAutoRun"=

"NoDriveTypeAutoRun"=

"NoDrives"=
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

"C:\Programme\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe"="C:\Programme\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:*:Disabled:Sony Ericsson Media Manager 1.1"
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
 

======List of files/folders created in the last 1 months======
 

2009-07-06 02:28:24 ----SH---- C:\boot.ini

2009-07-06 02:25:03 ----RSHDC---- C:\WINDOWS\system32\dllcache

2009-07-06 02:25:03 ----RSD---- C:\WINDOWS\Fonts

2009-07-06 02:25:03 ----RD---- C:\WINDOWS\Web

2009-07-06 02:25:03 ----HD---- C:\WINDOWS\inf

2009-07-06 02:25:03 ----D---- C:\WINDOWS\WinSxS

2009-07-06 02:25:03 ----D---- C:\WINDOWS\twain_32

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\wins

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\wbem

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\usmt

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\spool

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\ShellExt

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\Setup

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\ras

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\oobe

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\npp

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\mui

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\inetsrv

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\IME

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\icsxml

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\ias

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\export

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\drivers

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\dhcp

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\config

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\3com_dmi

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\3076

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\2052

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1054

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1042

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1041

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1037

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1033

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1031

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1028

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32\1025

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system32

2009-07-06 02:25:03 ----D---- C:\WINDOWS\system

2009-07-06 02:25:03 ----D---- C:\WINDOWS\security

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Resources

2009-07-06 02:25:03 ----D---- C:\WINDOWS\repair

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Provisioning

2009-07-06 02:25:03 ----D---- C:\WINDOWS\PeerNet

2009-07-06 02:25:03 ----D---- C:\WINDOWS\pchealth

2009-07-06 02:25:03 ----D---- C:\WINDOWS\mui

2009-07-06 02:25:03 ----D---- C:\WINDOWS\msapps

2009-07-06 02:25:03 ----D---- C:\WINDOWS\msagent

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Media

2009-07-06 02:25:03 ----D---- C:\WINDOWS\java

2009-07-06 02:25:03 ----D---- C:\WINDOWS\ime

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Help

2009-07-06 02:25:03 ----D---- C:\WINDOWS\ehome

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Driver Cache

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Debug

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Cursors

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Connection Wizard

2009-07-06 02:25:03 ----D---- C:\WINDOWS\Config

2009-07-06 02:25:03 ----D---- C:\WINDOWS\AppPatch

2009-07-06 02:25:03 ----D---- C:\WINDOWS\addins

2009-07-06 02:25:03 ----D---- C:\WINDOWS

2009-07-06 01:34:02 ----A---- C:\WINDOWS\system32\h323log.txt

2009-07-06 01:31:33 ----A---- C:\WINDOWS\system32\ativvaxx.dll

2009-07-06 01:31:33 ----A---- C:\WINDOWS\system32\ati3duag.dll

2009-07-06 01:31:33 ----A---- C:\WINDOWS\system32\ati3d1ag.dll

2009-07-06 01:31:32 ----A---- C:\WINDOWS\system32\ati2dvag.dll

2009-07-06 01:31:32 ----A---- C:\WINDOWS\system32\ati2cqag.dll

2009-07-06 01:31:21 ----A---- C:\WINDOWS\system32\usbui.dll

2009-07-06 01:30:11 ----SHD---- C:\WINDOWS\Installer

2009-07-06 01:30:11 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2009-07-06 01:30:10 ----D---- C:\Programme\Gemeinsame Dateien\ODBC

2009-07-06 01:30:10 ----A---- C:\WINDOWS\ODBCINST.INI

2009-07-06 01:30:07 ----RD---- C:\Programme

2009-07-06 01:30:07 ----D---- C:\Programme\Gemeinsame Dateien\SpeechEngines

2009-07-06 01:30:07 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared

2009-07-06 01:30:07 ----D---- C:\Programme\Gemeinsame Dateien

2009-07-06 01:30:04 ----RA---- C:\WINDOWS\system32\kbdtuq.dll

2009-07-06 01:30:04 ----RA---- C:\WINDOWS\system32\kbdtuf.dll

2009-07-06 01:30:04 ----RA---- C:\WINDOWS\system32\kbdazel.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdycc.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbduzb.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdur.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdtat.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdru1.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdru.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdmon.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdkyr.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdkaz.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdbu.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdblr.dll

2009-07-06 01:30:03 ----RA---- C:\WINDOWS\system32\kbdaze.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdhept.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdhela3.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdhela2.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdhe319.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdhe220.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdhe.dll

2009-07-06 01:30:01 ----RA---- C:\WINDOWS\system32\kbdgkl.dll

2009-07-06 01:30:00 ----RA---- C:\WINDOWS\system32\kbdlv1.dll

2009-07-06 01:30:00 ----RA---- C:\WINDOWS\system32\kbdlv.dll

2009-07-06 01:30:00 ----RA---- C:\WINDOWS\system32\kbdlt1.dll

2009-07-06 01:30:00 ----RA---- C:\WINDOWS\system32\kbdlt.dll

2009-07-06 01:30:00 ----RA---- C:\WINDOWS\system32\kbdest.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdycl.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdsl1.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdsl.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdro.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdpl1.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdpl.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdhu1.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdhu.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdcz2.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdcz1.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdcz.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\kbdcr.dll

2009-07-06 01:29:59 ----RA---- C:\WINDOWS\system32\KBDAL.DLL

2009-07-06 01:29:57 ----A---- C:\WINDOWS\system32\irclass.dll

2009-07-06 01:29:57 ----A---- C:\WINDOWS\system32\dgrpsetu.dll

2009-07-06 01:29:56 ----A---- C:\WINDOWS\system32\spxcoins.dll

2009-07-06 01:29:56 ----A---- C:\WINDOWS\system32\EqnClass.Dll

2009-07-06 01:29:56 ----A---- C:\WINDOWS\system32\dgsetup.dll

2009-07-06 01:29:55 ----A---- C:\WINDOWS\TASKMAN.EXE

2009-07-06 01:29:54 ----N---- C:\WINDOWS\system32\CONFIG.TMP

2009-07-06 01:29:54 ----A---- C:\WINDOWS\system32\batt.dll

2009-07-06 01:29:54 ----A---- C:\WINDOWS\NOTEPAD.EXE

2009-07-06 01:29:53 ----A---- C:\WINDOWS\system32\storprop.dll

2009-07-06 01:29:45 ----ASH---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\desktop.ini

2009-07-06 01:29:42 ----RA---- C:\WINDOWS\SET8.tmp

2009-07-06 01:29:39 ----RA---- C:\WINDOWS\SET4.tmp

2009-07-06 01:29:38 ----RA---- C:\WINDOWS\SET3.tmp

2009-07-06 01:29:33 ----D---- C:\WINDOWS\system32\CatRoot2

2009-07-06 01:29:33 ----D---- C:\WINDOWS\system32\CatRoot

2009-07-06 01:29:27 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft

2009-07-06 01:29:08 ----SHD---- C:\System Volume Information

2009-07-06 01:29:08 ----D---- C:\Dokumente und Einstellungen

2009-04-19 17:57:13 ----D---- C:\rsit

2009-04-19 17:51:21 ----SHD---- C:\RECYCLER

2009-04-19 16:30:58 ----D---- C:\WINDOWS\temp

2009-04-19 16:30:56 ----A---- C:\ComboFix.txt

2009-04-19 16:28:32 ----D---- C:\ComboFix

2009-04-19 14:05:49 ----A---- C:\WINDOWS\zip.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\vFind.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\SWXCACLS.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\SWSC.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\SWREG.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\sed.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\NIRCMD.exe

2009-04-19 14:05:49 ----A---- C:\WINDOWS\grep.exe

2009-04-19 14:05:46 ----D---- C:\WINDOWS\ERDNT

2009-04-19 14:04:51 ----D---- C:\Qoobox

2009-04-19 13:02:21 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com

2009-04-19 13:02:16 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\SUPERAntiSpyware.com

2009-04-19 13:01:08 ----D---- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard

2009-04-19 12:57:17 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Malwarebytes

2009-04-19 12:57:11 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

2009-04-19 12:19:31 ----D---- C:\WINDOWS\LastGood

2009-04-19 11:22:38 ----D---- C:\WINDOWS\system32\appmgmt

2009-04-01 18:30:24 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe

2009-03-29 16:27:53 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Leadertech

2009-03-28 04:04:12 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Sony

2009-03-28 04:04:12 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony

2009-03-28 02:08:07 ----A---- C:\WINDOWS\system32\TubeFinder.exe

2009-03-28 02:08:05 ----A---- C:\WINDOWS\system32\VB6STKIT.DLL

2009-03-28 02:08:05 ----A---- C:\WINDOWS\system32\VB6FR.DLL

2009-03-28 02:08:05 ----A---- C:\WINDOWS\system32\PCCLPFR.DLL

2009-03-28 02:08:05 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL

2009-03-28 02:08:04 ----A---- C:\WINDOWS\system32\CMDLGFR.DLL

2009-03-28 01:00:28 ----D---- C:\Advanced Wheel Mouse

2009-03-28 00:47:00 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Help

2009-03-28 00:45:09 ----A---- C:\WINDOWS\gswin32.ini

2009-03-28 00:42:25 ----D---- C:\Programme\gs

2009-03-28 00:40:23 ----D---- C:\Programme\Ghostgum

2009-03-27 23:43:09 ----D---- C:\Programme\Sony

2009-03-27 23:42:36 ----N---- C:\WINDOWS\system32\spmsg.dll

2009-03-27 23:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB926239$

2009-03-27 23:42:05 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$

2009-03-27 23:41:41 ----D---- C:\WINDOWS\system32\LogFiles

2009-03-27 23:41:32 ----A---- C:\WINDOWS\system32\spupdsvc.exe

2009-03-27 23:41:31 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$

2009-03-27 23:37:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ZoomBrowser

2009-03-27 23:37:36 ----D---- C:\Programme\Canon

2009-03-27 23:35:55 ----D---- C:\Programme\Gemeinsame Dateien\Canon

2009-03-27 23:33:49 ----D---- C:\Programme\Gemeinsame Dateien\Adobe

2009-03-27 23:33:49 ----D---- C:\Programme\Adobe

2009-03-27 23:33:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe

2009-03-27 23:30:48 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$

2009-03-27 23:28:04 ----D---- C:\Programme\Sony Ericsson

2009-03-27 23:28:04 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony Ericsson

2009-03-27 23:27:38 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\InstallShield

2009-03-27 22:39:35 ----A---- C:\WINDOWS\ODBC.INI

2009-03-27 22:39:20 ----A---- C:\WINDOWS\system32\mdimon.dll

2009-03-27 22:37:45 ----D---- C:\Programme\Gemeinsame Dateien\DESIGNER

2009-03-27 22:37:25 ----D---- C:\WINDOWS\SHELLNEW

2009-03-27 22:37:03 ----D---- C:\Programme\Microsoft.NET

2009-03-27 22:37:03 ----D---- C:\Programme\Microsoft Office

2009-03-23 20:46:10 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Apple Computer

2009-03-23 20:45:39 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

2009-03-23 20:44:52 ----D---- C:\Programme\QuickTime

2009-03-23 20:44:51 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer

2009-03-23 20:44:28 ----DC---- C:\WINDOWS\system32\DRVSTORE

2009-03-23 19:39:33 ----A---- C:\WINDOWS\NeroDigital.ini

2009-03-23 19:34:50 ----D---- C:\Programme\Gemeinsame Dateien\LightScribe

2009-03-23 19:32:48 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Ahead

2009-03-23 19:32:31 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ahead

2009-03-23 19:29:35 ----D---- C:\Programme\Nero

2009-03-23 19:29:35 ----D---- C:\Programme\Gemeinsame Dateien\Ahead

2009-03-23 19:29:35 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero

2009-03-23 19:27:28 ----D---- C:\WINDOWS\RegisteredPackages

2009-03-23 19:22:25 ----A---- C:\WINDOWS\system32\d3dx9_30.dll

2009-03-23 19:22:23 ----A---- C:\WINDOWS\system32\d3dx9_28.dll

Teil2...

Code:

======List of files/folders modified in the last 1 months======
 

2009-07-06 01:29:45 ----ASH---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\desktop.ini

2009-04-19 17:45:37 ----D---- C:\Programme\Mozilla Firefox

2009-04-19 16:30:08 ----A---- C:\WINDOWS\system.ini

2009-04-19 16:28:39 ----A---- C:\WINDOWS\SchedLgU.Txt

2009-04-19 16:28:32 ----D---- C:\WINDOWS\Prefetch

2009-04-19 16:23:59 ----D---- C:\WINDOWS\Minidump

2009-04-19 12:19:34 ----SD---- C:\WINDOWS\Downloaded Program Files

2009-04-19 12:19:33 ----D---- C:\WINDOWS\system32\Macromed

2009-04-19 11:23:48 ----SD---- C:\WINDOWS\Tasks

2009-03-30 23:16:21 ----D---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Adobe

2009-03-29 17:28:36 ----SD---- C:\Dokumente und Einstellungen\ICH\Anwendungsdaten\Microsoft

2009-03-28 01:00:34 ----D---- C:\WINDOWS\system32\ReinstallBackups

2009-03-27 23:44:12 ----RSD---- C:\WINDOWS\assembly

2009-03-27 23:42:15 ----D---- C:\Programme\Windows Media Player

2009-03-27 23:28:58 ----HD---- C:\Programme\InstallShield Installation Information

2009-03-27 22:39:06 ----A---- C:\WINDOWS\win.ini

2009-03-27 22:37:26 ----D---- C:\Programme\Gemeinsame Dateien\System

2009-03-23 19:22:26 ----D---- C:\WINDOWS\system32\DirectX
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 AmdK7;AMD K7-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-04 41472]

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys []

R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-10-30 75072]

R1 SASDIFSV;SASDIFSV; \??\D:\Programme\SUPERAntiSpyware\SASDIFSV.SYS []

R1 SASKUTIL;SASKUTIL; \??\D:\Programme\SUPERAntiSpyware\SASKUTIL.sys []

R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]

R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-08-07 404608]

R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-08-05 460864]

R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-10-29 3341824]

R3 avgntflt;avgntflt; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []

R3 FETNDIS;VIA PCI 10/100-MBit/s-Fast Ethernetadapter-NT-Treiber; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]

R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]

R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]

R3 SASENUM;SASENUM; \??\D:\Programme\SUPERAntiSpyware\SASENUM.SYS []

R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]

R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]

R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]

R3 vulfnths;VIA USB Host Controller Lower Filter; C:\WINDOWS\System32\Drivers\vulfnth.sys [2003-08-04 6912]

R3 vulfntrs;VIA USB Roothub Lower Filter; C:\WINDOWS\System32\Drivers\vulfntr.sys [2003-08-04 11392]

R3 whfltr2k;WheelMouse USB Lower Filter Driver; C:\WINDOWS\system32\DRIVERS\whfltr2k.sys [2007-01-26 6784]

S1 winefrx;winefrx; \??\C:\WINDOWS\system32\drivers\winefrx.sys []

S3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys []

S3 asliahmy;asliahmy; \??\C:\DOKUME~1\ICH\LOKALE~1\Temp\asliahmy.sys []

S3 catchme;catchme; \??\C:\DOKUME~1\ICH\LOKALE~1\Temp\catchme.sys []

S3 s3117bus;Sony Ericsson Device 3117 driver (WDM); C:\WINDOWS\system32\DRIVERS\s3117bus.sys [2008-05-12 90408]

S3 s3117mdfl;Sony Ericsson Device 3117 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s3117mdfl.sys [2008-05-12 15016]

S3 s3117mdm;Sony Ericsson Device 3117 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s3117mdm.sys [2008-05-12 122024]

S3 s3117mgmt;Sony Ericsson Device 3117 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s3117mgmt.sys [2008-05-12 115368]

S3 s3117nd5;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (NDIS); C:\WINDOWS\system32\DRIVERS\s3117nd5.sys [2008-05-12 25768]

S3 s3117obex;Sony Ericsson Device 3117 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s3117obex.sys [2008-05-12 111784]

S3 s3117unic;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (WDM); C:\WINDOWS\system32\DRIVERS\s3117unic.sys [2008-05-12 117544]

S3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys []

S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]

S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

S3 VIAudio;Vinyl AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\vinyl97.sys [2009-03-09 203648]

S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Planer; C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]

R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-10-29 585728]

R2 CCALib8;Canon Camera Access Library 8; C:\Programme\Canon\CAL\CALMAIN.exe [2007-01-31 96370]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [2007-07-25 79136]

R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]

R3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [2007-06-01 271920]

S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-10-28 593920]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]

S3 NBService;NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112]

S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
 

-----------------EOF-----------------

Code:

Rapport de ZHPDiag v1.18 par Nicolas Coolman

Enregistré le 19.04.2009 17:59:20

Platform : Microsoft Windows XP (5.1.2600) Service Pack 2

MSIE: Internet Explorer v6.0.2900.2180

MFIE: Mozilla Firefox (3.0.8)
 

---\\ 

C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe

SOUNDMAN.EXE

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

C:\ADVANC~1\wh_exec.exe

C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\ati2sgag.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\services.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\spoolsv.exe
 

---\\ 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
 

---\\ 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
 

---\\ 

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
 

---\\ 

O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe Reader\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKLM\..\policies\Explorer: [NoDriveAutoRun] Data="67108863"

O4 - HKLM\..\policies\Explorer: [NoDriveTypeAutoRun] Data="323"

O4 - HKLM\..\policies\Explorer: [NoDrives] Data="0"
 

---\\ 

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
 

---\\ 

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe,302

O9 - Extra 'Tools' menuitem: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFBARH.ICO

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFBARH.ICO

O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe,302
 

---\\ 

O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="ie.search.msn.com"
 

---\\ 

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
 

---\\ 

O20 - Winlogon Notify: SABWINLOStartup - D:\Programme\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: AtiStartupEvent - C:\WINDOWS\System32\Ati2evxx.dll
 

---\\ 

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1}

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030}
 

---\\ 

O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service:  (Ati HotKey Poller) - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart (ATI Smart) - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: Druckwarteschlange (Spooler) - C:\WINDOWS\system32\spoolsv.exe
 

---\\ 

O24 - Desktop Component 0: Die derzeitige Homepage - file:About:Home
 

---\\ 

O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

O40 - ASIC: Internet Explorer - {26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE

O40 - ASIC: Browseranpassungen - {60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

O40 - ASIC: Outlook Express - {881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE

O40 - ASIC: Vektorgrafik-Rendering (VML) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file)

O40 - ASIC: LightScribe Control Panel - {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"

O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll

O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll

O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - C:\WINDOWS\system32\danim.dll

O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll

O40 - ASIC: Dynamic HTML-Datenbindung für Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file)

O40 - ASIC: Offlinebrowsingpaket - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)

O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file)

O40 - ASIC: Erweitertes Authoring - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file)

O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

O40 - ASIC: DirectShow - {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - (not file)

O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)

O40 - ASIC: Internet Explorer-Hilfe - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)

O40 - ASIC: DirectAnimation Java Classes - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file)

O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)

O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

O40 - ASIC: (no name) - {5A8D6EE0-3E18-11D0-821E-444553540000} - (not file)

O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)

O40 - ASIC: Browsererweiterungen - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)

O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

O40 - ASIC: Zugang zu MSN Site - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)

O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file)

O40 - ASIC: Webordner - {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - (not file)

O40 - ASIC: Adressbuch 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

O40 - ASIC: .NET Framework - {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - (not file)

O40 - ASIC: Windows Desktop-Update - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

O40 - ASIC: Internet Explorer 6 - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe

O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

O40 - ASIC: Dynamic HTML-Datenbindung - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)

O40 - ASIC: (no name) - {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - (not file)

O40 - ASIC: Internet Explorer-Hauptschriftarten - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)

O40 - ASIC: Taskplaner - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file)

O40 - ASIC: (no name) - {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - (not file)

O40 - ASIC: Adobe Flash Player - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx

O40 - ASIC: HTML-Hilfe - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)

O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)
 

---\\ 

O41 - Driver: (no object) (aeaudio) - C:\WINDOWS\system32\drivers\aeaudio.sys

O41 - Driver: Microsoft Kernel-Echounterdrückung (aec) - C:\WINDOWS\system32\drivers\aec.sys

O41 - Driver: Service for WDM 3D Audio Driver (ALCXSENS) - C:\WINDOWS\system32\drivers\ALCXSENS.SYS

O41 - Driver: Service for Realtek AC97 Audio (WDM) (ALCXWDM) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS

O41 - Driver: AMD K7-Prozessortreiber (AmdK7) - C:\WINDOWS\system32\DRIVERS\amdk7.sys

O41 - Driver: Asynchroner RAS -Medientreiber (AsyncMac) - C:\WINDOWS\system32\DRIVERS\asyncmac.sys

O41 - Driver: (no object) (ati2mtag) - C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

O41 - Driver: Protokoll für ATM ARP-Client (Atmarpc) - C:\WINDOWS\system32\DRIVERS\atmarpc.sys

O41 - Driver: Audiostubtreiber (audstub) - C:\WINDOWS\system32\DRIVERS\audstub.sys

O41 - Driver: avgio (avgio) - C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys

O41 - Driver: avgntflt (avgntflt) - C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys

O41 - Driver: avipbb (avipbb) - C:\WINDOWS\system32\DRIVERS\avipbb.sys

O41 - Driver: (no object) (dmboot) - C:\WINDOWS\System32\drivers\dmboot.sys

O41 - Driver: Treiber für die Verwaltung logischer Datenträger (dmio) - C:\WINDOWS\System32\drivers\dmio.sys

O41 - Driver: (no object) (dmload) - C:\WINDOWS\System32\drivers\dmload.sys

O41 - Driver: Microsoft Kernel-DLS-Synthesizer (DMusic) - C:\WINDOWS\system32\drivers\DMusic.sys

O41 - Driver: Microsoft Kernel-DRM-Audioentschlüsselung (drmkaud) - C:\WINDOWS\system32\drivers\drmkaud.sys

O41 - Driver: VIA PCI 10/100-MBit/s-Fast Ethernetadapter-NT-Treiber (FETNDIS) - C:\WINDOWS\system32\DRIVERS\fetnd5.sys

O41 - Driver: FltMgr (FltMgr) - C:\WINDOWS\system32\DRIVERS\fltMgr.sys

O41 - Driver: Gameport-Enumerator (gameenum) - C:\WINDOWS\system32\DRIVERS\gameenum.sys

O41 - Driver: Standardpaketklassifizierung (Gpc) - C:\WINDOWS\system32\DRIVERS\msgpc.sys

O41 - Driver: Microsoft HID Class-Treiber (HidUsb) - C:\WINDOWS\system32\DRIVERS\hidusb.sys

O41 - Driver: i8042-Tastatur- und PS/2-Mausanschluss-Treiber (i8042prt) - C:\WINDOWS\system32\DRIVERS\i8042prt.sys

O41 - Driver: IPv6-Windows-Firewalltreiber (Ip6Fw) - C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys

O41 - Driver: Filtertreiber für IP-Verkehr (IpFilterDriver) - C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

O41 - Driver: IP/IP-Tunneltreiber (IpInIp) - C:\WINDOWS\system32\DRIVERS\ipinip.sys

O41 - Driver: IPSEC-Treiber (IPSec) - C:\WINDOWS\system32\DRIVERS\ipsec.sys

O41 - Driver: IR-Enumeratordienst (IRENUM) - C:\WINDOWS\system32\DRIVERS\irenum.sys

O41 - Driver: Microsoft Kernel-Waveaudiomixer (kmixer) - C:\WINDOWS\system32\drivers\kmixer.sys

O41 - Driver: Maus-HID-Treiber (mouhid) - C:\WINDOWS\system32\DRIVERS\mouhid.sys

O41 - Driver: Redirector für WebDav-Client (MRxDAV) - C:\WINDOWS\system32\DRIVERS\mrxdav.sys

O41 - Driver: MRXSMB (MRxSmb) - C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

O41 - Driver: Microsoft Streaming Service Proxy (MSKSSRV) - C:\WINDOWS\system32\drivers\MSKSSRV.sys

O41 - Driver: Microsoft Proxy für Streaming Clock (MSPCLOCK) - C:\WINDOWS\system32\drivers\MSPCLOCK.sys

O41 - Driver: Microsoft Proxy für Streaming Quality Manager (MSPQM) - C:\WINDOWS\system32\drivers\MSPQM.sys

O41 - Driver: Microsoft-Systemverwaltungs-BIOS-Treiber (mssmbios) - C:\WINDOWS\system32\DRIVERS\mssmbios.sys

O41 - Driver: RAS-NDIS-TAPI-Treiber (NdisTapi) - C:\WINDOWS\system32\DRIVERS\ndistapi.sys

O41 - Driver: NDIS-Benutzermodus-E/A-Protokoll (Ndisuio) - C:\WINDOWS\system32\DRIVERS\ndisuio.sys

O41 - Driver: RAS-NDIS-WAN-Treiber (NdisWan) - C:\WINDOWS\system32\DRIVERS\ndiswan.sys

O41 - Driver: NetBIOS-Schnittstelle (NetBIOS) - C:\WINDOWS\system32\DRIVERS\netbios.sys

O41 - Driver: NetBios über TCP/IP (NetBT) - C:\WINDOWS\system32\DRIVERS\netbt.sys

O41 - Driver: Filtertreiber für IPX-Verkehr (NwlnkFlt) - C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

O41 - Driver: Treiber für IPX-Verkehrsweiterleitung (NwlnkFwd) - C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

O41 - Driver: WAN-Miniport (PPTP) (PptpMiniport) - C:\WINDOWS\system32\DRIVERS\raspptp.sys

O41 - Driver: QoS-Paketplaner (PSched) - C:\WINDOWS\system32\DRIVERS\psched.sys

O41 - Driver: Treiber für direkte Parallelverbindung (Ptilink) - C:\WINDOWS\system32\DRIVERS\ptilink.sys

O41 - Driver: Treiber für automatische RAS-Verbindung (RasAcd) - C:\WINDOWS\system32\DRIVERS\rasacd.sys

O41 - Driver: WAN-Miniport (L2TP) (Rasl2tp) - C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

O41 - Driver: Remotezugriff-PPPOE-Treiber (RasPppoe) - C:\WINDOWS\system32\DRIVERS\raspppoe.sys

O41 - Driver: Parallelanschluss (direkt) (Raspti) - C:\WINDOWS\system32\DRIVERS\raspti.sys

O41 - Driver: Rdbss (Rdbss) - C:\WINDOWS\system32\DRIVERS\rdbss.sys

O41 - Driver: Treiber für Terminalserver-Geräteumleitung (rdpdr) - C:\WINDOWS\system32\DRIVERS\rdpdr.sys

O41 - Driver: Filtertreiber für digitale CD-Audiowiedergabe (redbook) - C:\WINDOWS\system32\DRIVERS\redbook.sys

O41 - Driver: Sony Ericsson Device 3117 driver (WDM) (s3117bus) - C:\WINDOWS\system32\DRIVERS\s3117bus.sys

O41 - Driver: Sony Ericsson Device 3117 USB WMC Modem Filter (s3117mdfl) - C:\WINDOWS\system32\DRIVERS\s3117mdfl.sys

O41 - Driver: Sony Ericsson Device 3117 USB WMC Modem Driver (s3117mdm) - C:\WINDOWS\system32\DRIVERS\s3117mdm.sys

O41 - Driver: Sony Ericsson Device 3117 USB WMC Device Management Drivers (WDM) (s3117mgmt) - C:\WINDOWS\system32\DRIVERS\s3117mgmt.sys

O41 - Driver: Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (NDIS) (s3117nd5) - C:\WINDOWS\system32\DRIVERS\s3117nd5.sys

O41 - Driver: Sony Ericsson Device 3117 USB WMC OBEX Interface (s3117obex) - C:\WINDOWS\system32\DRIVERS\s3117obex.sys

O41 - Driver: Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (WDM) (s3117unic) - C:\WINDOWS\system32\DRIVERS\s3117unic.sys

O41 - Driver: SASDIFSV (SASDIFSV) - D:\Programme\SUPERAntiSpyware\SASDIFSV.SYS

O41 - Driver: SASENUM (SASENUM) - D:\Programme\SUPERAntiSpyware\SASENUM.SYS

O41 - Driver: SASKUTIL (SASKUTIL) - D:\Programme\SUPERAntiSpyware\SASKUTIL.sys

O41 - Driver: Secdrv (Secdrv) - C:\WINDOWS\system32\DRIVERS\secdrv.sys

O41 - Driver: Serenum-Filtertreiber (serenum) - C:\WINDOWS\system32\DRIVERS\serenum.sys

O41 - Driver: (no object) (smwdm) - C:\WINDOWS\system32\drivers\smwdm.sys

O41 - Driver: Microsoft Kernel-Audiosplitter (splitter) - C:\WINDOWS\system32\drivers\splitter.sys

O41 - Driver: Filtertreiber für Systemwiederherstellung (sr) - C:\WINDOWS\system32\DRIVERS\sr.sys

O41 - Driver: Srv (Srv) - C:\WINDOWS\system32\DRIVERS\srv.sys

O41 - Driver: ssmdrv (ssmdrv) - C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

O41 - Driver: Software-Bus-Treiber (swenum) - C:\WINDOWS\system32\DRIVERS\swenum.sys

O41 - Driver: Microsoft Kernel GS Wavetablesynthesizer (swmidi) - C:\WINDOWS\system32\drivers\swmidi.sys

O41 - Driver: Microsoft Kernel-Systemaudiogerät (sysaudio) - C:\WINDOWS\system32\drivers\sysaudio.sys

O41 - Driver: TCP/IP-Protokolltreiber (Tcpip) - C:\WINDOWS\system32\DRIVERS\tcpip.sys

O41 - Driver: Microsoft AGPv3.5-Filter (uagp35) - C:\WINDOWS\system32\DRIVERS\uagp35.sys

O41 - Driver: Microcode Updatetreiber (Update) - C:\WINDOWS\system32\DRIVERS\update.sys

O41 - Driver: Microsoft Standard-USB-Haupttreiber (usbccgp) - C:\WINDOWS\system32\DRIVERS\usbccgp.sys

O41 - Driver: Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller (usbehci) - C:\WINDOWS\system32\DRIVERS\usbehci.sys

O41 - Driver: USB2-aktivierter Hub (usbhub) - C:\WINDOWS\system32\DRIVERS\usbhub.sys

O41 - Driver: USB-Scannertreiber (usbscan) - C:\WINDOWS\system32\DRIVERS\usbscan.sys

O41 - Driver: USB-Massenspeichertreiber (USBSTOR) - C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

O41 - Driver: Miniporttreiber für universellen Microsoft USB-Hostcontroller (usbuhci) - C:\WINDOWS\system32\DRIVERS\usbuhci.sys

O41 - Driver: VIA AGP Filter (viaagp1) - C:\WINDOWS\system32\DRIVERS\viaagp1.sys

O41 - Driver: (no object) (viamraid) - C:\WINDOWS\system32\DRIVERS\viamraid.sys

O41 - Driver: (no object) (viasraid) - C:\WINDOWS\system32\DRIVERS\viasraid.sys

O41 - Driver: Vinyl AC'97 Audio Controller (WDM) (VIAudio) - C:\WINDOWS\system32\drivers\vinyl97.sys

O41 - Driver: (no object) (videX32) - C:\WINDOWS\system32\DRIVERS\videX32.sys

O41 - Driver: RAS-IP-ARP-Treiber (Wanarp) - C:\WINDOWS\system32\DRIVERS\wanarp.sys

O41 - Driver: Treiber für Microsoft WINMM-WDM-Audiokompatibilität (wdmaud) - C:\WINDOWS\system32\drivers\wdmaud.sys

O41 - Driver: WheelMouse USB Lower Filter Driver (whfltr2k) - C:\WINDOWS\system32\DRIVERS\whfltr2k.sys

O41 - Driver: WpdUsb (WpdUsb) - C:\WINDOWS\system32\DRIVERS\wpdusb.sys

O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Platform Driver (WudfPf) - C:\WINDOWS\system32\DRIVERS\WudfPf.sys

O41 - Driver: Windows Driver Foundation - User-mode Driver Framework Reflector (WudfRd) - C:\WINDOWS\system32\DRIVERS\wudfrd.sys
 

---\\ 

O42 - Logiciel: Adobe Flash Player 10 ActiveX

O42 - Logiciel: Adobe Flash Player 10 Plugin

O42 - Logiciel: Adobe® Photoshop® Album Starter Edition 3.2

O42 - Logiciel: ATI - Software Uninstall Utility

O42 - Logiciel: Avira AntiVir Personal - Free Antivirus

O42 - Logiciel: ATI Display Driver

O42 - Logiciel: Canon Camera Access Library

O42 - Logiciel: Canon Utilities CameraWindow DC

O42 - Logiciel: Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX

O42 - Logiciel: Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX

O42 - Logiciel: Canon Utilities CameraWindow

O42 - Logiciel: Canon G.726 WMP-Decoder

O42 - Logiciel: CANON iMAGE GATEWAY Task for ZoomBrowser EX

O42 - Logiciel: Canon Internet Library for ZoomBrowser EX

O42 - Logiciel: CCleaner (remove only)

O42 - Logiciel: ClearProg 1.5.1 Beta 7

O42 - Logiciel: Canon Camera Support Core Library

O42 - Logiciel: Canon Utilities EOS Utility

O42 - Logiciel: Free FLV Converter V 6.23.0

O42 - Logiciel: HijackThis 2.0.2

O42 - Logiciel: VIA Platform Device Manager

O42 - Logiciel: IrfanView (remove only)

O42 - Logiciel: Windows Installer 3.1 (KB893803)

O42 - Logiciel: Hotfix for Windows XP (KB926239)

O42 - Logiciel: Malwarebytes' Anti-Malware

O42 - Logiciel: Microsoft .NET Framework 2.0

O42 - Logiciel: Microsoft .NET Framework 2.0 Language Pack - DEU

O42 - Logiciel: Canon MovieEdit Task for ZoomBrowser EX

O42 - Logiciel: Mozilla Firefox (3.0.8)

O42 - Logiciel: Canon Utilities MyCamera

O42 - Logiciel: Canon Utilities MyCamera DC

O42 - Logiciel: Canon Utilities PhotoStitch

O42 - Logiciel: Canon RAW Image Task for ZoomBrowser EX

O42 - Logiciel: Canon Utilities RemoteCapture Task for ZoomBrowser EX

O42 - Logiciel: Advanced Wheel Mouse 6.0.0.002

O42 - Logiciel: Windows Media Format 11 runtime

O42 - Logiciel: Microsoft User-Mode Driver Framework Feature Pack 1.0

O42 - Logiciel: Canon Utilities ZoomBrowser EX

O42 - Logiciel: Canon ZoomBrowser EX Memory Card Utility

O42 - Logiciel: ATI Catalyst Control Center

O42 - Logiciel: Nero 7 Essentials

O42 - Logiciel: QuickTime

O42 - Logiciel: ConvertHelper 2.2

O42 - Logiciel: Sony Ericsson PC Suite 3.209.00

O42 - Logiciel: neroxml

O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable

O42 - Logiciel: Sony Ericsson Media Manager 1.1

O42 - Logiciel: Microsoft Office Professional Edition 2003

O42 - Logiciel: SIW version 2009-02-24

O42 - Logiciel: Adobe Reader 9.1 - Deutsch

O42 - Logiciel: SUPERAntiSpyware Free Edition

O42 - Logiciel: Catalyst Control Center - Branding

O42 - Logiciel: Realtek AC'97 Audio

Code:



---\\ 

O44 - LFC:Last File Created - C:\WINDOWS\System32\$winnt$.inf -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\amcompat.tlb -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\ativvaxx.cap -->19.04.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\cdplayer.exe.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\CONFIG.NT -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\emptyregdb.dat -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\FNTCACHE.DAT -->27.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\h323log.txt -->06.07.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\logonui.exe.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\ncpa.cpl.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\nscompat.tlb -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\nwc.cpl.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\perfc007.dat -->29.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\perfc009.dat -->29.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\perfh007.dat -->29.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\perfh009.dat -->29.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\PerfStringBackup.INI -->29.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\sapi.cpl.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\TubeFinder.exe -->27.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\WindowsLogon.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\wpa.dbl -->13.04.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\wuaucpl.cpl.manifest -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\mbam.sys -->06.04.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\mbamswissarmy.sys -->06.04.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\viamraid.sys -->09.03.2009

O44 - LFC:Last File Created - C:\WINDOWS\System32\drivers\vinyl97.sys -->09.03.2009
 

---\\ 

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ACRORD32.EXE-21F63878.pf -->15.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ADOBE_UPDATER.EXE-059F58EC.pf -->15.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\APDPROXY.EXE-0BCD8D9C.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\APPLEMOBILEDEVICESERVICE.EXE-0B00542D.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATTRIB.CFEXE-07A4D3CF.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ATTRIB.EXE-39EAFB02.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVCENTER.EXE-324B1681.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVGNT.EXE-18356F59.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVNOTIFY.EXE-0B59FC42.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVSCAN.EXE-0D0CD933.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\AVWSC.EXE-3AC95876.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CATCHME.CFEXE-0F2A0789.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CCLEANER.EXE-17ADB38C.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CCSETUP218.EXE-29E386D6.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CF15270.EXE-2E0863D4.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CF19889.EXE-22A3E5A0.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CHCP.COM-18156052.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CLEARPROG.EXE-1934C98F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CMD.EXECF-27E83661.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\COMBOFIX.EXE-0359F628.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CONTROL.EXE-013DBFB5.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\CSCRIPT.EXE-1C26180C.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DIFXINSTALL32.EXE-1536957D.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DLLHOST.EXE-205D880D.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DOWNLOAD.EXE-2ABD4045.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\DWWIN.EXE-30875ADC.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\EXCEL.EXE-0DC93B7A.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINDSTR.CFEXE-38519B93.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FINDSTR.EXE-0CA6274B.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIREFOX SETUP 3.0.8.EXE-065118EC.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\FIREFOX.EXE-1D57670A.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\GREP.CFEXE-20443039.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\GREP.CFEXE-273BC5E1.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\GRPCONV.EXE-111CD845.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\GSAR.CFEXE-0E6FCB31.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\GSAR.CFEXE-156760D9.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\GUARDGUI.EXE-3AFB6D88.pf -->14.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HANDLE.CFEXE-13427ED2.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPER.EXE-244ABC1F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HIDEC.EXE-3818BC01.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HIDEC.EXE-3B166DB3.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-32795687.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\HJTINSTALL.EXE-00A80A3A.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\IEXPLORE.EXE-2CA9778D.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\INSTALL.EXE-10ADD043.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ITUNES.EXE-15E88941.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\ITUNESPHOTOPROCESSOR.EXE-0AD96FF6.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\Layout.ini -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MBAM-SETUP.EXE-0DA7B5F5.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MBAM-SETUP.TMP-1D181D19.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MBAM.EXE-325FAE38.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MBAMGUI.EXE-1253A586.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSCORSVW.EXE-1BF30400.pf -->27.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSPAINT.EXE-11CBB631.pf -->31.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MSW4C.TMP-2BC01F38.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\MTEE.CFEXE-1E067BC7.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\N.COM-3222D14C.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NERO.EXE-2031B565.pf -->01.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NEROSTARTSMART.EXE-0A488AA3.pf -->01.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NGEN.EXE-38021CCC.pf -->27.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NIRCMD.CFEXE-0E3F4BC2.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NIRCMD.CFEXE-19FF4781.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NIRCMD.COM-323C21EC.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NIRCMD.EXE-2C39EF53.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NIRCMDC.CFEXE-049E77E5.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NS50.TMP-08B4AD98.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\OUTLOOK.EXE-14C4968A.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PEV.CFEXE-26A9D6BD.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PEV.CFEXE-29A7886F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PHOTOSHOP ALBUM STARTER EDITI-037E01DD.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PING.EXE-31216D26.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\POWERPNT.EXE-28A8DBA4.pf -->05.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PREUPD.EXE-18CBCD87.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PV.CFEXE-0E6F2701.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PV.CFEXE-23E4A9A0.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\PV.EXE-06A2AC78.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\REGT.CFEXE-15DB5DAE.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-13404D23.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-1831A4F3.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-1EE676D0.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-24DBE541.pf -->29.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-29A2BA7C.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-3BCBAD9C.pf -->31.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNDLL32.EXE-4B850DC4.pf -->15.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\RUNONCE.EXE-2803F297.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SED.CFEXE-238FCCA6.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SED.CFEXE-268D7E58.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SED.EXE-0F4B402F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SETUP.EXE-0EEB9EC2.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SETUP.EXE-3A244AF0.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SNDVOL32.EXE-383480B7.pf -->03.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SOFTWAREUPDATE.EXE-1E90DF1F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SORT.EXE-194AE83C.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SUPERANTISPYWARE.EXE-07FB8387.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SUPERANTISPYWARE.EXE-164CB15F.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf -->28.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.CFEXE-2BF4FFCD.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.EXE-0937BD77.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWREG.EXE-3560BE42.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWSC.CFEXE-3B4FE4FE.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SWSC.EXE-17AFBFBF.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\SYSTRAY.EXE-345DCC1C.pf -->29.03.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\TRALLALA.EXE-0DA7B96A.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UNZIP.CFEXE-16348B59.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\UPDATE.EXE-3A80F1D2.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\VFIND.EXE-2152232B.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WIAACMGR.EXE-212ED878.pf -->18.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WINWORD.EXE-3395695A.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-09969332.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WMPLAYER.EXE-09969338.pf -->16.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WSCNTFY.EXE-1B24F5EB.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf -->19.04.2009

O45 - LFCP:Last File Created Prefetch - C:\WINDOWS\Prefetch\_IS13.EXE-00C22213.pf -->19.04.2009
 

---\\ 

O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll

O46 - SEH:ShellExecuteHooks - SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - D:\Programme\SUPERAntiSpyware\SASSEH.DLL
 

---\\ 

O47 - AAKE:Key Export - "C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"

O47 - AAKE:Key Export - "C:\Programme\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe"="C:\Programme\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:*:Disabled:Sony Ericsson Media Manager 1.1"

O47 - AAKE:Key Export - "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
 

---\\ 

O48 - LSA:Local Security Authority Authentication Packages - C:\WINDOWS\System32\msv1_0.dll

O48 - LSA:Local Security Authority Notification Packages - C:\WINDOWS\System32\scecli.dll
 

---\\ 

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Minimal\vgasave.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ip6fw.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpcdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\rdpwd.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\tdpipe.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\tdtcp.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CS1\Network\vgasave.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Minimal\vgasave.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmboot.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmio.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\dmload.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\ip6fw.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\rdpcdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\rdpdd.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\rdpwd.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\sr.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\tdpipe.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\tdtcp.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\vga.sys

O49 - CSB:Control Safe Boot HKLM\...\CS2\Network\vgasave.sys
 

---\\ 

O50 - IEFO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
 

---\\ 

O52 - TDSD:HKLM\...\Drivers\"timer"="timer.drv"

O52 - TDSD:HKLM\...\Drivers32\"midimapper"="midimap.dll"

O52 - TDSD:HKLM\...\Drivers32\"msacm.imaadpcm"="imaadp32.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msadpcm"="msadp32.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msg711"="msg711.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msgsm610"="msgsm32.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.trspch"="tssoft32.acm"

O52 - TDSD:HKLM\...\Drivers32\"vidc.cvid"="iccvid.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.I420"="msh263.drv"

O52 - TDSD:HKLM\...\Drivers32\"vidc.iv31"="ir32_32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.iv32"="ir32_32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.iv41"="ir41_32.ax"

O52 - TDSD:HKLM\...\Drivers32\"vidc.iyuv"="iyuv_32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.mrle"="msrle32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.msvc"="msvidc32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.uyvy"="msyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yuy2"="msyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yvu9"="tsbyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yvyu"="msyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"wavemapper"="msacm32.drv"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msg723"="msg723.acm"

O52 - TDSD:HKLM\...\Drivers32\"vidc.M263"="msh263.drv"

O52 - TDSD:HKLM\...\Drivers32\"vidc.M261"="msh261.drv"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msaudio1"="msaud32.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.sl_anet"="sl_anet.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.iac2"="C:\WINDOWS\system32\iac25_32.ax"

O52 - TDSD:HKLM\...\Drivers32\"vidc.iv50"="ir50_32.dll"

O52 - TDSD:HKLM\...\Drivers32\"msacm.l3acm"="C:\WINDOWS\system32\l3codeca.acm"

O52 - TDSD:HKLM\...\Drivers32\"wave"="wdmaud.drv"

O52 - TDSD:HKLM\...\Drivers32\"midi"="wdmaud.drv"

O52 - TDSD:HKLM\...\Drivers32\"mixer"="wdmaud.drv"
 
 

End of the scan:

Zitat:

Die Firmware lässt sich nicht updaten... da heißt es: ungültiges Dateiformat!

Dann führe es so aus wie es im Handbuch auf Seite 127 dargestellt ist. Exportiere vorher deine WLAN-Einstellungen und spiele sie nach Firmwareupdate wieder zurück.

1.) Kontrolliere dein Systemdatum und stelle es vernünftig ein. :)

2.) Deinstalliere:

SuperAntiSpyware
Gmer

3.) Scripten mit Combofix

Öffne den Editor (Start => Zubehör => Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

KILLALL::
 

Driver::

winefrx

Ip6Fw

catchme

asliahmy
 

Registry::

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NeroFilterCheck"=-

"QuickTime Task"=-

"Adobe Reader Speed Launcher"=-

"SoundMan"=-
 

Folder::

c:\programme\Online-Dienste

c:\dokumente und einstellungen\ICH\Anwendungsdaten\SUPERAntiSpyware.com

c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com

D:\Programme\SUPERAntiSpyware

C:\rsit
 

File::

C:\WINDOWS\SET3.tmp

C:\WINDOWS\SET4.tmp

C:\WINDOWS\SET8.tmp

C:\WINDOWS\System32\perfh009.dat 

C:\WINDOWS\System32\perfc009.dat 

c:\programme\Firefox Setup 3.0.7.exe

c:\windows\system32\perfh007.dat

c:\windows\system32\perfc007.dat

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann.

ciao, andreas

So...

- Firmware-Update des Routers ist auf dem neusten Stand, ging aber erst nach Neustart und trennen der Verbindung von Splitter zum Router

-die 2 Programme hab ich auch gelöscht

-aber was passt mit dem Systemdatum nicht? Heute ist doch der 19.04.2009...

Code:

ComboFix 09-04-19.05 - ICH 19.04.2009 21:29.3 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.1024.682 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\ICH\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\ICH\Desktop\cfscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

 * Neuer Wiederherstellungspunkt wurde erstellt
 

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
 

FILE ::

c:\programme\Firefox Setup 3.0.7.exe

c:\windows\SET3.tmp

c:\windows\SET4.tmp

c:\windows\SET8.tmp

c:\windows\system32\perfc007.dat

c:\windows\System32\perfc009.dat

c:\windows\system32\perfh007.dat

c:\windows\System32\perfh009.dat

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com

c:\dokumente und einstellungen\ICH\Anwendungsdaten\SUPERAntiSpyware.com

c:\programme\Firefox Setup 3.0.7.exe

c:\programme\Online-Dienste

c:\programme\Online-Dienste\An weitere Internetdienstanbieter verweisen.lnk

C:\rsit

c:\rsit\info.txt

c:\rsit\log.txt

c:\windows\SET3.tmp

c:\windows\SET4.tmp

c:\windows\SET8.tmp

c:\windows\system32\perfc007.dat

c:\windows\System32\perfc009.dat

c:\windows\system32\perfh007.dat

c:\windows\System32\perfh009.dat
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_ASLIAHMY

-------\Legacy_CATCHME

-------\Legacy_WINEFRX

-------\Service_catchme

-------\Service_Ip6Fw

-------\Service_winefrx
 
 

(((((((((((((((((((((((   Dateien erstellt von 2009-03-19 bis 2009-04-19  ))))))))))))))))))))))))))))))

.
 

Keine neuen Dateien erstellt in diesem Zeitraum
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-19 10:57 . 2009-04-19 10:57        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Malwarebytes

2009-04-19 10:57 . 2009-04-19 10:57        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2009-04-15 16:12 . 2009-03-27 21:33        --------        d-----w        c:\programme\Gemeinsame Dateien\Adobe

2009-04-06 13:32 . 2009-04-19 10:57        38496        ----a-w        c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-06 13:32 . 2009-04-19 10:57        15504        ----a-w        c:\windows\system32\drivers\mbam.sys

2009-04-01 16:30 . 2009-04-01 16:30        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\LightScribe

2009-03-29 14:27 . 2009-03-29 14:27        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Leadertech

2009-03-28 02:04 . 2009-03-28 02:04        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Sony

2009-03-28 02:04 . 2009-03-28 02:04        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sony

2009-03-28 00:18 . 2009-03-23 18:46        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Apple Computer

2009-03-27 22:42 . 2009-03-27 22:42        --------        d-----w        c:\programme\gs

2009-03-27 22:40 . 2009-03-27 22:40        --------        d-----w        c:\programme\Ghostgum

2009-03-27 21:45 . 2009-03-09 20:29        43248        ----a-w        c:\dokumente und einstellungen\ICH\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2009-03-27 21:43 . 2009-03-27 21:43        --------        d-----w        c:\programme\Sony

2009-03-27 21:43 . 2009-03-27 21:28        --------        d-----w        c:\programme\Sony Ericsson

2009-03-27 21:38 . 2009-03-27 21:37        --------        d-----w        c:\programme\Canon

2009-03-27 21:37 . 2009-03-27 21:37        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ZoomBrowser

2009-03-27 21:35 . 2009-03-27 21:35        --------        d-----w        c:\programme\Gemeinsame Dateien\Canon

2009-03-27 21:28 . 2009-03-09 18:50        --------        d--h--w        c:\programme\InstallShield Installation Information

2009-03-27 21:28 . 2009-03-27 21:28        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sony Ericsson

2009-03-27 21:27 . 2009-03-27 21:27        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\InstallShield

2009-03-27 20:37 . 2009-03-27 20:37        --------        d-----w        c:\programme\Microsoft.NET

2009-03-27 19:36 . 2009-03-28 00:08        290816        ----a-w        c:\windows\system32\TubeFinder.exe

2009-03-23 18:46 . 2009-03-23 18:45        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

2009-03-23 18:45 . 2009-03-23 18:44        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer

2009-03-23 18:45 . 2009-03-23 18:44        --------        d-----w        c:\programme\QuickTime

2009-03-23 17:40 . 2009-03-23 17:32        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Ahead

2009-03-23 17:34 . 2009-03-23 17:34        --------        d-----w        c:\programme\Gemeinsame Dateien\LightScribe

2009-03-23 17:32 . 2009-03-23 17:32        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Ahead

2009-03-23 17:32 . 2009-03-23 17:29        --------        d-----w        c:\programme\Gemeinsame Dateien\Ahead

2009-03-23 17:29 . 2009-03-23 17:29        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nero

2009-03-23 17:29 . 2009-03-23 17:29        --------        d-----w        c:\programme\Nero

2009-03-09 22:54 . 2009-03-09 22:54        --------        d-----w        c:\programme\ClearProg

2009-03-09 22:27 . 2009-03-09 20:39        --------        d-----w        c:\programme\AvRack

2009-03-09 22:04 . 2009-03-09 22:04        --------        d-----w        c:\programme\SIW

2009-03-09 22:01 . 2009-03-09 22:01        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\gtopala

2009-03-09 21:42 . 2009-03-09 18:38        86327        ----a-w        c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-03-09 21:19 . 2009-03-09 18:50        --------        d-----w        c:\programme\VIA

2009-03-09 21:18 . 2009-03-09 21:18        331184        ------w        c:\windows\system32\difxapi.dll

2009-03-09 21:18 . 2006-10-09 11:58        203648        ----a-w        c:\windows\system32\drivers\vinyl97.sys

2009-03-09 20:58 . 2006-03-31 01:18        100992        ----a-w        c:\windows\system32\drivers\viamraid.sys

2009-03-09 20:39 . 2009-03-09 20:39        --------        d-----w        c:\programme\Realtek Sound Manager

2009-03-09 20:28 . 2009-03-09 20:28        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\ATI

2009-03-09 20:28 . 2009-03-09 20:28        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ATI

2009-03-09 20:15 . 2009-03-09 20:15        --------        d-----w        c:\programme\Avira

2009-03-09 20:15 . 2009-03-09 20:15        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2009-03-09 20:03 . 2009-03-09 20:02        --------        d-----w        c:\programme\ATI Technologies

2009-03-09 20:03 . 2009-03-09 18:50        --------        d-----w        c:\programme\Gemeinsame Dateien\InstallShield

2009-03-09 18:40 . 2009-03-09 18:40        --------        d-----w        c:\programme\microsoft frontpage

2009-03-09 18:37 . 2009-03-09 18:37        --------        d-----w        c:\programme\Gemeinsame Dateien\Dienste

2009-03-09 18:36 . 2009-03-09 18:36        21740        ----a-w        c:\windows\system32\emptyregdb.dat

.
 

------- Sigcheck -------
 

[-] 2004-08-10 16:11        359040        27A5959C94EE173A063CA06BD14F021A        c:\windows\system32\drivers\tcpip.sys

.

(((((((((((((((((((((((((((((   SnapShot@2009-04-19_12.08.25   )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-04-19 19:31 . 2009-04-19 19:31        16384              c:\windows\temp\Perflib_Perfdata_758.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"avgnt"="c:\programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"AudioDeck"="c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe" [2009-03-09 528384]

"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-11-10 98304]

"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-15 57344]
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Programme\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
 

R3 s3117bus;Sony Ericsson Device 3117 driver (WDM);c:\windows\system32\DRIVERS\s3117bus.sys [2008-05-12 90408]

R3 s3117mdfl;Sony Ericsson Device 3117 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s3117mdfl.sys [2008-05-12 15016]

R3 s3117mdm;Sony Ericsson Device 3117 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s3117mdm.sys [2008-05-12 122024]

R3 s3117mgmt;Sony Ericsson Device 3117 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s3117mgmt.sys [2008-05-12 115368]

R3 s3117nd5;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (NDIS);c:\windows\system32\DRIVERS\s3117nd5.sys [2008-05-12 25768]

R3 s3117obex;Sony Ericsson Device 3117 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s3117obex.sys [2008-05-12 111784]

R3 s3117unic;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (WDM);c:\windows\system32\DRIVERS\s3117unic.sys [2008-05-12 117544]

S0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2003-10-31 77312]

S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784]
 

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\dokumente und einstellungen\ICH\Anwendungsdaten\Mozilla\Firefox\Profiles\wfkm5dza.default\

FF - plugin: d:\programme\Adobe Reader\Reader\browser\nppdf32.dll

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-19 21:31

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  AudioDeck = c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe 1???????????????????????????????????????????? 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\catchme]

"ImagePath"="\??\c:\dokume~1\ICH\LOKALE~1\Temp\catchme.sys"

--
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Ip6Fw]

"ImagePath"="system32\DRIVERS\Ip6Fw.sys"

--
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\winefrx]

"ImagePath"="\??\c:\windows\system32\drivers\winefrx.sys"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'winlogon.exe'(532)

c:\windows\system32\Ati2evxx.dll
 

- - - - - - - > 'explorer.exe'(3752)

c:\advanc~1\wh_hook.dll

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\programme\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

c:\advanced wheel mouse\wh_exec.exe

c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\programme\Canon\CAL\CALMAIN.exe

c:\programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe

c:\programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2009-04-19 21:32 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2009-04-19 19:32

ComboFix2.txt  2009-04-19 14:30

ComboFix3.txt  2009-04-19 12:09
 

Vor Suchlauf: 10 Verzeichnis(se), 13.164.711.936 Bytes frei

Nach Suchlauf: 8 Verzeichnis(se), 13.095.133.184 Bytes frei
 

197

Zitat:

aber was passt mit dem Systemdatum nicht?

Zitat:

2009-07-06 02:28:24 ----SH---- C:\boot.ini
2009-07-06 02:25:03 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-06 02:25:03 ----RSD---- C:\WINDOWS\Fonts

Besitzt du eine Zeitmaschine? :)

Gibt es eine Besserung oder sind die Umleitungen noch da? Teste mit beiden Browsern!

ciao, andreas

Ha! Wunderbar, von 20 Versuchen 20 mal am richtigen Ort rausgekommen. Myspace z.B. läuft auch wieder, ohne das sich der Browser aufhängt.

:Boogie::dankeschoen::Boogie:

Woran lag das jetzt? Wie kann ich sowas verhindern?

Zitat:

Woran lag das jetzt?

Um ehrlich zu sein, keine Ahnung. Ich habe da soviel gelöscht, dass ich den Verursacher nicht genau ausmachen kann. Ich vermute es war der Dienst winefrx. Fertig sind wir allerdings noch lange nicht. :)

Zitat:

Wie kann ich sowas verhindern?

Klicke auf die letzten beiden Links in meiner Signatur. Dort steht wie es geht, das wird gerne als Brain.exe bezeichnet. ;)

1.) Scripten mit Combofix

Öffne den Editor (Start => Zubehör => Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

KILLALL::
 

Registry::

[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\catchme]

[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Ip6Fw]

[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\winefrx]

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Das mit der Systemzeit finde ich merkwürdig, hab´s nochmal überprüft...sowohl in Windows als auch im Bios zeigt´s mir die richtige Uhrzeit und das richtige Datum an...

Code:

ComboFix 09-04-19.05 - ICH 19.04.2009 23:12.4 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.1024.677 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\ICH\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\ICH\Desktop\cfscript.txt

AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)

 * Neuer Wiederherstellungspunkt wurde erstellt
 

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.
 

(((((((((((((((((((((((   Dateien erstellt von 2009-03-19 bis 2009-04-19  ))))))))))))))))))))))))))))))

.
 

Keine neuen Dateien erstellt in diesem Zeitraum
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-19 10:57 . 2009-04-19 10:57        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Malwarebytes

2009-04-19 10:57 . 2009-04-19 10:57        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2009-04-15 16:12 . 2009-03-27 21:33        --------        d-----w        c:\programme\Gemeinsame Dateien\Adobe

2009-04-06 13:32 . 2009-04-19 10:57        38496        ----a-w        c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-06 13:32 . 2009-04-19 10:57        15504        ----a-w        c:\windows\system32\drivers\mbam.sys

2009-04-01 16:30 . 2009-04-01 16:30        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\LightScribe

2009-03-29 14:27 . 2009-03-29 14:27        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Leadertech

2009-03-28 02:04 . 2009-03-28 02:04        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Sony

2009-03-28 02:04 . 2009-03-28 02:04        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sony

2009-03-28 00:18 . 2009-03-23 18:46        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Apple Computer

2009-03-27 22:42 . 2009-03-27 22:42        --------        d-----w        c:\programme\gs

2009-03-27 22:40 . 2009-03-27 22:40        --------        d-----w        c:\programme\Ghostgum

2009-03-27 21:45 . 2009-03-09 20:29        43248        ----a-w        c:\dokumente und einstellungen\ICH\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2009-03-27 21:43 . 2009-03-27 21:43        --------        d-----w        c:\programme\Sony

2009-03-27 21:43 . 2009-03-27 21:28        --------        d-----w        c:\programme\Sony Ericsson

2009-03-27 21:38 . 2009-03-27 21:37        --------        d-----w        c:\programme\Canon

2009-03-27 21:37 . 2009-03-27 21:37        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ZoomBrowser

2009-03-27 21:35 . 2009-03-27 21:35        --------        d-----w        c:\programme\Gemeinsame Dateien\Canon

2009-03-27 21:28 . 2009-03-09 18:50        --------        d--h--w        c:\programme\InstallShield Installation Information

2009-03-27 21:28 . 2009-03-27 21:28        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sony Ericsson

2009-03-27 21:27 . 2009-03-27 21:27        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\InstallShield

2009-03-27 20:37 . 2009-03-27 20:37        --------        d-----w        c:\programme\Microsoft.NET

2009-03-27 19:36 . 2009-03-28 00:08        290816        ----a-w        c:\windows\system32\TubeFinder.exe

2009-03-23 18:46 . 2009-03-23 18:45        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

2009-03-23 18:45 . 2009-03-23 18:44        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer

2009-03-23 18:45 . 2009-03-23 18:44        --------        d-----w        c:\programme\QuickTime

2009-03-23 17:40 . 2009-03-23 17:32        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\Ahead

2009-03-23 17:34 . 2009-03-23 17:34        --------        d-----w        c:\programme\Gemeinsame Dateien\LightScribe

2009-03-23 17:32 . 2009-03-23 17:32        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Ahead

2009-03-23 17:32 . 2009-03-23 17:29        --------        d-----w        c:\programme\Gemeinsame Dateien\Ahead

2009-03-23 17:29 . 2009-03-23 17:29        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nero

2009-03-23 17:29 . 2009-03-23 17:29        --------        d-----w        c:\programme\Nero

2009-03-09 22:54 . 2009-03-09 22:54        --------        d-----w        c:\programme\ClearProg

2009-03-09 22:27 . 2009-03-09 20:39        --------        d-----w        c:\programme\AvRack

2009-03-09 22:04 . 2009-03-09 22:04        --------        d-----w        c:\programme\SIW

2009-03-09 22:01 . 2009-03-09 22:01        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\gtopala

2009-03-09 21:42 . 2009-03-09 18:38        86327        ----a-w        c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-03-09 21:19 . 2009-03-09 18:50        --------        d-----w        c:\programme\VIA

2009-03-09 21:18 . 2009-03-09 21:18        331184        ------w        c:\windows\system32\difxapi.dll

2009-03-09 21:18 . 2006-10-09 11:58        203648        ----a-w        c:\windows\system32\drivers\vinyl97.sys

2009-03-09 20:58 . 2006-03-31 01:18        100992        ----a-w        c:\windows\system32\drivers\viamraid.sys

2009-03-09 20:39 . 2009-03-09 20:39        --------        d-----w        c:\programme\Realtek Sound Manager

2009-03-09 20:28 . 2009-03-09 20:28        --------        d-----w        c:\dokumente und einstellungen\ICH\Anwendungsdaten\ATI

2009-03-09 20:28 . 2009-03-09 20:28        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ATI

2009-03-09 20:15 . 2009-03-09 20:15        --------        d-----w        c:\programme\Avira

2009-03-09 20:15 . 2009-03-09 20:15        --------        d-----w        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2009-03-09 20:03 . 2009-03-09 20:02        --------        d-----w        c:\programme\ATI Technologies

2009-03-09 20:03 . 2009-03-09 18:50        --------        d-----w        c:\programme\Gemeinsame Dateien\InstallShield

2009-03-09 18:40 . 2009-03-09 18:40        --------        d-----w        c:\programme\microsoft frontpage

2009-03-09 18:37 . 2009-03-09 18:37        --------        d-----w        c:\programme\Gemeinsame Dateien\Dienste

2009-03-09 18:36 . 2009-03-09 18:36        21740        ----a-w        c:\windows\system32\emptyregdb.dat

.
 

------- Sigcheck -------
 

[-] 2004-08-10 16:11        359040        27A5959C94EE173A063CA06BD14F021A        c:\windows\system32\drivers\tcpip.sys

.

(((((((((((((((((((((((((((((   SnapShot@2009-04-19_12.08.25   )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-04-19 21:10 . 2009-04-19 21:10        16384              c:\windows\temp\Perflib_Perfdata_754.dat

+ 2009-04-19 21:14 . 2009-04-19 21:14        16384              c:\windows\temp\Perflib_Perfdata_6f4.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"avgnt"="c:\programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

"AudioDeck"="c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe" [2009-03-09 528384]

"WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-11-10 98304]

"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-15 57344]
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Programme\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
 

R3 s3117bus;Sony Ericsson Device 3117 driver (WDM);c:\windows\system32\DRIVERS\s3117bus.sys [2008-05-12 90408]

R3 s3117mdfl;Sony Ericsson Device 3117 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s3117mdfl.sys [2008-05-12 15016]

R3 s3117mdm;Sony Ericsson Device 3117 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s3117mdm.sys [2008-05-12 122024]

R3 s3117mgmt;Sony Ericsson Device 3117 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s3117mgmt.sys [2008-05-12 115368]

R3 s3117nd5;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (NDIS);c:\windows\system32\DRIVERS\s3117nd5.sys [2008-05-12 25768]

R3 s3117obex;Sony Ericsson Device 3117 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s3117obex.sys [2008-05-12 111784]

R3 s3117unic;Sony Ericsson Device 3117 USB Ethernet Emulation SEMC3117 (WDM);c:\windows\system32\DRIVERS\s3117unic.sys [2008-05-12 117544]

S0 viasraid;viasraid;c:\windows\system32\DRIVERS\viasraid.sys [2003-10-31 77312]

S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784]
 

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\dokumente und einstellungen\ICH\Anwendungsdaten\Mozilla\Firefox\Profiles\wfkm5dza.default\

FF - plugin: d:\programme\Adobe Reader\Reader\browser\nppdf32.dll

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-19 23:15

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  AudioDeck = c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe 1???????????????????????????????????????????? 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'winlogon.exe'(532)

c:\windows\system32\Ati2evxx.dll
 

- - - - - - - > 'explorer.exe'(2324)

c:\advanc~1\wh_hook.dll

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\ati2evxx.exe

c:\windows\system32\ati2evxx.exe

c:\programme\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

c:\programme\Canon\CAL\CALMAIN.exe

c:\windows\system32\wscntfy.exe

c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\advanced wheel mouse\wh_exec.exe

c:\programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe

c:\programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe

c:\programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2009-04-19 23:16 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2009-04-19 21:16

ComboFix2.txt  2009-04-19 19:32

ComboFix3.txt  2009-04-19 14:30

ComboFix4.txt  2009-04-19 12:09
 

Vor Suchlauf: 9 Verzeichnis(se), 13.045.964.800 Bytes frei

Nach Suchlauf: 8 Verzeichnis(se), 13.034.266.624 Bytes frei
 

156

OK.

1.) Start => Ausführen => combofix /u => OK

2.) Klicke auf "Für alle Neuen" in meiner Signatur und arbeite die komplette Liste unter Punkt 2 ab.

ciao, andreas

Code:

Malwarebytes' Anti-Malware 1.36

Datenbank Version: 2009

Windows 5.1.2600 Service Pack 2
 

19.04.2009 23:51:24

mbam-log-2009-04-19 (23-51-24).txt
 

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|)

Durchsuchte Objekte: 93417

Laufzeit: 13 minute(s), 14 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:52:07, on 19.04.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe

C:\ADVANC~1\wh_exec.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\explorer.exe

D:\Programme\HiJackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIA\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [WheelMouse] C:\ADVANC~1\wh_exec.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
 

--

End of file - 4051 bytes

Code:

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.1 - Deutsch

Adobe® Photoshop® Album Starter Edition 3.2

Advanced Wheel Mouse 6.0.0.002

ATI - Software Uninstall Utility

ATI Catalyst Control Center

ATI Display Driver

Avira AntiVir Personal - Free Antivirus

Canon Camera Access Library

Canon Camera Support Core Library

Canon G.726 WMP-Decoder

CANON iMAGE GATEWAY Task for ZoomBrowser EX

Canon Internet Library for ZoomBrowser EX

Canon MovieEdit Task for ZoomBrowser EX

Canon RAW Image Task for ZoomBrowser EX

Canon Utilities CameraWindow

Canon Utilities CameraWindow DC

Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX

Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX

Canon Utilities EOS Utility

Canon Utilities MyCamera

Canon Utilities MyCamera DC

Canon Utilities PhotoStitch

Canon Utilities RemoteCapture Task for ZoomBrowser EX

Canon Utilities ZoomBrowser EX

Canon ZoomBrowser EX Memory Card Utility

Catalyst Control Center - Branding

CCleaner (remove only)

ClearProg 1.5.1 Beta 7

ConvertHelper 2.2

Free FLV Converter V 6.23.0

HijackThis 2.0.2

Hotfix for Windows XP (KB926239)

IrfanView (remove only)

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0

Microsoft .NET Framework 2.0 Language Pack - DEU

Microsoft Office Professional Edition 2003

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox (3.0.8)

Nero 7 Essentials

neroxml

QuickTime

Realtek AC'97 Audio

SIW version 2009-02-24

Sony Ericsson Media Manager 1.1

Sony Ericsson PC Suite 3.209.00

VIA Platform Device Manager

Windows Installer 3.1 (KB893803)

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Logs sind sauber. Wie geht es dem Rechner?

ciao, andreas

Dem Rechner scheint es gut zu gehn... alles läuft normal!
Nochmal vielen Dank!
:aplaus::dankeschoen::aplaus: