Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Internet Explorer öffnet sich immer + Werbung (https://www.trojaner-board.de/78346-internet-explorer-oeffnet-immer-werbung.html)

takedown 12.10.2009 03:23
Internet Explorer öffnet sich immer + Werbung
 
Hallo Community,

ich habe seit vorgestern folgendes Problem...

Bestimmt 2 Mal in der Stunde öffnet sich mein internet explorer ein paar mal und zeigt mir irgendwelche Webseiten an (meist Werbung enthalten!)
Hab Bitdefender 2010 auf meinem PC als Antivirus Programm.
Bisher noch nichts gefunden,dass dieses Problem lösen könnte. Hatte bis vor ner Woche noch Windows 7 drauf. Aufgrundessen,dass ich neue Recovery Disks bekommen habe,hab ich mir direkt wieder Vista aufgespielt und nun.. joa :heulen:

habe keine Lust wieder zu formatieren. )=

hoffe ihr könnt mir helfen..
hier ebend meine HiJackThis Auswertung...

Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Zitat:
Scan saved at 04:20:39, on 12.10.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\Logitech\Logitech Vid\Vid.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\zoneLINK\SystemUp 2009\Harddisk\hdtray.exe
C:\Program Files (x86)\QIP 2005 psYNovA-Edition\qip.exe
C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Seesmic Desktop\Seesmic Desktop.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Last.fm\LastFM.exe
C:\Program Files (x86)\T4E\Player\T4E_Player.exe
C:\Windows\SysWOW64\conime.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files\BitDefender\BitDefender 2010\antispam32\bdimguiaux.exe
C:\Program Files (x86)\CAPCOM\RESIDENT EVIL 5\Launcher.exe
C:\Program Files (x86)\CAPCOM\RESIDENT EVIL 5\RE5DX10.EXE
C:\Windows\msa.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AdblockIE - {90EFF544-3981-4d46-85C9-C0361D0931D6} - mscoree.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEToolbar.dll" (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe" -bootmode
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SystemUp HARDDISK GUARD] "C:\Program Files (x86)\zoneLINK\SystemUp 2009\Harddisk\hdtray.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [PopRock] C:\Users\takedown\AppData\Local\Temp\b.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: Seesmic Desktop.lnk = C:\Program Files (x86)\Seesmic Desktop\Seesmic Desktop.exe
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SystemUp HardDisk Service (SysUpHDService) - zoneLink - C:\Program Files (x86)\Common Files\SystemUp Harddisk\hdservice.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - Unknown owner - C:\Windows\System32\TUProgSt.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9376 bytes
Hoffe ihr könnt damit etwas anfangen.

Danke schonmal im Vorraus.

Mit freundlichen Grüßen

Angel21 12.10.2009 08:11
Hallo :hallo:

Bitte als Vista 64 bit Nutzer alle folgenden Programme per Rechtsklick -> Ausführen als Administrator starten:

Die schnellste und sicherste Methode ist das Neuaufsetzen wenn Du jedoch doch bereinigen möchtest geht es hier entlang:

1. Malwarebytes - Lasse Malwarebytes laufen, wenn die Setup NICHT starten möchte benenn es um zu blubb.exe. Wenn es durch ist per Vollständiger Scan bitte das Log posten.

2. Superantispyware - Lasse SASW laufen, poste danach alle Funde.

3. Avira Antivir in den Einstellungen nochmal "Rennen" lassen: Agressive Einstellungen von Avira AntiVir
Log von dem Avira Scan.

4. http://www.trojaner-board.de/74908-a...t-scanner.html bitte ebenfalls laufen lassen, Log hier her.

5. http://www.trojaner-board.de/74910-a...tion-tool.html Logs posten (Beide Logfiles bitte hier herein posten).

takedown 13.10.2009 00:08
Zitat:
Malwarebytes' Anti-Malware 1.41
Datenbank Version: 2947
Windows 6.0.6002 Service Pack 2

12.10.2009 18:12:27
mbam-log-2009-10-12 (18-12-27).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 80444
Laufzeit: 2 minute(s), 47 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\System32\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
______

SuperSpyware hat 147 Funde aber alle entfernt..hab keine Ahnung wo die Log ist.

Habe kein Antivir drauf sondern Bitdenfener.


Log:

nichts gefunden?

takedown 13.10.2009 00:11
[CODE]Logfile of random's system information tool 1.06 (written by random/random)
Run by takedown at 2009-10-13 01:04:13
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 780 GB (83%) free of 939 GB
Total RAM: 4094 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:04:14, on 13.10.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files (x86)\QIP 2005 psYNovA-Edition\qip.exe
C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Windows\SysWOW64\conime.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\takedown\Desktop\RSIT.exe
C:\Program Files (x86)\Trend Micro\HijackThis\takedown.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEToolbar.dll" (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe" -bootmode
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SystemUp HARDDISK GUARD] "C:\Program Files (x86)\zoneLINK\SystemUp 2009\Harddisk\hdtray.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [QIP2005] C:\Program Files (x86)\QIP 2005 psYNovA-Edition\qip.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: Seesmic Desktop.lnk = C:\Program Files (x86)\Seesmic Desktop\Seesmic Desktop.exe
O4 - Global Startup: Firefox Preloader.lnk = C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files (x86)\a-squared Free\a2service.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SystemUp HardDisk Service (SysUpHDService) - zoneLink - C:\Program Files (x86)\Common Files\SystemUp Harddisk\hdservice.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - Unknown owner - C:\Windows\System32\TUProgSt.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9022 bytes

======Scheduled tasks folder======

C:\Windows\tasks\1-Klick-Wartung.job
C:\Windows\tasks\User_Feed_Synchronization-{A09EDBE1-C9EA-4417-BF7A-30CB8E6826C2}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-10-06 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2010\Antispam32\IEToolbar.dll [2009-10-11 128832]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre6\bin\jusched.exe [2009-10-06 149280]
"LogitechQuickCamRibbon"=C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2009-05-08 2780432]
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2009-07-01 37888]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-08-13 98304]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2009-09-05 417792]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2009-09-21 305440]
"UnlockerAssistant"=C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe []
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1555968]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []
"Logitech Vid"=C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe [2009-06-02 5451536]
"Steam"=c:\program files (x86)\steam\steam.exe [2009-10-07 1217784]
"SystemUp HARDDISK GUARD"=C:\Program Files (x86)\zoneLINK\SystemUp 2009\Harddisk\hdtray.exe [2009-06-03 1723272]
"WMPNSCFG"=C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe []
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 138240]
"SUPERAntiSpyware"=C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-09-15 1998576]
"QIP2005"=C:\Program Files (x86)\QIP 2005 psYNovA-Edition\qip.exe [2009-08-13 3276288]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Firefox Preloader.lnk - C:\Program Files (x86)\FirefoxPreloader\FirefoxPreloader.exe

C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Seesmic Desktop.lnk - C:\Program Files (x86)\Seesmic Desktop\Seesmic Desktop.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"BindDirectlyToPropertySetStorage"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\SysWOW64\Notepad.exe %1
.js - open - C:\Windows\SysWOW64\WScript.exe "%1" %*

takedown 13.10.2009 00:13
[CODE]======List of files/folders created in the last 1 months======

2009-10-13 01:04:13 ----D---- C:\rsit
2009-10-12 18:17:42 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2009-10-12 18:17:34 ----D---- C:\Users\takedown\AppData\Roaming\SUPERAntiSpyware.com
2009-10-12 18:17:34 ----D---- C:\Program Files (x86)\SUPERAntiSpyware
2009-10-12 18:16:55 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2009-10-12 18:07:21 ----D---- C:\Users\takedown\AppData\Roaming\Malwarebytes
2009-10-12 18:07:15 ----D---- C:\ProgramData\Malwarebytes
2009-10-12 18:07:15 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2009-10-12 05:27:33 ----D---- C:\Program Files (x86)\a-squared Free
2009-10-12 04:57:10 ----D---- C:\Users\takedown\AppData\Roaming\UseNeXT
2009-10-12 04:57:08 ----D---- C:\Program Files (x86)\UseNeXT
2009-10-12 04:13:33 ----D---- C:\Program Files (x86)\Trend Micro
2009-10-11 18:00:52 ----D---- C:\Users\takedown\AppData\Roaming\Desktopicon
2009-10-11 18:00:51 ----D---- C:\Program Files (x86)\Unlocker
2009-10-11 14:27:56 ----A---- C:\Windows\ntbtlog.txt
2009-10-11 14:23:28 ----D---- C:\Users\takedown\AppData\Roaming\BitDefender
2009-10-11 14:22:52 ----D---- C:\ProgramData\BitDefender
2009-10-11 14:13:09 ----D---- C:\Program Files (x86)\Common Files\BitDefender
2009-10-11 14:01:28 ----D---- C:\Windows\system32\URTTEMP
2009-10-11 00:51:43 ----D---- C:\Windows\Sun
2009-10-10 20:31:14 ----D---- C:\Users\takedown\AppData\Roaming\Sincell
2009-10-10 20:30:44 ----D---- C:\ProgramData\Sincell
2009-10-10 15:46:42 ----A---- C:\Windows\system32\uxtuneup.dll
2009-10-10 15:46:42 ----A---- C:\Windows\system32\authuitu.dll
2009-10-10 15:43:35 ----D---- C:\Users\takedown\AppData\Roaming\TuneUp Software
2009-10-10 15:43:21 ----D---- C:\ProgramData\TuneUp Software
2009-10-10 15:43:21 ----D---- C:\Program Files (x86)\TuneUp Utilities 2009
2009-10-10 15:43:07 ----SHD---- C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357}
2009-10-10 15:25:58 ----D---- C:\Users\takedown\AppData\Roaming\FileZilla
2009-10-10 15:25:49 ----D---- C:\Program Files (x86)\FileZilla FTP Client
2009-10-10 15:20:42 ----A---- C:\Windows\system32\commdlg.dll
2009-10-09 20:19:56 ----D---- C:\Users\takedown\AppData\Roaming\ICQ
2009-10-09 20:19:29 ----D---- C:\Program Files (x86)\ICQ6.5
2009-10-09 00:00:18 ----D---- C:\ProgramData\IsolatedStorage
2009-10-08 23:27:04 ----D---- C:\Users\takedown\AppData\Roaming\vlc
2009-10-08 02:54:18 ----A---- C:\Windows\system32\XAudio2_5.dll
2009-10-08 02:54:18 ----A---- C:\Windows\system32\xactengine3_5.dll
2009-10-08 02:54:17 ----A---- C:\Windows\system32\d3dx11_42.dll
2009-10-08 02:54:17 ----A---- C:\Windows\system32\d3dcsx_42.dll
2009-10-08 02:54:17 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2009-10-08 02:54:16 ----A---- C:\Windows\system32\D3DX9_42.dll
2009-10-08 02:54:16 ----A---- C:\Windows\system32\d3dx10_42.dll
2009-10-08 02:54:13 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2009-10-08 02:54:10 ----A---- C:\Windows\system32\XAudio2_3.dll
2009-10-08 02:54:10 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2009-10-08 02:54:09 ----A---- C:\Windows\system32\xactengine3_3.dll
2009-10-08 02:54:09 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2009-10-08 02:54:08 ----A---- C:\Windows\system32\XAudio2_2.dll
2009-10-08 02:54:08 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2009-10-08 02:54:08 ----A---- C:\Windows\system32\xactengine3_2.dll
2009-10-07 22:09:23 ----A---- C:\Windows\system32\d3dx10_41.dll
2009-10-07 22:09:23 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2009-10-07 22:09:20 ----A---- C:\Windows\system32\D3DX9_41.dll
2009-10-07 22:09:16 ----A---- C:\Windows\system32\XAudio2_4.dll
2009-10-07 22:09:13 ----A---- C:\Windows\system32\xactengine3_4.dll
2009-10-07 22:09:11 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2009-10-07 22:09:09 ----A---- C:\Windows\system32\d3dx10_40.dll
2009-10-07 22:09:09 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2009-10-07 22:09:05 ----A---- C:\Windows\system32\D3DX9_40.dll
2009-10-07 22:08:50 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2009-10-07 22:08:49 ----A---- C:\Windows\system32\d3dx10_39.dll
2009-10-07 22:08:47 ----A---- C:\Windows\system32\D3DX9_39.dll
2009-10-07 22:08:43 ----A---- C:\Windows\system32\XAudio2_1.dll
2009-10-07 22:08:43 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2009-10-07 22:08:41 ----A---- C:\Windows\system32\xactengine3_1.dll
2009-10-07 22:08:40 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2009-10-07 22:08:38 ----A---- C:\Windows\system32\d3dx10_38.dll
2009-10-07 22:08:38 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2009-10-07 22:08:36 ----A---- C:\Windows\system32\D3DX9_38.dll
2009-10-07 22:08:34 ----A---- C:\Windows\system32\XAudio2_0.dll
2009-10-07 22:08:32 ----A---- C:\Windows\system32\xactengine3_0.dll
2009-10-07 22:08:31 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2009-10-07 22:08:22 ----A---- C:\Windows\system32\xactengine2_10.dll
2009-10-07 22:08:19 ----A---- C:\Windows\system32\d3dx10_36.dll
2009-10-07 22:08:19 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2009-10-07 22:08:17 ----A---- C:\Windows\system32\d3dx9_36.dll
2009-10-07 22:08:16 ----A---- C:\Windows\system32\xactengine2_9.dll
2009-10-07 22:08:14 ----A---- C:\Windows\system32\d3dx10_35.dll
2009-10-07 22:08:14 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2009-10-07 22:08:12 ----A---- C:\Windows\system32\d3dx9_35.dll
2009-10-07 22:08:05 ----A---- C:\Windows\system32\xactengine2_8.dll
2009-10-07 22:08:04 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2009-10-07 22:08:01 ----A---- C:\Windows\system32\d3dx10_34.dll
2009-10-07 22:08:01 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2009-10-07 22:07:58 ----A---- C:\Windows\system32\d3dx9_34.dll
2009-10-07 22:07:54 ----A---- C:\Windows\system32\xactengine2_7.dll
2009-10-07 22:07:52 ----A---- C:\Windows\system32\d3dx10_33.dll
2009-10-07 22:07:52 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2009-10-07 22:07:50 ----A---- C:\Windows\system32\d3dx9_33.dll
2009-10-07 22:07:45 ----A---- C:\Windows\system32\xactengine2_6.dll
2009-10-07 22:07:40 ----A---- C:\Windows\system32\xactengine2_5.dll
2009-10-07 22:07:39 ----A---- C:\Windows\system32\d3dx10.dll
2009-10-07 22:07:31 ----A---- C:\Windows\system32\d3dx9_32.dll
2009-10-07 22:07:26 ----A---- C:\Windows\system32\xactengine2_4.dll
2009-10-07 22:07:26 ----A---- C:\Windows\system32\x3daudio1_1.dll
2009-10-07 22:07:20 ----A---- C:\Windows\system32\d3dx9_31.dll
2009-10-07 22:07:16 ----A---- C:\Windows\system32\xactengine2_3.dll
2009-10-07 22:07:14 ----A---- C:\Windows\system32\xinput1_2.dll
2009-10-07 22:07:11 ----A---- C:\Windows\system32\xactengine2_2.dll
2009-10-07 22:07:08 ----A---- C:\Windows\system32\xinput1_1.dll
2009-10-07 22:07:04 ----A---- C:\Windows\system32\xactengine2_1.dll
2009-10-07 22:06:37 ----A---- C:\Windows\system32\d3dx9_30.dll
2009-10-07 22:06:27 ----A---- C:\Windows\system32\xactengine2_0.dll
2009-10-07 22:06:27 ----A---- C:\Windows\system32\x3daudio1_0.dll
2009-10-07 22:06:24 ----A---- C:\Windows\system32\d3dx9_29.dll
2009-10-07 22:06:17 ----A---- C:\Windows\system32\d3dx9_28.dll
2009-10-07 22:06:11 ----A---- C:\Windows\system32\d3dx9_27.dll
2009-10-07 22:06:08 ----A---- C:\Windows\system32\d3dx9_26.dll
2009-10-07 22:06:06 ----A---- C:\Windows\system32\d3dx9_25.dll
2009-10-07 22:05:47 ----A---- C:\Windows\system32\d3dx9_24.dll
2009-10-07 22:04:13 ----D---- C:\Program Files (x86)\CAPCOM
2009-10-07 22:03:19 ----A---- C:\Windows\system32\D3DX9_37.dll
2009-10-07 22:03:19 ----A---- C:\Windows\system32\d3dx10_37.dll
2009-10-07 22:03:19 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2009-10-07 22:03:18 ----A---- C:\Windows\system32\xinput1_3.dll
2009-10-07 22:02:37 ----D---- C:\Windows\system32\xlive
2009-10-07 22:02:37 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2009-10-07 20:27:21 ----D---- C:\Users\takedown\AppData\Roaming\com.seesmic.desktop.client.D89F32799270693BEF34AAA36E9B2632B59240FA.1
2009-10-07 20:27:21 ----D---- C:\ProgramData\Adobe
2009-10-07 20:27:19 ----D---- C:\Program Files (x86)\Seesmic Desktop
2009-10-07 20:27:17 ----D---- C:\Program Files (x86)\Common Files\Adobe AIR
2009-10-07 18:11:08 ----D---- C:\Windows\system32\Samsung_USB_Drivers
2009-10-07 18:11:04 ----D---- C:\Program Files (x86)\Samsung
2009-10-07 05:49:15 ----D---- C:\Users\takedown\AppData\Roaming\WinRAR
2009-10-07 05:18:47 ----D---- C:\Windows\pss
2009-10-07 05:12:53 ----A---- C:\Windows\RtlExUpd.dll
2009-10-07 05:12:49 ----D---- C:\Program Files (x86)\Common Files\InstallShield
2009-10-07 05:08:14 ----A---- C:\Windows\DIFxAPI.dll
2009-10-07 05:08:02 ----HD---- C:\Program Files (x86)\Temp
2009-10-07 05:04:34 ----A---- C:\Windows\system32\difxapi.dll
2009-10-07 05:02:27 ----D---- C:\Program Files (x86)\Realtek
2009-10-07 05:01:35 ----D---- C:\ProgramData\Ralink
2009-10-07 05:01:00 ----D---- C:\ProgramData\Ralink Driver
2009-10-07 05:00:57 ----A---- C:\Windows\system32\RAIHV.dll
2009-10-07 05:00:57 ----A---- C:\Windows\system32\RAEXTUI.dll
2009-10-07 05:00:56 ----D---- C:\Program Files (x86)\Ralink
2009-10-07 05:00:56 ----A---- C:\Windows\system32\RaCertMgr.dll
2009-10-07 04:57:22 ----D---- C:\ProgramData\InstallShield
2009-10-07 04:52:23 ----D---- C:\Program Files (x86)\Driver-Soft
2009-10-07 03:23:50 ----D---- C:\Windows\PCHEALTH
2009-10-07 03:10:51 ----D---- C:\Program Files (x86)\MSXML 4.0
2009-10-07 03:10:40 ----SD---- C:\Windows\system32\Microsoft
2009-10-07 03:07:29 ----HD---- C:\Config.Msi
2009-10-07 01:52:46 ----D---- C:\Program Files (x86)\FirefoxPreloader
2009-10-07 01:52:46 ----A---- C:\Windows\system32\regclass.dll
2009-10-07 01:48:10 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2009-10-07 01:47:53 ----D---- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2009-10-07 01:37:52 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-10-07 01:28:59 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-10-07 01:28:59 ----A---- C:\Windows\system32\mscoree.dll
2009-10-07 01:28:59 ----A---- C:\Windows\system32\dfshim.dll
2009-10-07 01:28:58 ----A---- C:\Windows\system32\PresentationHost.exe
2009-10-07 01:28:51 ----D---- C:\ProgramData\Last.fm
2009-10-07 01:28:29 ----D---- C:\Program Files (x86)\Last.fm
2009-10-07 01:21:00 ----D---- C:\Users\takedown\AppData\Roaming\ATI
2009-10-07 01:21:00 ----D---- C:\ProgramData\ATI
2009-10-07 01:13:37 ----D---- C:\Users\takedown\AppData\Roaming\Apple Computer
2009-10-07 01:13:22 ----A---- C:\Windows\system32\GEARAspi.dll
2009-10-07 01:12:53 ----D---- C:\ProgramData\{0DD0EEEE-2A7C-411C-9243-1AE62F445FC3}
2009-10-07 01:12:53 ----D---- C:\Program Files (x86)\iTunes
2009-10-07 01:10:50 ----D---- C:\Program Files (x86)\Bonjour
2009-10-07 01:10:05 ----D---- C:\Program Files (x86)\Razer
2009-10-07 01:10:04 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2009-10-07 01:09:43 ----D---- C:\Program Files (x86)\QuickTime
2009-10-07 01:09:42 ----D---- C:\ProgramData\Apple Computer
2009-10-07 01:08:34 ----D---- C:\Program Files (x86)\Apple Software Update
2009-10-07 01:05:30 ----D---- C:\ProgramData\Apple
2009-10-07 01:05:30 ----D---- C:\Program Files (x86)\Common Files\Apple
2009-10-07 00:46:43 ----D---- C:\Program Files (x86)\Microsoft
2009-10-07 00:46:17 ----D---- C:\Program Files (x86)\Windows Live SkyDrive
2009-10-07 00:46:01 ----D---- C:\Program Files (x86)\Windows Live
2009-10-07 00:43:50 ----D---- C:\Program Files (x86)\T4E
2009-10-07 00:42:21 ----D---- C:\Program Files (x86)\Common Files\Windows Live
2009-10-07 00:40:20 ----D---- C:\Program Files (x86)\SpeedFan
2009-10-07 00:34:46 ----D---- C:\Program Files (x86)\zoneLINK
2009-10-07 00:34:46 ----D---- C:\Program Files (x86)\Common Files\SystemUp Harddisk
2009-10-07 00:33:36 ----D---- C:\Program Files (x86)\ATI Technologies
2009-10-07 00:31:59 ----D---- C:\ATI
2009-10-07 00:30:10 ----D---- C:\Program Files (x86)\Common Files\PX Storage Engine
2009-10-07 00:30:09 ----D---- C:\Users\takedown\AppData\Roaming\Winamp
2009-10-07 00:30:09 ----D---- C:\Program Files (x86)\Winamp
2009-10-07 00:29:44 ----D---- C:\Users\takedown\AppData\Roaming\teamspeak2
2009-10-07 00:29:38 ----D---- C:\Program Files (x86)\Teamspeak2_RC2
2009-10-07 00:29:09 ----A---- C:\Windows\system32\jscript.dll
2009-10-07 00:29:07 ----D---- C:\Program Files (x86)\VideoLAN
2009-10-07 00:14:04 ----D---- C:\Program Files (x86)\QIP 2005 psYNovA-Edition
2009-10-07 00:13:45 ----A---- C:\Windows\system32\occache.dll
2009-10-07 00:13:45 ----A---- C:\Windows\system32\jsproxy.dll
2009-10-07 00:13:45 ----A---- C:\Windows\system32\iepeers.dll
2009-10-07 00:13:44 ----A---- C:\Windows\system32\wininet.dll
2009-10-07 00:13:44 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-10-07 00:13:44 ----A---- C:\Windows\system32\msfeeds.dll
2009-10-07 00:13:44 ----A---- C:\Windows\system32\ieui.dll
2009-10-07 00:13:44 ----A---- C:\Windows\system32\iernonce.dll
2009-10-07 00:13:43 ----A---- C:\Windows\system32\urlmon.dll
2009-10-07 00:13:43 ----A---- C:\Windows\system32\msfeedssync.exe
2009-10-07 00:13:43 ----A---- C:\Windows\system32\iesetup.dll
2009-10-07 00:13:43 ----A---- C:\Windows\system32\iedkcs32.dll
2009-10-07 00:13:43 ----A---- C:\Windows\system32\ie4uinit.exe
2009-10-07 00:13:40 ----A---- C:\Windows\system32\iertutil.dll
2009-10-07 00:13:39 ----A---- C:\Windows\system32\ieframe.dll
2009-10-07 00:13:37 ----A---- C:\Windows\system32\mshtml.dll
2009-10-07 00:13:37 ----A---- C:\Windows\system32\ieUnatt.exe
2009-10-07 00:13:37 ----A---- C:\Windows\system32\iesysprep.dll
2009-10-07 00:12:03 ----D---- C:\Program Files (x86)\Steam
2009-10-07 00:12:03 ----D---- C:\Program Files (x86)\Common Files\Steam
2009-10-07 00:12:02 ----A---- C:\Windows\system32\advpack.dll
2009-10-07 00:12:02 ----A---- C:\Windows\system32\admparse.dll
2009-10-07 00:12:01 ----A---- C:\Windows\system32\ieakeng.dll
2009-10-07 00:12:01 ----A---- C:\Windows\system32\icardie.dll
2009-10-07 00:12:01 ----A---- C:\Windows\system32\corpol.dll
2009-10-07 00:12:00 ----A---- C:\Windows\system32\wextract.exe
2009-10-07 00:12:00 ----A---- C:\Windows\system32\pngfilt.dll
2009-10-07 00:12:00 ----A---- C:\Windows\system32\msls31.dll
2009-10-07 00:12:00 ----A---- C:\Windows\system32\ieapfltr.dll
2009-10-07 00:11:59 ----A---- C:\Windows\system32\mstime.dll
2009-10-07 00:11:59 ----A---- C:\Windows\system32\imgutil.dll
2009-10-07 00:11:59 ----A---- C:\Windows\system32\dxtrans.dll
2009-10-07 00:11:59 ----A---- C:\Windows\system32\dxtmsft.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\WinFXDocObj.exe
2009-10-07 00:11:58 ----A---- C:\Windows\system32\webcheck.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\msrating.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\mshtmled.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\licmgr10.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\inseng.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\ieakui.dll
2009-10-07 00:11:58 ----A---- C:\Windows\system32\ieaksie.dll
2009-10-07 00:11:57 ----A---- C:\Windows\system32\vbscript.dll
2009-10-07 00:11:57 ----A---- C:\Windows\system32\url.dll
2009-10-07 00:11:57 ----A---- C:\Windows\system32\mshtmler.dll
2009-10-07 00:11:57 ----A---- C:\Windows\system32\mshta.exe
2009-10-07 00:11:57 ----A---- C:\Windows\system32\iexpress.exe
2009-10-07 00:11:56 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2009-10-07 00:11:56 ----A---- C:\Windows\system32\SetDepNx.exe
2009-10-07 00:11:56 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2009-10-07 00:11:56 ----A---- C:\Windows\system32\PDMSetup.exe
2009-10-07 00:11:19 ----D---- C:\Windows\system32\RTCOM
2009-10-07 00:11:02 ----D---- C:\Program Files (x86)\Logitech
2009-10-07 00:10:54 ----D---- C:\ProgramData\LogiShrd
2009-10-07 00:10:54 ----D---- C:\Program Files (x86)\Common Files\LogiShrd
2009-10-07 00:09:32 ----A---- C:\Windows\system32\tzres.dll
2009-10-07 00:04:44 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-10-07 00:04:44 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-10-07 00:04:39 ----A---- C:\Windows\system32\kerberos.dll
2009-10-07 00:04:38 ----A---- C:\Windows\system32\wdigest.dll
2009-10-07 00:04:38 ----A---- C:\Windows\system32\secur32.dll
2009-10-07 00:04:38 ----A---- C:\Windows\system32\schannel.dll
2009-10-07 00:04:38 ----A---- C:\Windows\system32\msv1_0.dll
2009-10-07 00:04:35 ----A---- C:\Windows\system32\mstscax.dll
2009-10-07 00:04:33 ----A---- C:\Windows\system32\rpcrt4.dll
2009-10-07 00:04:31 ----A---- C:\Windows\system32\localspl.dll
2009-10-07 00:03:44 ----A---- C:\Windows\system32\netiohlp.dll
2009-10-07 00:03:43 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-10-07 00:03:43 ----A---- C:\Windows\system32\ROUTE.EXE
2009-10-07 00:03:43 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-10-07 00:03:43 ----A---- C:\Windows\system32\netevent.dll
2009-10-07 00:03:43 ----A---- C:\Windows\system32\MRINFO.EXE
2009-10-07 00:03:43 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-10-07 00:03:43 ----A---- C:\Windows\system32\finger.exe
2009-10-07 00:03:43 ----A---- C:\Windows\system32\ARP.EXE
2009-10-07 00:03:27 ----A---- C:\Windows\system32\t2embed.dll
2009-10-07 00:03:26 ----A---- C:\Windows\system32\fontsub.dll
2009-10-07 00:03:26 ----A---- C:\Windows\system32\dciman32.dll
2009-10-07 00:03:26 ----A---- C:\Windows\system32\atmfd.dll
2009-10-07 00:00:38 ----A---- C:\Windows\system32\avifil32.dll
2009-10-07 00:00:28 ----A---- C:\Windows\system32\wmp.dll
2009-10-07 00:00:27 ----A---- C:\Windows\system32\wmpdxm.dll
2009-10-07 00:00:26 ----A---- C:\Windows\system32\dxmasf.dll
2009-10-07 00:00:25 ----A---- C:\Windows\system32\wmploc.DLL
2009-10-07 00:00:25 ----A---- C:\Windows\system32\spwmp.dll
2009-10-07 00:00:21 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-10-07 00:00:20 ----A---- C:\Windows\system32\mf.dll
2009-10-07 00:00:17 ----A---- C:\Windows\system32\wlansec.dll
2009-10-07 00:00:17 ----A---- C:\Windows\system32\wlanmsm.dll
2009-10-07 00:00:17 ----A---- C:\Windows\system32\wlanapi.dll
2009-10-07 00:00:17 ----A---- C:\Windows\system32\L2SecHC.dll
2009-10-07 00:00:15 ----A---- C:\Windows\system32\atl.dll
2009-10-06 23:59:50 ----D---- C:\Users\takedown\AppData\Roaming\Macromedia
2009-10-06 23:59:50 ----D---- C:\Users\takedown\AppData\Roaming\Adobe
2009-10-06 23:59:45 ----D---- C:\Windows\system32\Macromed
2009-10-06 23:59:22 ----A---- C:\Windows\system32\javaws.exe
2009-10-06 23:59:22 ----A---- C:\Windows\system32\javaw.exe
2009-10-06 23:59:22 ----A---- C:\Windows\system32\java.exe
2009-10-06 23:59:22 ----A---- C:\Windows\system32\deploytk.dll
2009-10-06 23:59:13 ----D---- C:\Program Files (x86)\Java
2009-10-06 23:55:34 ----SHD---- C:\Windows\Installer
2009-10-06 23:54:52 ----D---- C:\Program Files (x86)\Intel
2009-10-06 23:54:52 ----A---- C:\Windows\system32\CSVer.dll
2009-10-06 23:54:46 ----D---- C:\Intel
2009-10-06 23:52:31 ----D---- C:\Users\takedown\AppData\Roaming\Mozilla
2009-10-06 23:52:28 ----D---- C:\Program Files (x86)\Mozilla Firefox
2009-10-06 23:49:20 ----A---- C:\Windows\system32\wups.dll
2009-10-06 23:49:20 ----A---- C:\Windows\system32\wudriver.dll
2009-10-06 23:49:20 ----A---- C:\Windows\system32\wuapi.dll
2009-10-06 23:49:14 ----A---- C:\Windows\system32\wuwebv.dll
2009-10-06 23:49:14 ----A---- C:\Windows\system32\wuapp.exe
2009-10-06 23:47:10 ----D---- C:\Users\takedown\AppData\Roaming\WinBatch
2009-10-06 23:09:41 ----D---- C:\Users\takedown\AppData\Roaming\Identities
2009-10-06 23:09:36 ----SD---- C:\Users\takedown\AppData\Roaming\Microsoft
2009-10-06 23:09:36 ----D---- C:\Users\takedown\AppData\Roaming\Media Center Programs
2009-10-06 23:08:01 ----SHD---- C:\Programme
2009-10-06 23:08:01 ----SHD---- C:\ProgramData\Vorlagen
2009-10-06 23:08:01 ----SHD---- C:\ProgramData\Startmenü
2009-10-06 23:08:01 ----SHD---- C:\ProgramData\Favoriten
2009-10-06 23:08:01 ----SHD---- C:\ProgramData\Dokumente
2009-10-06 23:08:01 ----SHD---- C:\ProgramData\Anwendungsdaten
2009-10-06 23:08:01 ----SHD---- C:\Dokumente und Einstellungen
2009-10-06 23:07:44 ----D---- C:\Windows\Debug
2009-10-06 23:01:47 ----D---- C:\Windows\Panther
2009-10-06 23:01:34 ----RAS---- C:\BOOTSECT.BAK
2009-10-06 23:01:33 ----SHD---- C:\Boot
2009-10-06 22:05:02 ----D---- C:\Windows\SoftwareDistribution
2009-10-06 22:02:24 ----D---- C:\Windows\Prefetch
2009-10-06 22:02:23 ----SHD---- C:\System Volume Information

takedown 13.10.2009 00:14
Code:
======List of files/folders modified in the last 1 months======

2009-10-13 00:40:02 ----D---- C:\Windows\Temp
2009-10-13 00:06:19 ----D---- C:\Windows\System32
2009-10-13 00:06:18 ----D---- C:\Windows\inf
2009-10-12 22:21:00 ----RD---- C:\Program Files
2009-10-12 18:17:42 ----HD---- C:\ProgramData
2009-10-12 18:17:34 ----RD---- C:\Program Files (x86)
2009-10-12 18:16:55 ----D---- C:\Program Files (x86)\Common Files
2009-10-12 18:12:27 ----D---- C:\Windows\SysWOW64
2009-10-12 18:07:17 ----D---- C:\Windows\system32\drivers
2009-10-12 13:16:58 ----D---- C:\Windows
2009-10-12 13:16:57 ----D---- C:\Windows\Tasks
2009-10-11 14:24:21 ----D---- C:\Windows\winsxs
2009-10-11 14:02:15 ----D---- C:\Windows\Registration
2009-10-11 14:01:54 ----RSD---- C:\Windows\assembly
2009-10-11 14:01:28 ----D---- C:\Program Files (x86)\Internet Explorer
2009-10-09 01:44:17 ----RSD---- C:\Windows\Fonts
2009-10-07 23:09:18 ----D---- C:\Windows\rescache
2009-10-07 22:06:48 ----D---- C:\Windows\Microsoft.NET
2009-10-07 22:04:17 ----D---- C:\Windows\Logs
2009-10-07 04:19:25 ----SD---- C:\ProgramData\Microsoft
2009-10-07 03:23:51 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2009-10-07 01:28:56 ----D---- C:\Program Files (x86)\Windows Media Player
2009-10-07 01:20:32 ----SD---- C:\Windows\Downloaded Program Files
2009-10-07 01:17:12 ----D---- C:\Windows\system32\migration
2009-10-07 01:17:12 ----D---- C:\Windows\AppPatch
2009-10-07 01:17:06 ----D---- C:\Windows\system32\de-DE
2009-10-07 01:17:04 ----D---- C:\Windows\system32\en-US
2009-10-07 01:17:03 ----D---- C:\Windows\PolicyDefinitions
2009-10-07 01:17:01 ----D---- C:\Windows\ehome
2009-10-07 01:17:00 ----D---- C:\Program Files (x86)\Windows Mail
2009-10-07 00:08:56 ----D---- C:\Windows\twain_32
2009-10-06 23:09:53 ----SHD---- C:\$Recycle.Bin
2009-10-06 23:09:36 ----RD---- C:\Users

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver; C:\Windows\system32\DRIVERS\BdfNdisf6.sys []
R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [2009-10-11 104968]
R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys [2009-04-01 101896]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\Windows\system32\drivers\AtiHdmi.sys []
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 BDFM;BDFM; C:\Windows\system32\DRIVERS\bdfm.sys []
R3 DAdderFltr;DeathAdder Mouse; C:\Windows\system32\drivers\dadder.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 LVPr2M64;Logitech LVPr2M64 Driver; C:\Windows\system32\DRIVERS\LVPr2M64.sys []
R3 netr7364;USB Wireless 802.11 b/g Adaptor Driver for Vista; C:\Windows\system32\DRIVERS\netr7364.sys []
R3 PID_0928;Logitech QuickCam Express(PID_0928); C:\Windows\system32\DRIVERS\LV561V64.SYS []
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2009-08-19 222720]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
S1 SASDIFSV;SASDIFSV; \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS [2009-09-15 9968]
S1 SASKUTIL;SASKUTIL; \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys [2009-09-15 74480]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []
S3 LVPr2Mon;LVPr2M64 Driver; C:\Windows\system32\DRIVERS\LVPr2M64.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []
S3 SASENUM;SASENUM; \??\C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS [2009-09-15 7408]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; C:\Program Files (x86)\a-squared Free\a2service.exe [2009-10-01 1858144]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe []
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour-Dienst; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2009-06-05 354840]
R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2009-10-11 440928]
R2 LVPrcS64;Process Monitor; C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-04-30 190488]
R2 SysUpHDService;SystemUp HardDisk Service; C:\Program Files (x86)\Common Files\SystemUp Harddisk\hdservice.exe [2009-06-03 1773960]
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe []
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe [2009-10-11 2273816]
R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2009-09-21 660256]
S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2009-10-11 278224]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-04-11 89920]
S3 clr_optimization_v4.0.20506_32;.NET Runtime Optimization Service v4.0.20506_X86; c:\Windows\Microsoft.NET\Framework\v4.0.20506\mscorsvw.exe [2009-05-06 104272]
S3 clr_optimization_v4.0.20506_64;.NET Runtime Optimization Service v4.0.20506_X64; c:\Windows\Microsoft.NET\Framework64\v4.0.20506\mscorsvw.exe [2009-05-06 122192]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968]
S3 scan;BitDefender Threat Scanner; C:\Windows\System32\svchost.exe [2008-01-21 21504]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-10-07 316664]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe []
S4 RalinkRegistryWriter;Ralink Registry Writer; C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [2009-07-14 185632]
S4 RalinkRegistryWriter64;Ralink Registry Writer 64; C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [2009-07-14 211232]

-----------------EOF-----------------

takedown 13.10.2009 00:15
Code:
info.txt logfile of random's system information tool 1.06 2009-10-13 01:04:17

======Uninstall list======

Adobe AIR-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
a-squared Free 4.5-->"C:\Program Files (x86)\a-squared Free\unins000.exe"
Catalyst Control Center - Branding-->MsiExec.exe /I{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}
Counter-Strike: Source-->"C:\Program Files (x86)\Steam\steam.exe" steam://uninstall/240
Driver Genius Professional Edition-->"C:\Program Files (x86)\Driver-Soft\DriverGenius\unins000.exe"
Firefox Preloader-->"C:\Program Files (x86)\FirefoxPreloader\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT=""
ICQ6.5-->"C:\Program Files (x86)\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Last.fm 1.5.4.24567-->"C:\Program Files (x86)\Last.fm\unins000.exe"
Logitech Vid-->MsiExec.exe /I{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}
Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}
Microsoft Games for Windows - LIVE-->MsiExec.exe /X{F112F66E-25CA-42DD-983C-6118EB38F606}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2010  Beta 1 x86 Redistributable - 10.0.20506-->MsiExec.exe /X{FC92E32F-6AD6-38E7-AC11-83B639CEACD8}
Mozilla Firefox (3.5.3)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser und SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
QIP 2005 psYNovA-Edition-->"C:\Program Files (x86)\QIP 2005 psYNovA-Edition\unins000.exe"
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Ralink RT7x Wireless LAN Card-->C:\Program Files (x86)\InstallShield Installation Information\{E91E8912-769D-42F0-8408-0E329443BABC}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek Ethernet Controller  Driver-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe"  -removeonly
Realtek USB 2.0 Card Reader-->"C:\Program Files (x86)\InstallShield Installation Information\{96AE7E41-E34E-47D0-AC07-1091A8127911}\setup.exe" -runfromtemp -l0x0007 -removeonly
RESIDENT EVIL 5-->MsiExec.exe /X{AC08BBA0-96B9-431A-A7D0-D8598E493775}
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files (x86)\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x0007 -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Seesmic Desktop-->msiexec /qb /x {264DEAD1-8B60-A560-4130-0AC47215FA45}
Seesmic Desktop-->MsiExec.exe /I{264DEAD1-8B60-A560-4130-0AC47215FA45}
SpeedFan (remove only)-->"C:\Program Files (x86)\SpeedFan\uninstall.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Streamripper Plugin 1.62.1 (Remove only)-->C:\Program Files (x86)\Winamp\streamripper_uninstall.exe
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
TeamSpeak 2 RC2-->"C:\Program Files (x86)\Teamspeak2_RC2\unins000.exe"
Techno4ever Player-->C:\Program Files (x86)\T4E\Player\T4E_Uninstaller.exe
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
UseNeXT-->"C:\Program Files (x86)\UseNeXT\unins000.exe"
VLC media player 1.0.2-->C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe
Winamp-->"C:\Program Files (x86)\Winamp\UninstWA.exe"
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files (x86)\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}
Windows Live Mail-->MsiExec.exe /I{C4D738F7-996A-4C81-B8FA-C4E26D767E41}
Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
zoneLINK SystemUp 2009 Harddisk-->"C:\Program Files (x86)\zoneLINK\SystemUp 2009\Harddisk\unins000.exe"

======Hosts File======

127.0.0.1        localhost
::1        localhost

======Security center information======

AS: Windows Defender
AS: SUPERAntiSpyware (disabled)

======System event log======

Computer Name: 37L4247I05-02
Event Code: 6
Message: Der Dateisystemfilter "FileInfo" (6.0, 2008-01-19T08:05:23.000Z) wurde erfolgreich geladen und im Filter-Manager registriert.
Record Number: 5
Source Name: Microsoft-Windows-FilterManager
Time Written: 20091006200218.202004-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: 37L4247I05-02
Event Code: 263
Message: Der Dienst "ShellHWDetection" war möglicherweise für Geräteereignisbenachrichtigungen nicht deregistriert, bevor er beendet wurde.
Record Number: 4
Source Name: PlugPlayManager
Time Written: 20091006200338.000000-000
Event Type: Warnung
User:

Computer Name: 37L4247I05-02
Event Code: 6005
Message: Der Ereignisprotokolldienst wurde gestartet.
Record Number: 3
Source Name: EventLog
Time Written: 20091006200337.000000-000
Event Type: Informationen
User:

Computer Name: 37L4247I05-02
Event Code: 6009
Message: Microsoft (R) Windows (R) 6.00. 6002 Service Pack 2 Multiprocessor Free.
Record Number: 2
Source Name: EventLog
Time Written: 20091006200337.000000-000
Event Type: Informationen
User:

Computer Name: 37L4247I05-02
Event Code: 6011
Message: Der NetBIOS-Name und der DNS-Hostname dieses Computers wurde von 37L4247I05-02 in WIN-CFRM4KJ6RCG geändert.
Record Number: 1
Source Name: EventLog
Time Written: 20091006200337.000000-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: 37L4247I05-02
Event Code: 1003
Message: Der Windows-Suchdienst wurde gestartet.

Record Number: 5
Source Name: Microsoft-Windows-Search
Time Written: 20091006200341.000000-000
Event Type: Informationen
User:

Computer Name: 37L4247I05-02
Event Code: 5615
Message: Der Windows-Verwaltungsinstrumentationsdienst wurde erfolgreich gestartet.
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20091006200340.000000-000
Event Type: Informationen
User:

Computer Name: 37L4247I05-02
Event Code: 4625
Message: Das EventSystem-Subsystem unterdrückt duplizierte Ereignisprotokolleinträge für eine Dauer von 86400 Sekunden. Dieses Zeitlimit kann durch den REG_DWORD-Wert SuppressDuplicateDuration unter folgendem Registrierungsschlüssel gesteuert werden: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 3
Source Name: Microsoft-Windows-EventSystem
Time Written: 20091006200338.000000-000
Event Type: Informationen
User:

Computer Name: WIN-CFRM4KJ6RCG
Event Code: 1531
Message: Der Benutzerprofildienst wurde erfolgreich gestartet. 


Record Number: 2
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20091006200337.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: WIN-CFRM4KJ6RCG
Event Code: 900
Message: Der Softwarelizenzierungsdienst wird gestartet.

Record Number: 1
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20091006200337.000000-000
Event Type: Informationen

Angel21 13.10.2009 00:22
Öhhh, dann lass Bitdefender laufen, und versuche das Log zu posten.


SASW Log findest du bei Preferences -> Statistik/Logs -> View Logs -> Log aufrufen, kopieren + posten.
Falls du dir nicht sicher bist folge den Schritten in der Superantispyware Anleitung.

Bitte lass Gmer rennen wie in Anleitung beschrieben und poste das Log.

takedown 13.10.2009 00:23
Code:
=====Security event log=====

Computer Name: 37L4247I05-02
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                37L4247I05-02$
        Kontodomäne:                WORKGROUP
        Anmelde-ID:                0x3e7

Anmeldetyp:                        5

Neue Anmeldung:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-ID:                0x3e7
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
        Prozess-ID:                0x250
        Prozessname:                C:\Windows\System32\services.exe

Netzwerkinformationen:
        Arbeitsstationsname:       
        Quellnetzwerkadresse:        -
        Quellport:                -

Detaillierte Authentifizierungsinformationen:
        Anmeldeprozess:                Advapi 
        Authentifizierungspaket:        Negotiate
        Übertragene Dienste:        -
        Paketname (nur NTLM):        -
        Schlüssellänge:                0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
        - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091006200333.581687-000
Event Type: Überwachung erfolgreich
User:

Computer Name: 37L4247I05-02
Event Code: 4648
Message: Anmeldeversuch mit expliziten Anmeldeinformationen.

Antragsteller:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                37L4247I05-02$
        Kontodomäne:                WORKGROUP
        Anmelde-ID:                0x3e7
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Konto, dessen Anmeldeinformationen verwendet wurden:
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Zielserver:
        Zielservername:        localhost
        Weitere Informationen:        localhost

Prozessinformationen:
        Prozess-ID:                0x250
        Prozessname:                C:\Windows\System32\services.exe

Netzwerkinformationen:
        Netzwerkadresse:        -
        Port:                        -

Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden.  Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091006200333.581687-000
Event Type: Überwachung erfolgreich
User:

Computer Name: 37L4247I05-02
Event Code: 4902
Message: Eine Benutzerrichtlinien-Überwachungstabelle wurde erstellt.

        Anzahl von Elementen:        0
        Richtlinienkennung:        0xcf0bc
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091006200330.929670-000
Event Type: Überwachung erfolgreich
User:

Computer Name: 37L4247I05-02
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
        Sicherheits-ID:                S-1-0-0
        Kontoname:                -
        Kontodomäne:                -
        Anmelde-ID:                0x0

Anmeldetyp:                        0

Neue Anmeldung:
        Sicherheits-ID:                S-1-5-18
        Kontoname:                SYSTEM
        Kontodomäne:                NT-AUTORITÄT
        Anmelde-ID:                0x3e7
        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
        Prozess-ID:                0x4
        Prozessname:               

Netzwerkinformationen:
        Arbeitsstationsname:        -
        Quellnetzwerkadresse:        -
        Quellport:                -

Detaillierte Authentifizierungsinformationen:
        Anmeldeprozess:                -
        Authentifizierungspaket:        -
        Übertragene Dienste:        -
        Paketname (nur NTLM):        -
        Schlüssellänge:                0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
        - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091006200330.134065-000
Event Type: Überwachung erfolgreich
User:

Computer Name: 37L4247I05-02
Event Code: 4608
Message: Windows wird gestartet.

Dieses Ereignis wird protokolliert, wenn LSASS.EXE gestartet und das Überwachungssubsystem initialisiert wird.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091006200330.134065-000
Event Type: Überwachung erfolgreich
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files (x86)\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=1707
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\winseqfe\release\Windows6.0\lh_sp2rtm\6002.18005.090410-1830\amd64fre\symbols.pri\TraceFormat
"DFSTRACINGON"=FALSE
"CLASSPATH"=.;C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

takedown 13.10.2009 00:26
Super Antispyware:

Code:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/12/2009 at 10:47 PM

Application Version : 4.29.1002

Core Rules Database Version : 4161
Trace Rules Database Version: 2085

Scan type      : Custom Scan
Total Scan Time : 00:25:20

Memory items scanned      : 831
Memory threats detected  : 0
Registry items scanned    : 5341
Registry threats detected : 0
File items scanned        : 27848
File threats detected    : 11

Adware.Tracking Cookie
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@doubleclick[1].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@atdmt[2].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@atwola[1].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@tto2.traffictrack[1].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@webmasterplan[2].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@zanox[1].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@traffictrack[2].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@doubleclick[2].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@atdmt[1].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@adfarm1.adition[1].txt
        C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\Low\takedown@msnportal.112.2o7[1].txt

Bidefender hat nichts gefunden ...

Angel21 13.10.2009 00:29
Zitat:
SuperSpyware hat 147 Funde aber alle entfernt..hab keine Ahnung wo die Log ist.
Das eine Log mit den 11 Funden sind nur Tracking Cookies, ich hätte gerne noch das andere Log wie oben beschrieben mit den fast 150 Funden.

takedown 13.10.2009 00:38
GMER 1.0.15.15125 - http://www.gmer.net
Rootkit scan 2009-10-13 01:36:42
Windows 6.0.6002 Service Pack 2
Running: hqeme70f.exe


---- Files - GMER 1.0.15 ----

File C:\Users\takedown\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VZDIDB0J\atom[1].txt 984 bytes

---- EOF - GMER 1.0.15 ----


___________

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/12/2009 at 06:41 PM

Application Version : 4.29.1002

Core Rules Database Version : 4161
Trace Rules Database Version: 2085

Scan type : Quick Scan
Total Scan Time : 00:20:12

Memory items scanned : 687
Memory threats detected : 0
Registry items scanned : 392
Registry threats detected : 0
File items scanned : 23424
File threats detected : 147

Adware.Tracking Cookie
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@shop.zanox[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@rm.yieldmanager[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.pornhost[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.teenporntale[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.filthyadserver[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.teeniesmile[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@zedo[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@voyeurteentube[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.googleadservices[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adtech[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.zanox-affiliate[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.xxxmofo[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@babesteenagers[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.thepornxxx[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@porn-plus[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad2.doublepimp[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@server.iad.liveperson[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.yourmomhassex[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@mediaplex[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.garateens[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.homemadefuckers[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@a3.adserver01[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@the-sex[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.mothersextube[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adultadworld[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@eas.apm.emediate[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@interclick[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@galleries.adult-empire[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad.zanox[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@a9.adserver01[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.firstsextube[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@media.brandreachsys[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.abysspornstars[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@sexlist[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@yourmomhassex[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tribalfusion[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@content.yieldmanager[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.fullsexmovies[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@unitymedia[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.teeniepornotube[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@18pornmovies[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@xxx.sxvalue[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.candysteens[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tracking.3gnet[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@doubleclick[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ads.right-ads[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@a2.adserver01[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@apmebf[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tele2de.112.2o7[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@cdn.at.atwola[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@teeniepornotube[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@lucidmedia[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad.adition[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.free-good-porn[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad.yieldmanager[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adbrite[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.traffictrack[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@media.ohost[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@zbox.zanox[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.18pornmovies[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@kontera[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@at.atwola[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@abyssteens[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@toplist[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.pornflvs[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@homemadefuckers[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.allfuckvids[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@clickbank[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@media6degrees[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@smartadserver[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ads.crakmedia[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@rts.pgmediaserve[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@candysteens[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@12finder[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@webmasterplan[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tracking.mindshare[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ads.heias[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@im.banner.t-online[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@statcounter[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@bestmaturepornsite[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adviva[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.adultadvertising[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.etracker[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@streamsexclips[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ero-advertising[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adsrv1.admediate[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@rambler[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@xiti[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@serving-sys[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@traffictrack[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@atdmt[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@counter.surfcounters[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@imrworldwide[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tto2.traffictrack[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.greatteengirl[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@bs.serving-sys[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adprotraffic[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@counter15.sextracker[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@msnportal.112.2o7[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tacoda[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@pornhost[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adultfriendfinder[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@xxxcounter[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tradedoubler[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@server.iad.liveperson[3].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@go.dynamic-tracking[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@sextracker[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.fpctraffic[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@advertising[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@trafficholder[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tracking.quisma[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad.performance-netzwerk[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@teeniesmile[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adfarm1.adition[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@de.sitestat[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad.adnet[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@microsoftwindows.112.2o7[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@zanox[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@de.sitestat[3].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@tsprotraffic[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@content.yieldmanager[3].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@msnonecare.112.2o7[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@atwola[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@zanox-affiliate[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.tiniporn[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@euros4click[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@go.trafficshop[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.usenext[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.candysteens[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@pornteensmovies[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.hardteentube[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@xxxmofo[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@de.sitestat[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.sexodirectory[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ads.stileproject[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@www.pornosmile[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ads.glispa[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ad.trackbar[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@babesteenagers[3].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@ads.easyad[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@specificclick[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@fullsexmovies[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@xm.xtendmedia[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@forum.usenext[1].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adserving.favorit-network[2].txt
C:\Users\takedown\AppData\Roaming\Microsoft\Windows\Cookies\takedown@adsrv.admediate[2].txt
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@2o7[1].txt

Angel21 13.10.2009 00:42
Wir lassen eh noch etliche Scans laufen *gg*
aber erst Morgen - da ich nun ins Bett gehe. Oder möchtest Du für mich schon liebenswerterweise vorarbeiten? :)

takedown 13.10.2009 00:45
Was wäre es denn Ihrer Meinung nach?

Also bzgl. der Vorarbeit? :P

Ansonsten wünsche ich Ihnen eine gute Nacht ;)

Angel21 13.10.2009 00:55
Du kannst mich ruhig duzen ;)

1.) Kaspersky - Onlinescanner

Dieser Scanner entfernt die Funde nicht, gibt aber einen guten Überblick über die vorhandene Malware.

---> hier herunterladen => Kaspersky Online Scanner
=> Hinweise zu älteren Versionen beachten!
=> Voraussetzung: Internet Explorer 6.0 oder höher
=> die nötigen ActiveX-Steuerelemente installieren => Update der Signaturen => Weiter
=> Scan-Einstellungen => Standard wählen => OK => Link "Arbeitsplatz" anklicken
=> Scan beginnt automatisch => Untersuchung wurde abgeschlossen => Protokoll speichern als
=> Dateityp auf .txt umstellen => auf dem Desktop als Kaspersky.txt speichern => Log hier posten
=> Deinstallation => Systemsteuerung => Software => Kaspersky Online Scanner entfernen

2.) Überprüfe den Rechner mit PrevXCSI. Poste ein Screenshot falls etwas gefunden werden sollte oder poste Namen und Pfade.

3.) Panda Active Scan
Folgende Seite führt dich durch die Installation: PandaActiveScan2.0 Installation

Drücke auf Jetzt Scannen!

Eine Registrierung ist nicht erforderlich!

Nachdem der Scan abgeschlossen ist drücke auf das Text-Icon Export und speichere das log auf dem Desktop.
Öffne die Datei ActiveScan.txt die sich nun auf deinem Desktop befindet und poste uns den Inhalt.
Kannst du beruhigt die Nacht oder heute im Verlaufe des Tages abarbeiten. Mach dir kein Stress, lies alles sorgfältig :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:26 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19