Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bekomme den Virus nicht weg, brauche Hilfe. (https://www.trojaner-board.de/86462-bekomme-virus-weg-brauche-hilfe.html)

frERky 26.05.2010 20:26
Bekomme den Virus nicht weg, brauche Hilfe.
 
Hallo alle zusammen,

mich hat eben ein Virus "attackiert" indem er die Firewall ausgeschaltet hat und dann ständig die Meldung gebracht hat ob ein "Virenscan" gestartet werden soll, währenddessen öffnete sich ein falscher Virenscanner. Ich konnte die Firewall nicht wieder aktivieren (Fenster hat sich sofort geschlossen) und den Taskmanager konnte ich auch nicht aufrufen.

Ich habe Windows XP Professional.

Ich habe Malwarebytes Anti-Malware durchgeführt, die infizierten Sachen entfernen lassen und nach einem Neustart Rkill.exe ausgeführt (die ich in iexplore.exe umbenannt habe). Hier ist der Log dazu:

Processes terminated by Rkill or while it was running:


C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe
C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\GEMEIN~1\MICROS~1\DW\DW20.EXE


Rkill completed on 26.05.2010 at 21:18:35.


daraus schließe ich dass ich wohl immer noch was infiziertes aufm rechner habe, was ich mit anti-malware nicht wegbekomme.
kann mir jemand helfen?

danke im voraus für antworten


mfg

frERky

cosinus 27.05.2010 20:08
Hallo und :hallo:

bitte nen Vollscan mit malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

frERky 28.05.2010 15:34
Hi,

hier der Log von Malwarebytes Vollscan:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

28.05.2010 16:26:21
mbam-log-2010-05-28 (16-26-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|)
Durchsuchte Objekte: 478028
Laufzeit: 1 Stunde(n), 50 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> No action taken.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> No action taken.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

frERky 28.05.2010 15:35
hier die beiden logs aus dem OTL-Scan:

Log 1 (extras.txt)


OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 28.05.2010 16:27:37 - Run 1
OTL by OldTimer - Version 3.2.5.0    Folder = I:\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 71,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,66 Gb Total Space | 10,81 Gb Free Space | 11,07% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 4,20 Gb Free Space | 2,15% Space Free | Partition Type: NTFS
Drive E: | 172,79 Gb Total Space | 8,71 Gb Free Space | 5,04% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 465,76 Gb Total Space | 12,23 Gb Free Space | 2,62% Space Free | Partition Type: NTFS
 
Computer Name: FRITTENBUDE
Current User Name: Altan
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3106:UDP" = 3106:UDP:*:Enabled:Windows Media Format SDK (wmplayer.exe)
"3107:UDP" = 3107:UDP:*:Enabled:Windows Media Format SDK (wmplayer.exe)
"3108:UDP" = 3108:UDP:*:Enabled:Windows Media Format SDK (wmplayer.exe)
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Quake 3\quake3.exe" = D:\Quake 3\quake3.exe:*:Enabled:quake3 -- ()
"D:\Enemy Territory\ET.exe" = D:\Enemy Territory\ET.exe:*:Enabled:ET -- ()
"D:\TmNationsForever\TmForever.exe" = D:\TmNationsForever\TmForever.exe:*:Enabled:TmForever -- ()
"D:\Steam\SteamApps\frerky\half-life 2 deathmatch\hl2.exe" = D:\Steam\SteamApps\frerky\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2 -- ()
"C:\Programme\DNA\btdna.exe" = C:\Programme\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.)
"C:\Programme\BitTorrent\bittorrent.exe" = C:\Programme\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"D:\Steam\SteamApps\frerky\team fortress 2\hl2.exe" = D:\Steam\SteamApps\frerky\team fortress 2\hl2.exe:*:Enabled:hl2 -- ()
"D:\Steam\SteamApps\frerky\source sdk base 2007\hl2.exe" = D:\Steam\SteamApps\frerky\source sdk base 2007\hl2.exe:*:Enabled:hl2 -- ()
"D:\Steam\SteamApps\frerky\source sdk base\hl2.exe" = D:\Steam\SteamApps\frerky\source sdk base\hl2.exe:*:Enabled:hl2 -- ()
"D:\Steam\SteamApps\nubilein\counter-strike\hl.exe" = D:\Steam\SteamApps\nubilein\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"D:\Steam\SteamApps\nubilein\half-life\hl.exe" = D:\Steam\SteamApps\nubilein\half-life\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Programme\Canon\Color Network ScanGear\SgTool.exe" = C:\Programme\Canon\Color Network ScanGear\SgTool.exe:*:Enabled:SGTOOL -- (CANON INC.)
"D:\Steam\SteamApps\nubilein\opposing force\hl.exe" = D:\Steam\SteamApps\nubilein\opposing force\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)
"C:\Programme\GIGABYTE\GEST\run.exe" = C:\Programme\GIGABYTE\GEST\run.exe:*:Disabled:update -- ()
"C:\Programme\CryptLoad_1.1.6\RouterClient.exe" = C:\Programme\CryptLoad_1.1.6\RouterClient.exe:*:Enabled:RouterClient -- (hxxp://cryptload.info)
"D:\Anno 1701\Anno1701.exe" = D:\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701 -- (Related Designs Software GmbH)
"D:\Half Life\hl.exe" = D:\Half Life\hl.exe:*:Enabled:Half-Life Launcher -- (Valve, L.L.C.)
"D:\Command & Conquer 3\RetailExe\1.9\cnc3game.dat" = D:\Command & Conquer 3\RetailExe\1.9\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars -- (Electronic Arts Inc.)
"D:\GTA2\gta2.exe" = D:\GTA2\gta2.exe:*:Enabled:GTA2 main executable -- (Rockstar North)
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"D:\Multi Theft Auto\MTAServer.exe" = D:\Multi Theft Auto\MTAServer.exe:*:Enabled:MTAServer -- File not found
"D:\Black & White\runblack.exe" = D:\Black & White\runblack.exe:*:Enabled:lh -- (LionHead Studios Ltd.)
"D:\Steam\SteamApps\common\peggle extreme\PeggleExtreme.exe" = D:\Steam\SteamApps\common\peggle extreme\PeggleExtreme.exe:*:Enabled:Peggle Extreme -- ()
"C:\Programme\Backgammon7\Backgammon-Client.exe" = C:\Programme\Backgammon7\Backgammon-Client.exe:*:Enabled:Backgammon7 -- ( backgammon7.net)
"D:\FlatOut2\FlatOut2.exe" = D:\FlatOut2\FlatOut2.exe:*:Disabled:FlatOut2 -- ()
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\Zattoo\zattood.exe" = C:\Programme\Zattoo\zattood.exe:*:Enabled:zattood -- ()
"C:\Programme\Zattoo\Zattoo2.exe" = C:\Programme\Zattoo\Zattoo2.exe:*:Enabled:  -- ()
"C:\Programme\Joost\xulrunner\tvprunner.exe" = C:\Programme\Joost\xulrunner\tvprunner.exe:*:Enabled:tvprunner -- (Joost Technologies B.V.)
"C:\Programme\PPLive\PPLive.exe" = C:\Programme\PPLive\PPLive.exe:*:Enabled:PPLive -- ()
"D:\Star Wars Jedi Knight Jedi Academy\GameData\jamp.exe" = D:\Star Wars Jedi Knight Jedi Academy\GameData\jamp.exe:*:Enabled:Jedi Academy MultiPlayer -- File not found
"D:\Ghost Recon\GhostRecon.exe" = D:\Ghost Recon\GhostRecon.exe:*:Enabled:GhostRecon -- ()
"D:\Battlefield 2\BF2.exe" = D:\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2 -- ()
"D:\Battlefield Vietnam\bfvietnam.exe" = D:\Battlefield Vietnam\bfvietnam.exe:*:Enabled:bfvietnam -- ()
"D:\Quake 2\quake2xp.exe" = D:\Quake 2\quake2xp.exe:*:Enabled:quake2xp -- (Quake2xp Team)
"D:\Quake 2\quake2.exe" = D:\Quake 2\quake2.exe:*:Enabled:quake2 -- ()
"C:\Programme\Zattoo\Zattoo.exe" = C:\Programme\Zattoo\Zattoo.exe:*:Enabled:  -- ()
"D:\Diablo\diablo.exe" = D:\Diablo\diablo.exe:*:Enabled:Diablo -- (Blizzard Entertainment)
"D:\Aliens Versus Predator\MyAvP.exe" = D:\Aliens Versus Predator\MyAvP.exe:*:Enabled:MyAvP -- ()
"D:\FEAR\FEAR.exe" = D:\FEAR\FEAR.exe:*:Enabled:FEAR -- (Monolith Productions, Inc.)
"C:\Programme\Vuze\Azureus.exe" = C:\Programme\Vuze\Azureus.exe:*:Enabled:Azureus -- (Vuze Inc.)
"D:\Dawn of War\W40k.exe" = D:\Dawn of War\W40k.exe:*:Disabled:W40K -- (Relic Entertainment Inc.)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6.5 -- (ICQ, LLC.)
"D:\FlatOut Ultimate Carnage\Fouc.exe" = D:\FlatOut Ultimate Carnage\Fouc.exe:*:Enabled:FlatOut Ultimate Carnage -- (Empire Interactive Ltd.)
"C:\Programme\TVAnts\Tvants.exe" = C:\Programme\TVAnts\Tvants.exe:*:Enabled:TVAnts -- (Zhejiang University)
"D:\Crysis\Bin32\Crysis.exe" = D:\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32 -- (Crytek GmbH)
"D:\Crysis\Bin32\CrysisDedicatedServer.exe" = D:\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32 -- (Crytek GmbH)
"D:\Grand Theft Auto IV\LaunchGTAIV.exe" = D:\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Sony DADC Austria AG)
"D:\Grand Theft Auto IV\GTAIV.exe" = D:\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Take-Two Interactive Software, Inc.)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"I:\Spiele\Call of Duty 4 - Modern Warfare\iw3mp.exe" = I:\Spiele\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)  -- ()
"D:\Left 4 Dead\left4dead.exe" = D:\Left 4 Dead\left4dead.exe:*:Enabled:left4dead -- ()
"D:\Steam\SteamApps\common\jedi outcast\GameData\jk2sp.exe" = D:\Steam\SteamApps\common\jedi outcast\GameData\jk2sp.exe:*:Enabled:Star Wars Jedi Knight II: Jedi Outcast -- ()
"D:\Steam\SteamApps\common\jedi outcast\GameData\jk2mp.exe" = D:\Steam\SteamApps\common\jedi outcast\GameData\jk2mp.exe:*:Enabled:Star Wars Jedi Knight II: Jedi Outcast -- ()
"D:\Steam\SteamApps\common\jedi academy\GameData\jasp.exe" = D:\Steam\SteamApps\common\jedi academy\GameData\jasp.exe:*:Enabled:Star Wars Jedi Knight: Jedi Academy -- (Activision Inc)
"D:\Steam\SteamApps\common\jedi academy\GameData\jamp.exe" = D:\Steam\SteamApps\common\jedi academy\GameData\jamp.exe:*:Enabled:Star Wars Jedi Knight: Jedi Academy -- (Activision Inc)
"I:\Spiele\Mass Effect 2\Binaries\MassEffect2.exe" = I:\Spiele\Mass Effect 2\Binaries\MassEffect2.exe:*:Enabled:Mass Effect 2 -Spiel -- File not found
"I:\Spiele\Mass Effect 2\MassEffect2Launcher.exe" = I:\Spiele\Mass Effect 2\MassEffect2Launcher.exe:*:Enabled:Mass Effect 2 -Launcher -- (BioWare)
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote -- (Microsoft Corporation)
"I:\Spiele\Mass Effect 2\Binaries\UT3.exe" = I:\Spiele\Mass Effect 2\Binaries\UT3.exe:*:Enabled:Mass Effect 2 -- (BioWare)
"I:\Spiele\Mass Effect 2\Binaries\Mass Effect 2.exe" = I:\Spiele\Mass Effect 2\Binaries\Mass Effect 2.exe:*:Enabled:Mass Effect 2 -- File not found
"D:\Steam\SteamApps\common\torchlight\Torchlight.exe" = D:\Steam\SteamApps\common\torchlight\Torchlight.exe:*:Enabled:Torchlight -- (Runic Games, Inc.)
"D:\Star Wars Battlefront II\GameData\BattlefrontII.exe" = D:\Star Wars Battlefront II\GameData\BattlefrontII.exe:*:Enabled:BattlefrontII -- ()
"I:\Spiele\Ghost Recon Advanced Warfighter\GRAW.exe" = I:\Spiele\Ghost Recon Advanced Warfighter\GRAW.exe:*:Enabled:GRAW -- ()
"C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe" = C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe:*:Enabled:LogMeIn Hamachi -- File not found
"C:\Programme\Hamachialt\hamachi.exe" = C:\Programme\Hamachialt\hamachi.exe:*:Enabled:Hamachi -- File not found
"C:\Programme\Hamachi\hamachi.exe" = C:\Programme\Hamachi\hamachi.exe:*:Enabled:Hamachi -- (LogMeIn Inc.)
"D:\Starcraft\StarCraft.exe" = D:\Starcraft\StarCraft.exe:*:Enabled:Starcraft - Brood War -- (Blizzard Entertainment)
"D:\Age of Empires II\EMPIRES2.ICD" = D:\Age of Empires II\EMPIRES2.ICD:*:Enabled:Age of Empires II -- (Microsoft Corporation)
"D:\Age of Empires II\empires2.exe" = D:\Age of Empires II\empires2.exe:*:Enabled:Age of Empires II -- (Microsoft Corporation)
"I:\Spiele\EFLC\EFLC.exe" = I:\Spiele\EFLC\EFLC.exe:*:Disabled:Grand Theft Auto : Episodes from Liberty City -- (Take-Two Interactive Software, Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{02091327-B124-4216-9D71-58C0E24F5392}" = Nokia PC Suite
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{04F3BF74-9E34-4D3E-93C3-D3D1F24199C8}" = PC Connectivity Solution
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{0B25271C-C90B-056F-B4B1-84DFCC905497}" = ATI Catalyst Install Manager
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP220_series" = Canon MP220 series
"{141C141A-0DB8-E6E5-59AA-27576C20B75D}" = CCC Help English
"{1648DB98-AE62-6E92-F418-8A9ECCA078A9}" = Catalyst Control Center Graphics Previews Common
"{17200570-C3A0-DAAB-8232-491FEC0C1DF4}" = Catalyst Control Center Graphics Full Existing
"{17E83691-BC8E-BA2A-DE9B-AE845E1C2457}" = Catalyst Control Center Graphics Light
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A36CF15-DF66-4756-9482-A9ABF3DDACE6}_is1" = Driver Robot
"{1BC4026B-1957-4514-9058-2B542557F143}" = Opera 9.63
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{296D8550-CB06-48E4-9A8B-E5034FB64715}" = Command & Conquer™ Red Alert™ 3
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{2B21DEAC-4EB7-4516-8E0C-F1F3A29FF2AE}" = Gothic III - Götterdämmerung Patch
"{2B653229-9854-4989-B780-D978F5F13EAB}" = FEAR
"{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}" = Microsoft Games for Windows - LIVE Redistributable
"{33691AFF-9ABF-4278-BDB6-902EE07D9237}" = Native Instruments Guitar Rig 3
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{39930321-4C58-4B8B-BCBF-342698C9801D}" = Max Payne
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{3BFFC6B8-4EC0-4240-858C-998FD4077983}" = Nokia Connectivity Cable Driver
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{3D74A25E-F4A1-DD65-3327-FEE3C85A2565}" = Catalyst Control Center HydraVision Full
"{4538055F-EBC6-4E67-9365-F55B1DEFE9DE}" = Gothic 3 - Götterdämmerung
"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4B35F00C-E63D-40DC-9839-DF15A33EAC46}" = Grand Theft Auto Vice City
"{4E074808-1B86-4230-A9EB-0904942EC4AE}" = LEGO Star Wars II
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}" = Adobe Audition 3.0
"{5454083B-1308-4485-BF17-111000028701}" = Grand Theft Auto: Episodes from Liberty City
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{576E71DA-3000-48F6-9B21-B9A70D47DFCF}" = Star Wars JK II Jedi Outcast
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{5869CE1E-BC0B-4648-B1AE-6EF4A985590C}" = Dynamic Energy Saver B7.1214.3
"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{605BE2E8-D0D4-C157-68FD-40A318258E54}" = ccc-core-preinstall
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}" = Grand Theft Auto: Episodes From Liberty City
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{696DB748-73BB-405D-9567-79B5FCAEB691}" = PowerArchiver 2010 German
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{71E8DEC6-8785-B293-FA6D-7A37A3D3E773}" = ccc-core-static
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7EACD74C-147F-478C-9389-F9F52EE3C88A}" = LightScribe System Software
"{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1" = Hex-Editor MX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{88713CAC-8759-6FE4-D577-A823E5865CB9}" = ccc-utility
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = DIE SIEDLER - Das Erbe der Könige
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{92BD0C6C-B380-4D21-890A-6198D48D06C6}_is1" = Easy RM Producer
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A200E68-D5F4-4E70-910F-2871753A0E2B}" = Worms World Party
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A10D9B03-AABB-47D7-8A30-2FEA97E70BC7}" = Quake Live Mozilla Plugin
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93FE10A-42C3-B498-2856-2BBE22481A7A}" = Catalyst Control Center Graphics Full New
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{AF507761-0AD4-4BCC-A636-42DB38E689B0}" = Sven 2 XXL
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2BAD2AF-A391-4306-96A3-BA1139630D84}" = Catalyst Control Center InstallProxy
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B713000F-FBE3-11D3-9D91-0050DA5C3DCF}" = YAMAHA XG SoftSynthesizer S-YXG50
"{B8B0FC8B-E69B-4215-AF1A-4BDFF20D794B}" = pdfforge Toolbar v1.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB81360F-041C-4CF7-B15E-71380D154244}" = Adobe Setup
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C457BA5F-35F9-480C-90F8-5C91DB443A15}_is1" = Shutdown Manager
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{C79308BC-63CC-4A0F-A585-2E137EA42A1E}_is1" = Power MP4 iPod PSP 3GP AVI MPG WMV Video Converter 8.7
"{C884B05A-F5D9-4AE4-9D84-E6BD9F6E7890}" = FlatOut2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFEBE886-3EF2-4389-96D0-B0808E58BC3E}" = HipHop 6 Demo
"{D07643A3-CE41-4286-8C78-EB9C83E76DDB}" = PunkBuster für Battlefield Vietnam
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1ADE2BF-32D3-4EC3-9BF4-F5E1A740F92E}" = Color Network ScanGear Ver.2.42
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D4EEC21C-04F0-4CF4-8078-82C11E38EF11}" = REALTEK RTL8187SE Wireless LAN Driver
"{D596980D-17BE-4425-B8F0-5640719AADE9}" = LEGO® Star Wars™: The Complete Saga
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D89EF3B3-6F17-4665-B7A9-A4235A6DC787}" = Ghost Recon
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E280923D-C5D9-4728-8C79-AC9A0DC75875}" = BioShock
"{E35B3C63-E958-4E31-A178-95D22024109A}" = Battlefield Vietnam(TM)
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E51B4CD9-A0A6-4324-B26A-31B3F2DE26CE}" = Black and White
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EFC97089-04D6-42CE-A707-A343B4A7D2CD}" = Ghost Recon Advanced Warfighter
"{EFE1AB94-5466-4B6E-BE31-FF4C115FD25D}" = Max Payne 2
"{F029DBBC-FBBD-20CD-7038-6A703578EC79}" = Catalyst Control Center Core Implementation
"{F112F66E-25CA-42DD-983C-6118EB38F606}" = Microsoft Games for Windows - LIVE
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F138762F-5A1F-4CF0-A5E1-1588EF6088A4}" = The Witcher Enhanced Edition
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}" = Cisco Systems VPN Client 5.0.05.0290
"{F428768A-BA63-43A5-86E9-7F0CFD174944}" = Command & Conquer 3 Tiberium Wars(TM) Worldbuilder
"0852D05415AB9A4F1EF451E342267F76C776ED2F" = Windows Driver Package - Nokia Modem  (11/03/2006 6.82.0.1)
"4CFD94C379217A02D5EA067615FF789CD731BCDB" = Windows Driver Package - Nokia (WUDFRd) WPD  (11/03/2006 6.82.26.2)
"8461-7759-5462-8226" = Vuze
"Adobe Audition 3.0" = Adobe Audition 3.0
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_32fdd767b4383606e8168e834af5d90" = Adobe Premiere Pro CS3
"Age of Empires 2.0" = Microsoft Age of Empires II
"Aglare WMV to AVI Converter_is1" = Aglare WMV to AVI Converter 6.3
"Aliens Versus Predator" = Aliens Versus Predator
"Aplus WMV to XviD Converter_is1" = Aplus WMV to XviD Converter 8.89
"Ashampoo Cover Studio 2_is1" = Ashampoo Cover Studio 2.00
"ATI Display Driver" = ATI Display Driver
"Audacity_is1" = Audacity 1.2.6
"AudioRecorder" = AudioRecorder
"Autorun Eater_is1" = Autorun Eater v2.2
"AVIedit 3.38" = AVIedit 3.38
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AviSynth" = AviSynth 2.5
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"Babylon" = Babylon
"Battle.net" = Battle.net
"Battlecraft Vietnam1.0 BETA" = Battlecraft Vietnam
"BF2SP64" = BF2SP64
"BidForPower" = BidForPower
"Cake Poker" = Cake Poker
"Cakewalk Beatscape_is1" = Beatscape 1.0
"Canon MP220 series Benutzerregistrierung" = Canon MP220 series Benutzerregistrierung
"CANONBJ_Deinstall_CNMCP64.DLL" = Canon PIXMA iP4000
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CloneCD" = CloneCD
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Diablo" = Diablo
"DivX Setup.divx.com" = DivX-Setup
"DreamStation DXi2" = DreamStation DXi2
"DVD Shrink_is1" = DVD Shrink 3.2
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FlatOut Ultimate Carnage" = FlatOut Ultimate Carnage
"FLV Player" = FLV Player 2.0 (build 25)
"foobar2000" = foobar2000 v0.9.5.4
"FormatFactory" = FormatFactory 1.80
"Free Convert XVID AVI WMV MPEG FLV MP4 Converter_is1" = Free Convert XVID AVI WMV MPEG FLV MP4 Converter 5.8
"Free FLV Converter_is1" = Free FLV Converter V 5.9
"Grand Theft Auto" = Grand Theft Auto
"Grand Theft Auto London 1961" = Grand Theft Auto London 1961
"Guitar Pro 5_is1" = Guitar Pro 5.2
"Hamachi" = Hamachi 1.0.1.5
"Instagib - Source 1.0b" = Instagib - Source 1.0b
"InstallShield_{4E074808-1B86-4230-A9EB-0904942EC4AE}" = LEGO Star Wars II
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{D596980D-17BE-4425-B8F0-5640719AADE9}" = LEGO® Star Wars™: Die Komplette Saga
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"IrfanView" = IrfanView (remove only)
"Jalbum_0" = Jalbum 8.0
"JDownloader" = JDownloader
"Joost" = Joost (tm) Beta 1.1.8
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.0.0 (Full)
"Left 4 Dead" = Left 4 Dead
"Little Fighter 2" = Little Fighter 2 version 2.0
"MAGIX music maker 2005 e-version" = MAGIX music maker 2005 e-version
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MDT" = Battlefield Mod Development Toolkit 2.0 Beta
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MIDInight Express II" = MIDInight Express II
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"MP3 Converter Simple" = MP3 Converter Simple
"Native Instruments Guitar Rig 3" = Native Instruments Guitar Rig 3
"Native Instruments Service Center" = Native Instruments Service Center
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"OpenAL" = OpenAL
"PDF Editor 3" = PDF Editor 3
"Peer2Peer-DE Toolbar" = Peer2Peer-DE Toolbar
"Peggle" = Peggle (remove only)
"Peggle World of Warcraft Edition" = Peggle World of Warcraft Edition
"POD-Bot 2.5" = POD-Bot 2.5
"Postal 2" = Postal 2
"PPLive" = PPLive 1.9
"PunkBusterSvc" = PunkBuster Services
"Quake2UninstallKey" = Quake II
"Quake2xp" = Quake2xp 1.25 Point Release 7
"RealPlayer 12.0" = RealPlayer
"Red Alert" = Red Alert Windows 95
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"Runic Games Torchlight" = Torchlight
"San Andreas Mod Installer1.1" = San Andreas Mod Installer
"Screen Antics" = Screen Antics 2.1
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"ShrinkTo5Basic" = ShrinkTo5Basic
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"SONAR8Producer_is1" = SONAR 8.0 Producer Edition
"Star Wars: The Force Unleashed_is1" = Star Wars: The Force Unleashed
"Starcraft" = Starcraft
"Steam App 10" = Counter-Strike
"Steam App 130" = Half-Life: Blue Shift
"Steam App 20" = Team Fortress Classic
"Steam App 218" = Source SDK Base - Orange Box
"Steam App 220" = Half-Life 2
"Steam App 30" = Day of Defeat
"Steam App 320" = Half-Life 2: Deathmatch
"Steam App 32380" = Star Wars Jedi Knight: Dark Forces II
"Steam App 32390" = Star Wars Jedi Knight: Mysteries of the Sith
"Steam App 32400" = Star Wars: Dark Forces
"Steam App 340" = Half-Life 2: Lost Coast
"Steam App 3483" = Peggle Extreme
"Steam App 380" = Half-Life 2: Episode One
"Steam App 40" = Deathmatch Classic
"Steam App 400" = Portal
"Steam App 41500" = Torchlight
"Steam App 420" = Half-Life 2: Episode Two
"Steam App 440" = Team Fortress 2
"Steam App 50" = Opposing Force
"Steam App 6020" = Star Wars Jedi Knight: Jedi Academy
"Steam App 6030" = Star Wars Jedi Knight II: Jedi Outcast
"Steam App 70" = Half-Life
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"SurCode for Dolby Digital" = SurCode for Dolby Digital
"TotalBF2 Map Pack 3" = TotalBF2 Map Pack 3
"TVAnts 1.0" = TVAnts 1.0
"Ultra WMV Converter_is1" = Ultra WMV Converter 5.2.1022
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.0.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Zattoo" = Zattoo 3.3.4 Beta
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Backgammon7" = Backgammon7
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"Facebook Plug-In" = Facebook Plug-In
"Pirate Galaxy" = Pirate Galaxy
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 26.05.2010 15:18:19 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 26.05.2010 15:18:31 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 27.05.2010 02:46:23 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 27.05.2010 02:46:37 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 27.05.2010 07:37:21 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 27.05.2010 07:37:29 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 27.05.2010 20:53:50 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 27.05.2010 20:53:54 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 28.05.2010 08:32:27 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
Error - 28.05.2010 08:32:45 | Computer Name = FRITTENBUDE | Source = .NET Runtime 2.0 Error Reporting | ID = 1000
Description = Faulting application ccc.exe, version 2.0.0.0, stamp 49ef8e09, faulting
 module kernel32.dll, version 5.1.2600.5512, stamp 4802bfc0, debug? 0, fault address
 0x00012aeb.
 
[ System Events ]
Error - 27.05.2010 07:37:13 | Computer Name = FRITTENBUDE | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Bluetooth
 Support Service.
 
Error - 27.05.2010 07:37:13 | Computer Name = FRITTENBUDE | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Bluetooth Support Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 27.05.2010 20:49:54 | Computer Name = FRITTENBUDE | Source = Ftdisk | ID = 262189
Description = Das System konnte den Treiber für das Speicherabbild nicht laden.
 
Error - 27.05.2010 20:49:54 | Computer Name = FRITTENBUDE | Source = Ftdisk | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher
 abbilden zu können.
 
Error - 27.05.2010 20:51:03 | Computer Name = FRITTENBUDE | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Bluetooth
 Support Service.
 
Error - 27.05.2010 20:51:03 | Computer Name = FRITTENBUDE | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Bluetooth Support Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 28.05.2010 08:29:31 | Computer Name = FRITTENBUDE | Source = Ftdisk | ID = 262189
Description = Das System konnte den Treiber für das Speicherabbild nicht laden.
 
Error - 28.05.2010 08:29:31 | Computer Name = FRITTENBUDE | Source = Ftdisk | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
 fehlgeschlagen. Stellen  Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
 vorhanden ist und dass diese  groß genug ist, um den gesamten physikalischen Speicher
 abbilden zu können.
 
Error - 28.05.2010 08:30:40 | Computer Name = FRITTENBUDE | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Bluetooth
 Support Service.
 
Error - 28.05.2010 08:30:40 | Computer Name = FRITTENBUDE | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Bluetooth Support Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
 
< End of report >
--- --- ---

frERky 28.05.2010 15:35
Log 2 (OTL.txt)


OTL Logfile:
Code:
OTL logfile created on: 28.05.2010 16:27:37 - Run 1
OTL by OldTimer - Version 3.2.5.0    Folder = I:\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 71,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,66 Gb Total Space | 10,81 Gb Free Space | 11,07% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 4,20 Gb Free Space | 2,15% Space Free | Partition Type: NTFS
Drive E: | 172,79 Gb Total Space | 8,71 Gb Free Space | 5,04% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 465,76 Gb Total Space | 12,23 Gb Free Space | 2,62% Space Free | Partition Type: NTFS
 
Computer Name: FRITTENBUDE
Current User Name: Altan
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - I:\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\system32\drivers\sysam.exe ()
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\foobar2000\foobar2000.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\GIGABYTE\GEST\gest.exe ()
PRC - C:\Programme\GIGABYTE\GEST\GSvr.exe ()
PRC - C:\Programme\NETGEAR\WG111v3\WG111v3.exe ()
PRC - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\Programme\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
PRC - C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
PRC - C:\WINDOWS\system32\Sxgtkbar.exe (YAMAHA COROPRATION)
PRC - C:\refreshlock\RefreshLock.exe (Gregory Maynard-Hoare)
 
 
========== Modules (SafeList) ==========
 
MOD - I:\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Programme\ScanSoft\OmniPageSE4\OpHookSE4.dll (Nuance Communications, Inc.)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Systemsonsw) -- C:\WINDOWS\system32\drivers\sysam.exe ()
SRV - (Adobe LM Service) -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (LightScribeService) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (InstallShield Licensing Service) -- C:\Programme\Gemeinsame Dateien\InstallShield Shared\Service\InstallShield Licensing Service.exe (Macrovision                                                    )
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (GEST Service) -- C:\Programme\GIGABYTE\GEST\GSvr.exe ()
SRV - (StarWindServiceAE) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (gdrv) -- C:\WINDOWS\gdrv.sys (Windows (R) 2000 DDK provider)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (VClone) -- C:\WINDOWS\system32\drivers\VClone.sys (Elaborate Bytes AG)
DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (61883) -- C:\WINDOWS\system32\drivers\61883.sys (Microsoft Corporation)
DRV - (Avc) -- C:\WINDOWS\system32\drivers\avc.sys (Microsoft Corporation)
DRV - (MSDV) -- C:\WINDOWS\system32\drivers\msdv.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
DRV - (ET5Drv) -- C:\WINDOWS\system32\drivers\ET5Drv.sys (Windows (R) 2000 DDK provider)
DRV - (JRAID) -- C:\WINDOWS\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTL8187B) -- C:\WINDOWS\system32\drivers\wg111v3.sys (Realtek Semiconductor Corporation                          )
DRV - (ElbyCDFL) -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (Nokia USB Phone Parent) -- C:\WINDOWS\system32\drivers\nmwcd.sys (Nokia)
DRV - (Nokia USB Port) -- C:\WINDOWS\system32\drivers\nmwcdcj.sys (Nokia)
DRV - (Nokia USB Modem) -- C:\WINDOWS\system32\drivers\nmwcdcm.sys (Nokia)
DRV - (Nokia USB Generic) -- C:\WINDOWS\system32\drivers\nmwcdc.sys (Nokia)
DRV - (gtermddo) -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\gtermddo.sys ()
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ASPI) -- C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (SOFTXG) -- C:\WINDOWS\system32\drivers\sxgxgwdm.sys (YAMAHA CORPORATION)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://video.tomp4.com
IE - HKCU\..\URLSearchHook: {97ac393a-a525-4cd0-95cf-019b028cc7a4} - C:\Programme\Peer2Peer-DE\tbPee0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsof1.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\pdfforge Toolbar\SearchSettings.dll File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Ant.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {8b86149f-01fb-4842-9dd8-4d7eb02fd055}:0.21.1
FF - prefs.js..extensions.enabledItems: anttoolbar@ant.com:2.0.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.28 15:40:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.04.30 15:46:50 | 000,000,000 | ---D | M]
 
[2008.11.21 13:20:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Extensions
[2010.05.28 14:42:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions
[2010.04.13 23:53:13 | 000,000,000 | ---D | M] (All-in-One Gestures) -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\{8b86149f-01fb-4842-9dd8-4d7eb02fd055}
[2010.02.01 00:05:06 | 000,000,000 | ---D | M] (softonic-de3 Toolbar) -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2010.03.20 04:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\anttoolbar@ant.com
[2009.07.25 17:15:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\dlembed@aeruder.net
[2009.07.03 15:54:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\myspacetoolbar@gmail.com
[2009.10.25 13:33:18 | 000,000,886 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\searchplugins\conduit.xml
[2009.01.12 17:45:05 | 000,001,740 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\searchplugins\leo-deu-spa.xml
[2010.05.28 14:42:49 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.06 13:06:16 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009.04.09 13:25:11 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Programme\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2009.04.09 13:25:11 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\search@searchsettings.com
[2008.09.04 02:11:24 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npbittorrent.dll
[2008.07.16 15:42:38 | 000,066,208 | ---- | M] (Joost Technologies B.V. ) -- C:\Programme\Mozilla Firefox\plugins\npJoostPlugin.dll
[2009.08.17 23:40:27 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.08.17 23:40:27 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.08.17 23:40:27 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.09.10 17:30:53 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.08.17 23:40:27 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.05.27 08:46:26 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Shareware.Pro-DE Toolbar) - {97ac393a-a525-4cd0-95cf-019b028cc7a4} - C:\Programme\Peer2Peer-DE\tbPee0.dll (Conduit Ltd.)
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\WidgiToolbarIE.dll (GreenTree Applications, Inc.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsof1.dll (Conduit Ltd.)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\pdfforge Toolbar\SearchSettings.dll File not found
O3 - HKLM\..\Toolbar: (Shareware.Pro-DE Toolbar) - {97ac393a-a525-4cd0-95cf-019b028cc7a4} - C:\Programme\Peer2Peer-DE\tbPee0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\WidgiToolbarIE.dll (GreenTree Applications, Inc.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsof1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Shareware.Pro-DE Toolbar) - {97AC393A-A525-4CD0-95CF-019B028CC7A4} - C:\Programme\Peer2Peer-DE\tbPee0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Shareware.Pro-DE Toolbar) - {97AC393A-A525-4CD0-95CF-019B028CC7A4} - C:\Programme\Peer2Peer-DE\tbPee0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsof1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe (Gigabyte Technology Corp.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Babylon Client] C:\Programme\Babylon\Babylon-Pro\Babylon.exe (Babylon Ltd.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CloneCDTray] C:\Programme\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [GEST] C:\Programme\GIGABYTE\GEST\run.exe ()
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [OpwareSE4] C:\Programme\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
O4 - HKLM..\Run: [pjtcjxmo] C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Programme\pdfforge Toolbar\SearchSettings.exe (GreenTree Applications, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SxgTkBar] C:\WINDOWS\System32\Sxgtkbar.exe (YAMAHA COROPRATION)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VirtualCloneDrive] C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Programme\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Programme\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [pjtcjxmo] C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NETGEAR WG111v3 Smart Wizard.lnk = C:\Programme\NETGEAR\WG111v3\WG111v3.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}\Icon3E5562ED7.ico ()
O4 - Startup: C:\Dokumente und Einstellungen\Altan\Startmenü\Programme\Autostart\Verknüpfung mit RefreshLock.lnk = C:\refreshlock\RefreshLock.exe (Gregory Maynard-Hoare)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: khfy2n = C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Translate this web page with Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programme\PPLive\PPLive.exe ()
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programme\PPLive\PPLive.exe ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.220.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.11.21 13:06:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009.06.12 12:53:44 | 000,000,100 | ---- | M] () - E:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{20ce8f86-40d0-11df-b446-001e2a3e3b9e}\Shell - "" = AutoRun
O33 - MountPoints2\{20ce8f86-40d0-11df-b446-001e2a3e3b9e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{20ce8f86-40d0-11df-b446-001e2a3e3b9e}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found
O33 - MountPoints2\J\Shell - "" = AutoRun
O33 - MountPoints2\J\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.26 21:34:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2010.05.26 19:10:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc
[2010.05.25 12:24:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Citrix
[2010.05.25 12:17:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010.05.25 12:16:13 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Deterministic Networks
[2010.05.25 12:15:50 | 000,000,000 | ---D | C] -- C:\Programme\Cisco Systems
[2010.05.13 12:05:15 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecuROM
[2010.05.07 12:34:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ATI
[2010.05.06 13:08:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\skypePM
[2010.05.06 13:06:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Skype
[2010.05.06 13:06:05 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype
[2010.05.06 13:06:03 | 000,000,000 | R--D | C] -- C:\Programme\Skype
[2010.05.06 13:06:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype
[2010.04.30 15:46:32 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\DivX Shared
[2010.04.30 15:19:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
[2010.04.30 14:08:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.04.30 14:05:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\Google
[2010.04.30 14:03:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.04.30 14:03:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\Temp
[2010.04.30 14:03:18 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.04.30 14:03:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\Google
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.28 16:08:03 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.05.28 14:32:13 | 000,016,608 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys
[2010.05.28 14:32:13 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2010.05.28 14:31:55 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.05.28 14:29:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.28 14:29:18 | 000,060,452 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010.05.28 14:29:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.28 03:29:16 | 012,845,056 | -H-- | M] () -- C:\Dokumente und Einstellungen\Altan\NTUSER.DAT
[2010.05.28 03:29:16 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Altan\ntuser.ini
[2010.05.26 23:18:28 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.05.26 21:05:35 | 000,000,561 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Desktop\Verknüpfung mit iExplore.exe.lnk
[2010.05.26 19:31:25 | 000,242,688 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.26 19:19:27 | 2145,386,496 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2010.05.26 19:14:42 | 000,030,000 | ---- | M] () -- C:\WINDOWS\System32\gp1703a8ux.dll
[2010.05.26 19:10:55 | 000,116,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\sysam.exe
[2010.05.26 19:10:44 | 000,116,736 | ---- | M] () -- C:\WINDOWS\System32\drivers\sysam.exe388
[2010.05.25 12:24:10 | 000,000,081 | ---- | M] () -- C:\CTX.DAT
[2010.05.25 12:17:03 | 000,001,594 | ---- | M] () -- C:\WINDOWS\VPNInstall.MIF
[2010.05.25 03:28:53 | 002,644,972 | -H-- | M] () -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.05.23 13:59:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.18 15:29:53 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2010.05.15 17:17:19 | 000,000,025 | ---- | M] () -- C:\WINDOWS\System32\sysogg.dll
[2010.05.13 12:09:29 | 000,000,530 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Desktop\Episodes from Liberty City.lnk
[2010.05.08 14:47:48 | 000,000,051 | ---- | M] () -- C:\WINDOWS\AoE2T.ini
[2010.05.07 16:32:57 | 000,076,848 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.05.07 16:32:52 | 001,578,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.05.07 16:26:15 | 000,000,579 | ---- | M] () -- C:\Dokumente und Einstellungen\Altan\Desktop\Age of Empires II.lnk
[2010.05.06 13:08:42 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.05.04 18:12:10 | 000,000,460 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Steam.lnk
[2010.04.29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.05.26 19:14:42 | 000,030,000 | ---- | C] () -- C:\WINDOWS\System32\gp1703a8ux.dll
[2010.05.26 19:10:44 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\sysam.exe388
[2010.05.26 19:10:44 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\sysam.exe
[2010.05.25 12:24:10 | 000,000,081 | ---- | C] () -- C:\CTX.DAT
[2010.05.25 12:16:14 | 000,002,423 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2010.05.25 12:16:03 | 000,001,594 | ---- | C] () -- C:\WINDOWS\VPNInstall.MIF
[2010.05.13 12:09:29 | 000,000,530 | ---- | C] () -- C:\Dokumente und Einstellungen\Altan\Desktop\Episodes from Liberty City.lnk
[2010.05.08 14:47:48 | 000,000,051 | ---- | C] () -- C:\WINDOWS\AoE2T.ini
[2010.05.07 16:26:15 | 000,000,579 | ---- | C] () -- C:\Dokumente und Einstellungen\Altan\Desktop\Age of Empires II.lnk
[2010.05.07 13:22:26 | 000,011,892 | ---- | C] () -- C:\Dokumente und Einstellungen\Altan\hs_err_pid1348.log
[2010.05.06 13:08:42 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.05.06 13:06:06 | 000,002,243 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2010.04.30 14:03:28 | 000,001,086 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.04.30 14:03:26 | 000,001,082 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.04.28 23:03:25 | 000,000,561 | ---- | C] () -- C:\Dokumente und Einstellungen\Altan\Desktop\Verknüpfung mit iExplore.exe.lnk
[2010.04.22 12:31:39 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009.12.06 01:38:46 | 000,000,297 | ---- | C] () -- C:\WINDOWS\game.ini
[2009.10.28 15:27:23 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL
[2009.09.10 18:14:01 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2009.08.07 19:51:34 | 000,178,430 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009.07.18 00:47:41 | 000,000,261 | ---- | C] () -- C:\WINDOWS\mp3merger.ini
[2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2009.06.01 20:03:41 | 000,066,936 | -HS- | C] () -- C:\WINDOWS\dlinfo_0.drv
[2009.05.19 15:59:33 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI
[2009.04.17 18:09:37 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\cp.dll
[2009.04.09 13:24:44 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2009.04.06 17:27:42 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009.04.06 17:27:36 | 000,051,712 | ---- | C] () -- C:\WINDOWS\System32\coodest.dll
[2009.04.06 17:24:59 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.04.06 17:24:58 | 000,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009.04.06 17:24:57 | 000,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.03.06 23:39:12 | 000,000,025 | ---- | C] () -- C:\WINDOWS\System32\sysogg.dll
[2009.03.06 23:36:45 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2009.02.21 14:19:13 | 000,000,326 | ---- | C] () -- C:\WINDOWS\musicmaker.INI
[2009.02.21 14:17:53 | 000,001,208 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2009.02.11 14:45:20 | 000,000,157 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009.02.11 14:39:31 | 000,182,272 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2009.02.03 23:59:47 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2009.01.29 15:39:44 | 000,000,035 | ---- | C] () -- C:\WINDOWS\WorldBuilder.INI
[2009.01.13 11:29:00 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2009.01.13 11:28:44 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2008.12.25 19:10:03 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2008.12.25 19:10:02 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2008.12.10 00:14:50 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\wavpackdll.dll
[2008.12.09 23:53:52 | 000,040,960 | ---- | C] () -- C:\WINDOWS\Reyalp99.dll
[2008.11.30 14:24:33 | 000,000,404 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2008.11.27 12:59:30 | 000,138,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008.11.21 23:09:17 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008.11.21 17:41:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008.11.21 14:54:19 | 000,000,327 | ---- | C] () -- C:\WINDOWS\RefreshLock.ini
[2008.09.19 23:57:34 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.09.19 23:55:10 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2005.12.07 11:31:00 | 000,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[1997.06.14 10:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:33C186F8355D3259
< End of report >
--- --- ---


danke

cosinus 28.05.2010 15:41
Zitat:
Datenbank Version: 4052
Du hast Malwarebytes vorher nicht aktualisiert. Bitte die Datenbanken updaten und den Vollscan wiederholen.

frERky 28.05.2010 19:00
hier die neue logdatei:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4151

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

28.05.2010 19:59:56
mbam-log-2010-05-28 (19-59-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|)
Durchsuchte Objekte: 482635
Laufzeit: 1 Stunde(n), 39 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjtcjxmo (Rogue.SpywareGuard2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pjtcjxmo (Rogue.SpywareGuard2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\khfy2n (Spyware.OnlineGames) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe (Rogue.SpywareGuard2008) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\ccl9ke.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gp1703a8ux.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\wgvyd.exe (Rogue.SpywareGuard2008) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\r2g4n.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\ntl7eedg.exe (Trojan.Agent) -> Quarantined and deleted successfully.

cosinus 28.05.2010 19:12
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
PRC - C:\WINDOWS\system32\drivers\sysam.exe ()
SRV - (Systemsonsw) -- C:\WINDOWS\system32\drivers\sysam.exe ()
DRV - (gtermddo) -- C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\gtermddo.sys ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
O4 - HKLM..\Run: [pjtcjxmo] C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Programme\pdfforge Toolbar\SearchSettings.exe (GreenTree Applications, Inc.)
O4 - HKCU..\Run: [pjtcjxmo] C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: khfy2n = C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
@Alternate Data Stream - 24 bytes -> C:\WINDOWS:33C186F8355D3259
:Files
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\gtermddo.sys
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc
C:\WINDOWS\System32\sysogg.dll
C:\WINDOWS\System32\gp1703a8ux.dll
C:\WINDOWS\System32\drivers\sysam.exe388
C:\WINDOWS\System32\drivers\sysam.exe
C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

frERky 28.05.2010 19:24
All processes killed
========== OTL ==========
No active process named sysam.exe was found!
Service Systemsonsw stopped successfully!
Service Systemsonsw deleted successfully!
C:\WINDOWS\system32\drivers\sysam.exe moved successfully.
Service gtermddo stopped successfully!
Service gtermddo deleted successfully!
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\gtermddo.sys moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\pjtcjxmo not found.
File C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully.
C:\Programme\pdfforge Toolbar\SearchSettings.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\pjtcjxmo not found.
File C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc\upwbhgwtssd.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\khfy2n not found.
File C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
ADS C:\WINDOWS:33C186F8355D3259 deleted successfully.
========== FILES ==========
File\Folder C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Temp\gtermddo.sys not found.
C:\Dokumente und Einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\vtodhfbqc folder moved successfully.
C:\WINDOWS\System32\sysogg.dll moved successfully.
File\Folder C:\WINDOWS\System32\gp1703a8ux.dll not found.
C:\WINDOWS\System32\drivers\sysam.exe388 moved successfully.
File\Folder C:\WINDOWS\System32\drivers\sysam.exe not found.
File\Folder C:\DOKUME~1\Altan\LOKALE~1\Temp\ccl9ke.exe not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Altan
->Temp folder emptied: 2976404098 bytes
->Temporary Internet Files folder emptied: 40286378 bytes
->Java cache emptied: 87349019 bytes
->FireFox cache emptied: 99183889 bytes
->Opera cache emptied: 40211833 bytes
->Flash cache emptied: 1859995 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 985368 bytes
->Flash cache emptied: 348 bytes

User: wurst
->Temp folder emptied: 686195 bytes
->Temporary Internet Files folder emptied: 959656 bytes
->FireFox cache emptied: 75856047 bytes
->Opera cache emptied: 35553203 bytes
->Flash cache emptied: 6064 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 4949133 bytes
%systemroot%\System32 .tmp files removed: 3148679 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 42049370 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3.252,00 mb


OTL by OldTimer - Version 3.2.5.0 log created on 05282010_201831

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 28.05.2010 19:30
Gut. Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

frERky 28.05.2010 20:25
Combofix Logfile:
Code:
ComboFix 10-05-28.01 - Altan 28.05.2010  21:07:30.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3582.2973 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Altan\Desktop\cofi.exe.exe
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Images
c:\images\Der.Pate.II.GERMAN-0x0007\GODFATHER2.iso
C:\install.exe
c:\windows\system32\AVSredirect.dll
E:\Autorun.inf

Infizierte Kopie von c:\windows\system32\drivers\rdpcdd.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS
-------\Legacy_SVCHOST


(((((((((((((((((((((((  Dateien erstellt von 2010-04-28 bis 2010-05-28  ))))))))))))))))))))))))))))))
.

2010-05-26 19:29 . 2010-05-26 19:29        --------        d-s---w-        c:\dokumente und einstellungen\NetworkService\UserData
2010-05-25 10:24 . 2010-05-25 10:24        81        ----a-w-        C:\CTX.DAT
2010-05-25 10:24 . 2010-05-25 10:24        --------        d-----w-        c:\dokumente und einstellungen\Altan\Citrix
2010-05-25 10:17 . 2010-05-25 10:17        --------        d-----w-        c:\windows\Internet Logs
2010-05-25 10:16 . 2010-05-25 10:16        --------        d-----w-        c:\programme\Gemeinsame Dateien\Deterministic Networks
2010-05-25 10:15 . 2010-05-25 10:15        --------        d-----w-        c:\programme\Cisco Systems
2010-05-13 10:05 . 2010-05-13 10:05        --------        d-sh--w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecuROM
2010-05-07 10:34 . 2010-05-07 10:34        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ATI
2010-05-06 11:08 . 2010-05-18 13:29        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\skypePM
2010-05-06 11:08 . 2010-05-06 11:08        56        ---ha-w-        c:\windows\system32\ezsidmv.dat
2010-05-06 11:06 . 2010-05-18 13:37        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Skype
2010-05-06 11:06 . 2010-05-06 11:06        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype
2010-05-06 11:06 . 2010-05-06 11:06        --------        d-----r-        c:\programme\Skype
2010-05-06 11:06 . 2010-05-06 11:06        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype
2010-04-30 13:46 . 2010-04-30 13:46        --------        d-----w-        c:\programme\Gemeinsame Dateien\DivX Shared
2010-04-30 13:19 . 2010-05-15 11:06        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX
2010-04-30 12:08 . 2010-04-30 12:08        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
2010-04-30 12:03 . 2010-04-30 12:03        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
2010-04-30 12:03 . 2010-05-09 20:08        --------        d-----w-        c:\dokumente und einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\Temp
2010-04-30 12:03 . 2010-05-09 20:09        --------        d-----w-        c:\programme\Google
2010-04-30 12:03 . 2010-04-30 12:03        --------        d-----w-        c:\dokumente und einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\Google

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-28 19:19 . 2008-11-21 11:10        16608        ----a-w-        c:\windows\gdrv.sys
2010-05-28 19:15 . 2008-12-03 15:53        --------        d-----w-        c:\programme\DNA
2010-05-28 19:15 . 2008-12-03 15:53        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\DNA
2010-05-28 18:54 . 2008-11-21 13:02        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\foobar2000
2010-05-28 17:59 . 2008-11-21 12:31        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-05-28 13:19 . 2008-11-21 12:57        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\CoreFTP
2010-05-27 06:53 . 2010-03-11 23:25        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\vlc
2010-05-26 19:26 . 2008-11-22 10:45        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\ICQ
2010-05-26 13:36 . 2009-04-25 21:11        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DVD Shrink
2010-05-26 13:34 . 2009-06-03 14:00        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\dvdcss
2010-05-25 14:49 . 2009-11-12 11:24        --------        d-----w-        c:\programme\JDownloader
2010-05-15 11:06 . 2010-04-30 14:11        57344        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-05-15 11:05 . 2010-05-15 11:05        56766        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        53600        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Update\Uninstaller.exe
2010-05-15 11:05 . 2008-11-21 12:52        --------        d-----w-        c:\programme\DivX
2010-05-15 11:05 . 2010-05-15 11:05        54166        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAVCDecoder\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        57532        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSASPDecoder\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        57409        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ControlPanel\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        144696        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-05-15 11:05 . 2010-04-30 13:46        754984        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\Resource.dll
2010-05-13 09:50 . 2008-11-21 11:11        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-05-07 14:32 . 2008-11-21 11:23        76848        ----a-w-        c:\dokumente und einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-05-07 11:32 . 2010-02-27 21:32        --------        d-----w-        c:\programme\ATI
2010-05-07 10:30 . 2008-11-21 11:39        --------        d-----w-        c:\programme\ATI Technologies
2010-04-30 13:46 . 2010-04-30 13:46        56978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\WebPlayer\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        57054        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        56458        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        54174        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAACDecoder\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        52963        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        54073        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Qt4.5\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        56969        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ASPEncoder\Uninstaller.exe
2010-04-30 13:19 . 2010-04-30 13:46        1180952        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\DivXSetup.exe
2010-04-29 13:39 . 2008-11-21 12:31        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2008-11-21 12:31        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-04-28 12:25 . 2009-12-29 23:11        --------        d-----w-        c:\programme\softonic-de3
2010-04-28 11:52 . 2010-04-28 11:52        --------        d-----w-        c:\programme\PopCap Games
2010-04-27 12:28 . 2010-04-27 12:28        50354        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\uninstall.exe
2010-04-27 12:28 . 2010-04-27 12:28        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook
2010-04-27 12:11 . 2010-04-27 12:11        --------        d-----w-        c:\programme\Animake
2010-04-22 10:31 . 2010-04-22 10:31        --------        d-----w-        c:\programme\eRightSoft
2010-04-20 17:08 . 2010-04-20 17:08        --------        d-----w-        c:\programme\Alcohol Soft
2010-04-20 17:05 . 2009-01-12 09:39        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
2010-04-15 00:00 . 2009-11-07 01:29        79488        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Sun\Java\jre1.6.0_17\gtapi.dll
2010-04-14 23:56 . 2004-08-04 12:00        85526        ----a-w-        c:\windows\system32\perfc007.dat
2010-04-14 23:56 . 2004-08-04 12:00        462316        ----a-w-        c:\windows\system32\perfh007.dat
2010-04-12 13:49 . 2009-07-18 09:53        --------        d-----w-        c:\programme\Audacity
2010-04-07 17:33 . 2010-04-07 12:22        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Hamachi
2010-04-07 12:46 . 2010-04-07 12:45        --------        d-----w-        c:\programme\Hamachi
2010-04-07 12:45 . 2009-09-23 08:41        17480        ----a-w-        c:\windows\system32\drivers\hamachi.sys
2010-04-07 02:02 . 2009-03-16 19:35        45056        ----a-w-        c:\windows\system32\aticalrt.dll
2010-04-07 02:02 . 2009-03-16 19:34        45056        ----a-w-        c:\windows\system32\aticalcl.dll
2010-04-07 02:00 . 2009-03-16 19:33        3981312        ----a-w-        c:\windows\system32\aticaldd.dll
2010-04-07 01:26 . 2010-02-27 21:32        143360        ----a-w-        c:\windows\system32\atiapfxx.exe
2010-04-07 01:14 . 2009-03-16 19:40        65024        ----a-w-        c:\windows\system32\atimpc32.dll
2010-04-06 13:11 . 2010-02-19 10:50        --------        d-----w-        c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-04-06 12:42 . 2009-02-21 12:16        --------        d-----w-        c:\programme\MagicMusicmaker
2010-04-05 17:44 . 2010-04-05 17:41        --------        d-----w-        c:\programme\Ultra WMV Converter
2010-04-05 17:20 . 2010-04-05 17:20        --------        d-----w-        c:\programme\Free Convert XVID AVI WMV MPEG FLV MP4 Converter
2010-04-05 17:20 . 2010-04-05 17:20        34        ---ha-w-        c:\windows\system32\Converter_sysquict.dat
2010-04-05 17:20 . 2009-04-06 15:24        --------        d-----w-        c:\programme\K-Lite Codec Pack
2010-04-05 17:11 . 2010-04-05 17:11        --------        d-----w-        c:\programme\Aplus WMV to XviD Converter
2010-04-03 19:01 . 2010-04-03 19:01        --------        d-----w-        c:\programme\Easy RM Producer
2010-04-03 18:46 . 2010-04-03 18:46        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Nokia Multimedia Player
2010-04-03 18:43 . 2010-04-03 18:40        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Nokia
2010-04-03 18:43 . 2010-04-03 18:40        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\PC Suite
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\PC Suite
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\programme\Gemeinsame Dateien\PCSuite
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\programme\Gemeinsame Dateien\Nokia
2010-04-03 18:40 . 2010-04-03 18:39        --------        d-----w-        c:\programme\Nokia
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\programme\DIFX
2010-04-03 18:39 . 2010-04-03 18:39        --------        d-----w-        c:\programme\PC Connectivity Solution
2010-04-03 18:39 . 2010-04-03 18:39        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Downloaded Installations
2010-04-03 12:39 . 2009-12-07 06:38        --------        d-----w-        c:\programme\Cake Poker
2010-03-24 14:38 . 2009-09-30 11:01        3366760        ----a-w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2010-03-08 17:59 . 2010-03-08 17:59        94208        ----a-w-        c:\windows\system32\dpl100.dll
2010-03-06 05:30 . 2010-03-06 05:30        847040        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\axfbootloader.dll
2010-03-06 05:30 . 2010-03-06 05:30        5582848        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll
2010-03-02 00:29 . 2008-11-21 21:09        691696        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-03-01 14:47 . 2009-03-03 16:30        371776        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\baseq3\cgamex86.dll
2010-03-01 14:47 . 2009-03-03 16:30        187456        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\baseq3\uix86.dll
2010-03-01 14:43 . 2008-11-27 10:59        138504        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2010-03-01 14:43 . 2008-11-27 10:59        214488        ----a-w-        c:\windows\system32\PnkBstrB.exe
2010-03-01 14:43 . 2009-03-03 16:30        887856        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\pb\pbcl.dll
2010-03-01 14:43 . 2009-03-03 16:30        57344        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\pb\pbag.dll
2010-03-01 14:43 . 2009-03-03 16:30        2427968        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\baseq3\quakelive.dll
2010-02-28 22:43 . 2009-03-03 16:25        2373712        ----a-w-        c:\windows\system32\pbsvc.exe
2010-02-28 22:43 . 2008-11-27 10:59        75064        ----a-w-        c:\windows\system32\PnkBstrA.exe
2009-06-01 18:03 . 2009-06-01 18:03        66936        --sha-w-        c:\windows\dlinfo_0.drv
2006-05-03 10:06 . 2010-04-22 10:31        163328        --sh--r-        c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2010-04-22 10:31        31232        --sh--r-        c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2010-04-22 10:31        216064        --sh--r-        c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{97ac393a-a525-4cd0-95cf-019b028cc7a4}"= "c:\programme\Peer2Peer-DE\tbPee0.dll" [2010-04-28 2349080]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsof1.dll" [2010-04-28 2349080]

[HKEY_CLASSES_ROOT\clsid\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]
2010-04-28 12:25        2349080        ----a-w-        c:\programme\Peer2Peer-DE\tbPee0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-01-30 13:12        650752        ----a-w-        c:\programme\pdfforge Toolbar\WidgiToolbarIE.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-04-28 12:25        2349080        ----a-w-        c:\programme\softonic-de3\tbsof1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{97ac393a-a525-4cd0-95cf-019b028cc7a4}"= "c:\programme\Peer2Peer-DE\tbPee0.dll" [2010-04-28 2349080]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\programme\pdfforge Toolbar\WidgiToolbarIE.dll" [2009-01-30 650752]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsof1.dll" [2010-04-28 2349080]

[HKEY_CLASSES_ROOT\clsid\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{97AC393A-A525-4CD0-95CF-019B028CC7A4}"= "c:\programme\Peer2Peer-DE\tbPee0.dll" [2010-04-28 2349080]
"{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}"= "c:\programme\softonic-de3\tbsof1.dll" [2010-04-28 2349080]

[HKEY_CLASSES_ROOT\clsid\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\programme\DNA\btdna.exe" [2009-11-12 323392]
"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"AlcoholAutomount"="c:\programme\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-30 203928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="c:\programme\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"CanonSolutionMenu"="c:\programme\Canon\SolutionMenu\CNSLMAIN.exe" [2007-04-03 644696]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\programme\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"CanonMyPrinter"="c:\programme\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SxgTkBar"="SxgTkBar.exe" [2002-07-22 53248]
"CloneCDTray"="c:\programme\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2008-09-06 413696]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 16844800]
"VirtualCloneDrive"="c:\programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-01-29 52392]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-06-01 148888]
"Babylon Client"="c:\programme\Babylon\Babylon-Pro\Babylon.exe" [2009-07-07 3706768]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2010-01-25 198160]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"PCSuiteTrayApplication"="c:\programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-28 222720]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400]
"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"PcSync"="c:\programme\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

c:\dokumente und einstellungen\Altan\Startmen\Programme\Autostart\
Verknpfung mit RefreshLock.lnk - c:\refreshlock\RefreshLock.exe [2008-11-21 193024]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
NETGEAR WG111v3 Smart Wizard.lnk - c:\programme\NETGEAR\WG111v3\WG111v3.exe [2007-9-12 1527808]
VPN Client.lnk - c:\windows\Installer\{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}\Icon3E5562ED7.ico [2010-5-25 6144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Quake 3\\quake3.exe"=
"d:\\Enemy Territory\\ET.exe"=
"d:\\TmNationsForever\\TmForever.exe"=
"d:\\Steam\\SteamApps\\frerky\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Programme\\BitTorrent\\bittorrent.exe"=
"d:\\Steam\\SteamApps\\frerky\\team fortress 2\\hl2.exe"=
"d:\\Steam\\SteamApps\\frerky\\source sdk base 2007\\hl2.exe"=
"d:\\Steam\\SteamApps\\frerky\\source sdk base\\hl2.exe"=
"d:\\Steam\\SteamApps\\nubilein\\counter-strike\\hl.exe"=
"d:\\Steam\\SteamApps\\nubilein\\half-life\\hl.exe"=
"c:\\Programme\\Canon\\Color Network ScanGear\\SgTool.exe"=
"d:\\Steam\\SteamApps\\nubilein\\opposing force\\hl.exe"=
"c:\\Programme\\GIGABYTE\\GEST\\run.exe"=
"c:\\Programme\\CryptLoad_1.1.6\\RouterClient.exe"=
"d:\\Anno 1701\\Anno1701.exe"=
"d:\\Half Life\\hl.exe"=
"d:\\Command & Conquer 3\\RetailExe\\1.9\\cnc3game.dat"=
"d:\\GTA2\\gta2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\Black & White\\runblack.exe"=
"d:\\Steam\\SteamApps\\common\\peggle extreme\\PeggleExtreme.exe"=
"c:\\Programme\\Backgammon7\\Backgammon-Client.exe"=
"d:\\FlatOut2\\FlatOut2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Programme\\Zattoo\\zattood.exe"=
"c:\\Programme\\Zattoo\\Zattoo2.exe"=
"c:\\Programme\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Programme\\PPLive\\PPLive.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"d:\\Ghost Recon\\GhostRecon.exe"=
"d:\\Battlefield 2\\BF2.exe"=
"d:\\Battlefield Vietnam\\bfvietnam.exe"=
"d:\\Quake 2\\quake2xp.exe"=
"d:\\Quake 2\\quake2.exe"=
"c:\\Programme\\Zattoo\\Zattoo.exe"=
"d:\\Diablo\\diablo.exe"=
"d:\\Aliens Versus Predator\\MyAvP.exe"=
"d:\\FEAR\\FEAR.exe"=
"c:\\Programme\\Vuze\\Azureus.exe"=
"d:\\Dawn of War\\W40k.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"d:\\FlatOut Ultimate Carnage\\Fouc.exe"=
"c:\\Programme\\TVAnts\\Tvants.exe"=
"d:\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"i:\\Spiele\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Left 4 Dead\\left4dead.exe"=
"d:\\Steam\\SteamApps\\common\\jedi outcast\\GameData\\jk2sp.exe"=
"d:\\Steam\\SteamApps\\common\\jedi outcast\\GameData\\jk2mp.exe"=
"d:\\Steam\\SteamApps\\common\\jedi academy\\GameData\\jasp.exe"=
"d:\\Steam\\SteamApps\\common\\jedi academy\\GameData\\jamp.exe"=
"i:\\Spiele\\Mass Effect 2\\MassEffect2Launcher.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"i:\\Spiele\\Mass Effect 2\\Binaries\\UT3.exe"=
"d:\\Steam\\SteamApps\\common\\torchlight\\Torchlight.exe"=
"d:\\Star Wars Battlefront II\\GameData\\BattlefrontII.exe"=
"i:\\Spiele\\Ghost Recon Advanced Warfighter\\GRAW.exe"=
"c:\\Programme\\Hamachi\\hamachi.exe"=
"d:\\Starcraft\\StarCraft.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Age of Empires II\\EMPIRES2.ICD"=
"d:\\Age of Empires II\\empires2.exe"=
"i:\\Spiele\\EFLC\\EFLC.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3106:UDP"= 3106:UDP:Windows Media Format SDK (wmplayer.exe)
"3107:UDP"= 3107:UDP:Windows Media Format SDK (wmplayer.exe)
"3108:UDP"= 3108:UDP:Windows Media Format SDK (wmplayer.exe)

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [31.10.2009 21:17 108289]
R3 GEST Service;GEST Service for program management.;c:\programme\GIGABYTE\GEST\GSvr.exe [21.11.2008 13:11 47624]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [23.04.2007 15:11 224896]
R3 SOFTXG;YAMAHA XG SoftSynthesizer;c:\windows\system32\drivers\sxgxgwdm.sys [09.12.2008 23:53 966784]
S0 byeje;byeje; [x]
S0 ruhgnt;ruhgnt; [x]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [30.04.2010 14:03 136176]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [16.12.2008 14:15 16512]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.11.2008 23:09 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-11-20 13:28        451872        ----a-w-        c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners

2010-04-18 c:\windows\Tasks\Driver Robot.job
- c:\programme\Driver Robot\1.2.0.5\DriverRobot.exe [2009-12-03 16:29]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-30 12:03]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-30 12:03]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://video.tomp4.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\dokumente und einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\dokumente und einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll
FF - component: c:\dokumente und einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll
FF - component: c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\dokumente und einstellungen\All Users\Anwendungsdaten\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npJoostPlugin.dll
FF - plugin: c:\programme\Opera\program\plugins\npJoostPlugin.dll

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

AddRemove-DAEMON Tools Toolbar - c:\programme\DAEMON Tools Toolbar\uninst.exe
AddRemove-Quake2xp - d:\quake2\uninst.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\programme\DivX\DivXCodecUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-05-28 21:15
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-484763869-725345543-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1b,0a,95,d6,8a,b3,fb,cb,60,18,a4,8d,6f,5b,93,85,3a,35,62,9e,c0,26,c1,
  30,a8,8e,db,9b,bb,77,72,49,bf,56,bf,17,92,f1,94,f5,9e,53,04,46,31,99,ec,0a,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22

[HKEY_USERS\S-1-5-21-484763869-725345543-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:1a,bf,63,10,56,18,a6,ee,02,95,46,57,c5,c3,15,47,3d,8a,8a,8a,8a,
  38,bc,3c,86,f1,98,4f,fd,cf,a9,62,e3,c3,5d,b1,39,a7,e1,dd,1b,aa,9e,51,a6,a3,\
"rkeysecu"=hex:40,57,9f,d0,10,05,7b,c4,d6,0d,94,2a,d8,ae,fa,5c

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]
"AB141C35E9F4BF344B9FC010BB17F68A"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}\\Registered"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1656)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1192)
c:\programme\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programme\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\programme\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\programme\PC Connectivity Solution\ConnAPI.DLL
c:\programme\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_ger.nlr
c:\programme\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Cisco Systems\VPN Client\cvpnd.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\SxgTkBar.exe
c:\windows\RTHDCPL.EXE
c:\programme\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-05-28  21:21:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-05-28 19:21

Vor Suchlauf: 30 Verzeichnis(se), 14.949.257.216 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 14.816.387.072 Bytes frei

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - F1A8D6196B41107C333A5396D9806C7B
--- --- ---

cosinus 28.05.2010 23:44
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Driver::
byeje
ruhgnt
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

frERky 30.05.2010 15:44
Combofix Logfile:
Code:
ComboFix 10-05-29.05 - Altan 30.05.2010  16:33:13.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3582.2979 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Altan\Desktop\cofi.exe.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Altan\Desktop\CFScript.txt.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BYEJE
-------\Legacy_RUHGNT
-------\Service_byeje
-------\Service_ruhgnt


(((((((((((((((((((((((  Dateien erstellt von 2010-04-28 bis 2010-05-30  ))))))))))))))))))))))))))))))
.

2010-05-29 11:56 . 2008-04-14 05:52        21504        -c--a-w-        c:\windows\system32\dllcache\hidserv.dll
2010-05-29 11:56 . 2008-04-14 05:52        21504        ----a-w-        c:\windows\system32\hidserv.dll
2010-05-29 11:56 . 2008-04-14 05:28        14720        -c--a-w-        c:\windows\system32\dllcache\kbdhid.sys
2010-05-29 11:56 . 2008-04-14 05:28        14720        ----a-w-        c:\windows\system32\drivers\kbdhid.sys
2010-05-29 10:37 . 2010-05-29 10:37        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\NeroDCTemplates
2010-05-28 19:27 . 2010-05-28 19:27        --------        d-----w-        c:\programme\CCleaner
2010-05-28 18:57 . 2010-05-28 19:22        --------        d-----w-        C:\cofi.exe
2010-05-26 19:29 . 2010-05-26 19:29        --------        d-s---w-        c:\dokumente und einstellungen\NetworkService\UserData
2010-05-25 10:24 . 2010-05-25 10:24        81        ----a-w-        C:\CTX.DAT
2010-05-25 10:24 . 2010-05-25 10:24        --------        d-----w-        c:\dokumente und einstellungen\Altan\Citrix
2010-05-25 10:17 . 2010-05-25 10:17        --------        d-----w-        c:\windows\Internet Logs
2010-05-25 10:16 . 2010-05-25 10:16        --------        d-----w-        c:\programme\Gemeinsame Dateien\Deterministic Networks
2010-05-25 10:15 . 2010-05-25 10:15        --------        d-----w-        c:\programme\Cisco Systems
2010-05-13 10:05 . 2010-05-13 10:05        --------        d-sh--w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecuROM
2010-05-07 10:34 . 2010-05-07 10:34        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ATI
2010-05-06 11:08 . 2010-05-18 13:29        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\skypePM
2010-05-06 11:08 . 2010-05-06 11:08        56        ---ha-w-        c:\windows\system32\ezsidmv.dat
2010-05-06 11:06 . 2010-05-18 13:37        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Skype
2010-05-06 11:06 . 2010-05-06 11:06        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype
2010-05-06 11:06 . 2010-05-06 11:06        --------        d-----r-        c:\programme\Skype
2010-05-06 11:06 . 2010-05-06 11:06        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Skype

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-30 14:41 . 2008-11-21 11:10        16608        ----a-w-        c:\windows\gdrv.sys
2010-05-30 14:37 . 2008-12-03 15:53        --------        d-----w-        c:\programme\DNA
2010-05-30 14:37 . 2008-12-03 15:53        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\DNA
2010-05-30 04:36 . 2010-03-11 23:25        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\vlc
2010-05-29 15:19 . 2008-11-22 10:45        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\ICQ
2010-05-28 22:02 . 2008-11-21 13:02        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\foobar2000
2010-05-28 21:01 . 2009-11-12 11:24        --------        d-----w-        c:\programme\JDownloader
2010-05-28 17:59 . 2008-11-21 12:31        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-05-28 13:19 . 2008-11-21 12:57        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\CoreFTP
2010-05-26 13:36 . 2009-04-25 21:11        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DVD Shrink
2010-05-26 13:34 . 2009-06-03 14:00        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\dvdcss
2010-05-15 11:06 . 2010-04-30 14:11        57344        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-05-15 11:06 . 2010-04-30 13:19        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX
2010-05-15 11:05 . 2010-05-15 11:05        56766        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        53600        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Update\Uninstaller.exe
2010-05-15 11:05 . 2008-11-21 12:52        --------        d-----w-        c:\programme\DivX
2010-05-15 11:05 . 2010-05-15 11:05        54166        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAVCDecoder\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        57532        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSASPDecoder\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        57409        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ControlPanel\Uninstaller.exe
2010-05-15 11:05 . 2010-05-15 11:05        144696        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-05-15 11:05 . 2010-04-30 13:46        754984        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\Resource.dll
2010-05-13 09:50 . 2008-11-21 11:11        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-05-09 20:09 . 2010-04-30 12:03        --------        d-----w-        c:\programme\Google
2010-05-07 14:32 . 2008-11-21 11:23        76848        ----a-w-        c:\dokumente und einstellungen\Altan\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-05-07 11:32 . 2010-02-27 21:32        --------        d-----w-        c:\programme\ATI
2010-05-07 10:30 . 2008-11-21 11:39        --------        d-----w-        c:\programme\ATI Technologies
2010-04-30 13:46 . 2010-04-30 13:46        56978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\WebPlayer\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        57054        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        56458        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        54174        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAACDecoder\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        52963        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        54073        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Qt4.5\Uninstaller.exe
2010-04-30 13:46 . 2010-04-30 13:46        --------        d-----w-        c:\programme\Gemeinsame Dateien\DivX Shared
2010-04-30 13:46 . 2010-04-30 13:46        56969        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ASPEncoder\Uninstaller.exe
2010-04-30 13:19 . 2010-04-30 13:46        1180952        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\DivXSetup.exe
2010-04-29 13:39 . 2008-11-21 12:31        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2008-11-21 12:31        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-04-28 12:25 . 2009-12-29 23:11        --------        d-----w-        c:\programme\softonic-de3
2010-04-28 11:52 . 2010-04-28 11:52        --------        d-----w-        c:\programme\PopCap Games
2010-04-27 12:28 . 2010-04-27 12:28        50354        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\uninstall.exe
2010-04-27 12:28 . 2010-04-27 12:28        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook
2010-04-27 12:11 . 2010-04-27 12:11        --------        d-----w-        c:\programme\Animake
2010-04-22 10:31 . 2010-04-22 10:31        --------        d-----w-        c:\programme\eRightSoft
2010-04-20 17:08 . 2010-04-20 17:08        --------        d-----w-        c:\programme\Alcohol Soft
2010-04-20 17:05 . 2009-01-12 09:39        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
2010-04-15 00:00 . 2009-11-07 01:29        79488        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Sun\Java\jre1.6.0_17\gtapi.dll
2010-04-14 23:56 . 2004-08-04 12:00        85526        ----a-w-        c:\windows\system32\perfc007.dat
2010-04-14 23:56 . 2004-08-04 12:00        462316        ----a-w-        c:\windows\system32\perfh007.dat
2010-04-12 13:49 . 2009-07-18 09:53        --------        d-----w-        c:\programme\Audacity
2010-04-07 17:33 . 2010-04-07 12:22        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Hamachi
2010-04-07 12:46 . 2010-04-07 12:45        --------        d-----w-        c:\programme\Hamachi
2010-04-07 12:45 . 2009-09-23 08:41        17480        ----a-w-        c:\windows\system32\drivers\hamachi.sys
2010-04-07 02:02 . 2009-03-16 19:35        45056        ----a-w-        c:\windows\system32\aticalrt.dll
2010-04-07 02:02 . 2009-03-16 19:34        45056        ----a-w-        c:\windows\system32\aticalcl.dll
2010-04-07 02:00 . 2009-03-16 19:33        3981312        ----a-w-        c:\windows\system32\aticaldd.dll
2010-04-07 01:26 . 2010-02-27 21:32        143360        ----a-w-        c:\windows\system32\atiapfxx.exe
2010-04-07 01:14 . 2009-03-16 19:40        65024        ----a-w-        c:\windows\system32\atimpc32.dll
2010-04-06 13:11 . 2010-02-19 10:50        --------        d-----w-        c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-04-06 12:42 . 2009-02-21 12:16        --------        d-----w-        c:\programme\MagicMusicmaker
2010-04-05 17:44 . 2010-04-05 17:41        --------        d-----w-        c:\programme\Ultra WMV Converter
2010-04-05 17:20 . 2010-04-05 17:20        --------        d-----w-        c:\programme\Free Convert XVID AVI WMV MPEG FLV MP4 Converter
2010-04-05 17:20 . 2010-04-05 17:20        34        ---ha-w-        c:\windows\system32\Converter_sysquict.dat
2010-04-05 17:20 . 2009-04-06 15:24        --------        d-----w-        c:\programme\K-Lite Codec Pack
2010-04-05 17:11 . 2010-04-05 17:11        --------        d-----w-        c:\programme\Aplus WMV to XviD Converter
2010-04-03 19:01 . 2010-04-03 19:01        --------        d-----w-        c:\programme\Easy RM Producer
2010-04-03 18:46 . 2010-04-03 18:46        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Nokia Multimedia Player
2010-04-03 18:43 . 2010-04-03 18:40        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Nokia
2010-04-03 18:43 . 2010-04-03 18:40        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\PC Suite
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\PC Suite
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\programme\Gemeinsame Dateien\PCSuite
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\programme\Gemeinsame Dateien\Nokia
2010-04-03 18:40 . 2010-04-03 18:39        --------        d-----w-        c:\programme\Nokia
2010-04-03 18:40 . 2010-04-03 18:40        --------        d-----w-        c:\programme\DIFX
2010-04-03 18:39 . 2010-04-03 18:39        --------        d-----w-        c:\programme\PC Connectivity Solution
2010-04-03 18:39 . 2010-04-03 18:39        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Downloaded Installations
2010-04-03 12:39 . 2009-12-07 06:38        --------        d-----w-        c:\programme\Cake Poker
2010-03-24 14:38 . 2009-09-30 11:01        3366760        ----a-w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2010-03-08 17:59 . 2010-03-08 17:59        94208        ----a-w-        c:\windows\system32\dpl100.dll
2010-03-06 05:30 . 2010-03-06 05:30        847040        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\axfbootloader.dll
2010-03-06 05:30 . 2010-03-06 05:30        5582848        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll
2010-03-02 00:29 . 2008-11-21 21:09        691696        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-03-01 14:47 . 2009-03-03 16:30        371776        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\baseq3\cgamex86.dll
2010-03-01 14:47 . 2009-03-03 16:30        187456        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\baseq3\uix86.dll
2010-03-01 14:43 . 2008-11-27 10:59        138504        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2010-03-01 14:43 . 2008-11-27 10:59        214488        ----a-w-        c:\windows\system32\PnkBstrB.exe
2010-03-01 14:43 . 2009-03-03 16:30        887856        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\pb\pbcl.dll
2010-03-01 14:43 . 2009-03-03 16:30        57344        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\pb\pbag.dll
2010-03-01 14:43 . 2009-03-03 16:30        2427968        ----a-w-        c:\dokumente und einstellungen\Altan\Anwendungsdaten\id Software\quakelive\home\baseq3\quakelive.dll
2009-06-01 18:03 . 2009-06-01 18:03        66936        --sha-w-        c:\windows\dlinfo_0.drv
2006-05-03 10:06 . 2010-04-22 10:31        163328        --sh--r-        c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2010-04-22 10:31        31232        --sh--r-        c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2010-04-22 10:31        216064        --sh--r-        c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{97ac393a-a525-4cd0-95cf-019b028cc7a4}"= "c:\programme\Peer2Peer-DE\tbPee0.dll" [2010-04-28 2349080]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsof1.dll" [2010-04-28 2349080]

[HKEY_CLASSES_ROOT\clsid\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]
2010-04-28 12:25        2349080        ----a-w-        c:\programme\Peer2Peer-DE\tbPee0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2009-01-30 13:12        650752        ----a-w-        c:\programme\pdfforge Toolbar\WidgiToolbarIE.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-04-28 12:25        2349080        ----a-w-        c:\programme\softonic-de3\tbsof1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{97ac393a-a525-4cd0-95cf-019b028cc7a4}"= "c:\programme\Peer2Peer-DE\tbPee0.dll" [2010-04-28 2349080]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\programme\pdfforge Toolbar\WidgiToolbarIE.dll" [2009-01-30 650752]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsof1.dll" [2010-04-28 2349080]

[HKEY_CLASSES_ROOT\clsid\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]

[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{97AC393A-A525-4CD0-95CF-019B028CC7A4}"= "c:\programme\Peer2Peer-DE\tbPee0.dll" [2010-04-28 2349080]
"{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}"= "c:\programme\softonic-de3\tbsof1.dll" [2010-04-28 2349080]

[HKEY_CLASSES_ROOT\clsid\{97ac393a-a525-4cd0-95cf-019b028cc7a4}]

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\programme\DNA\btdna.exe" [2009-11-12 323392]
"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"AlcoholAutomount"="c:\programme\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-30 203928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="c:\programme\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"CanonSolutionMenu"="c:\programme\Canon\SolutionMenu\CNSLMAIN.exe" [2007-04-03 644696]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\programme\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"CanonMyPrinter"="c:\programme\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SxgTkBar"="SxgTkBar.exe" [2002-07-22 53248]
"CloneCDTray"="c:\programme\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2008-09-06 413696]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 16844800]
"VirtualCloneDrive"="c:\programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-01-29 52392]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-06-01 148888]
"Babylon Client"="c:\programme\Babylon\Babylon-Pro\Babylon.exe" [2009-07-07 3706768]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2010-01-25 198160]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"PCSuiteTrayApplication"="c:\programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-28 222720]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400]
"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"PcSync"="c:\programme\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

c:\dokumente und einstellungen\Altan\Startmen\Programme\Autostart\
Verknpfung mit RefreshLock.lnk - c:\refreshlock\RefreshLock.exe [2008-11-21 193024]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
NETGEAR WG111v3 Smart Wizard.lnk - c:\programme\NETGEAR\WG111v3\WG111v3.exe [2007-9-12 1527808]
VPN Client.lnk - c:\windows\Installer\{F3C1DE9E-5E16-4BA9-B854-7B53A45E3579}\Icon3E5562ED7.ico [2010-5-25 6144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Quake 3\\quake3.exe"=
"d:\\Enemy Territory\\ET.exe"=
"d:\\TmNationsForever\\TmForever.exe"=
"d:\\Steam\\SteamApps\\frerky\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Programme\\BitTorrent\\bittorrent.exe"=
"d:\\Steam\\SteamApps\\frerky\\team fortress 2\\hl2.exe"=
"d:\\Steam\\SteamApps\\frerky\\source sdk base 2007\\hl2.exe"=
"d:\\Steam\\SteamApps\\frerky\\source sdk base\\hl2.exe"=
"d:\\Steam\\SteamApps\\nubilein\\counter-strike\\hl.exe"=
"d:\\Steam\\SteamApps\\nubilein\\half-life\\hl.exe"=
"c:\\Programme\\Canon\\Color Network ScanGear\\SgTool.exe"=
"d:\\Steam\\SteamApps\\nubilein\\opposing force\\hl.exe"=
"c:\\Programme\\GIGABYTE\\GEST\\run.exe"=
"c:\\Programme\\CryptLoad_1.1.6\\RouterClient.exe"=
"d:\\Anno 1701\\Anno1701.exe"=
"d:\\Half Life\\hl.exe"=
"d:\\Command & Conquer 3\\RetailExe\\1.9\\cnc3game.dat"=
"d:\\GTA2\\gta2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\Black & White\\runblack.exe"=
"d:\\Steam\\SteamApps\\common\\peggle extreme\\PeggleExtreme.exe"=
"c:\\Programme\\Backgammon7\\Backgammon-Client.exe"=
"d:\\FlatOut2\\FlatOut2.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Programme\\Zattoo\\zattood.exe"=
"c:\\Programme\\Zattoo\\Zattoo2.exe"=
"c:\\Programme\\Joost\\xulrunner\\tvprunner.exe"=
"c:\\Programme\\PPLive\\PPLive.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"d:\\Ghost Recon\\GhostRecon.exe"=
"d:\\Battlefield 2\\BF2.exe"=
"d:\\Battlefield Vietnam\\bfvietnam.exe"=
"d:\\Quake 2\\quake2xp.exe"=
"d:\\Quake 2\\quake2.exe"=
"c:\\Programme\\Zattoo\\Zattoo.exe"=
"d:\\Diablo\\diablo.exe"=
"d:\\Aliens Versus Predator\\MyAvP.exe"=
"d:\\FEAR\\FEAR.exe"=
"c:\\Programme\\Vuze\\Azureus.exe"=
"d:\\Dawn of War\\W40k.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"d:\\FlatOut Ultimate Carnage\\Fouc.exe"=
"c:\\Programme\\TVAnts\\Tvants.exe"=
"d:\\Crysis\\Bin32\\Crysis.exe"=
"d:\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Grand Theft Auto IV\\GTAIV.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"i:\\Spiele\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Left 4 Dead\\left4dead.exe"=
"d:\\Steam\\SteamApps\\common\\jedi outcast\\GameData\\jk2sp.exe"=
"d:\\Steam\\SteamApps\\common\\jedi outcast\\GameData\\jk2mp.exe"=
"d:\\Steam\\SteamApps\\common\\jedi academy\\GameData\\jasp.exe"=
"d:\\Steam\\SteamApps\\common\\jedi academy\\GameData\\jamp.exe"=
"i:\\Spiele\\Mass Effect 2\\MassEffect2Launcher.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"i:\\Spiele\\Mass Effect 2\\Binaries\\UT3.exe"=
"d:\\Steam\\SteamApps\\common\\torchlight\\Torchlight.exe"=
"d:\\Star Wars Battlefront II\\GameData\\BattlefrontII.exe"=
"i:\\Spiele\\Ghost Recon Advanced Warfighter\\GRAW.exe"=
"c:\\Programme\\Hamachi\\hamachi.exe"=
"d:\\Starcraft\\StarCraft.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Age of Empires II\\EMPIRES2.ICD"=
"d:\\Age of Empires II\\empires2.exe"=
"i:\\Spiele\\EFLC\\EFLC.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3106:UDP"= 3106:UDP:Windows Media Format SDK (wmplayer.exe)
"3107:UDP"= 3107:UDP:Windows Media Format SDK (wmplayer.exe)
"3108:UDP"= 3108:UDP:Windows Media Format SDK (wmplayer.exe)

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [31.10.2009 21:17 108289]
R3 GEST Service;GEST Service for program management.;c:\programme\GIGABYTE\GEST\GSvr.exe [21.11.2008 13:11 47624]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [23.04.2007 15:11 224896]
R3 SOFTXG;YAMAHA XG SoftSynthesizer;c:\windows\system32\drivers\sxgxgwdm.sys [09.12.2008 23:53 966784]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [30.04.2010 14:03 136176]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [16.12.2008 14:15 16512]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21.11.2008 23:09 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-11-20 13:28        451872        ----a-w-        c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners

2010-04-18 c:\windows\Tasks\Driver Robot.job
- c:\programme\Driver Robot\1.2.0.5\DriverRobot.exe [2009-12-03 16:29]

2010-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-30 12:03]

2010-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-30 12:03]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://video.tomp4.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Translate this web page with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\dokumente und einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\dokumente und einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll
FF - component: c:\dokumente und einstellungen\Altan\Anwendungsdaten\Mozilla\Firefox\Profiles\gonf3w8u.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll
FF - component: c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\dokumente und einstellungen\All Users\Anwendungsdaten\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\dokumente und einstellungen\Altan\Anwendungsdaten\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npJoostPlugin.dll
FF - plugin: c:\programme\Opera\program\plugins\npJoostPlugin.dll

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-05-30 16:37
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-484763869-725345543-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:1b,0a,95,d6,8a,b3,fb,cb,60,18,a4,8d,6f,5b,93,85,3a,35,62,9e,c0,26,c1,
  30,a8,8e,db,9b,bb,77,72,49,bf,56,bf,17,92,f1,94,f5,9e,53,04,46,31,99,ec,0a,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22

[HKEY_USERS\S-1-5-21-484763869-725345543-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:1a,bf,63,10,56,18,a6,ee,02,95,46,57,c5,c3,15,47,3d,8a,8a,8a,8a,
  38,bc,3c,86,f1,98,4f,fd,cf,a9,62,e3,c3,5d,b1,39,a7,e1,dd,1b,aa,9e,51,a6,a3,\
"rkeysecu"=hex:40,57,9f,d0,10,05,7b,c4,d6,0d,94,2a,d8,ae,fa,5c

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]
"AB141C35E9F4BF344B9FC010BB17F68A"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}\\Registered"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1660)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2932)
c:\programme\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programme\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\programme\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\programme\PC Connectivity Solution\ConnAPI.DLL
c:\programme\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_ger.nlr
c:\programme\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Cisco Systems\VPN Client\cvpnd.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\SxgTkBar.exe
c:\windows\RTHDCPL.EXE
c:\programme\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-05-30  16:43:40 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-05-30 14:43
ComboFix2.txt  2010-05-28 19:21

Vor Suchlauf: 31 Verzeichnis(se), 17.060.028.416 Bytes frei
Nach Suchlauf: 33 Verzeichnis(se), 17.027.375.104 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 7FAC3F6496A383996C8B2F561455D098
--- --- ---

cosinus 30.05.2010 16:14
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

frERky 31.05.2010 12:25
Superantispyware Scan:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/31/2010 at 01:12 PM

Application Version : 4.38.1004

Core Rules Database Version : 5007
Trace Rules Database Version: 2819

Scan type : Complete Scan
Total Scan Time : 00:40:16

Memory items scanned : 635
Memory threats detected : 0
Registry items scanned : 7144
Registry threats detected : 0
File items scanned : 33231
File threats detected : 8

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\Altan\Cookies\altan@ad.yieldmanager[2].txt
C:\Dokumente und Einstellungen\Altan\Cookies\altan@content.yieldmanager[1].txt
C:\Dokumente und Einstellungen\Altan\Cookies\altan@doubleclick[1].txt
C:\Dokumente und Einstellungen\Altan\Cookies\altan@atwola[1].txt
C:\Dokumente und Einstellungen\Altan\Cookies\altan@tradedoubler[1].txt

Adware.Flash Tracking Cookie
C:\Dokumente und Einstellungen\Altan\Anwendungsdaten\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\MDB5MMWZ\MEDIA.MTVNSERVICES.COM

Trojan.Agent/Gen
I:\_OTL\MOVEDFILES\05282010_201831\C_WINDOWS\SYSTEM32\DRIVERS\SYSAM.EXE
I:\_OTL\MOVEDFILES\05282010_201831\C_WINDOWS\SYSTEM32\DRIVERS\SYSAM.EXE388



Malwarebyte Scan:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4157

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

31.05.2010 12:27:58
mbam-log-2010-05-31 (12-27-58).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|)
Durchsuchte Objekte: 492194
Laufzeit: 1 Stunde(n), 58 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:37 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19