Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Mozilla Firefox und ICQ können keine Verbindung zum Internet herstellen (https://www.trojaner-board.de/87264-mozilla-firefox-icq-keine-verbindung-internet-herstellen.html)

Janzen 18.06.2010 10:44
Mozilla Firefox und ICQ können keine Verbindung zum Internet herstellen
 
Hallo zusammen!
Seit heute morgen hab ich ein Problem mit meinem Mozilla Firefox, sowie ICQ.
Jedes Mal wenn ich Firefox öffne kommt "Fehler: Verbindung fehlgeschlagen", bei ICQ genau dasselbe in grün. Der IE funktioniert allerdings tadellos.
Ich habe den PC schon neugestartet, ebenso die Fritzbox. Ich habe Firefox und ICQ deinstaliiert(inklusive profile), habe auch schon gegoogelt aber nichts weiteres finden können :( Außerdem hab ich Antivir und Spybot durchlaufen lassen (wurden beide erst diese Woche aktualisiert, können aber seit heute keine Updates laden bzw. bekommen keine Verbindung!), leider auch dies ohne Erfolg :(
Ich muss leider gestehen, dass ich seit ca 5-6Jahren meinen PC nicht mehr formatiert hab und er ziemlich zugemüllt ist. Ich hoffe ihr könnt mir trotzdem helfen! Danke schon mal im voraus! Ich hoffe ich habe alle Links/ Benutzernamen rausgefiltert!

Hier das Hijack-Logfile:

HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:40:02, on 18.06.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
J:\Avira\AntiVir Desktop\sched.exe
C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe
J:\Avira\AntiVir Desktop\avguard.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\Programme\Hotspot Shield\bin\openvpnas.exe
C:\Programme\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
J:\PDF Suite 2010\ConversionService.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
J:\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\DivX\DivX Update\DivXUpdate.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\FRITZ!DSL\FwebProt.exe
C:\Programme\FRITZ!DSL\StCenter.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Programme\ICQ6.5\ICQ.exe
C:\Programme\Full Tilt Poker\FullTiltPoker.exe
J:\Programme\HijackThis.exe
C:\WINDOWS\system32\msiexec.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = QIP: ????? ? ?????????
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = QIP: ????? ? ?????????
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = QIP: ????? ? ?????????
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = QIP: ????? ? ?????????
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = start.qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = QIP: ????? ? ?????????
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll (file missing)
R3 - URLSearchHook: (no name) -  - (no file)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll (file missing)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Norton-Symbolleiste anzeigen - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll (file missing)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll (file missing)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "J:\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [DivXUpdate] "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Programme\DAEMON Tools Pro\DTProAgent.exe" -autorun
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe (User 'Default user')
O4 - Startup: FRITZ!DSL Protect.lnk = C:\Programme\FRITZ!DSL\FwebProt.exe
O4 - Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe
O8 - Extra context menu item: Alles mit FDM herunterladen - file://C:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://C:\Programme\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://C:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download with GetRight - J:\FM09 Install\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - J:\FM09 Install\GetRight\GRbrowse.htm
O8 - Extra context menu item: Videos mit FDM herunterladen - file://C:\Programme\Free Download Manager\dlfvideo.htm
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - J:\poker\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Programme\QIP\qip.exe (HKCU)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Programme/Risk/Images/stg_drm.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158857053128
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Programme/Risk/Images/armhelper.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{A34BF862-D011-4462-833F-B592D32B1E9E}: NameServer = 192.168.122.252,192.168.122.253
O20 - AppInit_DLLs: c:\progra~1\google\google~3\goec62~1.dll infomsas.dll confxxn.dll      confjfg.dll jfgstat.dll    confmms.dll mmsstat.dll
O20 - Winlogon Notify: autowinn - C:\WINDOWS\
O20 - Winlogon Notify: jfgmgr - jfgmgr32.dll (file missing)
O20 - Winlogon Notify: mmsmgr - mmsmgr32.dll (file missing)
O20 - Winlogon Notify: nethesen - C:\WINDOWS\system32\nethesen.dll (file missing)
O23 - Service: AccSys WiFi Server (AccWLSvc) - AccSys GmbH - C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - J:\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - J:\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Programme\Hotspot Shield\bin\openvpnas.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Programme\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDF Suite 2010 Service - Interactive Brands Inc. - J:\PDF Suite 2010\ConversionService.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - C:\Programme\Spyware Doctor\svcntaux.exe (file missing)
O23 - Service: Spyware Doctor Service (sdCoreService) - Unknown owner - C:\Programme\Spyware Doctor\swdsvc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Programme\tune-up\WinStylerThemeSvc.exe (file missing)

--
End of file - 14194 bytes
--- --- ---

cosinus 18.06.2010 11:29
Hallo und :hallo:

bitte nen Vollscan mit malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

Janzen 18.06.2010 14:57
Hallo!
Danke für die Instruktionen, hab zuerst malwarebytes durchlaufen lassen und er hat jede Menge gefunden!
Hier der Log, jetzt kommt dann OTL dran:

alwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

18.06.2010 15:53:59
mbam-log-2010-06-18 (15-53-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|J:\|)
Durchsuchte Objekte: 304658
Laufzeit: 3 Stunde(n), 23 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 7
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 9
Infizierte Dateien: 23

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{bb05bd70-4605-4829-93fc-ad80d8cc5b66} (Rogue.PerformanceCenter) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\Programme\Advantage (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302} (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\RelevantKnowledge (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Infizierte Dateien:
J:\poker\Expekt Poker\_SetupPoker.exe (Adware.Casino) -> Quarantined and deleted successfully.
J:\Downloads\SetupPoker.exe (Adware.Casino) -> Quarantined and deleted successfully.
J:\Gamez\Crimsonland\Crimsonland198.exe (Trojan.Bancos) -> Quarantined and deleted successfully.
C:\Programme\Advantage\AdVantage.db (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\AdVantage.htm (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\user.db (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Programme\Advantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt (Adware.Advantage) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\RelevantKnowledge\About RelevantKnowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\RelevantKnowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\RelevantKnowledge\Uninstall Instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.
C:\WINDOWS\ogx5r1bglo.dat (Malware.Trace) -> Quarantined and deleted successfully.

Janzen 18.06.2010 15:37
Das erste Logfile heoßt Extras:

OTL Logfile:
Code:
OTL Extras logfile created on: 18.06.2010 16:09:35 - Run 1
OTL by OldTimer - Version 3.2.6.0    Folder = C:\Dokumente und Einstellungen\XXX\Eigene Dateien
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): J:\pagefile.sys 3000 3000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 12,32 Gb Total Space | 0,79 Gb Free Space | 6,44% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 136,73 Gb Total Space | 6,61 Gb Free Space | 4,84% Space Free | Partition Type: NTFS
 
Computer Name: XXX
Current User Name: XXX
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- J:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" File not found
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" File not found
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "J:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "J:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\concept design\onlineTV 4\onlineTV.exe" = C:\Programme\concept design\onlineTV 4\onlineTV.exe:*:Enabled:onlineTV -- (concept/design GmbH)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ\Icq.exe" = C:\Programme\ICQ\Icq.exe:*:Enabled:ICQ -- (ICQ Inc.)
"J:\eMule\emule.exe" = J:\eMule\emule.exe:*:Enabled:eMule -- (hxxp://www.emule-project.net)
"J:\Game´z\Blobby an 192.168.1.64\volley.exe" = J:\Game´z\Blobby an 192.168.1.64\volley.exe:*:Enabled:volley -- File not found
"\\Seeplor\blobby volley\volley.exe" = \\Seeplor\blobby volley\volley.exe:*:Enabled:volley.exe
"J:\Game´z\Valve\Steam\Steam.exe" = J:\Game´z\Valve\Steam\Steam.exe:*:Enabled:Steam -- File not found
"J:\Game´z\Valve\Steam\SteamApps\XXX\counter-strike\hl.exe" = J:\Game´z\Valve\Steam\SteamApps\XXX\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"J:\Game´z\empires neuzeit\Empires_DMW.exe" = J:\Game´z\empires neuzeit\Empires_DMW.exe:*:Enabled:Empires_DMW -- File not found
"C:\Programme\HLSW\hlsw.exe" = C:\Programme\HLSW\hlsw.exe:*:Enabled:HLSW -- (Stripf Software)
"J:\Game´z\HALF-LIFE an Steven\hl.exe" = J:\Game´z\HALF-LIFE an Steven\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"J:\Game´z\Call of Duty\CoDUOMP.exe" = J:\Game´z\Call of Duty\CoDUOMP.exe:*:Enabled:CoDUOMP -- File not found
"J:\Game´z\Age2\aoe2\age2_x1.exe" = J:\Game´z\Age2\aoe2\age2_x1.exe:*:Enabled:Age of Empires II Expansion -- File not found
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Programme\mIRC\mirc.exe" = C:\Programme\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)
"J:\Game´z\World of Warcraft\WoW-1.6.1.4544-to-1.7.0-deDE-downloader.exe" = J:\Game´z\World of Warcraft\WoW-1.6.1.4544-to-1.7.0-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\DC++\DCPlusPlus.exe" = J:\DC++\DCPlusPlus.exe:*:Enabled:DC++ -- File not found
"J:\Game´z\Call of Duty\CoDMP.exe" = J:\Game´z\Call of Duty\CoDMP.exe:*:Enabled:CoDMP -- File not found
"J:\Game´z\C&C\generäle\game.dat" = J:\Game´z\C&C\generäle\game.dat:*:Enabled:game -- File not found
"J:\Game´z\World of Warcraft\WoW-1.8.3.4807-to-1.8.4.4878-deDE-downloader.exe" = J:\Game´z\World of Warcraft\WoW-1.8.3.4807-to-1.8.4.4878-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\Game´z\World of Warcraft\WoW-1.8.4-deDE-downloader.exe" = J:\Game´z\World of Warcraft\WoW-1.8.4-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\Game´z\World of Warcraft\Repair.exe" = J:\Game´z\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility -- File not found
"J:\World of Warcraft\WoW-1.8.4-deDE-downloader.exe" = J:\World of Warcraft\WoW-1.8.4-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\World of Warcraft\BackgroundDownloader.exe" = J:\World of Warcraft\BackgroundDownloader.exe:*:Disabled:Blizzard Downloader -- File not found
"J:\World of Warcraft\WoW-1.10.2.5302-to-1.11.0.5428-deDE-downloader.exe" = J:\World of Warcraft\WoW-1.10.2.5302-to-1.11.0.5428-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-deDE-downloader.exe" = J:\World of Warcraft\WoW-1.11.1.5462-to-1.11.2.5464-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- File not found
"J:\World of Warcraft\WoW-1.11.2.5464-to-1.12.0.5595-deDE-downloader.exe" = J:\World of Warcraft\WoW-1.11.2.5464-to-1.12.0.5595-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-deDE-downloader.exe" = J:\World of Warcraft\WoW-1.12.0.5595-to-1.12.1.5875-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"C:\Dokumente und Einstellungen\XXX\Desktop\WoW-BurningCrusade-deDE-Installer-downloader.exe" = C:\Dokumente und Einstellungen\XXX\Desktop\WoW-BurningCrusade-deDE-Installer-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"C:\Dokumente und Einstellungen\XXX\Desktop\WoW-BurningCrusade-deDE-Installer-downloader(2).exe" = C:\Dokumente und Einstellungen\XXX\Desktop\WoW-BurningCrusade-deDE-Installer-downloader(2).exe:*:Enabled:Blizzard Downloader -- File not found
"C:\Programme\PPStream\PPStream.exe" = C:\Programme\PPStream\PPStream.exe:*:Enabled:PPStream -- File not found
"J:\World of Warcraft\WoW-2.0.3-deDE-downloader.exe" = J:\World of Warcraft\WoW-2.0.3-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"J:\World of Warcraft\WoW-2.0.3.6299-to-2.0.12.6546-deDE-downloader.exe" = J:\World of Warcraft\WoW-2.0.3.6299-to-2.0.12.6546-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"C:\Dokumente und Einstellungen\XXX\Desktop\WoW-BurningCrusade-enGB-Installer-downloader.exe" = C:\Dokumente und Einstellungen\XXX\Desktop\WoW-BurningCrusade-enGB-Installer-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"C:\Dokumente und Einstellungen\XXX\Desktop\Crisisatdaportal_DE_SUBS_avi-downloader.exe" = C:\Dokumente und Einstellungen\XXX\Desktop\Crisisatdaportal_DE_SUBS_avi-downloader.exe:*:Enabled:Blizzard Downloader -- File not found
"C:\WINDOWS\system32\svhst32.exe" = C:\WINDOWS\system32\svhst32.exe:*:Enabled:SystemVersion -- File not found
"\\HANZ\UT\System\UnrealTournament.exe" = \\HANZ\UT\System\UnrealTournament.exe:*:Enabled:UnrealTournament.exe
"J:\Game´z\UT\System\UnrealTournament.exe" = J:\Game´z\UT\System\UnrealTournament.exe:*:Enabled:UnrealTournament -- File not found
"J:\Game´z\Cs 1.5\hl.exe" = J:\Game´z\Cs 1.5\hl.exe:*:Enabled:Half-Life Launcher -- File not found
"C:\WINDOWS\system32\svct.exe" = C:\WINDOWS\system32\svct.exe:*:Enabled:SystemVersion -- File not found
"C:\WINDOWS\ctgt86.exe" = C:\WINDOWS\ctgt86.exe:*:Enabled:ctgt86 -- File not found
"C:\WINDOWS\system32\svct_32.exe" = C:\WINDOWS\system32\svct_32.exe:*:Enabled:SystemVersion -- File not found
"D:\fsetup.exe" = D:\fsetup.exe:*:Enabled:AVM FSetup Application -- File not found
"C:\Programme\FRITZ!DSL\IGDCTRL.EXE" = C:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Enabled:FRITZ!DSL - igdctrl.exe -- (AVM Berlin)
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\concept design\onlineTV 4\onlineTV.exe" = C:\Programme\concept design\onlineTV 4\onlineTV.exe:*:Enabled:onlineTV -- (concept/design GmbH)
"C:\Programme\uusee\UUSeePlayer.exe" = C:\Programme\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer -- File not found
"C:\Programme\PPMate\ppmate.exe" = C:\Programme\PPMate\ppmate.exe:*:Enabled:PPMate -- File not found
"C:\Programme\PPMate\ppamnet.exe" = C:\Programme\PPMate\ppamnet.exe:*:Enabled:PPMate -- File not found
"J:\Game´z\assasin\AssassinsCreed_Dx9.exe" = J:\Game´z\assasin\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9 -- File not found
"J:\Game´z\assasin\AssassinsCreed_Dx10.exe" = J:\Game´z\assasin\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10 -- File not found
"J:\Game´z\assasin\AssassinsCreed_Launcher.exe" = J:\Game´z\assasin\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update -- File not found
"C:\Programme\sina\SAP\SAPlatform.exe" = C:\Programme\sina\SAP\SAPlatform.exe:*:Enabled:SAPlatform.exe -- File not found
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}" = Pivot Software
"{022DA2C3-81C7-4003-A6BC-1BB147B20097}" = SuppSoft
"{0405E51E-9582-4207-8F38-AC44201D3808}" = VeohTV BETA
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{072A1145-79D5-4BEB-4D8A-59CCB7CB31AE}" = Catalyst Control Center Graphics Full Existing
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{097CF8DE-C007-F3C5-2A80-C1AD2A9D7EFB}" = Catalyst Control Center Graphics Previews Common
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0E5E5B46-61B6-3FF3-5C7C-87F1AC00568E}" = CCC Help Czech
"{0F200FB1-B904-1820-0EEA-15C458B575B3}" = CCC Help Portuguese
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP140_series" = Canon MP140 series
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{145C6099-E682-AFBB-4E4C-2FE72333E2FB}" = CCC Help Hungarian
"{15A0B9F3-DCE9-42D8-0F81-A03C0BF9BB3B}" = CCC Help Norwegian
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19A84EB1-D85B-BB4F-0030-B7E2BC1ACB6F}" = Catalyst Control Center Localization Dutch
"{1BF4CB7A-85C6-0480-30D9-C8F711C9D99E}" = Catalyst Control Center Localization Chinese Traditional
"{1CA941F1-5006-487E-9FD4-09F812A7D6B8}" = Norton 360 Help
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2034E9E2-60F5-A335-363F-9FA9B0864FBA}" = CCC Help Chinese Standard
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{21829177-4DED-4209-AD08-490B3AC9C01A}" = Norton 360
"{228F6876-A313-40A3-91C0-C3CBE6997D09}" = GearDrvs
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{233EE11F-A04C-B612-AEDF-16A312986113}" = Catalyst Control Center Graphics Light
"{2358a6dd-dfcc-4519-90a8-63ad28847171}" = RelevantKnowledge
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{2808E975-BD01-47DD-9852-54E3C622BDDC}" = WLAN Monitor
"{2C3738C9-56FA-410A-BCB5-79C5DFD238F0}" = TuneUp Utilities 2004
"{2D617065-1C52-4240-B5BC-C0AE12157777}" = Norton 360
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{3074EB89-1BCA-4AEF-AFF4-EFB4634C1923}" = Norton Confidential Web Authentification Component
"{31DABA20-10A1-4746-9D9F-57955B8DFF66}" = Free Games Offer, Desktop Shortcut
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3405EF6E-6E68-AF1A-A165-4832ADA3221E}" = Catalyst Control Center Localization Finnish
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{354DC3BC-A17F-E931-E696-E57EF0BF39B1}" = CCC Help Japanese
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{39BBA37B-E375-4977-6EC2-9FB182A18CD1}" = Catalyst Control Center Localization Russian
"{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" = ccCommon
"{3CFC1E5C-52C5-F564-BBBD-A791A0ED2868}" = CCC Help Swedish
"{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}" = DAEMON Tools
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40A77C5E-831D-53B7-6DD6-049390E99737}" = CCC Help Turkish
"{43673268-252B-10C5-A96B-BD766CECF1BC}" = Catalyst Control Center Localization Korean
"{43B7C43F-406C-4DE5-DCC5-6712A09890D1}" = Catalyst Control Center Localization Danish
"{4517BAE4-D4F2-3A21-38F7-8E4D798515E3}" = Catalyst Control Center Localization Norwegian
"{4843B611-8FCB-4428-8C23-31D0A5EAE164}" = Norton Confidential Browser Component
"{49FC50FC-F965-40D9-89B4-CBFF80941031}" = Windows Movie Maker 2.0
"{4B0F42ED-C1AA-1EE3-694C-B338B60D202A}" = Catalyst Control Center Localization German
"{4DE8C2BD-F830-CB44-3C55-FC77DE3FDB80}" = CCC Help German
"{4FAF0223-13C2-E94B-6E9E-D5807EFE8589}" = CCC Help Korean
"{51007CF9-CB4C-265B-D62A-FF6BFD327ABA}" = Catalyst Control Center Localization Polish
"{512CF520-5B4A-46DA-90D7-AF179B424DCB}" = QuickCalc
"{526AAE17-8067-9BF2-C56B-EE8CEED32254}" = CCC Help Polish
"{56BA64AD-C2DF-9C71-E521-F87A2D335F57}" = Catalyst Control Center Localization French
"{57A17677-2064-D213-F2C0-37874112BCE8}" = ccc-utility
"{5B680750-760B-49E4-81E7-21B2B337F9F7}" = Microsoft Works
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" = Norton 360
"{666CF041-77BE-414E-9A9D-0A227E9B48F8}" = Norton™ Security Scan
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68249B78-B714-11D7-88E8-0050DA21757E}" = Java 2 Runtime Environment Standard Edition 1.3.1_18
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PartitionMagic
"{6E637484-7ED6-4AA5-BEDC-FD821F64D372}_is1" =  Moyea Video4Web Converter version  1.6.2.0
"{7158F6F3-E9F2-4133-8755-401AE64BC2C8}" = USB_20_HDD
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{785A16DC-26B7-3184-D5F7-4186C90F77B9}" = Catalyst Control Center Localization Chinese Standard
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{7DCA3763-701D-45DD-8F6B-A8C3206C0289}" = ActiveSpeed
"{849A20E0-8A09-45F9-BE58-4DAE823E8CE4}" = Catalyst Control Center Localization Czech
"{85785A25-4ED5-1CDF-24BF-4AD32FFDCD3D}" = Catalyst Control Center Localization Turkish
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{911B0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{91EF6424-0C93-4C2C-9858-B4F8625645AD}" = PDF Suite 2010
"{929408E6-D265-4174-805F-81D1D914E2A4}" = QuickTime
"{92B1B3CC-EC78-45B8-96D0-8B3F11495864}" = Symantec Technical Support Controls
"{93693EB3-E1E9-BC11-76D9-E03BF7338FC9}" = CCC Help Greek
"{9541B99F-5A88-9C02-6424-F17883E907A9}" = Catalyst Control Center Localization Spanish
"{9600B88C-BE14-4BEA-A529-F5F312900BA3}" = Samsung PC Studio 3
"{973DFE07-93EE-4EC0-73B2-1E9B1EB1B46D}" = CCC Help Danish
"{97B2C4BB-08B1-6092-0F67-62AFA077444C}" = CCC Help Russian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A35883BD-9C83-4625-82F3-90F86728C662}" = FreeUndelete
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A70FF5D5-D3A5-27EF-9751-3280710AFB9C}" = Skins
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A958AD7D-A598-A2B6-CB71-19033DAD6730}" = Catalyst Control Center Localization Swedish
"{A9F95496-FA05-9808-2A6A-850D7CD6513A}" = CCC Help Thai
"{AAF4238F-7C29-451D-9925-C753271A5728}" = Microsoft Visual C++ Run Time  Lib Setup
"{AAFEE577-C6AE-AB27-479D-592E2A74DBCE}" = Catalyst Control Center Localization Greek
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B086AF23-5775-46EE-882D-19BF0974742E}" = Sid Meier's Civilization 4 - Beyond the Sword - Final Frontier Demo
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B18A9215-5C66-C719-F861-2491E0726B78}" = CCC Help Spanish
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B41B9D4A-42D5-F51F-4F9A-626D9A06CB4C}" = ccc-core-preinstall
"{B5DF8957-5B84-405F-95C0-A64BE3C9CFF6}" = Microsoft LifeChat
"{B6E9A977-C2C7-4CA0-0001-98605B7C7D3E}" = MyTube Recorder
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{B9A5D708-5F66-1B3D-A2D5-4A6E24BF32F7}" = CCC Help Chinese Traditional
"{BB10A37C-4BFB-BC3D-2CE4-72895A56FFAA}" = Catalyst Control Center Localization Hungarian
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C12C6589-32A4-2D8E-C8D5-C85CCF40157F}" = ccc-core-static
"{C1609713-CAE7-9D05-46C5-97CF48ECE7E7}" = Catalyst Control Center Localization Japanese
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C40B3988-1BF3-12FD-10AC-F708BF1C5CFC}" = Catalyst Control Center Core Implementation
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C61177FD-37C4-4C5F-BE6C-E04A8AC399B6}" = EclipseCrossword
"{C7888C3F-0506-555F-7907-CDD3F81719A5}" = Adobe Media Player
"{C876E6DA-EC76-B2EC-6E09-3A7E00233750}" = CCC Help Italian
"{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}" = AVIVO Codecs
"{CAEFCB7D-C290-57B2-D10D-E3DDBA524232}" = CCC Help Finnish
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CC93120F-55BA-2E8A-C3B6-982B57600A89}" = Catalyst Control Center Localization Portuguese
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE94D3CF-8435-42E6-B1A3-D13917ABCF04}" = TOM Live Player
"{D353CC51-430D-4C6F-9B7E-52003DA1E05A}" = Norton Confidential Web Protection Component
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D72C29C6-8476-B58D-9453-6D0FCD7FF481}" = Catalyst Control Center Graphics Full New
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DD9E5033-7C22-4665-2232-1F8E5BB3B450}" = Catalyst Control Center Localization Thai
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{E07B7A31-E160-466D-A003-3BB7B8989D52}" = Full Tilt Poker.Net
"{E40268F4-7E9F-4E07-B773-7FF64971F42E}" = WLAN Quick-Starter
"{E4ABEF81-DE3D-DF19-BC99-BC34E2BD16B3}" = CCC Help Dutch
"{E58CBA0A-710D-4BDE-ABEA-5446A56AE5E2}_is1" = concept/design onlineTV 4
"{E7240B3B-9B61-491F-8901-7410980C739B}" = Symantec Real Time Storage Protection Component
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{ED3948D4-05E9-A37B-1D52-2466AEA87F5E}" = Catalyst Control Center Localization Italian
"{EF4A88E7-AB69-EB25-2920-0F46F27D0DB2}" = CCC Help French
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null
"{F413B69D-4AD6-42ab-AEA5-0548989FAD50}" = Norton 360
"{F4DB525F-A986-4249-B98B-42A8066251CA}" = AV
"{F5F16F97-9094-02B8-2BF0-F03E67C4E55C}" = CCC Help English
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FA3A247D-437A-455E-A88F-7EB6E5F9E799}" = Catalyst Control Center - Branding
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem  (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows-Treiberpaket - MobileTop (sshpusb) USB  (02/23/2007 2.5.0.0)
"ABC Amber Audio Converter" = ABC Amber Audio Converter
"AC3Filter" = AC3Filter (remove only)
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Archive Password Recovery" = Advanced Archive Password Recovery (remove only)
"All ATI Software" = ATI - Software Uninstall Utility
"All-in-One DVD Player_is1" = All-in-One DVD Player Powered by AdVantage
"Alt WAV MP3 WMA OGG Converter 7.2 Shareware_is1" = Alt WAV MP3 WMA OGG Converter 7.2
"Applian FLV Player2.0.24" = Applian FLV Player
"Ashampoo Magical Security 2007" = Ashampoo Magical Security 2007
"Ask Toolbar_is1" = Ask Toolbar
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"Battle for Wesnoth 1.7.13-1.8beta6" = Battle for Wesnoth 1.7.13-1.8beta6
"BLASC" = BLASC
"Canon MP140 series Benutzerregistrierung" = Canon MP140 series Benutzerregistrierung
"C-Media Audio Driver" = C-Media WDM Audio Driver
"Command & Conquer 95" = Command & Conquer Windows 95
"Crimsonland_is1" = Crimsonland
"Daimonin Client_is1" = Daimonin Client 0.967.1 patch 108
"DFÜ-Speed" = DFÜ-Speed
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"EADM" = EA Download Manager
"Easy-LayoutPrint" = Canon Utilities Easy-LayoutPrint
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"eMule" = eMule
"Expekt Poker" = Expekt Poker
"Explorer Suite_is1" = Explorer Suite III
"File Recover_is1" = File Recover 7.0
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"Free CD to MP3 Converter" = Free CD to MP3 Converter
"Free Download Manager_is1" = Free Download Manager 2.5
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.1
"FRITZ!DSL" = AVM FRITZ!DSL
"FUSSBALL MANAGER 08" = FUSSBALL MANAGER 08
"FUSSBALL MANAGER 09" = FUSSBALL MANAGER 09
"FUSSBALL MANAGER 09 DEMO" = FUSSBALL MANAGER 09 DEMO
"FUSSBALL MANAGER 10" = FUSSBALL MANAGER 10
"GameSpy Arcade" = GameSpy Arcade
"GetRight_is1" = GetRight
"GMX ProfiFax" = GMX ProfiFax
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"HighGrow Freeware Version 4.20" = HighGrow Freeware Version 4.20
"HijackThis" = HijackThis 2.0.2
"HLSW_is1" = HLSW v1.0.0.39
"Hotspot_Shield Toolbar" = Hotspot_Shield Toolbar
"HotspotShield" = Hotspot Shield 1.04
"ICQ" = ICQ
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{0405E51E-9582-4207-8F38-AC44201D3808}" = VeohTV BETA
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}" = PowerQuest PartitionMagic 8.0
"InstallShield_{7158F6F3-E9F2-4133-8755-401AE64BC2C8}" = USB_20_HDD
"InstallShield_{929408E6-D265-4174-805F-81D1D914E2A4}" = QuickTime
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null
"JAP" = JAP
"K!TV" = K!TV
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 4.7.5
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Miranda IM" = Miranda IM 0.6.8
"mIRC" = mIRC
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MP Navigator 3.1" = Canon MP Navigator 3.1
"MultiRes (remove only)" = MultiRes (remove only)
"Nero - Burning Rom!UninstallKey" = Ahead Nero 6 Demo
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PageFour_is1" = PageFour 1.66
"PANZERS - Phase1" = PANZERS - Phase1
"PartyPoker" = PartyPoker
"PDF Editor 2" = PDF Editor 2
"Pegasus Mail" = Pegasus Mail
"Picasa2" = Picasa 2
"PokerStars" = PokerStars
"PokerStars.net" = PokerStars.net
"ppmate" = PPMate Network TV 2.3.1.74
"PPStream_is1" = PPStream
"QIP 8070 Jeak Edition" = QIP 8070 Jeak Edition
"QIP Infium_is1" = QIP Infium 2.0.9020 RC3
"QIP2005" = QIP 2005 Uninstall
"Radeon Omega Drivers for Windows 2k/XPv3.8.330" = Radeon Omega Drivers v3.8.330 Setup Files and Tools
"Replay_Converter_1" = Replay Converter 2.8
"RiseOfNations 1.0" = Microsoft Rise Of Nations
"RiseofNationsExpansion 1.0" = Rise of Nations Thrones and Patriots
"Risk" = Risk
"RonyaSoft CD DVD Label Maker" = RonyaSoft CD DVD Label Maker 2.01
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SeaMonkey (1.1.11)" = SeaMonkey (1.1.11)
"Security Task Manager" = Security Task Manager 1.7h
"Shockwave" = Shockwave
"Sina Web TV" = Sina Web TV
"SopCast" = SopCast 3.2.9
"Sprüche- und Zitate-Lexikon 4.0" = Sprüche- und Zitate-Lexikon 4.0
"SPVOD Player1.8" = SPVOD Player1.8
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"Spyware Doctor" = Spyware Doctor 5.0
"Steam" = Steam
"Steam App 240" = Counter-Strike: Source
"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)
"SymSetup.{2D617065-1C52-4240-B5BC-C0AE12157777}" = Norton 360 Online (Symantec Corporation)
"SystemRequirementsLab" = System Requirements Lab
"TeamSpeak 2 RC2_is1" = TeamSpeak 2 RC2
"TestPokerStars.com" = TestPokerStars.com
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.3.4.1
"Ugutil" = Upgrade Utility
"Uninstall_is1" = Uninstall 1.0.0.1
"UnityWebPlayer" = Unity Web Player
"UUSEE_base" = UUSee ²¥·Å²å¼þ»ù´¡°ü 4.8.2.4
"Veetle TV" = Veetle TV 0.9.16
"VLC media player" = VLC media player 1.0.5
"WIC" = Windows Imaging Component
"WinAce Archiver" = WinAce Archiver
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR Archivierer
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wolfenstein - Enemy Territory" = Wolfenstein - Enemy Territory
"Works2004Setup" = Setup-Start von Microsoft Works 2004
"World of Warcraft" = World of Warcraft
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Zattoo" = Zattoo 3.3.4 Beta
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MessageViewer Pro" = MessageViewer Pro 3.1.5
"QIP 2005" = QIP 2005 8095
"Steam App 10" = Counter-Strike
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 16.06.2010 12:06:45 | Computer Name = XXX | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
 
Error - 17.06.2010 07:21:58 | Computer Name = XXX | Source = ESENT | ID = 490
Description = svchost (1164) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 
Error - 17.06.2010 07:21:58 | Computer Name = XXX | Source = ESENT | ID = 470
Description = Catalog Database (1164) Datenbank C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
 wurde teilweise angehängt. Anhängungsstufe: 3. Fehler: -1032.
 
Error - 17.06.2010 12:06:47 | Computer Name = XXX | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
 
Error - 18.06.2010 04:35:25 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 05:35:26 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 06:35:26 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 07:35:28 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 08:35:29 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 09:35:26 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
[ Application Events ]
Error - 16.06.2010 12:06:45 | Computer Name = XXX | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
 
Error - 17.06.2010 07:21:58 | Computer Name = XXX | Source = ESENT | ID = 490
Description = svchost (1164) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
 für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
 Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
 wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. 
Error - 17.06.2010 07:21:58 | Computer Name = XXX | Source = ESENT | ID = 470
Description = Catalog Database (1164) Datenbank C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
 wurde teilweise angehängt. Anhängungsstufe: 3. Fehler: -1032.
 
Error - 17.06.2010 12:06:47 | Computer Name = XXX | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
 
Error - 18.06.2010 04:35:25 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 05:35:26 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 06:35:26 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 07:35:28 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 08:35:29 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
Error - 18.06.2010 09:35:26 | Computer Name = XXX | Source = Google Update | ID = 20
Description =
 
[ System Events ]
Error - 19.05.2010 15:26:43 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 19.05.2010 15:27:26 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 26.05.2010 21:17:39 | Computer Name = XXX | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst AVM
 IGD CTRL Service.
 
Error - 26.05.2010 21:17:39 | Computer Name = XXX | Source = Service Control Manager | ID = 7000
Description = Der Dienst "AVM IGD CTRL Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 29.05.2010 08:13:02 | Computer Name = XXX | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "EraserUtilDrv11010.sys" auf Volume "HarddiskVolume1"
 ist im Wiederherstellungsfilter der unerwartete Fehler "0xC0000243" aufgetreten.
 Die Volumeüberwachung wurde angehalten.
 
Error - 30.05.2010 09:01:53 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "F:" aus.
 
Error - 09.06.2010 06:00:56 | Computer Name = XXX | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 09.06.2010 06:00:57 | Computer Name = XXX | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 18.06.2010 10:03:45 | Computer Name = XXX | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
Error - 18.06.2010 10:04:17 | Computer Name = XXX | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  PCIIde  ViaIde
 
 
< End of report >
--- --- ---


Das 2. Logfile heißt OTL:

OTL Logfile:
Code:
OTL logfile created on: 18.06.2010 16:09:35 - Run 1
OTL by OldTimer - Version 3.2.6.0    Folder = C:\Dokumente und Einstellungen\XXX\Eigene Dateien
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): J:\pagefile.sys 3000 3000 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 12,32 Gb Total Space | 0,79 Gb Free Space | 6,44% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 136,73 Gb Total Space | 6,61 Gb Free Space | 4,84% Space Free | Partition Type: NTFS
 
Computer Name: XXX
Current User Name: XXX
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\XXX\Eigene Dateien\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - J:\PDF Suite 2010\ConversionService.exe (Interactive Brands Inc.)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - J:\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - J:\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - J:\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Hotspot Shield\bin\openvpnas.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
PRC - C:\Programme\FRITZ!DSL\FwebProt.exe (AVM Berlin)
PRC - C:\Programme\FRITZ!DSL\StCenter.exe (AVM Berlin)
PRC - C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe (AccSys GmbH)
PRC - C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\XXX\Eigene Dateien\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (TUWinStylerThemeSvc) --  File not found
SRV - (sdCoreService) --  File not found
SRV - (sdAuxService) --  File not found
SRV - (iPodService) --  File not found
SRV - (GoogleDesktopManager) --  File not found
SRV - (PDF Suite 2010 Service) -- J:\PDF Suite 2010\ConversionService.exe (Interactive Brands Inc.)
SRV - (Lavasoft Ad-Aware Service) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (AntiVirService) -- J:\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- J:\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (vvdsvc) -- C:\WINDOWS\system32\Nagasoft\vjocx.dll (南京纳加软件有限公司)
SRV - (HotspotShieldService) -- C:\Programme\Hotspot Shield\bin\openvpnas.exe ()
SRV - (LiveUpdate Notice Service) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
SRV - (Symantec Core LC) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (comHost) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe (Symantec Corporation)
SRV - (LiveUpdate Notice Ex) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (CLTNetCnService) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (p2pgasvc) -- C:\WINDOWS\system32\p2pgasvc.dll (Microsoft Corporation)
SRV - (Adobe LM Service) -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe ()
SRV - (AVM IGD CTRL Service) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (de_serv) -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe (AVM Berlin)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (AccWLSvc) -- C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe (AccSys GmbH)
SRV - (Atp.ntpsi) -- C:\WINDOWS\system32\odbcad32.exe (Microsoft Corporation)
SRV - (Iprip) -- C:\WINDOWS\system32\iprip.dll (Microsoft Corporation)
SRV - (SimpTcp) -- C:\WINDOWS\system32\tcpsvcs.exe (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (eeCtrl) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVEX15) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20100617.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20100617.003\NAVENG.SYS (Symantec Corporation)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (Lbd) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SYMIDSCO) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SymcData\idsdefs\20100615.001\SymIDSco.sys (Symantec Corporation)
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- J:\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (tapvpn) -- C:\WINDOWS\system32\drivers\tapvpn.sys (The OpenVPN Project)
DRV - (SRTSPL) -- C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) -- C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)
DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (IkSysFlt) -- C:\WINDOWS\system32\drivers\iksysflt.sys (PCTools Research Pty Ltd.)
DRV - (pivot) -- C:\WINDOWS\system32\drivers\pivot.sys (Portrait Displays, Inc.)
DRV - (pivotmou) -- C:\WINDOWS\system32\drivers\pivotmou.sys (Portrait Displays, Inc.)
DRV - (IKSysSec) -- C:\WINDOWS\system32\drivers\iksyssec.sys (PCTools Research Pty Ltd.)
DRV - (IKFileSec) -- C:\WINDOWS\system32\drivers\ikfilesec.sys (PCTools Research Pty Ltd.)
DRV - (IKFileFlt) -- C:\WINDOWS\system32\drivers\ikfileflt.sys (PCTools Research Pty Ltd.)
DRV - (SPBBCDrv) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMFW) -- C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMIDS) -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMNDIS) -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMREDRV) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMDNS) -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\AtiHdAud.sys (ATI Research Inc.)
DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (StarOpen) -- C:\WINDOWS\system32\drivers\StarOpen.sys ()
DRV - (xfilt) -- C:\WINDOWS\system32\DRIVERS\xfilt.sys (VIA Technologies,Inc)
DRV - (videX32) -- C:\WINDOWS\system32\DRIVERS\videX32.sys (VIA Technologies, Inc.)
DRV - (NETFWDSL) -- C:\WINDOWS\system32\drivers\NETFWDSL.SYS (AVM Berlin)
DRV - (NETDSL) -- C:\WINDOWS\system32\drivers\netdsl.sys (Microsoft Corporation)
DRV - (accwldrv) -- C:\WINDOWS\system32\drivers\accwldrv.sys (AccSys GmbH)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (d347prt) -- C:\WINDOWS\System32\Drivers\d347prt.sys ( )
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (PRISM_A00) -- C:\WINDOWS\system32\drivers\PRISMA00.sys (Intersil Americas Inc.)
DRV - (PhTVTune) -- C:\WINDOWS\system32\drivers\PhTVTune.sys (Philips Semiconductors)
DRV - (Cap7134) MEDION (7134) -- C:\WINDOWS\system32\drivers\Cap7134.sys (Philips Semiconductors)
DRV - (Intels51) -- C:\WINDOWS\system32\drivers\ctxs51.sys (Intel Corporation)
DRV - (PQNTDrv) -- C:\WINDOWS\system32\drivers\PQNTDRV.sys (PowerQuest Corporation)
DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = start.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.selectedEngine: "QIP Search"
FF - prefs.js..browser.startup.homepage: "hxxp://start.qip.ru"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {A89AED22-9133-424c-88E7-C8235C5FF302}:0.9.1
FF - prefs.js..network.proxy.type: 4
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: J:\Programme\Mozilla Firefox\components [2010.06.18 11:18:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: J:\Programme\Mozilla Firefox\plugins [2010.06.18 11:18:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\SeaMonkey 1.1.11\Extensions\\Components: C:\Programme\mozilla.org\SeaMonkey\Components [2010.02.09 20:56:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\SeaMonkey 1.1.11\Extensions\\Plugins: C:\Programme\mozilla.org\SeaMonkey\Plugins [2010.02.07 16:41:22 | 000,000,000 | ---D | M]
 
[2008.08.31 17:21:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Extensions
[2010.06.18 10:59:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\6abymfcw.default\extensions
[2010.06.18 10:59:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\hua5zddq.XXX\extensions
[2010.06.18 11:00:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\ojjmil73.Standard-Benutzer\extensions
[2010.06.18 11:00:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\ojjmil73.Standard-Benutzer\extensions\fdm_ffext@freedownloadmanager.org
 
O1 HOSTS File: ([2001.08.18 21:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.5\NppBHO.dll (Symantec Corporation)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Hotspot Shield Toolbar) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll File not found
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll File not found
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Norton-Symbolleiste anzeigen) - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.5\UIBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Hotspot Shield Toolbar) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
O3 - HKLM\..\Toolbar: (Veoh Browser Plug-in) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (Hotspot Shield Toolbar) - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll File not found
O4 - HKLM..\Run: [avgnt] J:\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Programme\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\XXX\Startmenü\Programme\Autostart\FRITZ!DSL Protect.lnk = C:\Programme\FRITZ!DSL\FwebProt.exe (AVM Berlin)
O4 - Startup: C:\Dokumente und Einstellungen\XXX\Startmenü\Programme\Autostart\FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe (AVM Berlin)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe (ICQ Inc.)
O9 - Extra 'Tools' menuitem : ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe (ICQ Inc.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - J:\poker\PokerStarsUpdate.exe (PokerStars)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Programme/Risk/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158857053128 (MUWebControl Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-1_3_1_18-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Programme/Risk/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~1\google\google~3\goec62~1.dll) - c:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (infomsas.dll) -  File not found
O20 - AppInit_DLLs: (confxxn.dll) -  File not found
O20 - AppInit_DLLs: (confjfg.dll) -  File not found
O20 - AppInit_DLLs: (jfgstat.dll) -  File not found
O20 - AppInit_DLLs: (confmms.dll) -  File not found
O20 - AppInit_DLLs: (mmsstat.dll) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\autowinn: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\jfgmgr: DllName - jfgmgr32.dll -  File not found
O20 - Winlogon\Notify\mmsmgr: DllName - mmsmgr32.dll -  File not found
O20 - Winlogon\Notify\nethesen: DllName - C:\WINDOWS\system32\nethesen.dll - C:\WINDOWS\System32\nethesen.dll File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: J:\ICQ DOWNLODAS\243195095_Clarissa\P4020865.JPG
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.01.31 22:55:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009.08.02 13:45:01 | 212,547,140 | ---- | M] () - J:\Auto1.ea -- [ NTFS ]
O32 - AutoRun File - [2009.08.02 10:25:37 | 211,201,729 | ---- | M] () - J:\Auto2.ea -- [ NTFS ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\atisetup.exe -- File not found
O33 - MountPoints2\D\Shell\launch\command - "" = D:\atisetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.18 16:08:41 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\OTL.exe
[2010.06.18 12:29:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Malwarebytes
[2010.06.18 12:29:12 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.06.18 12:29:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.06.18 12:29:09 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.06.18 12:29:09 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.18 12:28:24 | 006,153,648 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\mbam-setup.exe
[2010.06.18 11:15:46 | 008,188,856 | ---- | C] (Mozilla) -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Firefox Setup 3.6.3.exe
[2010.06.18 10:46:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Downloads
[2010.06.17 13:27:19 | 000,000,000 | ---D | C] -- C:\Programme\NortonInstaller
[2010.06.09 12:43:27 | 000,000,000 | ---D | C] -- C:\Programme\EclipseCrossword
[2010.06.07 20:27:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia
[2005.02.03 19:42:13 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.18 16:15:07 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\Install_NSS.job
[2010.06.18 16:09:16 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010.06.18 16:09:16 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010.06.18 16:09:16 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010.06.18 16:09:15 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010.06.18 16:09:15 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010.06.18 16:08:42 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\OTL.exe
[2010.06.18 16:06:04 | 000,243,620 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.06.18 16:04:03 | 000,001,014 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010.06.18 16:03:43 | 000,001,078 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.06.18 16:03:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.06.18 16:03:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.06.18 16:00:37 | 027,787,264 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\NTUSER.DAT
[2010.06.18 16:00:37 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\XXX\ntuser.ini
[2010.06.18 15:35:26 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.06.18 15:00:00 | 000,000,388 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan.job
[2010.06.18 12:28:24 | 006,153,648 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\mbam-setup.exe
[2010.06.18 11:15:47 | 008,188,856 | ---- | M] (Mozilla) -- C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Firefox Setup 3.6.3.exe
[2010.06.17 13:20:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.06.09 22:58:07 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt
[2010.06.09 22:56:01 | 000,000,297 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Samsung PC Studio 3.lnk
[2010.06.08 14:57:44 | 000,021,577 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Folgen der friedlichen Revolution2.odt
[2010.05.31 13:04:54 | 000,022,016 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\bio.doc
[2010.05.28 17:15:00 | 000,000,364 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2010.05.26 17:48:42 | 003,351,552 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Tierbilder.doc
[2010.05.26 07:07:36 | 000,039,108 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\44442581_gazza_jone300s.jpg
[2010.05.26 06:51:50 | 000,028,935 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\rage-against-the-machine1.jpg
[2010.05.23 08:37:51 | 000,058,044 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\l_4fb18e426a7de440df3193bd8d8da4e6.jpg
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.06.09 22:58:07 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt
[2010.06.09 22:56:01 | 000,000,297 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Samsung PC Studio 3.lnk
[2010.05.30 19:10:43 | 000,022,016 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\bio.doc
[2010.05.26 17:48:41 | 003,351,552 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Tierbilder.doc
[2010.05.26 07:07:36 | 000,039,108 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\44442581_gazza_jone300s.jpg
[2010.05.26 06:51:49 | 000,028,935 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\rage-against-the-machine1.jpg
[2010.05.23 08:37:50 | 000,058,044 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\l_4fb18e426a7de440df3193bd8d8da4e6.jpg
[2010.04.13 02:52:58 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010.04.13 02:52:57 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010.04.13 02:32:23 | 000,000,035 | ---- | C] () -- C:\WINDOWS\WorldBuilder.INI
[2010.01.07 16:49:17 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI
[2009.04.22 17:07:52 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009.04.22 17:07:48 | 000,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.03.14 20:12:10 | 000,000,269 | ---- | C] () -- C:\WINDOWS\game.ini
[2008.11.02 05:08:51 | 000,036,972 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2008.06.05 08:58:26 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
[2008.05.18 16:32:42 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2008.04.16 22:45:49 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2008.04.01 03:12:32 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008.02.21 19:19:09 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2007.12.17 15:41:46 | 000,000,404 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007.09.26 14:59:37 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007.08.16 06:23:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\gpyapi.dll
[2007.06.20 19:34:26 | 001,936,528 | ---- | C] () -- C:\WINDOWS\System32\ltmm15.dll
[2007.05.29 16:43:33 | 000,000,324 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007.05.19 21:06:20 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2007.05.19 20:53:08 | 000,002,304 | ---- | C] () -- C:\WINDOWS\System32\Machnm32.sys
[2007.05.11 20:09:24 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\WINKRNME.DLL
[2007.05.04 13:20:20 | 000,092,672 | ---- | C] () -- C:\WINDOWS\System32\asusasv2.dll
[2007.05.04 13:20:20 | 000,071,680 | ---- | C] () -- C:\WINDOWS\System32\asusasv1.dll
[2007.04.29 18:35:36 | 000,000,613 | ---- | C] () -- C:\WINDOWS\psnetwork.ini
[2007.04.29 18:35:36 | 000,000,035 | ---- | C] () -- C:\WINDOWS\Powerplayer.ini
[2007.03.09 09:12:32 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2007.03.06 11:14:48 | 000,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007.03.06 11:14:48 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006.09.26 22:04:50 | 000,001,161 | ---- | C] () -- C:\WINDOWS\ARCHPR.INI
[2006.09.13 13:06:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\gtapi.dll
[2006.03.31 22:00:35 | 000,000,011 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.ini
[2005.10.12 01:21:48 | 000,000,213 | ---- | C] () -- C:\WINDOWS\CWREGIST.INI
[2005.10.10 15:52:55 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\MWLPS.dll
[2005.10.09 04:13:07 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005.03.13 14:18:49 | 000,002,862 | ---- | C] () -- C:\WINDOWS\CARDIRIS.INI
[2005.03.13 14:16:54 | 000,000,037 | ---- | C] () -- C:\WINDOWS\progman.ini
[2005.03.13 14:16:44 | 000,000,030 | ---- | C] () -- C:\WINDOWS\readiris.ini
[2005.02.20 21:58:09 | 000,000,748 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005.02.03 01:08:47 | 000,000,162 | ---- | C] () -- C:\WINDOWS\BUHL.INI
[2005.02.02 13:25:04 | 000,000,192 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2005.02.02 01:38:29 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005.01.31 23:31:33 | 000,008,632 | R--- | C] () -- C:\WINDOWS\PRISMDOM.ini
[2005.01.31 23:30:38 | 000,028,672 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll
[2004.08.22 18:04:56 | 000,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[1999.07.23 13:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999.07.23 10:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1999.01.26 23:00:00 | 000,114,816 | ---- | C] () -- C:\WINDOWS\System32\MSMT4232.DLL
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 124 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:3F2F06F2
@Alternate Data Stream - 113 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 108 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:24051EFF
< End of report >
--- --- ---

cosinus 19.06.2010 15:19
Zitat:
Datenbank Version: 4052
Du hast Malwarebytes vorher nicht aktualisiert. Bitte die Datenbanken updaten und den Vollscan wiederholen.

Janzen 20.06.2010 16:26
Hi,
leider geht das bei mir nicht! Es kommt immer die Fehlermeldung:
MBAM_ERROR_UPDATING (12029, 0, WINHTTPSENDREQUEST)

Ich vermute dass es mit meinem Problem zusammenhängt...wie gesagt, weder ICQ noch Mozilla, noch diverse andere Programme(Poker, Steam etc) können eine Internetverbindung aufbauen. Nur der IE läuft tadellos!
Komme ich iwie auf einem anderen Weg an die Datenbankaktualisierung?
Vielen Dank nochmals!

EDIT: Habe natürlich Malwarebytes schon deinstalliert und neu installiert, trotzdem kommt die gleiche Fehlermeldung :(

cosinus 20.06.2010 17:59
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKCU\..\URLSearchHook: {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.selectedEngine: "QIP Search"
FF - prefs.js..browser.startup.homepage: "http://start.qip.ru"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {A89AED22-9133-424c-88E7-C8235C5FF302}:0.9.1
FF - prefs.js..network.proxy.type: 4
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll File not found
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Norton-Symbolleiste anzeigen) - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.5\UIBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Hotspot Shield Toolbar) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
O3 - HKLM\..\Toolbar: (Veoh Browser Plug-in) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (Hotspot Shield Toolbar) - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - C:\Programme\Hotspot_Shield\tbHot0.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll File not found
O20 - AppInit_DLLs: (infomsas.dll) -  File not found
O20 - AppInit_DLLs: (confxxn.dll) -  File not found
O20 - AppInit_DLLs: (confjfg.dll) -  File not found
O20 - AppInit_DLLs: (jfgstat.dll) -  File not found
O20 - AppInit_DLLs: (confmms.dll) -  File not found
O20 - AppInit_DLLs: (mmsstat.dll) -  File not found
O20 - Winlogon\Notify\autowinn: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\jfgmgr: DllName - jfgmgr32.dll -  File not found
O20 - Winlogon\Notify\mmsmgr: DllName - mmsmgr32.dll -  File not found
O20 - Winlogon\Notify\nethesen: DllName - C:\WINDOWS\system32\nethesen.dll - C:\WINDOWS\System32\nethesen.dll File not found
O32 - AutoRun File - [2009.08.02 13:45:01 | 212,547,140 | ---- | M] () - J:\Auto1.ea -- [ NTFS ]
O32 - AutoRun File - [2009.08.02 10:25:37 | 211,201,729 | ---- | M] () - J:\Auto2.ea -- [ NTFS ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\atisetup.exe -- File not found
O33 - MountPoints2\D\Shell\launch\command - "" = D:\atisetup.exe -- File not found
@Alternate Data Stream - 124 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:3F2F06F2
@Alternate Data Stream - 113 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 108 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:24051EFF
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Janzen 20.06.2010 20:42
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{c95a4e8e-816d-4655-8c79-d736da1adb6d} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\ deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "QIP Search" removed from browser.search.defaultenginename
Prefs.js: "QIP Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://start.qip.ru" removed from browser.startup.homepage
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
Prefs.js: {A89AED22-9133-424c-88E7-C8235C5FF302}:0.9.1 removed from extensions.enabledItems
Prefs.js: 4 removed from network.proxy.type
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ deleted successfully.
C:\Programme\AskBarDis\bar\bin\askBar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{90222687-F593-4738-B738-FBEE9C7B26DF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90222687-F593-4738-B738-FBEE9C7B26DF}\ deleted successfully.
C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.5\UIBHO.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{c95a4e8e-816d-4655-8c79-d736da1adb6d} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D0943516-5076-4020-A3B5-AEFAF26AB263} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0943516-5076-4020-A3B5-AEFAF26AB263}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C95A4E8E-816D-4655-8C79-D736DA1ADB6D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:infomsas.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:confxxn.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:confjfg.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:jfgstat.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:confmms.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:mmsstat.dll deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\autowinn\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jfgmgr\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mmsmgr\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nethesen\ deleted successfully.
J:\Auto1.ea moved successfully.
J:\Auto2.ea moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
File D:\atisetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
File D:\atisetup.exe not found.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:3F2F06F2 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:24051EFF deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: XXX
->Temp folder emptied: 431283 bytes
->Temporary Internet Files folder emptied: 349182516 bytes
->Java cache emptied: 64300055 bytes
->FireFox cache emptied: 42378806 bytes
->Flash cache emptied: 17075454 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 124648 bytes
->Flash cache emptied: 405 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1236103 bytes
%systemroot%\System32 .tmp files removed: 800015 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 593 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 454,00 mb


OTL by OldTimer - Version 3.2.6.0 log created on 06202010_210846

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 20.06.2010 20:50
Kannst Du Malwarebytes jetzt updaten?

Janzen 20.06.2010 21:13
Nein leider nicht, es kommt wieder die gleiche Fehlermeldung (Firefox funktioniert auch nicht) :(
Weißt du mir noch einen Rat? Sonst werd ich zeitnah formatieren und Win7 holen. Oder?

cosinus 20.06.2010 21:30
Wollte nur wissen obs jetzt schon wieder geht. Probier bitte jetzt mal einen Durchgang mit CF:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Janzen 21.06.2010 12:23
Juhu es hat geklappt :D Der Firefox und ICQ funktionieren wieder! Vielen, vielen Dank!
Kannst du mir vllt etwas empfehlen was ich tun sollte damit sowas nicht mehr vorkommt? Bzw. mir ein Antivirenprogramm nennen, das du empfehlen kannst?

Zur Vollständigkeit hier der Output von Combofix:

Combofix Logfile:
Code:
ComboFix 10-06-20.03 - XXX 21.06.2010  12:49:23.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.2046.1480 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\XXX\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Norton 360 Online *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 Online *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\XXX\Anwendungsdaten\Microsoft\Internet Explorer\qiPSearchbar.dll
C:\no.txt
c:\programme\INSTALL.LOG
c:\windows\patch.exe
c:\windows\system32\Cache
c:\windows\system32\work.exe
J:\install.exe

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPRIP
-------\Service_Iprip


(((((((((((((((((((((((  Dateien erstellt von 2010-05-21 bis 2010-06-21  ))))))))))))))))))))))))))))))
.

2010-06-21 10:17 . 2010-06-21 10:17        --------        d-----w-        c:\programme\CCleaner
2010-06-20 19:08 . 2010-06-20 19:08        --------        d-----w-        C:\_OTL
2010-06-18 10:29 . 2010-06-18 10:29        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\Malwarebytes
2010-06-18 10:29 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-18 10:29 . 2010-06-18 10:29        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-06-18 10:29 . 2010-06-20 15:21        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-06-18 10:29 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-06-17 11:27 . 2010-06-17 11:27        --------        d-----w-        c:\programme\NortonInstaller
2010-06-09 10:43 . 2010-06-09 10:43        --------        d-----w-        c:\programme\EclipseCrossword

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-21 10:58 . 2010-05-05 14:46        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\PDF Software
2010-06-21 10:24 . 2005-01-31 22:03        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Symantec
2010-06-21 10:23 . 2009-12-05 11:34        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-06-21 10:23 . 2009-06-24 15:36        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\Media Player Classic
2010-06-21 01:05 . 2007-11-19 09:14        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\FRITZ!
2010-06-20 19:09 . 2001-08-18 19:00        77744        ----a-w-        c:\windows\system32\perfc007.dat
2010-06-20 19:09 . 2001-08-18 19:00        442364        ----a-w-        c:\windows\system32\perfh007.dat
2010-06-18 20:43 . 2007-11-19 17:17        --------        d-----w-        c:\programme\Norton 360 Online
2010-06-18 14:00 . 2010-02-08 16:29        --------        d-----w-        c:\programme\Full Tilt Poker
2010-06-17 11:23 . 2005-01-31 22:03        --------        d-----w-        c:\programme\Gemeinsame Dateien\Symantec Shared
2010-06-08 12:57 . 2009-08-04 04:59        1        ----a-w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-18 20:32 . 2007-05-01 11:57        --------        d-----w-        c:\programme\Google
2010-05-18 02:48 . 2010-05-18 02:48        98304        ----a-w-        c:\windows\system32CmdLineExt.dll
2010-05-15 17:33 . 2010-05-15 17:32        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Google Updater
2010-05-08 10:42 . 2008-07-05 12:14        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\DivX
2010-05-06 18:26 . 2007-05-01 12:03        --------        d---a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
2010-05-06 18:26 . 2010-05-06 17:53        --------        d-----w-        c:\programme\Risk
2010-05-06 17:54 . 2010-05-06 17:54        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\iWin
2010-05-06 17:53 . 2010-05-06 17:53        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\SpinTop
2010-05-05 14:56 . 2010-05-05 14:47        --------        d-----w-        c:\dokumente und einstellungen\XXX\Anwendungsdaten\PDF Software
2010-05-05 14:35 . 2010-05-05 14:35        73216        ----a-w-        c:\windows\cadkasdeinst01.exe
2010-05-03 17:05 . 2010-03-19 22:03        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX
2010-04-29 12:40 . 2010-04-29 12:40        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton
2010-04-16 13:39 . 2010-04-09 23:06        57344        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-16 13:38 . 2010-04-16 13:38        56766        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-16 13:38 . 2010-04-16 13:38        57679        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Player\Uninstaller.exe
2010-04-16 13:37 . 2010-04-16 13:37        84040        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\TransferWizard\Uninstaller.exe
2010-04-16 13:36 . 2010-04-16 13:36        54166        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-16 13:36 . 2010-04-16 13:36        57532        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSASPDecoder\Uninstaller.exe
2010-04-16 13:36 . 2010-04-16 13:36        54153        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DFXPlugin\Uninstaller.exe
2010-04-16 13:36 . 2010-04-16 13:36        57409        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ControlPanel\Uninstaller.exe
2010-04-16 13:35 . 2010-03-19 22:04        754984        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\Resource.dll
2010-04-13 00:58 . 2008-04-01 01:12        691696        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-04-13 00:52 . 2010-04-13 00:52        281760        ----a-w-        c:\windows\system32\drivers\atksgt.sys
2010-04-13 00:52 . 2010-04-13 00:52        25888        ----a-w-        c:\windows\system32\drivers\lirsgt.sys
2010-04-13 00:42 . 2005-08-02 18:03        993        ----a-w-        c:\windows\eReg.dat
2010-04-09 23:06 . 2010-04-09 23:06        56978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\WebPlayer\Uninstaller.exe
2010-04-09 23:06 . 2010-04-09 23:06        53600        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Update\Uninstaller.exe
2010-04-09 23:05 . 2010-04-09 23:05        57054        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-09 23:05 . 2010-04-09 23:05        56458        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-09 23:05 . 2010-04-09 23:05        54174        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DSAACDecoder\Uninstaller.exe
2010-04-09 23:05 . 2010-04-09 23:05        54128        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Converter\Uninstaller.exe
2010-04-09 23:05 . 2010-04-09 23:05        54629        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\TranscodeEngine\Uninstaller.exe
2010-04-09 23:04 . 2010-04-09 23:04        54101        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-09 23:04 . 2010-04-09 23:04        52963        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-09 23:04 . 2010-04-09 23:04        54073        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Qt4.5\Uninstaller.exe
2010-04-09 23:04 . 2010-04-09 23:04        56969        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\ASPEncoder\Uninstaller.exe
2010-04-09 22:57 . 2010-03-19 22:04        1180952        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\Setup\DivXSetup.exe
2010-03-31 01:58 . 2008-07-04 22:59        125424        ------w-        c:\windows\system32\pxinsi64.exe
2010-03-31 01:58 . 2008-07-04 22:59        123888        ------w-        c:\windows\system32\pxcpyi64.exe
2010-03-31 01:58 . 2007-06-14 16:32        133616        ------w-        c:\windows\system32\pxafs.dll
2010-03-31 01:58 . 2006-09-27 21:53        44944        ------w-        c:\windows\system32\drivers\pxhelp20.sys
2007-03-30 16:30 . 2007-03-30 16:30        233472        ----a-w-        c:\programme\Recover4all-Professional.exe
2007-02-13 20:05 . 2007-02-13 20:05        78361        ----a-w-        c:\programme\Recover4all-Help.chm
2005-04-16 17:15 . 2005-04-16 17:15        6748        -c--a-w-        c:\programme\u.r4p
2006-05-03 10:06 . 2009-02-06 13:38        163328        --sh--r-        c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2009-02-06 13:38        31232        --sh--r-        c:\windows\system32\msfDX.dll
2008-03-16 13:30 . 2009-02-06 13:38        216064        --sh--r-        c:\windows\system32\nbDX.dll
.

------- Sigcheck -------

[-] 2007-10-30 . EF7834C1D9DDF4C7DA697D8C24A03791 . 360064 . . [5.1.2600.3244] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2007-10-30 . EF7834C1D9DDF4C7DA697D8C24A03791 . 360064 . . [5.1.2600.3244] . . c:\windows\system32\drivers\tcpip.sys
[7] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 727723537C9BF6BAA1FB8799A6839CD4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[7] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[7] 2006-01-13 . 583E063FDC888CA30D05C2724B0D7EF4 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[7] 2005-05-25 . 88763A98A4C26C409741B4AA162720C9 . 359808 . . [5.1.2600.2685] . . c:\windows\$NtUninstallKB913446$\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893066$\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2002-08-28 . 244A2F9816BC9B593957281EF577D976 . 332928 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"DAEMON Tools Pro Agent"="c:\programme\DAEMON Tools Pro\DTProAgent.exe" [2009-12-18 427328]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-15 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"Symantec PIF AlertEng"="c:\programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"nwiz"="c:\programme\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"avgnt"="j:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]

c:\dokumente und einstellungen\XXX\Startmen\Programme\Autostart\
FRITZ!DSL Protect.lnk - c:\programme\FRITZ!DSL\FwebProt.exe [2007-11-18 917504]
FRITZ!DSL Startcenter.lnk - c:\programme\FRITZ!DSL\StCenter.exe [2007-11-18 679936]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=c:\windows\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Synchronizer.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Google Updater.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^XXX^Startmenü^Programme^Autostart^FRITZ!DSL Internet.lnk]
path=c:\dokumente und einstellungen\XXX\Startmenü\Programme\Autostart\FRITZ!DSL Internet.lnk
backup=c:\windows\pss\FRITZ!DSL Internet.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSTA.EXE]
PRISMSTA.EXE START [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04        39792        -c--a-w-        c:\programme\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 16:43        69632        ----a-w-        c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2009-01-14 04:36        26112        ----a-w-        c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
2006-02-22 00:05        344064        ----a-w-        c:\windows\system32\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 07:57        15360        ----a-w-        c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-03-21 08:30        486856        ----a-w-        c:\programme\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 16:05        81920        ----a-w-        c:\programme\Daemon\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
1998-02-10 14:10        33280        ----a-w-        c:\tbridge\Flatbed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
2003-10-14 16:36        38984        -c--a-w-        c:\progra~1\ICQ\ICQNet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-03 23:58        1667584        ------w-        c:\programme\messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
2007-02-23 10:00        829176        -c--a-w-        c:\programme\Portrait Displays\Pivot Software\wpCtrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-05-10 16:08        16342528        ----a-w-        c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2006-11-10 10:35        90112        -c--a-w-        c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-01-04 12:45        136600        -c--a-w-        c:\programme\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WLAN Quick-Starter]
2005-03-30 09:22        1249280        ----a-w-        c:\programme\WLAN Quick-Starter\WLAN Quick-Starter.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wlconfig]
2005-03-30 09:43        1236992        ----a-w-        c:\programme\WLAN Monitor\WLConfig.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"updateMgr"="c:\programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"DAEMON Tools-1033"="c:\programme\Daemon\daemon.exe"  -lang 1033
"Mirabilis ICQ"=c:\progra~1\ICQ\ICQNet.exe
"NeroCheck"=c:\windows\system32\NeroCheck.exe
"WLAN Quick-Starter"="c:\programme\WLAN Quick-Starter\WLAN Quick-Starter.exe" -update
"wlconfig"=c:\programme\WLAN Monitor\wlconfig.exe -autostart
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\ICQ\\Icq.exe"=
"j:\\eMule\\emule.exe"=
"\\\\Seeplor\\blobby volley\\volley.exe"=
"c:\\Programme\\HLSW\\hlsw.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Programme\\mIRC\\mirc.exe"=
"\\\\HANZ\\UT\\System\\UnrealTournament.exe"=
"c:\\Programme\\FRITZ!DSL\\IGDCTRL.EXE"=
"c:\\Programme\\concept design\\onlineTV 4\\onlineTV.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
"AllowInboundEchoRequest"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [21.01.2010 19:05 64288]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [01.04.2008 03:12 691696]
R1 NETDSL;AVM PPP over Ethernet;c:\windows\system32\drivers\netdsl.sys [18.11.2007 21:42 11264]
R2 AccWLSvc;AccSys WiFi Server;c:\programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe [11.10.2005 00:08 180224]
R2 AntiVirSchedulerService;Avira AntiVir Planer;j:\avira\AntiVir Desktop\sched.exe [30.10.2009 06:50 108289]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [02.12.2009 15:19 1181328]
R2 PDF Suite 2010 Service;PDF Suite 2010 Service;j:\pdf suite 2010\ConversionService.exe [25.03.2010 15:48 799496]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [28.05.2010 19:26 102448]
S0 d347bus;d347bus;c:\windows\system32\DRIVERS\d347bus.sys --> c:\windows\system32\DRIVERS\d347bus.sys [?]
S0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [03.02.2005 19:42 5248]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [15.05.2010 19:24 136176]
S3 accwldrv;AccSys WiFi Protokoll;c:\windows\system32\drivers\accwldrv.sys [11.10.2005 00:08 12032]
S3 Atp.ntpsi;Atp.ntpsi;c:\windows\system32\odbcad32.exe [29.08.2002 03:43 32768]
S3 NETFWDSL;AVM FRITZ!web DSL PPP;c:\windows\system32\drivers\NETFWDSL.SYS [18.11.2007 21:42 367104]
S3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;c:\windows\system32\drivers\PhTVTune.sys [31.01.2005 23:33 24704]
S3 PRISM_A00;PRISM 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys [31.01.2005 23:31 362688]
S3 sdAuxService;Spyware Doctor Auxiliary Service;c:\programme\Spyware Doctor\svcntaux.exe --> c:\programme\Spyware Doctor\svcntaux.exe [?]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc        REG_MULTI_SZ          p2psvc p2pimsvc p2pgasvc PNRPSvc
vvdsvc        REG_MULTI_SZ          vvdsvc
.
Inhalt des "geplante Tasks" Ordners

2010-06-21 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 17:07]

2010-06-21 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 17:07]

2010-06-21 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 17:07]

2010-06-21 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 17:07]

2010-06-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 17:07]

2010-06-21 c:\windows\Tasks\Google Software Updater.job
- c:\programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-01 17:32]

2010-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-05-15 17:21]

2010-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-05-15 17:21]

2010-06-18 c:\windows\Tasks\Install_NSS.job
- j:\divx\Symantec\scstubinstaller.exe [2010-03-08 18:00]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = start.qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
mWindow Title = Arcor AG & Co. KG
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: Alles mit FDM herunterladen - file://c:\programme\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://c:\programme\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\programme\Free Download Manager\dllink.htm
IE: Download with GetRight - j:\fm09 install\GetRight\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Open with GetRight Browser - j:\fm09 install\GetRight\GRbrowse.htm
IE: Videos mit FDM herunterladen - file://c:\programme\Free Download Manager\dlfvideo.htm
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - j:\poker\PokerStarsUpdate.exe
TCP: {A34BF862-D011-4462-833F-B592D32B1E9E} = 192.168.122.252,192.168.122.253
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\ojjmil73.Standard-Benutzer\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://de.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Google Updater\2.4.1739.5352\npCIDetect13.dll
FF - plugin: c:\programme\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\programme\TOM Online Inc\TOM Live Player\nppl3260.dll
FF - plugin: c:\programme\TOM Online Inc\TOM Live Player\nprpjplug.dll
FF - plugin: c:\programme\TOM Online Inc\TOM Live Player\nptcast30.dll
FF - plugin: c:\programme\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: j:\divx\DivX Plus Web Player\npdivx32.dll
FF - plugin: j:\downloads\veetle\Player\npvlc.dll
FF - plugin: j:\downloads\veetle\plugins\npVeetle.dll
FF - plugin: j:\downloads\veetle\VLCBroadcast\npvbp.dll
FF - plugin: j:\k-lite codec pack\Real\browser\plugins\nppl3260.dll
FF - plugin: j:\k-lite codec pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: j:\programme\DivX\DivX Web Player\npdivx32.dll
FF - plugin: j:\programme\VLC\npvlc.dll

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truej:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
j:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
j:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
j:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
j:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
j:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
j:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
j:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
j:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
j:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
BHO-{c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
HKU-Default-Run-Mcafee Antivirus Monitoring System32mn - VSStatmn32.exe
MSConfigStartUp-ActiveSpeed - c:\programme\Ascentive\ActiveSpeed\AS.exe
MSConfigStartUp-AdVantage - c:\programme\AdVantage\AdVantage.exe
MSConfigStartUp-AVP - c:\programme\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
MSConfigStartUp-Google Desktop Search - c:\programme\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-ICQ - c:\progra~1\ICQ6\ICQ.exe
MSConfigStartUp-iTunesHelper - c:\programme\iTunes\iTunesHelper.exe
MSConfigStartUp-LifeChat - c:\programme\Microsoft LifeChat\LifeChat.exe
MSConfigStartUp-OpwareSE4 - c:\programme\ScanSoft\OmniPageSE4\OpwareSE4.exe
MSConfigStartUp-Performance Center - c:\programme\Ascentive\Performance Center\ApcMain.exe
MSConfigStartUp-QuickTime Task - c:\programme\QuickTime\qttask.exe
MSConfigStartUp-RelevantKnowledge - c:\windows\system32\rlvknlg.exe
MSConfigStartUp-SSBkgdUpdate - c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
MSConfigStartUp-Veoh - c:\programme\Veoh Networks\Veoh\VeohClient.exe
AddRemove-InstallShield_{06F80017-8F98-4C94-B868-52358569FC32} - c:\progra~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
AddRemove-InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169} - c:\progra~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
AddRemove-InstallShield_{6BE2A4A4-99FB-48ED-AE1E-4E850389F804} - c:\progra~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
AddRemove-InstallShield_{7158F6F3-E9F2-4133-8755-401AE64BC2C8} - c:\progra~1\GEMEIN~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe
AddRemove-InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1} - c:\progra~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
AddRemove-XPv3.8.330 - c:\windows\Radeon Omega Drivers v3.8.330
AddRemove-Ugutil - c:\program files\Ugutil\program\Uninst.isu
AddRemove-Wolfenstein - Enemy Territory - f:\gamez\WOLFEN~2\UNINST~1\UNWISE.EXE
AddRemove-Steam App 10 - j:\game´z\Valve\Steam\steam.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-21 13:00
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, hxxp://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8ADE51F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebfc3
\Driver\ACPI -> ACPI.sys @ 0xf7252cb8
\Driver\atapi -> 0x8ade51f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582490
 ParseProcedure -> ntkrnlpa.exe @ 0x805815d0
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582490
 ParseProcedure -> ntkrnlpa.exe @ 0x805815d0
NDIS: VIA Rhine II Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf70f0ba0
 PacketIndicateHandler -> NDIS.sys @ 0xf70fdb21
 SendHandler -> NDIS.sys @ 0xf70db87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1993962763-1580436667-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1993962763-1580436667-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Electronic Arts\C*o*m*m*a*n*d* *&* *C*o*n*q*u*e*r* *3* *T*i*b*e*r*i*u*m* *W*a*r*s*"!\Kundendienst]
"Order"=hex:08,00,00,00,02,00,00,00,b8,02,00,00,01,00,00,00,04,00,00,00,de,00,
  00,00,00,00,00,00,d0,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,be,00,32,\

[HKEY_USERS\S-1-5-21-1993962763-1580436667-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:64,7f,42,2d,96,a9,36,a4,80,f1,8d,50,1d,53,32,29,d7,93,79,73,ca,80,aa,
  b7,46,f2,5d,7f,9c,c2,61,9c,18,7f,50,96,74,6d,82,98,aa,87,7a,9a,9a,47,43,e4,\
"??"=hex:46,3c,1d,a1,4d,8d,35,74,bc,c7,2f,cf,19,a8,e1,f6

[HKEY_USERS\S-1-5-21-1993962763-1580436667-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:29,8e,41,2e,24,07,8b,22,2d,f5,cc,b5,1e,6a,0f,9c,04,6f,19,f7,39,
  5f,0c,bb,fa,f4,5c,22,75,97,19,ed,da,a2,9a,59,93,8a,97,6c,15,a0,e2,7d,0f,32,\
"rkeysecu"=hex:b1,f4,f6,42,56,60,e4,1e,12,81,bd,1d,b3,01,52,5e

[HKEY_LOCAL_MACHINE\System\ControlSet005\Enum\ACPI\PNP0F03\4&1d8e1589&0\LogConf]
@DACL=(02 0000)
"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,
  00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,
  00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff

[HKEY_LOCAL_MACHINE\System\ControlSet005\Enum\HID\Vid_04f2&Pid_0200&MI_02\7&2c00162b&0&0000\LogConf]
@DACL=(02 0000)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(872)
c:\windows\system32\msls31.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\Google\Update\1.2.183.29\GoogleCrashHandler.exe
j:\avira\AntiVir Desktop\avguard.exe
c:\programme\FRITZ!DSL\IGDCTRL.EXE
c:\programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
c:\programme\Hotspot Shield\bin\openvpnas.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\System32\tcpsvcs.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\System32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\programme\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-06-21  13:11:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-06-21 11:10

Vor Suchlauf: 698.626.048 Bytes frei
Nach Suchlauf: 497.885.184 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=3,4,5,6
- - End Of File - - 5CFDBE2848EB54938FEFE2E297C06A67
--- --- ---

cosinus 21.06.2010 12:51
Zitat:
Kannst du mir vllt etwas empfehlen was ich tun sollte damit sowas nicht mehr vorkommt? Bzw. mir ein Antivirenprogramm nennen, das du empfehlen kannst?
Ganz einfach, Du musst Dein Verhalten ändern!
Virenscanner schön und gut, damit ist es allein nicht getan!

Halte Dich am besten grob an diese fünf Regeln:

1) Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
2) Halte Windows und alle verwendeten Programme immer aktuell
3) Führe regelmäßig Backups auf externe Medien durch
4) Arbeite mit eingeschränkten Rechten
5) Nutze sichere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen

Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?



Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Janzen 21.06.2010 16:41
Ohje, während Malwarebytes läuft, hat Antivir mir gemeldet dass es etwas gefunden hat!
TR/Trash.Gen bzw. A0311138.exe
Naja ich lass Malwarebytes mal weiter durchlaufen und poste dann das Ergebnis!

Janzen 21.06.2010 18:19
Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4220

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

21.06.2010 19:16:09
mbam-log-2010-06-21 (19-16-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|J:\|)
Durchsuchte Objekte: 301247
Laufzeit: 3 Stunde(n), 41 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
J:\System Volume Information\_restore{E5810CCF-C81C-4C71-B7AA-D285EAF5472A}\RP1232\A0311138.exe (Trojan.Bancos) -> Quarantined and deleted successfully.


Alle Zeitangaben in WEZ +1. Es ist jetzt 04:44 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131