Trojaner-Board
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   iexplore.exe, wave-regler auf null, pop-ups in IE-Fenstern (https://www.trojaner-board.de/88139-iexplore-exe-wave-regler-null-pop-ups-ie-fenstern.html)

do.cal 18.07.2010 17:26
In der SASW Quarantäne sind jetzt alle 243 Daten soll ich die löschen????
Kann ich auch danach das Programm deinstallieren???

cosinus 18.07.2010 18:11
Ja, kannst Du vorher mal löschen :rolleyes:

do.cal 18.07.2010 19:35
hier die Log-Datei vom Combofix:

Code:
ComboFix 10-07-16.02 - Giuseppe Rocca 18.07.2010  20:09:47.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.49.1031.18.511.175 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Giuseppe Rocca\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokume~1\GIUSEP~1\LOKALE~1\Temp\SAS17A.tmp
c:\dokumente und einstellungen\Giuseppe Rocca\Lokale Einstellungen\Temp\SAS17A.tmp
c:\dokumente und einstellungen\Giuseppe Rocca\setx.exe
c:\windows\My.ini
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\bbvmwxxf.hml
c:\windows\system32\dumphive.exe
c:\windows\system32\filesms.fms
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\langeinf.lin
c:\windows\system32\nonrunso.ber
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\rubezahl.rub
c:\windows\system32\runstop.rst
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
(((((((((((((((((((((((  Dateien erstellt von 2010-06-18 bis 2010-07-18  ))))))))))))))))))))))))))))))
.

2010-07-18 17:25 . 2010-07-18 17:57        --------        d-----w-        c:\programme\CCleaner
2010-07-17 22:49 . 2010-07-17 22:49        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2010-07-13 16:11 . 2010-07-13 16:12        --------        d-----w-        c:\windows\system32\NtmsData
2010-07-09 16:22 . 2010-07-09 16:22        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\PrivacIE
2010-07-09 07:11 . 2010-07-09 07:11        --------        d-----r-        c:\dokumente und einstellungen\NetworkService\Favoriten
2010-07-09 06:24 . 2010-07-14 12:43        8        ----a-w-        c:\windows\system32\config\systemprofile\100.dat
2010-07-05 10:31 . 2010-07-07 09:45        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\AskToolbar
2010-07-05 07:37 . 2010-07-05 07:37        --------        d-sh--w-        c:\dokumente und einstellungen\LocalService\PrivacIE
2010-07-05 07:37 . 2010-07-16 19:58        8        ----a-w-        c:\dokumente und einstellungen\LocalService\100.dat
2010-07-05 07:37 . 2010-07-05 07:37        --------        d-sh--w-        c:\windows\system32\config\systemprofile\PrivacIE

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-18 17:47 . 2008-10-07 14:02        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-07-17 22:43 . 2006-12-19 12:30        --------        d-----w-        c:\programme\Steam
2010-07-16 19:59 . 2010-07-16 19:59        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF8281.tmp
2010-07-16 19:49 . 2010-07-16 19:49        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF67BA.tmp
2010-07-16 19:48 . 2010-07-16 19:48        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF99FD.tmp
2010-07-16 17:29 . 2010-07-16 17:29        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF701F.tmp
2010-07-16 16:16 . 2010-07-16 16:15        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DFBAAC.tmp
2010-07-16 15:44 . 2010-07-16 15:44        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF1FC.tmp
2010-07-16 12:26 . 2010-07-16 12:25        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF883D.tmp
2010-07-16 11:29 . 2010-07-16 11:29        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFC313.tmp
2010-07-16 09:54 . 2009-03-18 21:35        1        ----a-w-        c:\dokumente und einstellungen\Giuseppe Rocca\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-16 09:53 . 2010-07-16 09:53        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF935E.tmp
2010-07-16 09:41 . 2010-07-16 09:41        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFFCB5.tmp
2010-07-16 09:39 . 2010-07-16 09:39        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFA21C.tmp
2010-07-16 09:38 . 2010-07-16 09:38        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF977B.tmp
2010-07-15 11:00 . 2010-07-15 11:00        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF6CBD.tmp
2010-07-15 10:47 . 2010-07-15 10:47        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFBCC7.tmp
2010-07-15 08:17 . 2010-07-15 08:17        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF46F4.tmp
2010-07-15 08:17 . 2010-07-15 08:17        16384        ----atw-        c:\windows\system32\config\systemprofile\~DFC796.tmp
2010-07-14 20:36 . 2010-07-14 20:36        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF61A4.tmp
2010-07-14 19:35 . 2010-07-14 19:35        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF7FA9.tmp
2010-07-14 12:43 . 2010-07-14 12:43        512        ----atw-        c:\windows\system32\config\systemprofile\~DFF564.tmp
2010-07-14 12:43 . 2010-07-14 12:43        512        ----atw-        c:\windows\system32\config\systemprofile\~DFF533.tmp
2010-07-14 12:43 . 2010-07-14 12:43        32768        ----a-w-        c:\windows\system32\config\systemprofile\~DFF526.tmp
2010-07-14 12:43 . 2010-07-14 12:43        16384        ----a-w-        c:\windows\system32\config\systemprofile\~DFF558.tmp
2010-07-14 12:43 . 2010-07-14 12:43        16384        ----atw-        c:\windows\system32\config\systemprofile\~DFE38C.tmp
2010-07-14 11:18 . 2010-07-14 11:18        16384        ----atw-        c:\windows\system32\config\systemprofile\~DF4DC4.tmp
2010-07-14 09:08 . 2010-07-14 09:08        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFF388.tmp
2010-07-14 08:16 . 2010-07-14 08:16        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF4485.tmp
2010-07-14 08:15 . 2010-07-14 08:15        16384        ----atw-        c:\windows\system32\config\systemprofile\~DF6A6.tmp
2010-07-13 18:17 . 2010-07-13 18:08        49152        ----atw-        c:\windows\system32\config\systemprofile\~DF7E27.tmp
2010-07-13 18:08 . 2010-07-13 18:08        512        ----atw-        c:\windows\system32\config\systemprofile\~DF92E4.tmp
2010-07-13 18:08 . 2010-07-13 18:08        512        ----atw-        c:\windows\system32\config\systemprofile\~DF92A3.tmp
2010-07-13 18:08 . 2010-07-13 18:08        32768        ----a-w-        c:\windows\system32\config\systemprofile\~DF9291.tmp
2010-07-13 18:08 . 2010-07-13 18:08        16384        ----a-w-        c:\windows\system32\config\systemprofile\~DF92D2.tmp
2010-07-13 18:00 . 2010-07-13 18:00        16384        ----atw-        c:\windows\system32\config\systemprofile\~DF4C5B.tmp
2010-07-13 14:51 . 2010-07-13 14:50        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF8F55.tmp
2010-07-13 14:34 . 2010-07-13 14:34        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF8EB9.tmp
2010-07-13 10:54 . 2010-07-13 10:54        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF3235.tmp
2010-07-13 10:20 . 2010-07-13 10:20        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF45DB.tmp
2010-07-13 10:08 . 2010-07-13 10:04        32768        ----atw-        c:\windows\system32\config\systemprofile\~DF3E40.tmp
2010-07-13 10:04 . 2010-07-13 10:04        512        ----atw-        c:\windows\system32\config\systemprofile\~DFFBA.tmp
2010-07-13 10:04 . 2010-07-13 10:04        512        ----atw-        c:\windows\system32\config\systemprofile\~DF968.tmp
2010-07-13 10:04 . 2010-07-13 10:04        32768        ----a-w-        c:\windows\system32\config\systemprofile\~DF6C7.tmp
2010-07-13 10:04 . 2010-07-13 10:04        16384        ----a-w-        c:\windows\system32\config\systemprofile\~DFF43.tmp
2010-07-13 10:04 . 2010-07-13 10:04        16384        ----atw-        c:\windows\system32\config\systemprofile\~DF1846.tmp
2010-07-12 21:33 . 2010-07-12 21:33        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF7E64.tmp
2010-07-12 20:50 . 2010-07-12 20:50        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF47F.tmp
2010-07-12 19:50 . 2010-07-12 19:50        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF5755.tmp
2010-07-12 19:48 . 2010-07-12 19:48        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF623D.tmp
2010-07-12 19:18 . 2010-07-12 19:18        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFCEFA.tmp
2010-07-12 19:18 . 2010-07-12 19:17        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF1E34.tmp
2010-07-12 12:59 . 2010-07-12 12:57        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DF6DBF.tmp
2010-07-12 10:35 . 2010-07-12 10:35        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF85CA.tmp
2010-07-12 09:59 . 2010-07-12 09:59        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF250E.tmp
2010-07-11 23:19 . 2010-07-11 23:19        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFC2BA.tmp
2010-07-11 23:19 . 2010-07-11 23:19        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFC1EC.tmp
2010-07-11 22:47 . 2010-07-11 22:47        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF4FD0.tmp
2010-07-11 15:45 . 2010-07-11 15:45        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF783E.tmp
2010-07-11 15:26 . 2010-07-11 15:26        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFF7.tmp
2010-07-11 15:19 . 2010-07-11 15:19        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFAFE4.tmp
2010-07-11 15:19 . 2010-07-11 15:19        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF9078.tmp
2010-07-11 15:19 . 2010-07-11 15:19        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF1899.tmp
2010-07-11 12:00 . 2010-07-11 12:00        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF929C.tmp
2010-07-11 11:41 . 2010-07-11 11:38        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF1573.tmp
2010-07-11 11:36 . 2009-10-15 17:04        --------        d-----w-        c:\programme\Mozilla Thunderbird
2010-07-11 10:11 . 2010-07-11 10:11        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF488E.tmp
2010-07-10 21:46 . 2010-07-10 21:46        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF6028.tmp
2010-07-10 21:45 . 2010-07-10 21:45        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF589C.tmp
2010-07-10 21:30 . 2010-07-10 21:29        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DFCCFC.tmp
2010-07-10 21:13 . 2010-07-10 21:13        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFDDEC.tmp
2010-07-10 18:02 . 2010-07-10 17:54        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DF75E6.tmp
2010-07-10 17:18 . 2010-07-10 17:18        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFB056.tmp
2010-07-10 16:41 . 2010-07-10 16:41        1111453        ----a-w-        c:\dokumente und einstellungen\LocalService\fla237.tmp
2010-07-10 16:36 . 2010-07-10 16:30        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DFE579.tmp
2010-07-10 15:49 . 2010-07-10 15:49        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF891A.tmp
2010-07-10 15:21 . 2010-07-10 15:21        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFAEE5.tmp
2010-07-10 15:14 . 2010-07-10 15:11        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DF73A5.tmp
2010-07-10 15:11 . 2010-07-10 15:11        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF47CC.tmp
2010-07-10 12:49 . 2010-07-10 12:46        32768        ----atw-        c:\dokumente und einstellungen\LocalService\~DFBBEF.tmp
2010-07-10 12:46 . 2010-07-10 12:46        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF6B3C.tmp
2010-07-10 12:17 . 2010-07-10 12:17        512        ----atw-        c:\windows\system32\config\systemprofile\~DF13D3.tmp
2010-07-10 12:17 . 2010-07-10 12:17        512        ----atw-        c:\windows\system32\config\systemprofile\~DF132F.tmp
2010-07-10 12:17 . 2010-07-10 12:17        16384        ----a-w-        c:\windows\system32\config\systemprofile\~DF13C1.tmp
2010-07-10 12:17 . 2010-07-10 12:17        32768        ----a-w-        c:\windows\system32\config\systemprofile\~DF1310.tmp
2010-07-10 12:17 . 2010-07-10 12:17        16384        ----atw-        c:\windows\system32\config\systemprofile\~DF272C.tmp
2010-07-10 12:17 . 2010-07-10 12:17        16384        ----atw-        c:\windows\system32\config\systemprofile\~DFD7D.tmp
2010-07-10 12:17 . 2010-07-10 12:17        16384        ----atw-        c:\windows\system32\config\systemprofile\~DFF58D.tmp
2010-07-10 12:12 . 2010-07-10 12:08        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF2957.tmp
2010-07-10 11:13 . 2010-07-10 11:13        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFDEAF.tmp
2010-07-10 08:27 . 2010-07-10 08:26        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DF4C40.tmp
2010-07-10 08:26 . 2010-07-10 08:26        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF3F14.tmp
2010-07-09 19:03 . 2010-07-09 19:03        49152        ----atw-        c:\dokumente und einstellungen\LocalService\~DFDD4F.tmp
2010-07-09 18:46 . 2010-07-09 18:46        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF3512.tmp
2010-07-09 18:05 . 2010-07-09 18:05        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DFAACF.tmp
2010-07-09 16:53 . 2010-07-09 16:53        16384        ----atw-        c:\dokumente und einstellungen\LocalService\~DF4ECA.tmp
2010-07-09 16:05 . 2010-07-09 16:03        32768        ----atw-        c:\windows\system32\config\systemprofile\~DF5099.tmp
2010-07-09 16:03 . 2010-07-09 16:03        512        ----atw-        c:\windows\system32\config\systemprofile\~DF6BC3.tmp
2010-07-09 16:03 . 2010-07-09 16:03        16384        ----a-w-        c:\windows\system32\config\systemprofile\~DF6B2B.tmp
2010-07-09 16:03 . 2010-07-09 16:03        512        ----atw-        c:\windows\system32\config\systemprofile\~DF68E9.tmp
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-30 28672]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2005-10-24 180269]
"ToADiMon.exe"="c:\programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe" [2003-07-01 212992]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\dokumente und einstellungen\Giuseppe Rocca\Startmen�\Programme\Autostart\
OpenOffice.org 3.0.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
CAPIControl.lnk - c:\programme\Telekom\Eumex 504PC SE\Capictrl.exe [2003-6-12 274432]
HomeNet Control.lnk - c:\programme\Telekom\Eumex 504PC SE\HNetCtrl.exe [2002-11-15 86016]
Microsoft Office.lnk - c:\programme\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Steam\\steamapps\\domrocca\\team fortress 2\\hl2.exe"=
"c:\\Programme\\Steam\\steamapps\\domrocca\\source sdk base\\hl2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\Opera\\opera.exe"=
"c:\\Programme\\Steam\\steamapps\\patidoerr3@web.de\\counter-strike\\hl.exe"=
"c:\\Programme\\Steam\\steamapps\\domrocca\\source sdk base 2007\\hl2.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [19.03.2009 17:39 108289]
R2 CAPI20;Eumex 504PC SE;c:\windows\system32\drivers\Capi20.sys [17.04.2003 16:14 960436]
R2 DETEWECP;Telekom CapiPort;c:\windows\system32\drivers\DETEWECP.SYS [19.03.2003 13:36 37696]
R3 dtwmnic5;Telekom Eumex 504PC SE;c:\windows\system32\drivers\dtwmnic5.sys [20.12.2002 11:04 198118]
S3 Fadpu16E;Fadpu16E;\??\c:\dokume~1\GIUSEP~1\LOKALE~1\Temp\Fadpu16E.sys --> c:\dokume~1\GIUSEP~1\LOKALE~1\Temp\Fadpu16E.sys [?]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - SISPORT
*Deregistered* - SiSPort
.
Inhalt des "geplante Tasks" Ordners

2010-07-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2007-08-29 11:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Connection Wizard,ShellNext = iexplore
IE: &ICQ Toolbar Search - c:\programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {96B5E782-D692-4AED-A930-852F6DA21C27} = 217.0.43.113 217.0.43.97
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
FF - ProfilePath - c:\dokumente und einstellungen\Giuseppe Rocca\Anwendungsdaten\Mozilla\Firefox\Profiles\ba0v25ry.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox
FF - plugin: c:\dokumente und einstellungen\Giuseppe Rocca\Anwendungsdaten\Mozilla\Firefox\Profiles\ba0v25ry.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\programme\Opera\program\plugins\nppdf32.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
AddRemove-RD - c:\dokumente und einstellungen\Giuseppe Rocca\Eigene Dateien\Eigene Musik\Domi\Schule\mukke\RD\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-07-18 20:22
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\??????[????`??[???[`??[???????????????[???[???[???[$??????[???????????????[???????????[???w????(????3?w???w?????3?w ??w???[:???????d???r??[1??[???[d??????[?-?[????z??w8h?[\2?[?1?[htinst.INI?[?u?[????d????????F?

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,da,f8,00,8d,27,ea,46,9b,8f,23,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
  d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,da,f8,00,8d,27,ea,46,9b,8f,23,\
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\programme\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2010-07-18  20:28:30
ComboFix-quarantined-files.txt  2010-07-18 18:28

Vor Suchlauf: 10 Verzeichnis(se), 77.893.197.824 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 81.313.288.192 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - E6088B9D4FB68741AC18AC9F42445A78
Ich hab jetzt noch einen "Internet Explorer" kann ich den löschen, und kann ich auch Combofix und vielleicht auch die Wiederherstellungsbox .... oder gib mir einfach eine Liste von Daten/Programme die ich löschen kann, die ich wegen dir installiert habe.

do.cal 20.07.2010 14:46
bedeutet keine Antwort, dass alles wieder OK ist ..... :applaus: ..... sonst hoffe ich, dass du dich bald wieder meldest.

cosinus 21.07.2010 17:33
Den Internet Explorer kannst Du nicht löschen/deinstallieren, weil das eine Systemkomponente von Windows ist!

Ich seh da noch einige Sachen, mach bitte aber damit ich möglichst alles erwische noch einen Durchgang mit OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

do.cal 21.07.2010 18:00
Sollte ich bei LOP Prüfung und Purity Prüfung ein Häkchen machen????
diese Log sind ohne:

Extras.txt
OTL Logfile:
Code:
OTL Extras logfile created on: 21.07.2010 18:48:19 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\****\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 153,00 Mb Available Physical Memory | 30,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 56,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 111,78 Gb Total Space | 75,66 Gb Free Space | 67,69% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirewallDisableNotify" = 0
"UPDATESDISABLENOTIFY" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Steam\steamapps\domrocca\team fortress 2\hl2.exe" = C:\Programme\Steam\steamapps\domrocca\team fortress 2\hl2.exe:*:Enabled:hl2 -- ()
"C:\Programme\Steam\steamapps\domrocca\source sdk base\hl2.exe" = C:\Programme\Steam\steamapps\domrocca\source sdk base\hl2.exe:*:Enabled:hl2 -- ()
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\Steam\steamapps\patidoerr3@web.de\counter-strike\hl.exe" = C:\Programme\Steam\steamapps\patidoerr3@web.de\counter-strike\hl.exe:*:Enabled:Counter-Strike -- (Valve)
"C:\Programme\Steam\steamapps\domrocca\source sdk base 2007\hl2.exe" = C:\Programme\Steam\steamapps\domrocca\source sdk base 2007\hl2.exe:*:Enabled:Source SDK Base 2007 -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1C27C64B-D5CF-4881-A310-0BD2A0D21927}" = ElsterFormular 2005/2006
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{200F584F-848D-4B6B-B1A1-C74D735F18A4}" = InstallRTC
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 18
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32A3A4F4-B792-11D6-A78A-00B0D0160170}" = Java(TM) SE Development Kit 6 Update 17
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = HydraVision
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{49FC50FC-F965-40D9-89B4-CBFF80941031}" = Windows Movie Maker 2.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AC34E29-82A8-42E4-916C-29F594B9DD03}" = Eumex 504PC SE
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = LiveUpdate BVRP Software
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7EC19307-7C22-47A8-922B-3FA965291260}" = OpenOffice.org 3.0
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{8283FCCD-AC71-4DC1-A81E-4F244FBBE11D}" = T-Online 5.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{926C96FB-9D0A-4504-8000-C6D3A4A3118E}" = Java DB 10.4.2.1
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B510A987-487E-4C66-9F4F-D386AC275715}" = TextPad 4.7
"{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}" = EPSON Easy Photo Print
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F18E8A0F-BE99-4305-96A5-6C0FD9D7D999}" = mobile PhoneTools
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"All ATI Software" = ATI - Software Uninstall Utility
"AsUninst.exe" = Anvil Studio
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVS DVD Player_is1" = AVS DVD Player version 2.4
"CCleaner" = CCleaner
"C-Media Audio" = C-Media 3D Audio
"CX4300_5500_DX4400 Handbuch" = CX4300_5500_DX4400 Handbuch
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"ie8" = Windows Internet Explorer 8
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
"Nero - Burning Rom!UninstallKey" = Ahead Nero - Burning Rom
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 6.0" = RealPlayer
"ShockwaveFlash" = Macromedia Flash Player 8
"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver
"Steam" = Steam
"Steam App 215" = Source SDK Base
"Steam App 218" = Source SDK Base - Orange Box
"Steam App 400" = Portal
"Steam App 440" = Team Fortress 2
"T-Online Copas" = T-Online Copas
"T-Online Direktanwahl" = T-Online Direktanwahl
"T-Online Fotoservice" = T-Online Fotoservice
"Uninstall_is1" = Uninstall 1.0.0.0
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WinZip" = WinZip
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Card Manager" = Card Manager
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 16.07.2010 05:52:11 | Computer Name = **** | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 16.07.2010 10:51:14 | Computer Name = **** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 16.07.2010 10:51:15 | Computer Name = **** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 16.07.2010 10:51:18 | Computer Name = **** | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
 
Error - 16.07.2010 13:26:47 | Computer Name = **** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 16.07.2010 13:26:48 | Computer Name = **** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 16.07.2010 13:27:03 | Computer Name = **** | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 16.07.2010 13:27:08 | Computer Name = **** | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung capictrl.exe, Version 2.0.0.2100, fehlgeschlagenes
 Modul mfc42.dll, Version 6.2.4131.0, Fehleradresse 0x000021e6.
 
Error - 17.07.2010 05:28:55 | Computer Name = **** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 17.07.2010 05:28:56 | Computer Name = **** | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
[ System Events ]
Error - 18.07.2010 14:51:48 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 19.07.2010 06:44:09 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 19.07.2010 11:17:02 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 19.07.2010 11:17:39 | Computer Name = **** | Source = Tcpip | ID = 4198
Description = Das System hat einen Adressenkonflikt der IP-Adresse 169.254.198.202
 mit dem Computer mit der  Netzwerkhardwareadresse 00:30:42:FF:FD:02 ermittelt. Die
 lokale Schnittstelle wurde deaktiviert.
 
Error - 20.07.2010 06:39:44 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 20.07.2010 18:02:37 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 20.07.2010 18:02:55 | Computer Name = **** | Source = Tcpip | ID = 4198
Description = Das System hat einen Adressenkonflikt der IP-Adresse 169.254.192.37
 mit dem Computer mit der  Netzwerkhardwareadresse 00:30:42:FF:FD:02 ermittelt. Die
 lokale Schnittstelle wurde deaktiviert.
 
Error - 21.07.2010 05:53:10 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 21.07.2010 08:35:11 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
Error - 21.07.2010 12:37:49 | Computer Name = **** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  Beep
 
 
< End of report >
--- --- ---


OTL.txt

Code:
OTL Logfile:

       
Code:

       
OTL logfile created on: 21.07.2010 18:48:19 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\****\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,00 Mb Total Physical Memory | 153,00 Mb Available Physical Memory | 30,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 56,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 111,78 Gb Total Space | 75,66 Gb Free Space | 67,69% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ****
Current User Name: ****
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\****\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Opera\opera.exe (Opera Software)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe (Marmiko IT-Solutions GmbH)
PRC - C:\WINDOWS\htpatch.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\****\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (Fadpu16E) -- C:\DOKUME~1\GIUSEP~1\LOKALE~1\Temp\Fadpu16E.sys File not found
DRV - (catchme) -- C:\DOKUME~1\GIUSEP~1\LOKALE~1\Temp\catchme.sys File not found
DRV - (PnkBstrK) -- C:\WINDOWS\system32\drivers\PnkBstrK.sys ()
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Aspi32) -- C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (tandpl) -- C:\WINDOWS\system32\drivers\tandpl.sys ()
DRV - (CAPI20) -- C:\WINDOWS\system32\drivers\Capi20.sys (DeTeWe Berlin)
DRV - (DETEWECP) -- C:\WINDOWS\System32\drivers\detewecp.sys (DeTeWe Berlin)
DRV - (enodpl) -- C:\WINDOWS\system32\drivers\enodpl.sys ()
DRV - (dtwmnic5) -- C:\WINDOWS\system32\drivers\dtwmnic5.sys (DeTeWe Berlin)
DRV - (SISAGP) -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (SISNIC) -- C:\WINDOWS\system32\drivers\sisnic.sys (SiS Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/firefox"
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:4.0.14.0
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.06 23:42:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.03.31 17:10:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2009.12.18 18:39:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2009.04.06 18:15:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Extensions
[2010.07.21 00:14:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\ba0v25ry.default\extensions
[2009.04.17 14:07:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\ba0v25ry.default\extensions\battlefieldheroespatcher@ea.com
[2010.07.06 23:19:19 | 000,002,384 | ---- | M] () -- C:\Dokumente und Einstellungen\****\Anwendungsdaten\Mozilla\Firefox\Profiles\ba0v25ry.default\searchplugins\askcom.xml
[2010.07.21 00:14:19 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.01.07 15:02:44 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.07 15:02:45 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.07 15:02:45 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.07 15:02:45 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.07 15:02:45 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.07.18 20:22:40 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HTpatch] C:\WINDOWS\htpatch.exe ()
O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe (Silicon Integrated Systems Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe (Marmiko IT-Solutions GmbH)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\CAPIControl.lnk = C:\Programme\Telekom\Eumex 504PC SE\Capictrl.exe (DeTeWe AG & Co.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\HomeNet Control.lnk = C:\Programme\Telekom\Eumex 504PC SE\HNetCtrl.exe (DeTeWe AG & Co.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\****\Startmenü\Programme\Autostart\OpenOffice.org 3.0.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Programme\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKCU\..Trusted Domains:   ([]msn in My Computer)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB (Reg Error: Key error.)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198780545453 (WUWebControl Class)
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.10.23 16:48:31 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.21 18:47:08 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\****\Desktop\OTL.exe
[2010.07.19 12:51:46 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010.07.18 20:28:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010.07.18 20:06:32 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.07.18 20:01:21 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.07.18 20:01:21 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.07.18 20:01:21 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.07.18 20:01:21 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.07.18 20:01:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.07.18 19:59:50 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.07.18 19:49:34 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\****\Recent
[2010.07.18 19:25:47 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.07.18 00:49:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
[2010.07.13 18:11:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.07.05 12:31:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\AskToolbar
[2010.07.05 09:43:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\****\*.tmp files -> C:\Dokumente und Einstellungen\****\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.21 18:47:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\****\Desktop\OTL.exe
[2010.07.21 18:35:46 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.07.21 18:35:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.07.21 15:05:58 | 031,195,136 | -H-- | M] () -- C:\Dokumente und Einstellungen\****\NTUSER.DAT
[2010.07.21 15:05:58 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\****\ntuser.ini
[2010.07.18 20:22:53 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.07.18 20:22:40 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.18 20:06:38 | 000,000,281 | -HS- | M] () -- C:\boot.ini
[2010.07.18 19:24:01 | 003,737,904 | R--- | M] () -- C:\Dokumente und Einstellungen\****\Desktop\cofi.exe
[2010.07.16 11:35:30 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.10 22:44:00 | 000,004,096 | ---- | M] () -- C:\WINDOWS\System32\crash
[2010.07.10 14:51:43 | 001,580,114 | -H-- | M] () -- C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.07.10 09:35:12 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.07.08 10:07:22 | 000,000,815 | ---- | M] () -- C:\WINDOWS\System\CmiCnfg.ini
[2010.07.03 21:59:53 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Opera.lnk
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Dokumente und Einstellungen\****\*.tmp files -> C:\Dokumente und Einstellungen\****\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.07.18 20:06:38 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010.07.18 20:06:34 | 000,262,448 | ---- | C] () -- C:\cmldr
[2010.07.18 20:01:21 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.07.18 20:01:21 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.07.18 20:01:21 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.07.18 20:01:21 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.07.18 20:01:21 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.07.18 19:24:00 | 003,737,904 | R--- | C] () -- C:\Dokumente und Einstellungen\****\Desktop\cofi.exe
[2010.04.05 14:06:11 | 000,138,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009.12.13 02:50:56 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2008.05.30 14:03:01 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2008.05.29 15:00:24 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008.05.29 14:55:27 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE DX4400DEFGIPS.ini
[2008.05.23 00:22:18 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.05.23 00:19:46 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008.05.23 00:19:46 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008.05.23 00:18:54 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008.03.19 23:20:26 | 000,000,216 | ---- | C] () -- C:\WINDOWS\MPPAGER.INI
[2007.11.30 16:13:14 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007.11.30 16:13:14 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007.09.17 09:04:30 | 000,000,253 | ---- | C] () -- C:\WINDOWS\tm.ini
[2007.03.19 19:05:42 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2007.03.15 13:07:39 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2007.03.15 13:07:39 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2007.03.15 13:04:09 | 000,007,552 | ---- | C] () -- C:\WINDOWS\System32\drivers\enodpl.sys
[2007.03.15 13:04:09 | 000,004,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\tandpl.sys
[2007.01.29 18:33:32 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2007.01.29 17:55:00 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2007.01.29 17:54:59 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2007.01.29 17:54:59 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2006.04.27 16:21:51 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006.02.01 18:21:05 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2006.01.18 19:51:58 | 000,000,192 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005.11.10 20:38:18 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2005.10.31 18:20:08 | 000,000,023 | ---- | C] () -- C:\WINDOWS\FLASHKSK.INI
[2005.10.31 18:17:53 | 000,000,361 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2005.10.23 18:15:34 | 000,000,211 | ---- | C] () -- C:\WINDOWS\uno.ini
[2005.10.23 18:15:28 | 000,287,744 | ---- | C] () -- C:\WINDOWS\uno364mi.dll
[2005.10.23 18:15:28 | 000,109,568 | ---- | C] () -- C:\WINDOWS\vos364mi.dll
[2005.10.23 18:15:28 | 000,091,648 | ---- | C] () -- C:\WINDOWS\osl364mi.dll
[2005.10.23 18:12:49 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WINPHONE.INI
[2005.10.23 17:24:40 | 000,048,634 | ---- | C] () -- C:\WINDOWS\System32\interceptor.sys
[2005.10.23 17:02:56 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2005.10.23 17:02:56 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2005.10.23 17:02:46 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll
[2005.10.23 17:01:48 | 000,032,768 | ---- | C] () -- C:\WINDOWS\SIS_LIB.DLL
[2005.10.23 17:01:48 | 000,003,072 | R--- | C] () -- C:\WINDOWS\winio.sys
[2005.10.23 17:01:09 | 000,002,133 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2005.10.23 17:01:08 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2002.06.06 03:01:58 | 000,029,696 | ---- | C] () -- C:\WINDOWS\System32\asutl8.dll
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys
< End of report >

--- --- ---

do.cal 21.07.2010 18:11
Liste der Anhänge anzeigen (Anzahl: 1)
Seit ich combofix benutzt habe, sind diese Daten/Ordner in C: kann ich die und Combofix löschen???
Und mir ist auf gefallen das fast alle "Beschwerden" weg sind aber die zwei iexplore.exe sind immer noch da, MENNO!!!

cosinus 21.07.2010 18:49
Zitat:
Seit ich combofix benutzt habe, sind diese Daten/Ordner in C: kann ich die und Combofix löschen???
Bitte nicht immer voreilig irgendwas löschen! Qoobox ist der Quarantäneordner von CF und wenn Du was löscht ist das weg, äußerst blöd wenn man an diese Dateien noch run muss! Lass den Ordner erstmal so wie er ist!

cosinus 21.07.2010 19:00
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

:Files
c:\dokumente und einstellungen\LocalService\*.tmp
c:\windows\system32\config\systemprofile\*.tmp

:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

do.cal 22.07.2010 17:19
Liste der Anhänge anzeigen (Anzahl: 1)
Code:
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
========== FILES ==========
c:\dokumente und einstellungen\LocalService\fla11.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\fla237.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\fla81.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\fla82.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF106C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF12DF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF132E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF1573.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF1899.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF1E34.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF1FC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF219C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF21E0.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF250E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF2957.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF2AF2.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF2B9.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF2D62.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF2FBD.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF3235.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF3512.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF3B38.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF3F14.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF3F17.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF3FF2.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF4485.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF44FC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF45DB.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF46F4.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF47CC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF47F.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF488E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF4C40.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF4ECA.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF4FD0.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF50BF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF51BC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF5578.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF5755.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF576A.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF583.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF5844.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF589C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6028.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF61A4.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF623D.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6753.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF67BA.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6807.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF68A4.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6A3C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6A97.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6AEE.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6B3C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6CBD.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6DBF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6DD3.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF6E87.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF701F.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF73A5.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF75E6.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF783E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF7A42.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF7A74.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF7D58.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF7E64.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF7FA9.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8281.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF85CA.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF883D.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF891A.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8C2C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8E0C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8EB9.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8F55.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8F7B.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF8FCA.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF9078.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF9125.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF929C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF935E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF977B.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DF99FD.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFA21C.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFA5B.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFAACF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFAEE5.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFAFE4.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFB056.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFB6A3.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFBAAC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFBBEF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFBCC7.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFBE24.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC1EC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC2A8.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC2AF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC2BA.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC313.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC3E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC584.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC908.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFC91B.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFCCFC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFCEFA.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFD8FE.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFDA0E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFDC74.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFDD4F.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFDDEC.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFDEAF.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFDF13.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFE579.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFE5F3.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFE6F8.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFE872.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFEAFE.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFEB2D.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFEB8A.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFF388.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFF3B3.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFF44E.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFF628.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFF7.tmp moved successfully.
c:\dokumente und einstellungen\LocalService\~DFFCB5.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF1310.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF132F.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF13C1.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF13D3.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF14C6.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF1846.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF272C.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF3E40.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF4C5B.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF4DC4.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF5099.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF6896.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF68E9.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF6A6.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF6B2B.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF6BC3.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF6C7.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF732C.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF7E27.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF9291.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF92A3.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF92D2.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF92E4.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DF968.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFB14A.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFBEDD.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFC796.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFCD87.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFCE37.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFCE51.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFCF1B.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFD0F5.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFD7D.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFE38C.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFF43.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFF526.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFF533.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFF558.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFF564.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFF58D.tmp moved successfully.
c:\windows\system32\config\systemprofile\~DFFBA.tmp moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: *****
->Temp folder emptied: 99094 bytes
->Temporary Internet Files folder emptied: 115994 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 62212504 bytes
->Google Chrome cache emptied: 5990224 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 1919817 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 83035512 bytes
->Flash cache emptied: 1170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1487042 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 148,00 mb
 
 
OTL by OldTimer - Version 3.2.9.1 log created on 07222010_175755

Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W2EVD1OH\iframe3[4].htm moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QUWIJY2M\iframe3[1].htm moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QUWIJY2M\st[3] moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QUWIJY2M\st[4] moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QUWIJY2M\st[5] moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QUWIJY2M\st[6] moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CJFRJ2UF\st[9] moved successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\38BQDKER\banner2[1].htm moved successfully.

Registry entries deleted on Reboot...
Nach den OTL-Neustart waren Daten über der OTL.exe wie du im Bild sehen kannst, ich wollte dich eigentlich fragen ob ich diese Daten löschen darf aber als ich den Screenshot gespeichert habe waren die Daten weg. Normal oder werde ich verrückt??? Aber ich hab ja das Beweisfoto!!!

PS:Auch wenn wir noch ein langen Weg vor uns haben, mit meinen übelst infizierten PC, DANKE!!! :dankeschoen:

cosinus 22.07.2010 18:17
Das sind versteckte Dateien, die Du nur siehst, wenn die Option, versteckte Dateien auszublenden deaktiviert wurde. An für sich sind die Dateien aber nicht überlebenswichtig und können können idR weg.

Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

do.cal 23.07.2010 17:56
Hey wollte nur Bescheid sagen, das es ein wenig dauern kann hab viel zu tun.
Spätestens Sonntag hast du beide Logs, versprochen. Kannst ja Heute und Morgen dich um andere verlorene Seelen kümmern.

do.cal 24.07.2010 19:43
Hey hier der GMER-Log:

GMER Logfile:
GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-07-24 20:33:57
Windows 5.1.2600 Service Pack 2
Running: xhmml2jg.exe; Driver: C:\DOKUME~1\GIUSEP~1\LOKALE~1\Temp\fxdyypow.sys


---- System - GMER 1.0.15 ----

SSDT            F8B3CBE6                                                                                                                              ZwCreateKey
SSDT            F8B3CBDC                                                                                                                              ZwCreateThread
SSDT            F8B3CBEB                                                                                                                              ZwDeleteKey
SSDT            F8B3CBF5                                                                                                                              ZwDeleteValueKey
SSDT            F8B3CBFA                                                                                                                              ZwLoadKey
SSDT            F8B3CBC8                                                                                                                              ZwOpenProcess
SSDT            F8B3CBCD                                                                                                                              ZwOpenThread
SSDT            F8B3CC04                                                                                                                              ZwReplaceKey
SSDT            F8B3CBFF                                                                                                                              ZwRestoreKey
SSDT            F8B3CBF0                                                                                                                              ZwSetValueKey
SSDT            F8B3CBD7                                                                                                                              ZwTerminateProcess

---- User code sections - GMER 1.0.15 ----

.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!CreateWindowExW                                                          7E36FC25 5 Bytes  JMP 01244832 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!DialogBoxParamW                                                          7E37555F 5 Bytes  JMP 01169315 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!DialogBoxIndirectParamW                                                  7E382032 5 Bytes  JMP 0135E021 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!MessageBoxIndirectA                                                      7E38A04A 5 Bytes  JMP 0135DF51 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!DialogBoxParamA                                                          7E38B10C 5 Bytes  JMP 0135DFBE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!MessageBoxExW                                                            7E3A05D8 5 Bytes  JMP 0135DE22 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!MessageBoxExA                                                            7E3A05FC 5 Bytes  JMP 0135DE84 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!DialogBoxIndirectParamA                                                  7E3A6B50 5 Bytes  JMP 0135E084 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1708] USER32.dll!MessageBoxIndirectW                                                      7E3B62AB 5 Bytes  JMP 0135DEE6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!UnhookWindowsHookEx                                                      7E36F21E 5 Bytes  JMP 011A1CA2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!CallNextHookEx                                                            7E36F85B 5 Bytes  JMP 0123DD81 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!CreateWindowExW                                                          7E36FC25 5 Bytes  JMP 01244832 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!DialogBoxParamW                                                          7E37555F 5 Bytes  JMP 01169315 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!SetWindowsHookExW                                                        7E37DDB5 5 Bytes  JMP 0123DBCB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!DialogBoxIndirectParamW                                                  7E382032 5 Bytes  JMP 0135E021 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!MessageBoxIndirectA                                                      7E38A04A 5 Bytes  JMP 0135DF51 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!DialogBoxParamA                                                          7E38B10C 5 Bytes  JMP 0135DFBE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!MessageBoxExW                                                            7E3A05D8 5 Bytes  JMP 0135DE22 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!MessageBoxExA                                                            7E3A05FC 5 Bytes  JMP 0135DE84 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!DialogBoxIndirectParamA                                                  7E3A6B50 5 Bytes  JMP 0135E084 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] USER32.dll!MessageBoxIndirectW                                                      7E3B62AB 5 Bytes  JMP 0135DEE6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] ole32.dll!CoCreateInstance                                                          774CFAC3 5 Bytes  JMP 0124488E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2620] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]                        [009318FD] C:\Programme\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                              fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Files - GMER 1.0.15 ----

File            C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C55UJCQ6\ErrorPageTemplate[1]    2168 bytes
File            C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\C55UJCQ6\background_gradient[4]  453 bytes
File            C:\Dokumente und Einstellungen\LocalService\~DF5809.tmp                                                                                16384 bytes

---- EOF - GMER 1.0.15 ----
--- --- ---

--- --- ---


Kurzer Hinweis, beim Scan popte wiedermal ein IE-Fenster auf. Denke aber es war nur Zufall.

do.cal 24.07.2010 20:10
der Log von OSAM:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:04:51 on 24.07.2010

OS: Windows XP Home Edition Service Pack 2 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir PersonalEdition Classic Konfiguration" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl  (File not found)
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
"ToSysCnf" - "Marmiko IT-Solutions GmbH" - C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToSysCnf.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Aspi32" (Aspi32) - "Adaptec" - C:\WINDOWS\System32\drivers\aspi32.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"Beep" (Beep) - ? - C:\WINDOWS\system32\drivers\Beep.sys  (File not found)
"catchme" (catchme) - ? - C:\DOKUME~1\GIUSEP~1\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"enodpl" (enodpl) - ? - C:\WINDOWS\System32\drivers\enodpl.sys  (File found, but it contains no detailed information)
"Eumex 504PC SE" (CAPI20) - "DeTeWe Berlin" - C:\WINDOWS\System32\Drivers\CAPI20.SYS
"Fadpu16E" (Fadpu16E) - ? - C:\DOKUME~1\GIUSEP~1\LOKALE~1\Temp\Fadpu16E.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PnkBstrK" (PnkBstrK) - ? - C:\WINDOWS\system32\drivers\PnkBstrK.sys  (File found, but it contains no detailed information)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Secdrv" (Secdrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\WINDOWS\System32\DRIVERS\secdrv.sys
"SiS AGP Filter" (SISAGP) - "Silicon Integrated Systems Corporation" - C:\WINDOWS\System32\DRIVERS\SISAGPX.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"tandpl" (tandpl) - ? - C:\WINDOWS\System32\drivers\tandpl.sys  (File found, but it contains no detailed information)
"Telekom CapiPort" (DETEWECP) - "DeTeWe Berlin" - C:\WINDOWS\System32\drivers\detewecp.sys
"Telekom Eumex 504PC SE" (dtwmnic5) - "DeTeWe Berlin" - C:\WINDOWS\System32\DRIVERS\dtwmnic5.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\msohev.dll
{D9872D13-7651-4471-9EEE-F0A00218BEBB} "Multiscan" - ? -  (File not found | COM-object registry key not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll
{2F25CF20-C569-11D1-B94C-00608CB45480} "TextPad" - "Helios Software Solutions" - C:\Programme\TextPad 4\System\shellext.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, Inc." - C:\PROGRA~1\WINZIP\WZSHLSTB.DLL

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Yahoo! Toolbar" - ? -  (File not found | COM-object registry key not found)
<binary data> "EPSON Web-To-Page" - "SEIKO EPSON CORPORATION" - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{784797A8-342D-4072-9486-03C8D0F2F0A1} "Battlefield Heroes Updater" - "EA Digital Illusions CE AB" - C:\WINDOWS\Downloaded Program Files\BFHUpdater.dll / hxxp://play.battlefield-heroes.com/static/updater/BFHUpdater_4.0.11.0.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? -  (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\System32\Macromed\Flash\Flash9e.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{5C051655-FCD5-4969-9182-770EA5AA5565} "Solitaire Showdown Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\SolitaireShowdown.dll / hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\System32\LegitCheckControl.DLL / hxxp://go.microsoft.com/fwlink/?linkid=39204
{3334504D-9980-0010-8000-00AA00389B71} "{3334504D-9980-0010-8000-00AA00389B71}" - ? -  (File not found | COM-object registry key not found) / hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
"ICQ Lite" - ? - C:\Programme\ICQLite\ICQLite.exe  (File not found)
"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension )-----
"Location" - "InterTrust Technologies Corporation, Inc." - C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "EPSON Web-To-Page" - "SEIKO EPSON CORPORATION" - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} "EpsonToolBandKicker Class" - "SEIKO EPSON CORPORATION" - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"CAPIControl.lnk" - "DeTeWe AG & Co." - C:\Programme\Telekom\Eumex 504PC SE\Capictrl.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"HomeNet Control.lnk" - "DeTeWe AG & Co." - C:\Programme\Telekom\Eumex 504PC SE\HNetCtrl.exe  (Shortcut exists | File exists)
"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\OSA.EXE  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\****\Startmenü\Programme\Autostart\desktop.ini
"OpenOffice.org 3.0.lnk" - ? - C:\Programme\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ATICCC" - "ATI Technologies Inc." - "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"HTpatch" - ? - C:\WINDOWS\htpatch.exe  (File found, but it contains no detailed information)
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"NeroCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime
"SiSUSBRG" - "Silicon Integrated Systems Corp." - C:\WINDOWS\SiSUSBrg.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"TkBellExe" - "RealNetworks, Inc." - "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
"ToADiMon.exe" - "Marmiko IT-Solutions GmbH" - C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)
"PnkBstrB" (PnkBstrB) - ? - C:\WINDOWS\system32\PnkBstrB.exe  (File found, but it contains no detailed information)
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 26.07.2010 15:10
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
C:\WINDOWS\system32\ole32.dll /md5
C:\WINDOWS\system32\IEFRAME.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:45 Uhr.
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131