Trojaner-Board - Nach "Antimalware Doctor"-Befall weiterhin Probleme

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Nach "Antimalware Doctor"-Befall weiterhin Probleme (https://www.trojaner-board.de/88448-antimalware-doctor-befall-weiterhin-probleme.html)

Nach "Antimalware Doctor"-Befall weiterhin Probleme

Hallo erstmal,

vor einer Woche ca. hatte ich einen Befall von "Antimalware Doctor". Daraufhin habe ich eine hier im Forum gepostete Anleitung befolgt (mit Malwarebytes Anti Malware).
Der Doctor ist nun verschwunden, jedoch habe ich jetzt das Problem, dass sich in meinem Browser (Firefox) sporadisch merkwürdige Internetseiten öffnen und auch geklickte Links manchmal auf genannte Seiten führen, anstatt auf die vom Link angegebenen.
Ähnliche Threads sind bereits vorhanden, jedoch habe ich keine Lösung gefunden, die mein Problem behoben haben.
Daher poste ich euch hier mal meine Logs.

Erstmal das HijackThis-Log:

Zitat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:04, on 20.07.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\WButton.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\vsnpstd3.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE
C:\Users\+++\AppData\Local\Lexar Media\LxrAutorun.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat

\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:

\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin

\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSD.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\/\KiesTrayAgent.exe
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [WEB.DE_WEB.DE SmartDrive Manager] "C:\Program Files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE"

/hide
O4 - HKCU\..\Run: [LxrAutorun] C:\Users\+++\AppData\Local\Lexar Media\LxrAutorun.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:

\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:

\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:

\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:

\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O22 - SharedTaskScheduler: FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock

\Fences\FencesMenu.dll
O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: SAMSUNG KiesAllShare Service (KiesAllShare) - Unknown owner - C:\Program Files\Samsung\Kies

\WiselinkPro\WiselinkPro.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\Windows\SYSTEM32\LxrSII1s.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
O23 - Service: XobniService - Xobni Corporation - C:\Program Files\Xobni\XobniService.exe

--
End of file - 7944 bytes

Zitat:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4275

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

04.07.2010 21:06:00
mbam-log-2010-07-04 (21-06-00).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 216527
Laufzeit: 36 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 18

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted

successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor)

-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\070700setup.exe (Rogue.Installer) -> Quarantined

and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewabqaf7kl (Trojan.FakeAV) -> Quarantined and

deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\halo2 (Trojan.FakeAlert) -> Quarantined and deleted

successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\***\AppData\Roaming\824D73B28B7DA196CBEF3C9CD5F6E641\070700Setup.exe (Rogue.Installer) -> Quarantined and

deleted successfully.
C:\Users\***\AppData\Local\Temp\Bml.exe (Trojan.FakeAV) -> Delete on reboot.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FMBHFMVW\kksahc[1].htm

(Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QKNES90O\070700Setup[1].exe

(Rogue.Installer) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QKNES90O\ggbrzx[1].htm

(Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QKNES90O\kksaupwr[1].htm

(Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\qodigx.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\Bmj.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\Bmk.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\mwosacxern.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Bfilaa.exe (Trojan.FakeAV) -> Delete on reboot.
C:\Windows\System32\net.net (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\System32\spool\prtprocs\w32x86\3B51.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\spool\prtprocs\w32x86\5558.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Windows\Temp\BF.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted

successfully.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted

successfully.

Zitat:

info.txt logfile of random's system information tool 1.08 2010-07-20 20:52:43

======Uninstall list======

-->MsiExec /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
3531-W-D-->MsiExec.exe /X{BD1587F7-B8D0-4111-8F1F-3327628AB02F}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin
Adobe Reader 9.3.3 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
AuthenTec Fingerprint Sensor Minimum Install-->MsiExec.exe /X{E815FB81-995F-4F33-8E25-F16712123AB7}
AuthenTec TrueSuite-->MsiExec.exe /X{E6C44758-FF49-47D1-8182-65E3818ACE23}
Bejeweled 2 Deluxe 1.1-->C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\PopUninstall.exe "C:\Program Files\PopCap

Games\Bejeweled 2 Deluxe\Install.log"
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
DivX-Setup-->C:\ProgramData\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
EA SPORTS(TM) FIFA Online-->MsiExec.exe /X{6FE3B0CE-37C1-4825-908A-5A84C9B4EC2F}
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Fences-->"C:\ProgramData\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe" REMOVE=TRUE MODIFY=FALSE
Fences-->C:\ProgramData\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}\Fences.exe
Google Calendar Sync-->"C:\Program Files\Google\Google Calendar Sync\uninstall.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
ICQ7-->"C:\Program Files\InstallShield Installation Information\{88EB38EF-4D2C-436D-ABD3-56B232674062}\ICQ7.exe" -

runfromtemp -l0x0009 -removeonly
ImgBurn-->"C:\Program Files\ImgBurn\uninstall.exe"
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216015FF}
JDownloader-->C:\Program Files\JDownloader\uninstall.exe
Kies-->"C:\Program Files\InstallShield Installation Information\{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}\setup.exe"

-runfromtemp -l0x0407 -removeonly
Kies-->MsiExec.exe /X{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}
LADSPA_plugins-win-0.4.15-->"C:\Program Files\Audacity\Plug-Ins\unins000.exe"
LAME v3.98.2 for Audacity-->"C:\Program Files\Lame for Audacity\unins000.exe"
Launch Manager V1.4.9-->C:\Program Files\InstallShield Installation Information\{D0846526-66DD-4DC9-A02C-

98F9A2806812}\setup.exe -runfromtemp -l0x0007 -removeonly
LogMeIn-->MsiExec.exe /I{34F93E31-E1A0-421C-8E86-BCF7C4193A91}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client

\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Antimalware Service DE-DE Language Pack-->MsiExec.exe /X{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}
Microsoft Antimalware-->MsiExec.exe /X{E62A1F01-07B7-4541-A835-EE5B0BF064C2}
Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup

Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}
Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}
Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}
Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}
Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}
Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}
Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}
Microsoft Security Essentials-->C:\Program Files\Microsoft Security Essentials\setup.exe /x
Microsoft Security Essentials-->MsiExec.exe /I{EF98A02A-1748-4762-9B7D-5ED1600520D5}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft_VC90_CRT_x86-->MsiExec.exe /I{DF2035BE-5820-4965-BD97-7FAF8D4A7879}
Mozilla Firefox (3.6.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVC80_x86_v2-->MsiExec.exe /I{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}
MSVC90_x86-->MsiExec.exe /I{AF111648-99A1-453E-81DD-80DBBF6DAD0D}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Nokia Connectivity Cable Driver-->MsiExec.exe /I{B9C9DB4C-6D77-4AE9-AD1C-C708C23239A0}
Nokia Ovi Suite Software Updater-->MsiExec.exe /X{4FFD1AB4-54F0-4069-88D9-3A55B38F874B}
Nokia Ovi Suite-->C:\ProgramData\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-

23CBEA5D739C}\Nokia_Ovi_Suite_webinstaller_ALL.exe
Nokia Ovi Suite-->MsiExec.exe /X{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}
NVIDIA Display Control Panel-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe DisplayControlPanel
NVIDIA Drivers-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
OpenAL-->"C:\Program Files\OpenAL\alredist.exe" /U
Ovi Desktop Sync Engine-->MsiExec.exe /X{60DED9C2-22BF-47A3-B6C8-6B141BA31DFD}
OviMPlatform-->MsiExec.exe /I{4E1CD3D5-D4EE-4246-AE24-F0FD5A60390D}
PC Connectivity Solution-->MsiExec.exe /I{7397EDED-F38A-4654-B669-BF61065803D0}
PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime

\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-

8A7C-958108FE7DBC}\Setup.exe" -removeonly
Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime

\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-

8A82-CE685433FA7D}\setup.exe" -l0x9 -removeonly
SAMSUNG Mobile Composite Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6_old\SSBCUninstall.exe
Samsung Mobile Modem Device Software-->C:\Windows\system32\Samsung_USB_Drivers\7\SSECUninstall.exe
Samsung Mobile phone USB driver Drive Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Download Driver Software-->C:\Windows\system32\Samsung_USB_Drivers\NXP_Driver\SSDUUninstall.exe
SAMSUNG Mobile USB Driver-->MsiExec.exe /I{7184F382-8A6C-4B85-A3AC-B63734B1E241}
Samsung New PC Studio-->"C:\Program Files\InstallShield Installation Information\{F193FC0E-9E18-40FC-A974-

509A1BDD240A}\setup.exe" -runfromtemp -l0x0407 -removeonly
Samsung New PC Studio-->MsiExec.exe /X{F193FC0E-9E18-40FC-A974-509A1BDD240A}
SAMSUNG USB Driver for Mobile Phones-->C:\Program Files\SAMSUNG\USB Drivers\Uninstall.exe
SopCast 3.2.9-->C:\Program Files\SopCast\uninst.exe
SUPER © Version 2010.bld.37 (Jan 2, 2010)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TreeSize Free V2.4-->"C:\Program Files\JAM Software\TreeSize Free\unins000.exe"
UltraISO Premium V9.36-->"C:\Program Files\UltraISO\unins000.exe"
Unigine Heaven Benchmark v1.0-->MsiExec.exe /I{B2D4D657-DAA4-4C68-B01E-11736C1D8C0D}
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
Veoh Web Player-->"C:\Program Files\Veoh Networks\VeohWebPlayer\uninst.exe"
VirtualCom driver-->MsiExec.exe /I{1943A043-5C85-4A16-A0D0-D687B2C1A40F}
VLC media player 1.0.5-->C:\Program Files\VideoLAN\VLC\uninstall.exe
WBFS Manager 3.0-->C:\Program Files\WBFS\WBFS Manager 3.0\uninstall.exe
WEB.DE SmartDrive Manager-->C:\Program Files\WEB.DE\WEB.DE SmartDrive Manager\uninst.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Mobile-Gerätecenter-->MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917}
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\B4723E9A0713E5B1\dpinst.exe /u C:

\Windows\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
XMedia Recode 2.2.3.2-->C:\Program Files\XMedia Recode\uninst.exe
Xobni Core-->MsiExec.exe /I{8DC069E7-893C-41E1-9442-DE89FEC33371}
Xobni-->"C:\Program Files\Xobni\UninstallerWizard.exe"

======System event log======

Computer Name: WIN-EESJFG89GSV
Event Code: 7036
Message: Dienst "Windows Search" befindet sich jetzt im Status "Beendet".
Record Number: 572
Source Name: Service Control Manager
Time Written: 20091014022452.250000-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 7040
Message: Der Starttyp des Diensts "Windows Search" wurde von Automatisch starten in Deaktiviert geändert.
Record Number: 571
Source Name: Service Control Manager
Time Written: 20091014022451.578125-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 104
Message: Die Protokolldatei "Setup" wurde gelöscht.
Record Number: 570
Source Name: Microsoft-Windows-Eventlog
Time Written: 20091014022446.062500-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 104
Message: Die Protokolldatei "Application" wurde gelöscht.
Record Number: 569
Source Name: Microsoft-Windows-Eventlog
Time Written: 20091014022446.000000-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 104
Message: Die Protokolldatei "System" wurde gelöscht.
Record Number: 568
Source Name: Microsoft-Windows-Eventlog
Time Written: 20091014022445.984375-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: WIN-EESJFG89GSV
Event Code: 900
Message: Der Softwareschutzdienst wird gestartet.

Record Number: 200
Source Name: Microsoft-Windows-Security-SPP
Time Written: 20091014022606.000000-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 1003
Message: Windows Search wurde gestartet.

Record Number: 199
Source Name: Microsoft-Windows-Search
Time Written: 20091014022454.000000-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 1013
Message: Windows Search wurde normal beendet.

Record Number: 198
Source Name: Microsoft-Windows-Search
Time Written: 20091014022452.000000-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 103
Message: Windows (612) Windows: Das Datenbankmodul hat die Instanz (0) beendet.
Record Number: 197
Source Name: ESENT
Time Written: 20091014022452.000000-000
Event Type: Informationen
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 4104
Message:
Eine Hauptzusammenführung wurde für Katalog SystemIndex wegen des Fehlers 0xc0000001 angehalten. Sie wird

für einen späteren Zeitpunkt neu geplant.
Record Number: 196
Source Name: Microsoft-Windows-Search
Time Written: 20091014022451.000000-000
Event Type: Informationen
User:

=====Security event log=====

Computer Name: WIN-EESJFG89GSV
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: WIN-EESJFG89GSV$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7

Anmeldetyp: 5

Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
Prozess-ID: 0x1bc
Prozessname: C:\Windows\System32\services.exe

Netzwerkinformationen:
Arbeitsstationsname:
Quellnetzwerkadresse: -
Quellport: -

Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Advapi
Authentifizierungspaket: Negotiate
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den

zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies

ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete

Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer

verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen

Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem

KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel

angefordert wurde, ist dieser Wert 0.
Record Number: 165
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091014022455.343750-000
Event Type: Überwachung erfolgreich
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 4672
Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7

Berechtigungen: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 164
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091014022454.562500-000
Event Type: Überwachung erfolgreich
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: WIN-EESJFG89GSV$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7

Anmeldetyp: 5

Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
Prozess-ID: 0x1bc
Prozessname: C:\Windows\System32\services.exe

Netzwerkinformationen:
Arbeitsstationsname:
Quellnetzwerkadresse: -
Quellport: -

Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Advapi
Authentifizierungspaket: Negotiate
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den

zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies

ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete

Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer

verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen

Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem

KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel

angefordert wurde, ist dieser Wert 0.
Record Number: 163
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091014022454.562500-000
Event Type: Überwachung erfolgreich
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 4738
Message: Ein Benutzerkonto wurde geändert.

Antragsteller:
Sicherheits-ID: S-1-5-21-221655767-1795451823-3490316122-500
Kontoname: Administrator
Kontodomäne: WIN-EESJFG89GSV
Anmelde-ID: 0x150b1

Zielkonto:
Sicherheits-ID: S-1-5-21-221655767-1795451823-3490316122-500
Kontoname: Administrator
Kontodomäne: WIN-EESJFG89GSV

Geänderte Attribute:
SAM-Kontoname: -
Anzeigename: -
Benutzerprinzipalname: -
Stammverzeichnis: -
Stammlaufwerk: -
Skriptpfad: -
Profilpfad: -
Benutzerarbeitsstationen: -
Letzte Kennwortänderung: -
Konto gültig bis: -
Primäre Gruppen-ID: -
Darf delegieren an: -
Alter Benutzerkontensteuerungswert: 0x211
Neuer Benutzerkontensteuerungswert: 0x211
Benutzerkontensteuerung: -
Benutzerparameter: -
SID-Verlauf: -
Anmeldezeiten: -

Weitere Informationen:
Berechtigungen: -
Record Number: 162
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091014022446.171875-000
Event Type: Überwachung erfolgreich
User:

Computer Name: WIN-EESJFG89GSV
Event Code: 1102
Message: Das Überwachungsprotokoll wurde gelöscht.
Subjekt:
Sicherheits-ID: S-1-5-21-221655767-1795451823-3490316122-500
Kontoname: Administrator
Domänenname: WIN-EESJFG89GSV
Anmelde-ID: 0x150b1
Record Number: 161
Source Name: Microsoft-Windows-Eventlog
Time Written: 20091014022446.015625-000
Event Type: Überwachung erfolgreich
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=C:\Program Files\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;

%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Users\***\Downloads\android-sdk_r06-windows\android-sdk-windows

\tools
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=0f0d
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%

-----------------EOF-----------------

Zitat:

Logfile of random's system information tool 1.08 (written by random/random)
Run by *** at 2010-07-20 20:52:35
Microsoft Windows 7 Ultimate
System drive C: has 158 GB (56%) free of 282 GB
Total RAM: 3070 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:52:41, on 20.07.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\WButton.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\vsnpstd3.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE
C:\Users\***\AppData\Local\Lexar Media\LxrAutorun.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Windows\explorer.exe
C:\Users\***\Desktop\RSIT.exe
C:\Program Files\trend micro\***.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat

\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:

\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin

\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [HotkeyApp] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSD.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\/\KiesTrayAgent.exe
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [WEB.DE_WEB.DE SmartDrive Manager] "C:\Program Files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE"

/hide
O4 - HKCU\..\Run: [LxrAutorun] C:\Users\***\AppData\Local\Lexar Media\LxrAutorun.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:

\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:

\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:

\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:

\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O22 - SharedTaskScheduler: FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock

\Fences\FencesMenu.dll
O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: SAMSUNG KiesAllShare Service (KiesAllShare) - Unknown owner - C:\Program Files\Samsung\Kies

\WiselinkPro\WiselinkPro.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\Windows\SYSTEM32\LxrSII1s.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: WisLMSvc - Wistron Corp. - C:\Program Files\Launch Manager\WisLMSvc.exe
O23 - Service: XobniService - Xobni Corporation - C:\Program Files\Xobni\XobniService.exe

--
End of file - 7792 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-

A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-

B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-

BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-14 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-08-31 102400]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-07-03 6266880]
"Skytel"=C:\Windows\Skytel.exe [2008-06-25 1826816]
"LaunchAp"=C:\Program Files\Launch Manager\LaunchAp.exe [2007-09-01 32768]
"HotkeyApp"=C:\Program Files\Launch Manager\HotkeyApp.exe [2007-09-06 188416]
"LMgrOSD"=C:\Program Files\Launch Manager\OSD.exe [2006-12-26 180224]
"Wbutton"=C:\Program Files\Launch Manager\Wbutton.exe [2007-09-07 86016]
"NPSStartup"= []
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-01-14 37888]
"LogMeIn GUI"=C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2008-08-11 63048]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"snpstd3"=C:\Windows\vsnpstd3.exe [2006-09-19 827392]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"MSSE"=c:\Program Files\Microsoft Security Essentials\msseces.exe [2010-06-01 1093208]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2009-10-09 107864]
"KiesTrayAgent"=C:\Program Files\Samsung\Kies\/\KiesTrayAgent.exe [2010-02-26 3404600]
""= []
"VeohPlugin"=C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [2010-04-28 2633976]
"WEB.DE_WEB.DE SmartDrive Manager"=C:\Program Files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE [2010-01-27

1208320]
"LxrAutorun"=C:\Users\***\AppData\Local\Lexar Media\LxrAutorun.exe [2006-11-09 24576]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Google Calendar Sync.lnk - C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock\Fences\FencesMenu.dll [2009-10

-02 128360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile

\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile

\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-07-20 20:52:35 ----D---- C:\rsit
2010-07-20 20:43:20 ----D---- C:\Program Files\CCleaner
2010-07-18 16:34:17 ----SHD---- C:\Config.Msi
2010-07-16 09:38:32 ----D---- C:\Program Files\Lame for Audacity
2010-07-16 09:29:00 ----D---- C:\Program Files\Audacity
2010-07-14 11:21:10 ----D---- C:\Program Files\Trend Micro
2010-07-12 20:44:49 ----A---- C:\Windows\system32\drivers\mvzxzdje.sys
2010-07-12 20:13:50 ----D---- C:\Program Files\Microsoft Security Essentials
2010-07-04 20:27:37 ----D---- C:\Users\***\AppData\Roaming\Malwarebytes
2010-07-04 20:27:28 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-07-04 20:27:27 ----D---- C:\ProgramData\Malwarebytes
2010-07-04 20:27:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-07-04 20:27:27 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-07-04 14:27:17 ----A---- C:\Windows\system32\msrun.exe
2010-07-04 14:27:17 ----A---- C:\Windows\system32\drivers\srenum.sys
2010-07-04 14:26:15 ----D---- C:\Users\***\AppData\Roaming\824D73B28B7DA196CBEF3C9CD5F6E641
2010-07-04 14:10:36 ----D---- C:\Users\***\AppData\Roaming\DivX
2010-07-04 14:10:06 ----D---- C:\Program Files\Common Files\DivX Shared
2010-07-04 14:09:30 ----D---- C:\Program Files\DivX
2010-07-04 14:09:14 ----D---- C:\ProgramData\DivX
2010-06-28 20:19:26 ----D---- C:\Program Files\Microsoft Silverlight
2010-06-25 23:18:51 ----D---- C:\2bfbbba04d5ca5af5f673b22
2010-06-24 18:56:40 ----D---- C:\Program Files\EA Sports
2010-06-24 18:56:22 ----A---- C:\Windows\system32\drivers\PnkBstrK.sys
2010-06-24 18:56:22 ----A---- C:\Users\***\AppData\Roaming\PnkBstrK.sys
2010-06-24 18:56:07 ----A---- C:\Windows\system32\PnkBstrB.exe
2010-06-24 18:55:48 ----A---- C:\Windows\system32\PnkBstrA.exe
2010-06-24 18:55:48 ----A---- C:\Windows\system32\pbsvc.exe
2010-06-24 08:34:25 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-06-24 08:34:25 ----A---- C:\Windows\system32\PresentationHost.exe
2010-06-24 08:34:25 ----A---- C:\Windows\system32\netfxperf.dll
2010-06-24 08:34:25 ----A---- C:\Windows\system32\mscoree.dll
2010-06-24 08:34:25 ----A---- C:\Windows\system32\dfshim.dll
2010-06-24 07:56:18 ----A---- C:\Windows\system32\ntdll.dll
2010-06-24 07:56:17 ----A---- C:\Windows\system32\CPFilters.dll
2010-06-24 07:56:16 ----A---- C:\Windows\system32\msdri.dll
2010-06-23 08:13:58 ----D---- C:\Xobni
2010-06-22 05:42:41 ----D---- C:\Program Files\Xobni

======List of files/folders modified in the last 1 months======

2010-07-20 20:52:41 ----D---- C:\Windows\Prefetch
2010-07-20 20:52:32 ----D---- C:\Windows\Temp
2010-07-20 20:47:49 ----D---- C:\Windows\Minidump
2010-07-20 20:47:49 ----D---- C:\Windows\debug
2010-07-20 20:47:49 ----D---- C:\Windows
2010-07-20 20:43:20 ----D---- C:\Program Files
2010-07-20 20:38:59 ----D---- C:\Windows\System32
2010-07-20 20:38:59 ----D---- C:\Windows\inf
2010-07-20 20:38:59 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-07-20 20:11:18 ----D---- C:\Windows\system32\config
2010-07-20 08:50:53 ----D---- C:\Users\***\AppData\Roaming\vlc
2010-07-20 07:52:41 ----D---- C:\Program Files\LogMeIn
2010-07-18 16:34:43 ----SHD---- C:\Windows\Installer
2010-07-16 19:01:37 ----D---- C:\Users\***\AppData\Roaming\Winamp
2010-07-14 12:18:01 ----SHD---- C:\Boot
2010-07-12 20:44:49 ----D---- C:\Windows\system32\drivers
2010-07-12 20:13:55 ----D---- C:\Windows\system32\catroot
2010-07-12 20:13:54 ----SD---- C:\ProgramData\Microsoft
2010-07-12 15:32:12 ----SHD---- C:\System Volume Information
2010-07-12 09:59:10 ----D---- C:\Windows\system32\catroot2
2010-07-11 13:58:06 ----D---- C:\Program Files\JDownloader
2010-07-11 13:55:19 ----D---- C:\Program Files\Common Files\PX Storage Engine
2010-07-09 08:11:35 ----D---- C:\Program Files\Mozilla Firefox
2010-07-04 21:07:08 ----D---- C:\Windows\Downloaded Program Files
2010-07-04 20:54:08 ----D---- C:\Windows\system32\Tasks
2010-07-04 20:54:05 ----D---- C:\Windows\Tasks
2010-07-04 20:27:27 ----HD---- C:\ProgramData
2010-07-04 14:10:06 ----D---- C:\Program Files\Common Files
2010-06-28 18:10:09 ----D---- C:\Users\***\AppData\Roaming\ICQ
2010-06-26 10:46:56 ----RSD---- C:\Windows\assembly
2010-06-26 10:46:56 ----D---- C:\Windows\Microsoft.NET
2010-06-25 23:16:51 ----D---- C:\Windows\system32\en-US
2010-06-25 23:16:51 ----D---- C:\Program Files\Microsoft.NET
2010-06-24 21:12:30 ----D---- C:\Windows\system32\DriverStore
2010-06-24 18:55:48 ----D---- C:\Windows\system32\LogFiles
2010-06-24 18:45:27 ----D---- C:\Windows\winsxs
2010-06-24 08:34:15 ----D---- C:\Windows\ehome
2010-06-24 08:34:05 ----D---- C:\Windows\AppPatch
2010-06-22 08:21:30 ----D---- C:\Windows\twain_32

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 Si3531;SiI-3531 SATA Controller; C:\Windows\system32\DRIVERS\Si3531.sys [2009-02-05 212520]
R0 SiFilter;SATALink driver accelerator; C:\Windows\system32\DRIVERS\SiWinAcc.sys [2007-05-25 17328]
R0 SiRemFil;SATALink External Device Filter; C:\Windows\system32\DRIVERS\SiRemFil.sys [2007-05-25 12464]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 Hotkey;Hotkey; C:\Windows\system32\drivers\Hotkey.sys [2003-04-28 9867]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys [2010-01-29 82320]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-03-25 151216]
R1 uiwbrdr;uiwbrdr; C:\Windows\System32\DRIVERS\uiwbrdr.sys [2010-01-27 144896]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\Windows\system32\drivers\LMIRfsDriver.sys [2008-08-11

47640]
R2 LxrSII1d;Secure II Driver; \??\C:\Windows\system32\Drivers\LxrSII1d.sys [2006-12-14 72672]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2009-12-03 625224]
R3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 58880]
R3 Cam5607;Bison Webcam; C:\Windows\System32\Drivers\BisonC07.sys [2007-08-30 805416]
R3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [2010-02-04 18136]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-12-22 36640]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-07-03

2152088]
R3 lmimirr;lmimirr; C:\Windows\system32\DRIVERS\lmimirr.sys [2008-08-11 10144]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit; C:\Windows

\system32\DRIVERS\netw5v32.sys [2009-07-14 4231168]
R3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-12-19 249888]
R3 RTSTOR;USB Mass Storage Device; C:\Windows\system32\drivers\RTSTOR.SYS [2008-01-03 59392]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-08-31 192688]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S2 srenum;srenum; C:\Windows\System32\DRIVERS\srenum.sys [2010-07-04 46976]
S3 {BA122420-466D-42CC-B4D6B4B8A560B2B5};{BA122420-466D-42CC-B4D6B4B8A560B2B5}; \??\C:\Windows\TEMP\88D.tmp []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP-Bus-Filtertreiber; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2010-02-04

30240]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14

229888]
S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 392704]
S3 E1G60;Intel(R) PRO/1000 NDIS 6-Adaptertreiber; C:\Windows\system32\DRIVERS\E1G60I32.sys [2009-07-14 118784]
S3 ndisrd;WinpkFilter Service; C:\Windows\system32\DRIVERS\ndisrd.sys []
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP-Bus-Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 SNPSTD3;USB PC Camera (SNPSTD3); C:\Windows\system32\DRIVERS\snpstd3.sys [2007-03-27 10252544]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2010-02-04

96416]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2010-02-04 12704]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2010-02-04 121504]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2010-01-20 98560]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2010-01-20 14848]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2010-01-20 123648]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 viaagp;VIA AGP-Bus-Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7-Prozessortreiber; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb-Treiber; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-08-13 60160]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\Windows\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 dgdersvc;Device Error Recovery Service; C:\Windows\system32\dgdersvc.exe [2010-02-04 95568]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2009-12-22 217088]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2010-06-10 116104]
R2 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2008-08-11 63040]
R2 LxrSII1s;Lexar Secure II; C:\Windows\system32\LxrSII1s.exe [2006-01-09 49152]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2010-03-25

17904]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-11-20 122984]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-06-24 75064]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 XobniService;XobniService; C:\Program Files\Xobni\XobniService.exe [2010-05-20 55016]
R3 WisLMSvc;WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [2007-09-11 118784]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework

\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 {C41AD944-8FFF-4A4A-83F6D279C1E1554D};{C41AD944-8FFF-4A4A-83F6D279C1E1554D}; C:\Windows\System32\svchost.exe

[2009-07-14 20992]
S3 {EE58B4F4-5720-4300-BC3E22D26B7DAB84};{EE58B4F4-5720-4300-BC3E22D26B7DAB84}; C:\Windows\System32\svchost.exe

[2009-07-14 20992]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 KiesAllShare;SAMSUNG KiesAllShare Service; C:\Program Files\Samsung\Kies\WiselinkPro\WiselinkPro.exe [2010-01-18

9201664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office

\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

[2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26

145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]

-----------------EOF-----------------

Und desweiteren bekam ich während ich sämtliche Progs laufen lies und die Logs bearbeitet habe, 3 ähnliche Meldungen wie diese:

http://img706.imageshack.us/img706/9838/wurmp.jpg

Ich hoffe, dass ich alles befolgt habe und somit entsprechend Hilfe bekomme :)

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Hi, Danke für die Antwort, aber eine Logfile ist bei mir leer:

die OTL.txt ist leer.

die Extras.txt zeigt folgendes:
OTL EXTRAS Logfile:

Code:

OTL Extras logfile created on: 22.07.2010 21:05:13 - Run 1

OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\BigDan\Downloads

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 59,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 76,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 275,41 Gb Total Space | 152,00 Gb Free Space | 55,19% Space Free | Partition Type: NTFS

Drive D: | 22,66 Gb Total Space | 12,51 Gb Free Space | 55,20% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Drive W: | 4,00 Gb Total Space | 2,22 Gb Free Space | 55,50% Space Free | Partition Type: FAT

 

Computer Name: BIGDAN-PC

Current User Name: BigDan

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences

"{1943A043-5C85-4A16-A0D0-D687B2C1A40F}" = VirtualCom driver

"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15

"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{4E1CD3D5-D4EE-4246-AE24-F0FD5A60390D}" = OviMPlatform

"{4FFD1AB4-54F0-4069-88D9-3A55B38F874B}" = Nokia Ovi Suite Software Updater

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{60DED9C2-22BF-47A3-B6C8-6B141BA31DFD}" = Ovi Desktop Sync Engine

"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2

"{6FE3B0CE-37C1-4825-908A-5A84C9B4EC2F}" = EA SPORTS(TM) FIFA Online

"{7184F382-8A6C-4B85-A3AC-B63734B1E241}" = SAMSUNG Mobile USB Driver

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7397EDED-F38A-4654-B669-BF61065803D0}" = PC Connectivity Solution

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}" = Microsoft Antimalware Service DE-DE Language Pack

"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8DC069E7-893C-41E1-9442-DE89FEC33371}" = Xobni Core

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch

"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86

"{B2D4D657-DAA4-4C68-B01E-11736C1D8C0D}" = Unigine Heaven Benchmark v1.0

"{B9C9DB4C-6D77-4AE9-AD1C-C708C23239A0}" = Nokia Connectivity Cable Driver

"{BD1587F7-B8D0-4111-8F1F-3327628AB02F}" = 3531-W-D

"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX

"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones

"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.4.9

"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies

"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader

"{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}" = Nokia Ovi Suite

"{DF2035BE-5820-4965-BD97-7FAF8D4A7879}" = Microsoft_VC90_CRT_x86

"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware

"{E6C44758-FF49-47D1-8182-65E3818ACE23}" = AuthenTec TrueSuite

"{E815FB81-995F-4F33-8E25-F16712123AB7}" = AuthenTec Fingerprint Sensor Minimum Install

"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio

"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Audacity_is1" = Audacity 1.2.6

"Bejeweled 2 Deluxe 1.1" = Bejeweled 2 Deluxe 1.1

"CCleaner" = CCleaner

"DivX Setup.divx.com" = DivX-Setup

"eMule" = eMule

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Fences" = Fences

"Google Calendar Sync" = Google Calendar Sync

"HijackThis" = HijackThis 2.0.2

"ImgBurn" = ImgBurn

"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies

"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio

"IrfanView" = IrfanView (remove only)

"JDownloader" = JDownloader

"LADSPA_plugins-win_is1" = LADSPA_plugins-win-0.4.15

"LAME for Audacity_is1" = LAME v3.98.2 for Audacity

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft Security Essentials" = Microsoft Security Essentials

"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)

"Nokia Ovi Suite" = Nokia Ovi Suite

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"NVIDIA Drivers" = NVIDIA Drivers

"OpenAL" = OpenAL

"PunkBusterSvc" = PunkBuster Services

"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software

"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software

"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software

"SAMSUNG Mobile USB Download Driver" = SAMSUNG Mobile USB Download Driver Software

"SopCast" = SopCast 3.2.9

"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"SystemRequirementsLab" = System Requirements Lab

"TreeSize Free_is1" = TreeSize Free V2.4

"UltraISO_is1" = UltraISO Premium V9.36

"VLC media player" = VLC media player 1.0.5

"WBFS Manager 3.0" = WBFS Manager 3.0

"WEB.DE SmartDrive Manager" = WEB.DE SmartDrive Manager

"Winamp" = Winamp

"WinRAR archiver" = WinRAR

"XMedia Recode" = XMedia Recode 2.2.3.2

"XobniMain" = Xobni

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"5f48e2ab41c5d005" = RapidShare Manager

"Winamp Detect" = Winamp Erkennungs-Plug-in

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 14.07.2010 05:32:18 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 14.07.2010 05:32:18 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 14.07.2010 05:32:34 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.07.2010 01:42:46 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.07.2010 01:55:16 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.07.2010 01:55:16 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.07.2010 01:55:31 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 16.07.2010 02:18:45 | Computer Name = BigDan-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107

Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen

 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.

 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum

 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

.

 

Error - 19.07.2010 12:59:03 | Computer Name = BigDan-PC | Source = System Restore | ID = 8193

Description = 

 

Error - 20.07.2010 01:53:03 | Computer Name = BigDan-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: WButton.exe, Version: 1.0.8.6, Zeitstempel:

 0x46e0a8dc  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bdaae  Ausnahmecode: 0xe06d7363  Fehleroffset: 0x00009617  ID des fehlerhaften

 Prozesses: 0xca8  Startzeit der fehlerhaften Anwendung: 0x01cb27cfcc519fa3  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Launch Manager\WButton.exe  Pfad des fehlerhaften

 Moduls: C:\Windows\system32\KERNELBASE.dll  Berichtskennung: 0f32c3e3-93c3-11df-a9ca-000a3a86eb0f

 

[ System Events ]

Error - 18.07.2010 16:36:12 | Computer Name = BigDan-PC | Source = NetBT | ID = 4321

Description = Der Name "BIGDAN-PC      :20" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.2.106  registriert werden. Der Computer mit IP-Adresse 192.168.2.3

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

Error - 19.07.2010 10:58:47 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 19.07.2010 12:17:43 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.07.2010 01:52:34 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.07.2010 02:03:26 | Computer Name = BigDan-PC | Source = Microsoft Antimalware | ID = 2001

Description = Fehler in %%861 beim Aktualisieren von Signaturen.     Neue Signaturversion:

      Vorherige Signaturversion: 1.87.121.0     Aktualisierungsquelle: %%859     Aktualisierungsstufe:

 %%852     Quellpfad: hxxp://www.microsoft.com     Signaturtyp: %%800     Aktualisierungstyp: %%803
 

        Benutzer:

 NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:      Vorherige Modulversion: 1.1.6004.0     Fehlercode:

 0x80072efe     Fehlerbeschreibung: Die Serververbindung wurde aufgrund eines Fehlers

 beendet. 

 

Error - 20.07.2010 04:03:00 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.07.2010 04:28:50 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.07.2010 06:09:17 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.07.2010 14:07:03 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 20.07.2010 14:33:48 | Computer Name = BigDan-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "srenum" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

 

< End of report >

--- --- ---

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Alles klar :=)

Combofix Logfile:

Code:

ComboFix 10-07-24.01 - BigDan 24.07.2010  23:59:00.2.2 - x86

Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.3070.1959 [GMT 2:00]

ausgeführt von:: c:\users\BigDan\Desktop\cofi.exe

 * Neuer Wiederherstellungspunkt wurde erstellt

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Vorheriger Suchlauf -------

.

c:\users\BigDan\AppData\Roaming\824D73B28B7DA196CBEF3C9CD5F6E641\enemies-names.txt

c:\users\BigDan\AppData\Roaming\824D73B28B7DA196CBEF3C9CD5F6E641\local.ini

c:\windows\system\BisonC07.dll

c:\windows\system\BisonV07.dll

c:\windows\system32\drivers\srenum.sys

c:\windows\system32\msrun.exe

c:\windows\system32\muzapp.exe

c:\windows\system32\system
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Service_ndisrd
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-06-24 bis 2010-07-24  ))))))))))))))))))))))))))))))

.
 

2010-07-24 22:05 . 2010-07-24 22:05        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-07-22 19:19 . 2010-07-22 19:19        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2010-07-22 19:15 . 2010-07-22 19:15        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help

2010-07-20 19:44 . 2010-07-20 19:44        51776        ----a-w-        c:\windows\system32\drivers\poqmpwsk.sys

2010-07-20 18:52 . 2010-07-20 18:54        --------        d-----w-        C:\rsit

2010-07-20 18:43 . 2010-07-20 18:43        --------        d-----w-        c:\program files\CCleaner

2010-07-18 14:41 . 2010-01-25 09:58        462848        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\ractrlkeyhook.dll

2010-07-18 14:41 . 2010-01-15 12:25        864256        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardianDll.dll

2010-07-18 14:41 . 2010-01-15 12:25        315392        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardianEvt.dll

2010-07-18 14:41 . 2010-01-15 12:25        372736        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardian.exe

2010-07-18 14:41 . 2010-06-01 09:44        3907584        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll

2010-07-18 14:41 . 2010-01-15 12:26        70984        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIProxyHelper.exe

2010-07-16 07:38 . 2010-07-16 07:38        --------        d-----w-        c:\program files\Lame for Audacity

2010-07-16 07:29 . 2010-07-16 07:29        --------        d-----w-        c:\program files\Audacity

2010-07-14 09:21 . 2010-07-20 18:52        --------        d-----w-        c:\program files\Trend Micro

2010-07-12 18:44 . 2010-07-12 18:44        51776        ----a-w-        c:\windows\system32\drivers\TERMDD.SYS

2010-07-12 18:13 . 2010-07-12 18:14        --------        d-----w-        c:\program files\Microsoft Security Essentials

2010-07-11 11:55 . 2010-07-11 11:55        56765        ----a-w-        c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-07-11 11:55 . 2010-07-11 11:55        57715        ----a-w-        c:\programdata\DivX\Player\Uninstaller.exe

2010-07-11 11:55 . 2010-07-11 11:55        84054        ----a-w-        c:\programdata\DivX\TransferWizard\Uninstaller.exe

2010-07-11 11:55 . 2010-07-11 11:55        54153        ----a-w-        c:\programdata\DivX\DFXPlugin\Uninstaller.exe

2010-07-04 18:27 . 2010-07-04 18:27        --------        d-----w-        c:\users\BigDan\AppData\Roaming\Malwarebytes

2010-07-04 18:27 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-04 18:27 . 2010-07-04 18:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-07-04 18:27 . 2010-07-04 18:27        --------        d-----w-        c:\programdata\Malwarebytes

2010-07-04 18:27 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-07-04 12:11 . 2010-07-11 11:58        57344        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-07-04 12:09 . 2010-07-11 11:55        --------        d-----w-        c:\program files\DivX

2010-07-04 12:09 . 2010-07-11 11:55        --------        d-----w-        c:\programdata\DivX

2010-06-28 18:19 . 2010-06-28 18:19        --------        d-----w-        c:\program files\Microsoft Silverlight

2010-06-27 19:16 . 2010-06-27 19:16        --------        d-----w-        c:\users\BigDan\AppData\Local\RapidShare

2010-06-27 19:16 . 2010-06-27 19:16        --------        d-----w-        c:\users\BigDan\AppData\Local\Deployment

2010-06-27 19:16 . 2010-06-27 19:16        --------        d-----w-        c:\users\BigDan\AppData\Local\Apps

2010-06-25 21:18 . 2010-06-25 21:18        --------        d-----w-        C:\2bfbbba04d5ca5af5f673b22
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-24 22:00 . 2010-04-08 05:14        --------        d-----w-        c:\program files\LogMeIn

2010-07-24 21:58 . 2009-07-14 08:47        657676        ----a-w-        c:\windows\system32\perfh007.dat

2010-07-24 21:58 . 2009-07-14 08:47        131016        ----a-w-        c:\windows\system32\perfc007.dat

2010-07-24 12:26 . 2010-03-15 06:54        --------        d-----w-        c:\programdata\Microsoft Help

2010-07-24 12:19 . 2010-03-28 01:51        --------        d-----w-        c:\users\BigDan\AppData\Roaming\Winamp

2010-07-23 10:56 . 2010-03-15 21:33        108824        ----a-w-        c:\users\BigDan\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-22 19:16 . 2010-03-15 06:56        --------        d-----w-        c:\program files\Microsoft Works

2010-07-22 19:08 . 2010-04-02 19:03        --------        d-----w-        c:\users\BigDan\AppData\Roaming\vlc

2010-07-22 18:54 . 2010-03-14 16:38        --------        d-----w-        c:\program files\JDownloader

2010-07-11 11:55 . 2010-03-28 01:51        --------        d-----w-        c:\program files\Common Files\PX Storage Engine

2010-07-11 11:54 . 2010-07-04 12:10        1062184        ----a-w-        c:\programdata\DivX\Setup\Resource.dll

2010-07-11 11:54 . 2010-07-04 12:10        895256        ----a-w-        c:\programdata\DivX\Setup\DivXSetup.exe

2010-06-28 16:10 . 2010-03-18 20:13        --------        d-----w-        c:\users\BigDan\AppData\Roaming\ICQ

2010-06-27 19:23 . 2010-06-24 16:56        138968        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2010-06-27 19:23 . 2010-06-24 16:56        214592        ----a-w-        c:\windows\system32\PnkBstrB.exe

2010-06-25 21:16 . 2010-03-15 06:56        --------        d-----w-        c:\program files\Microsoft.NET

2010-06-24 19:12 . 2010-06-24 19:12        0        ---ha-w-        c:\windows\system32\drivers\Msft_Kernel_xusb21_01009.Wdf

2010-06-24 16:56 . 2010-06-24 16:56        --------        d-----w-        c:\program files\EA Sports

2010-06-24 16:56 . 2010-06-24 16:56        139152        ----a-w-        c:\users\BigDan\AppData\Roaming\PnkBstrK.sys

2010-06-24 16:56 . 2010-06-24 16:56        139152        ----a-w-        c:\users\BigDan\AppData\Roaming\PnkBstrK.sys

2010-06-24 16:55 . 2010-06-24 16:55        794408        ----a-w-        c:\windows\system32\pbsvc.exe

2010-06-24 16:55 . 2010-06-24 16:55        75064        ----a-w-        c:\windows\system32\PnkBstrA.exe

2010-06-22 03:43 . 2010-06-22 03:42        --------        d-----w-        c:\program files\Xobni

2010-06-20 19:50 . 2010-06-20 19:50        --------        d-----w-        c:\programdata\eMule

2010-06-20 19:50 . 2010-06-20 19:50        --------        d-----w-        c:\program files\eMule

2010-06-20 19:47 . 2010-04-27 21:36        --------        d-----w-        c:\users\BigDan\AppData\Roaming\uTorrent

2010-06-20 09:17 . 2010-06-20 08:56        --------        d-----w-        c:\program files\Illusion

2010-06-13 08:53 . 2010-03-28 12:42        --------        d-----w-        c:\users\BigDan\AppData\Roaming\ImgBurn

2010-06-10 16:58 . 2010-04-08 05:14        83360        ----a-w-        c:\windows\system32\LMIRfsClientNP.dll

2010-06-10 16:58 . 2010-04-08 05:14        29568        ----a-w-        c:\windows\system32\LMIport.dll

2010-06-10 16:58 . 2010-04-08 05:14        87424        ----a-w-        c:\windows\system32\LMIinit.dll

2010-06-09 04:28 . 2010-06-09 04:25        --------        d-----w-        c:\program files\XMedia Recode

2010-06-08 08:21 . 2010-06-08 08:21        --------        d-----w-        c:\program files\Common Files\NSV

2010-06-01 17:37 . 2009-10-14 02:21        221568        ------w-        c:\windows\system32\MpSigStub.exe

2010-05-31 04:24 . 2010-05-31 04:24        --------        d-----w-        c:\users\BigDan\AppData\Roaming\WEB.DE

2010-05-31 04:22 . 2010-05-31 04:22        --------        d-----w-        c:\programdata\WEB.DE

2010-05-31 04:22 . 2010-05-31 04:22        --------        d-----w-        c:\program files\WEB.DE

2010-05-27 07:24 . 2010-06-10 20:28        34304        ----a-w-        c:\windows\system32\atmlib.dll

2010-05-27 03:49 . 2010-06-10 20:28        293888        ----a-w-        c:\windows\system32\atmfd.dll

2010-05-21 05:18 . 2010-06-10 20:28        977920        ----a-w-        c:\windows\system32\wininet.dll

2010-05-09 09:14 . 2010-06-24 05:56        641536        ----a-w-        c:\windows\system32\CPFilters.dll

2010-05-09 09:14 . 2010-06-24 05:56        417792        ----a-w-        c:\windows\system32\msdri.dll

2010-05-01 14:49 . 2010-06-10 20:28        2326528        ----a-w-        c:\windows\system32\win32k.sys

2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat

2006-05-03 10:06 . 2010-04-05 08:16        163328        --sh--r-        c:\windows\System32\flvDX.dll

2007-02-21 11:47 . 2010-04-05 08:16        31232        --sh--r-        c:\windows\System32\msfDX.dll

2008-03-16 13:30 . 2010-04-05 08:16        216064        --sh--r-        c:\windows\System32\nbDX.dll

2009-07-14 01:14 . 2009-07-13 23:42        396800        --sha-w-        c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KiesTrayAgent"="c:\program files\Samsung\Kies\" [X]

"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-10-09 107864]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-04-28 2633976]

"WEB.DE_WEB.DE SmartDrive Manager"="c:\program files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE" [2010-01-27 1208320]

"LxrAutorun"="c:\users\BigDan\AppData\Local\Lexar Media\LxrAutorun.exe" [2006-11-09 24576]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-31 102400]

"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]

"Skytel"="Skytel.exe" [2008-06-25 1826816]

"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2007-09-01 32768]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-09-06 188416]

"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2006-12-26 180224]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2007-09-07 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)
 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2009-10-02 128360]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 srenum;srenum;c:\windows\system32\DRIVERS\srenum.sys [x]

R3 {BA122420-466D-42CC-B4D6B4B8A560B2B5};{BA122420-466D-42CC-B4D6B4B8A560B2B5};c:\windows\TEMP\88D.tmp [x]

R3 {C41AD944-8FFF-4A4A-83F6D279C1E1554D};{C41AD944-8FFF-4A4A-83F6D279C1E1554D};c:\windows\System32\svchost.exe [2009-07-14 20992]

R3 {EE58B4F4-5720-4300-BC3E22D26B7DAB84};{EE58B4F4-5720-4300-BC3E22D26B7DAB84};c:\windows\System32\svchost.exe [2009-07-14 20992]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-02-04 30240]

R3 KiesAllShare;SAMSUNG KiesAllShare Service;c:\program files\Samsung\Kies\WiselinkPro\WiselinkPro.exe [2010-01-18 9201664]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2010-02-04 96416]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2010-02-04 12704]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2010-02-04 121504]

S0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\DRIVERS\Si3531.sys [2009-02-05 212520]

S1 uiwbrdr;uiwbrdr;c:\windows\system32\DRIVERS\uiwbrdr.sys [2010-01-27 144896]

S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-02-04 95568]

S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088]

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]

S2 LxrSII1d;Secure II Driver;c:\windows\system32\Drivers\LxrSII1d.sys [2006-12-14 72672]

S2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [2010-05-20 55016]

S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-12-03 625224]

S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-02-04 18136]

S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-12-22 36640]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-12-19 249888]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2007-09-11 118784]
 
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - FSUSBEXDISK
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

{C41AD944-8FFF-4A4A-83F6D279C1E1554D}

.

.

------- Zusätzlicher Suchlauf -------

.

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\

FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF - plugin: c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll

FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll
 

---- FIREFOX Richtlinien ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKLM-Run-NPSStartup - (no file)

AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe

AddRemove-02_Siberian - c:\program files\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exe

AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe

AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe

AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe

AddRemove-09_Hsp - c:\program files\SAMSUNG\USB Drivers\09_Hsp\Uninstall.exe

AddRemove-11_HSP_Plus_Default - c:\program files\SAMSUNG\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

AddRemove-12_Symbian_USB_Download_Driver - c:\program files\SAMSUNG\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe

AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe

AddRemove-16_Shrewsbury - c:\program files\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exe
 
 

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(3120)

c:\program files\Stardock\Fences\FencesMenu.dll

c:\program files\stardock\fences\DesktopDock.dll

.

Zeit der Fertigstellung: 2010-07-25  00:09:54

ComboFix-quarantined-files.txt  2010-07-24 22:09
 

Vor Suchlauf: 18 Verzeichnis(se), 170.902.220.800 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 170.605.973.504 Bytes frei
 

- - End Of File - - 5789C61A93ED2069D875466D53088C84

--- --- ---

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

File::

c:\windows\system32\drivers\poqmpwsk.sys

c:\windows\system32\DRIVERS\srenum.sys

c:\windows\TEMP\88D.tmp

c:\windows\system32\drivers\dgderdrv.sys
 

Driver::

srenum

dgderdrv

{BA122420-466D-42CC-B4D6B4B8A560B2B5}

{C41AD944-8FFF-4A4A-83F6D279C1E1554D}

{EE58B4F4-5720-4300-BC3E22D26B7DAB84}
 

NetSvc::

{BA122420-466D-42CC-B4D6B4B8A560B2B5}

{C41AD944-8FFF-4A4A-83F6D279C1E1554D}

{EE58B4F4-5720-4300-BC3E22D26B7DAB84}

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

so hier die neue logfile

Combofix Logfile:

Code:

ComboFix 10-07-24.06 - BigDan 26.07.2010  23:44:02.3.2 - x86

Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.3070.1805 [GMT 2:00]

ausgeführt von:: c:\users\BigDan\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\BigDan\CFScript.txt

 * Neuer Wiederherstellungspunkt wurde erstellt
 

FILE ::

"c:\windows\system32\drivers\dgderdrv.sys"

"c:\windows\system32\drivers\poqmpwsk.sys"

"c:\windows\system32\DRIVERS\srenum.sys"

"c:\windows\TEMP\88D.tmp"

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windows\system32\drivers\dgderdrv.sys

c:\windows\system32\drivers\poqmpwsk.sys
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_DGDERDRV

-------\Service_{BA122420-466D-42CC-B4D6B4B8A560B2B5}

-------\Service_{C41AD944-8FFF-4A4A-83F6D279C1E1554D}

-------\Service_{EE58B4F4-5720-4300-BC3E22D26B7DAB84}

-------\Service_dgderdrv

-------\Service_srenum
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-06-26 bis 2010-07-26  ))))))))))))))))))))))))))))))

.
 

2010-07-26 21:51 . 2010-07-26 21:51        --------        d-----w-        c:\users\Public\AppData\Local\temp

2010-07-26 21:51 . 2010-07-26 21:51        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-07-26 21:51 . 2010-07-26 21:51        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2010-07-22 19:19 . 2010-07-22 19:19        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2010-07-22 19:15 . 2010-07-22 19:15        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help

2010-07-20 18:52 . 2010-07-20 18:54        --------        d-----w-        C:\rsit

2010-07-20 18:43 . 2010-07-20 18:43        --------        d-----w-        c:\program files\CCleaner

2010-07-18 14:41 . 2010-01-25 09:58        462848        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\ractrlkeyhook.dll

2010-07-18 14:41 . 2010-01-15 12:25        864256        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardianDll.dll

2010-07-18 14:41 . 2010-01-15 12:25        315392        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardianEvt.dll

2010-07-18 14:41 . 2010-01-15 12:25        372736        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIGuardian.exe

2010-07-18 14:41 . 2010-06-01 09:44        3907584        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll

2010-07-18 14:41 . 2010-01-15 12:26        70984        ----a-w-        c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\LMIProxyHelper.exe

2010-07-16 07:38 . 2010-07-16 07:38        --------        d-----w-        c:\program files\Lame for Audacity

2010-07-16 07:29 . 2010-07-16 07:29        --------        d-----w-        c:\program files\Audacity

2010-07-14 09:21 . 2010-07-20 18:52        --------        d-----w-        c:\program files\Trend Micro

2010-07-12 18:44 . 2010-07-12 18:44        51776        ----a-w-        c:\windows\system32\drivers\TERMDD.SYS

2010-07-12 18:13 . 2010-07-12 18:14        --------        d-----w-        c:\program files\Microsoft Security Essentials

2010-07-11 11:55 . 2010-07-11 11:55        56765        ----a-w-        c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-07-11 11:55 . 2010-07-11 11:55        57715        ----a-w-        c:\programdata\DivX\Player\Uninstaller.exe

2010-07-11 11:55 . 2010-07-11 11:55        84054        ----a-w-        c:\programdata\DivX\TransferWizard\Uninstaller.exe

2010-07-11 11:55 . 2010-07-11 11:55        54153        ----a-w-        c:\programdata\DivX\DFXPlugin\Uninstaller.exe

2010-07-04 18:27 . 2010-07-04 18:27        --------        d-----w-        c:\users\BigDan\AppData\Roaming\Malwarebytes

2010-07-04 18:27 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-04 18:27 . 2010-07-04 18:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-07-04 18:27 . 2010-07-04 18:27        --------        d-----w-        c:\programdata\Malwarebytes

2010-07-04 18:27 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-07-04 12:11 . 2010-07-11 11:58        57344        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-07-04 12:09 . 2010-07-11 11:55        --------        d-----w-        c:\program files\DivX

2010-07-04 12:09 . 2010-07-11 11:55        --------        d-----w-        c:\programdata\DivX

2010-06-28 18:19 . 2010-06-28 18:19        --------        d-----w-        c:\program files\Microsoft Silverlight

2010-06-27 19:16 . 2010-06-27 19:16        --------        d-----w-        c:\users\BigDan\AppData\Local\RapidShare

2010-06-27 19:16 . 2010-07-24 22:39        --------        d-----w-        c:\users\BigDan\AppData\Local\Deployment

2010-06-27 19:16 . 2010-06-27 19:16        --------        d-----w-        c:\users\BigDan\AppData\Local\Apps
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-26 19:10 . 2009-07-14 08:47        657676        ----a-w-        c:\windows\system32\perfh007.dat

2010-07-26 19:10 . 2009-07-14 08:47        131016        ----a-w-        c:\windows\system32\perfc007.dat

2010-07-26 16:34 . 2010-04-08 05:14        --------        d-----w-        c:\program files\LogMeIn

2010-07-24 22:38 . 2010-06-20 19:50        --------        d-----w-        c:\programdata\eMule

2010-07-24 12:26 . 2010-03-15 06:54        --------        d-----w-        c:\programdata\Microsoft Help

2010-07-24 12:19 . 2010-03-28 01:51        --------        d-----w-        c:\users\BigDan\AppData\Roaming\Winamp

2010-07-23 10:56 . 2010-03-15 21:33        108824        ----a-w-        c:\users\BigDan\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-22 19:16 . 2010-03-15 06:56        --------        d-----w-        c:\program files\Microsoft Works

2010-07-22 19:08 . 2010-04-02 19:03        --------        d-----w-        c:\users\BigDan\AppData\Roaming\vlc

2010-07-22 18:54 . 2010-03-14 16:38        --------        d-----w-        c:\program files\JDownloader

2010-07-11 11:55 . 2010-03-28 01:51        --------        d-----w-        c:\program files\Common Files\PX Storage Engine

2010-07-11 11:54 . 2010-07-04 12:10        1062184        ----a-w-        c:\programdata\DivX\Setup\Resource.dll

2010-07-11 11:54 . 2010-07-04 12:10        895256        ----a-w-        c:\programdata\DivX\Setup\DivXSetup.exe

2010-06-28 16:10 . 2010-03-18 20:13        --------        d-----w-        c:\users\BigDan\AppData\Roaming\ICQ

2010-06-25 21:16 . 2010-03-15 06:56        --------        d-----w-        c:\program files\Microsoft.NET

2010-06-24 19:12 . 2010-06-24 19:12        0        ---ha-w-        c:\windows\system32\drivers\Msft_Kernel_xusb21_01009.Wdf

2010-06-24 16:56 . 2010-06-24 16:56        --------        d-----w-        c:\program files\EA Sports

2010-06-24 16:56 . 2010-06-24 16:56        139152        ----a-w-        c:\users\BigDan\AppData\Roaming\PnkBstrK.sys

2010-06-24 16:56 . 2010-06-24 16:56        139152        ----a-w-        c:\users\BigDan\AppData\Roaming\PnkBstrK.sys

2010-06-22 03:43 . 2010-06-22 03:42        --------        d-----w-        c:\program files\Xobni

2010-06-20 19:47 . 2010-04-27 21:36        --------        d-----w-        c:\users\BigDan\AppData\Roaming\uTorrent

2010-06-20 09:17 . 2010-06-20 08:56        --------        d-----w-        c:\program files\Illusion

2010-06-13 08:53 . 2010-03-28 12:42        --------        d-----w-        c:\users\BigDan\AppData\Roaming\ImgBurn

2010-06-10 16:58 . 2010-04-08 05:14        83360        ----a-w-        c:\windows\system32\LMIRfsClientNP.dll

2010-06-10 16:58 . 2010-04-08 05:14        29568        ----a-w-        c:\windows\system32\LMIport.dll

2010-06-10 16:58 . 2010-04-08 05:14        87424        ----a-w-        c:\windows\system32\LMIinit.dll

2010-06-09 04:28 . 2010-06-09 04:25        --------        d-----w-        c:\program files\XMedia Recode

2010-06-08 08:21 . 2010-06-08 08:21        --------        d-----w-        c:\program files\Common Files\NSV

2010-06-01 17:37 . 2009-10-14 02:21        221568        ------w-        c:\windows\system32\MpSigStub.exe

2010-05-31 04:24 . 2010-05-31 04:24        --------        d-----w-        c:\users\BigDan\AppData\Roaming\WEB.DE

2010-05-31 04:22 . 2010-05-31 04:22        --------        d-----w-        c:\programdata\WEB.DE

2010-05-31 04:22 . 2010-05-31 04:22        --------        d-----w-        c:\program files\WEB.DE

2010-05-27 07:24 . 2010-06-10 20:28        34304        ----a-w-        c:\windows\system32\atmlib.dll

2010-05-27 03:49 . 2010-06-10 20:28        293888        ----a-w-        c:\windows\system32\atmfd.dll

2010-05-21 05:18 . 2010-06-10 20:28        977920        ----a-w-        c:\windows\system32\wininet.dll

2010-05-09 09:14 . 2010-06-24 05:56        641536        ----a-w-        c:\windows\system32\CPFilters.dll

2010-05-09 09:14 . 2010-06-24 05:56        417792        ----a-w-        c:\windows\system32\msdri.dll

2010-05-01 14:49 . 2010-06-10 20:28        2326528        ----a-w-        c:\windows\system32\win32k.sys

2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat

2006-05-03 10:06 . 2010-04-05 08:16        163328        --sh--r-        c:\windows\System32\flvDX.dll

2007-02-21 11:47 . 2010-04-05 08:16        31232        --sh--r-        c:\windows\System32\msfDX.dll

2008-03-16 13:30 . 2010-04-05 08:16        216064        --sh--r-        c:\windows\System32\nbDX.dll

2009-07-14 01:14 . 2009-07-13 23:42        396800        --sha-w-        c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KiesTrayAgent"="c:\program files\Samsung\Kies\" [X]

"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-10-09 107864]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-04-28 2633976]

"WEB.DE_WEB.DE SmartDrive Manager"="c:\program files\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE" [2010-01-27 1208320]

"LxrAutorun"="c:\users\BigDan\AppData\Local\Lexar Media\LxrAutorun.exe" [2006-11-09 24576]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-31 102400]

"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]

"Skytel"="Skytel.exe" [2008-06-25 1826816]

"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2007-09-01 32768]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-09-06 188416]

"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2006-12-26 180224]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2007-09-07 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-2 546288]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-02-04 95568]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-02-04 30240]

R3 KiesAllShare;SAMSUNG KiesAllShare Service;c:\program files\Samsung\Kies\WiselinkPro\WiselinkPro.exe [2010-01-18 9201664]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2010-02-04 96416]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2010-02-04 12704]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2010-02-04 121504]

S0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\DRIVERS\Si3531.sys [2009-02-05 212520]

S1 uiwbrdr;uiwbrdr;c:\windows\system32\DRIVERS\uiwbrdr.sys [2010-01-27 144896]

S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088]

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856]

S2 LxrSII1d;Secure II Driver;c:\windows\system32\Drivers\LxrSII1d.sys [2006-12-14 72672]

S2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [2010-05-20 55016]

S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-12-03 625224]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-03-25 42368]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-12-19 249888]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2007-09-11 118784]
 
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - FSUSBEXDISK
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

.

.

------- Zusätzlicher Suchlauf -------

.

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\

FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF - plugin: c:\users\BigDan\AppData\Roaming\Mozilla\Firefox\Profiles\0fvlewqo.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll

FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll
 

---- FIREFOX Richtlinien ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(6100)

c:\program files\WEB.DE\WEB.DE SmartDrive Manager\ExplorerHook.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\program files\Microsoft Security Essentials\MsMpEng.exe

c:\windows\system32\nvvsvc.exe

c:\program files\LogMeIn\x86\RaMaint.exe

c:\program files\LogMeIn\x86\LogMeIn.exe

c:\program files\LogMeIn\x86\LMIGuardian.exe

c:\windows\system32\LxrSII1s.exe

c:\windows\system32\WUDFHost.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\Microsoft Security Essentials\MpCmdRun.exe

c:\windows\RtHDVCpl.exe

c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe

c:\program files\LogMeIn\x86\LMIGuardian.exe

c:\program files\Synaptics\SynTP\SynTPEnh.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

c:\program files\Mozilla Firefox\firefox.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-07-26  23:57:53 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-07-26 21:57

ComboFix2.txt  2010-07-24 22:09
 

Vor Suchlauf: 17 Verzeichnis(se), 172.686.254.080 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 172.481.613.824 Bytes frei
 

- - End Of File - - D26A861715433CFD19A56A420BED78C2

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.