Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   HiJackThis Logs zwecks Auswertung posten (https://www.trojaner-board.de/90546-hijackthis-logs-zwecks-auswertung-posten.html)

Coolcat 08.09.2010 17:14
HiJackThis Logs zwecks Auswertung posten
 
Hallo Ihr Lieben :D

Ich habe festgestellt, das mit meinem Lapi (Laptop) etwas nicht stimmt, da es mega-lahm wurde und so hat ein Bekannter mit "MalwareBytes" gescannt und prommt 6 Viren gefunden ... er hat sie, wie hier im Forum empfohlen, mit "HijackThis" unschädlich gemacht und gelöscht...
(oh Gott, sagt man das so ...??? Ich bin völlig unbeholfen in PC-Angelegenheiten :stirn: )

Na ja, auf jeden Fall, hat dieser Kollege mir geraten, den HijackThis.exe hier zu posten um einen netten Menschen zu finden, der mir sagen kann ob jetzt wieder alles Okay auf meinem Lapi ist ;) :huepp:

DAS IST DER REPORT: (original kopiert)
HiJackthis Logfile:
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:12:13, on 08.09.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\Programme\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Programme\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Dokumente und Einstellungen\****\Desktop\This.com
C:\Programme\Mobile Partner\Mobile Partner.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
 
hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
 
hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
 
hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
 
hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
 
hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
 
hxxp://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: MessengerPlusLive Germany TB Toolbar -
 
{76aeea42-e04a-4b62-83ab-df4b2be2541e} -
 
C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -
 
C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky
 
Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: MessengerPlusLive Germany TB Toolbar - {76aeea42-e04a-4b62-83ab-df4b2be2541e}
 
- C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -
 
C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} -
 
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -
 
C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - (no file)
O3 - Toolbar: MessengerPlusLive Germany TB Toolbar -
 
{76aeea42-e04a-4b62-83ab-df4b2be2541e} -
 
C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Internet Security
 
2010\avp.exe"
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKCU\..\Run: [BatteryLife] C:\Programme\ASUS\Power4 Gear\BatteryLife.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER
 
DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER
 
DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User
 
'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User
 
'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default
 
user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default
 
user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver -
 
res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und
 
Einstellungen\****\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky
 
Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} -
 
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} -
 
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
 
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
 
{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
 
C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
 
- C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) -
 
hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
 
hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
 
hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload
 
Tool) - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F389915F-F243-48F4-BAC3-9C3A309D8CB7}:
 
NameServer = 193.189.244.225 193.189.244.206
O20 - AppInit_DLLs:
 
C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} -
 
C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon -
 
{8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -
 
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab -
 
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. -
 
C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software -
 
C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software -
 
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
 
--
End of file - 7941 bytes
--- --- ---

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

BITTE IST JEMAND IM FORUM DER MIR AUS DIESEM DATEN-GULASCH SAGEN KANN OB ALLES "CLEAN" IST ??? :confused:

Lieben Gruß an alle :D

By Coolcat

cosinus 08.09.2010 21:13
Zitat:
so hat ein Bekannter mit "MalwareBytes" gescannt und prommt 6 Viren gefunden
Bitte alle Logs davon posten!

Coolcat 08.09.2010 23:35
Hallo :D

Ich hoffe, das dies die richtigen sind ...

LOG-DATEIEN:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4571

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

08.09.2010 16:57:57
mbam-log-2010-09-08 (16-57-57).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 154593
Laufzeit: 21 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\JDK5SWFMZY (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\W34BCG2GRJ (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\a.txt (Worm.Traces) -> Quarantined and deleted successfully.
C:\WINDOWS\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.


:dankeschoen:

cosinus 09.09.2010 10:52
Zitat:
Art des Suchlaufs: Quick-Scan
Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

Coolcat 09.09.2010 17:02
Hallo Arne :abklatsch:

Danke erstmal, das du dich um mein Problem kümmerst ... smile
Ich bin dir wirklich zutiefst dankbar dafür ... :bussi:

Habe das OTL installiert und scannen lassen ...
Es sind 3 Dateien, weil ich erst versehentlich auf Quickscann geklickt, aber dann Full-Scan erneut ausgeführt hab ... :)

DATEIEN-LOG:OTL Logfile:
Code:
OTL Extras logfile created on: 09.09.2010 17:41:00 - Run 2
OTL by OldTimer - Version 3.2.11.0    Folder = C:\Dokumente und Einstellungen\Cool-Cat\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
895,00 Mb Total Physical Memory | 258,00 Mb Available Physical Memory | 29,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 19,53 Gb Total Space | 7,69 Gb Free Space | 39,37% Space Free | Partition Type: NTFS
Drive D: | 9,78 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 92,25 Gb Total Space | 75,46 Gb Free Space | 81,81% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: COOLCAT
Current User Name: Cool-Cat
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 60 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\livecall.exe" = C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Dokumente und Einstellungen\Cool-Cat\Desktop\IM88532.JPG-www.facebook.com.exe" = C:\WINDOWS\infocard.exe:*:Enabled:Firewall Administrating -- File not found
"C:\Programme\Windows Live\Messenger\livecall.exe" = C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) -- (Microsoft Corporation)
"C:\Programme\Hercules\Deluxe Optical Glass\XtrCtrl.exe" = C:\Programme\Hercules\Deluxe Optical Glass\XtrCtrl.exe:*:Enabled:Hercules Xtra Controller Main Application -- (Guillemot Corporation S.A.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{003C932A-0064-B581-3935-284D2CE76A89}" = Catalyst Control Center Core Implementation
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AD37499-3D5D-12F0-EBEA-46EE9AD02DBF}" = Catalyst Control Center Localization German
"{174D7CC5-1117-29D3-8422-2E54ADF7DB5D}" = Catalyst Control Center Localization Norwegian
"{1E0E1039-E45D-7EA2-E377-E00C2857E0C2}" = ccc-core-static
"{21A1D4A5-3D9B-9434-4F97-40367BDF4E47}" = Catalyst Control Center Graphics Full New
"{22E95014-3038-4909-8708-48AE7FEFBF05}" = DSL Connection Manager
"{23170F69-40C1-2701-0465-000001000000}" = 7-Zip 4.65
"{23894154-0961-CD0A-BAC0-67E6E96165C3}" = CCC Help Chinese Standard
"{24DFAAD6-E1ED-F588-2AD5-2EA4FE9113AE}" = CCC Help Korean
"{26886987-D038-7438-8DF2-ED3B1888E052}" = CCC Help Hungarian
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{2B091530-69AA-442E-AB09-39ED06B58220}" = Windows Live Messenger
"{2C6D0ACD-DD2B-BFE5-A005-53AFD4AA3175}" = Catalyst Control Center Localization Spanish
"{2D50DC1F-FCEC-D970-1DFB-E73CF2404451}" = Catalyst Control Center Localization Hungarian
"{306682DE-BB8E-CD56-9F6B-DE209469418A}" = CCC Help Turkish
"{310477AD-884B-736D-B2C8-7BE9433B243D}" = CCC Help Swedish
"{31814F2E-FA58-AFE8-DC97-3BD97F7191C2}" = CCC Help Greek
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{354F7470-D8E3-95D0-3488-B9E32D5E9636}" = CCC Help German
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{380FAC97-C47F-C5A9-2A51-DFF8DE144B37}" = Catalyst Control Center Localization Italian
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{407A5080-4B1C-A43D-9EED-A3B5EDBCF593}" = CCC Help Polish
"{4462AD13-F2AA-4CBD-9F95-293C38EED870}" = Power4 Gear
"{46FE06BF-2A08-9D00-ABFD-7F967817E275}" = Catalyst Control Center Localization Swedish
"{4B50D80D-A482-DECD-B584-EB054EBA878A}" = ccc-core-preinstall
"{4B8ACECB-D518-99AA-B1F3-E79F905A83EE}" = Catalyst Control Center Localization Czech
"{5ABA84ED-D61B-257F-809F-A8C883865854}" = Catalyst Control Center Localization Dutch
"{5B464CAC-76BD-BDBB-8066-318D05D171DF}" = Catalyst Control Center Localization Finnish
"{5C7332EA-BFB9-24A0-BDD9-254F4B113E41}" = Catalyst Control Center Localization Polish
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6426C1E8-ADD6-F91F-C152-2ABB7AB25F9F}" = Catalyst Control Center Graphics Full Existing
"{66B5F542-952C-F50D-BFF3-BCA582B65860}" = Catalyst Control Center Localization Turkish
"{67213BA8-70C6-458D-9B64-4B93FB35E84B}" = CCC Help Italian
"{6AA66ACB-E93C-C7CD-F303-D473AEC8A43E}" = CCC Help Norwegian
"{6D5DC54D-B06E-32A8-A5D9-4978D7A75FA1}" = Catalyst Control Center Localization Japanese
"{6DC712D0-A8AE-70EE-215D-ECE5DB29782C}" = Skins
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75AE638F-750A-11DF-96D5-005056806466}" = Google Earth Plug-in
"{782BC438-2C73-77F4-F5B6-7ADC87F611BB}" = CCC Help Spanish
"{791A19F4-E4E5-F4B0-7687-F5D1C4FF799A}" = Catalyst Control Center Graphics Light
"{7BBA76B4-CC34-0AAB-6D48-BE0181E20832}" = CCC Help Dutch
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{7F311276-1CD6-1661-8BAE-DD9016FE9B8D}" = Catalyst Control Center Localization Russian
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{84C89CF4-F64E-6820-375C-24963DDF99C9}" = Catalyst Control Center Localization Greek
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C0D145D-EB41-E1DB-6250-0146B02CBA3A}" = CCC Help Japanese
"{8F5D6849-1A7E-B0B2-F1DE-C0FF21F9E78C}" = CCC Help French
"{928BDF57-B11C-3917-8C21-7948439E49B4}" = Microsoft Visual Basic Power Packs 3.0 Redistributable
"{944DA8EF-FD4E-1FD9-D88A-B22D78913BE6}" = Catalyst Control Center Localization Portuguese
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97F5E039-D2F5-18C0-F0C9-6981F73514CC}" = Catalyst Control Center Localization French
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{9E684286-287F-AE06-6909-31A0944A9B4F}" = Catalyst Control Center Localization Danish
"{A0CE9CC5-B17D-3FD5-20B9-A2509B475A20}" = ccc-utility
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A35D49A6-F3CF-87AA-6FF1-777D8A06BAB1}" = CCC Help English
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2CEACB9-7690-30B5-D80A-B138DB4F0E37}" = Catalyst Control Center Localization Chinese Traditional
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D26970AA-C66F-142F-7C66-A73FC3546F57}" = CCC Help Russian
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D88DB576-0989-879A-38B1-7ED6224B2F52}" = Catalyst Control Center Localization Thai
"{D8B87EBC-12C2-D4FC-F085-A062D4906216}" = CCC Help Danish
"{E2A05D36-56EF-84FC-E7D7-090D6E5F09BC}" = CCC Help Finnish
"{E4DA4D2C-F57F-782E-752E-9286E5713297}" = Catalyst Control Center Localization Korean
"{E4E118EF-5286-915B-7DBD-D931AB9AF200}" = CCC Help Portuguese
"{E5B85BE7-55B5-0A14-7634-FEF92BCB87FB}" = CCC Help Chinese Traditional
"{E6F043EB-FEF5-4C34-95AF-99B3EB68F7D9}" = Hercules Deluxe Optical Glass
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}" = Paint.NET v3.5.5
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F384BD83-C317-94DA-A4AB-3E75E43F4F8C}" = Catalyst Control Center Localization Chinese Standard
"{F622BE4A-363F-F2B6-1F98-54E5E99B1750}" = CCC Help Thai
"{F6D39840-BB27-A191-BDF2-1841CA805D24}" = CCC Help Czech
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"CCleaner" = CCleaner
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"FotoMix" = Digital Photo Software FotoMix 7.4
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Freemake Video Converter_is1" = Freemake Video Converter version 1.1.6
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (nur entfernen)
"HControl" = ATK0100 ACPI UTILITY
"ie8" = Windows Internet Explorer 8
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"MessengerPlusLive_Germany_TB Toolbar" = MessengerPlusLive Germany TB Toolbar
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Nero8Lite_is1" = Nero 8 Micro 8.3.2.1
"Photo Pos Pro" = Photo Pos Pro
"Picasa 3" = Picasa 3
"Room Arranger" = Room Arranger
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SWR3 RauchFrei_is1" = SWR3 RauchFrei Version 1.2
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"T-Mobile Internet Manager" = T-Mobile Internet Manager
"TuneUp Utilities" = TuneUp Utilities
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"Winamp" = Winamp
"xp-AntiSpy" = xp-AntiSpy 3.96-8
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.09.2010 07:22:36 | Computer Name = COOLCAT | Source = Google Update | ID = 20
Description =
 
Error - 07.09.2010 23:22:35 | Computer Name = COOLCAT | Source = Google Update | ID = 20
Description =
 
Error - 08.09.2010 08:18:16 | Computer Name = COOLCAT | Source = PerfNet | ID = 2002
Description = Der Redirectordienst konnte nicht geöffnet werden. Die Redirectorleistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 08.09.2010 08:58:35 | Computer Name = COOLCAT | Source = PerfNet | ID = 2002
Description = Der Redirectordienst konnte nicht geöffnet werden. Die Redirectorleistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 08.09.2010 09:50:04 | Computer Name = COOLCAT | Source = PerfNet | ID = 2002
Description = Der Redirectordienst konnte nicht geöffnet werden. Die Redirectorleistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 08.09.2010 13:10:30 | Computer Name = COOLCAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3855,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b.
 
Error - 08.09.2010 13:12:00 | Computer Name = COOLCAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3855,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b.
 
Error - 09.09.2010 07:22:07 | Computer Name = COOLCAT | Source = Google Update | ID = 20
Description =
 
Error - 09.09.2010 08:22:05 | Computer Name = COOLCAT | Source = Google Update | ID = 20
Description =
 
Error - 09.09.2010 08:33:44 | Computer Name = COOLCAT | Source = Google Update | ID = 20
Description =
 
[ System Events ]
Error - 08.09.2010 08:19:21 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet:  %%2
 
Error - 08.09.2010 08:59:42 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet:  %%2
 
Error - 08.09.2010 08:59:42 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7023
Description = Der Dienst "IPSEC-Dienste" wurde mit folgendem Fehler beendet:  %%1747
 
Error - 08.09.2010 09:02:16 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.
 
Error - 08.09.2010 09:02:16 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 08.09.2010 09:51:15 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet:  %%2
 
Error - 08.09.2010 09:51:15 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7023
Description = Der Dienst "IPSEC-Dienste" wurde mit folgendem Fehler beendet:  %%1747
 
Error - 08.09.2010 09:53:27 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.
 
Error - 08.09.2010 09:53:27 | Computer Name = COOLCAT | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 08.09.2010 11:00:55 | Computer Name = COOLCAT | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
 
< End of report >
--- --- ---
-----------------------------------------------------------------------OTL Logfile:
Code:
OTL logfile created on: 09.09.2010 17:41:00 - Run 2
OTL by OldTimer - Version 3.2.11.0    Folder = C:\Dokumente und Einstellungen\Cool-Cat\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
895,00 Mb Total Physical Memory | 258,00 Mb Available Physical Memory | 29,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 19,53 Gb Total Space | 7,69 Gb Free Space | 39,37% Space Free | Partition Type: NTFS
Drive D: | 9,78 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 92,25 Gb Total Space | 75,46 Gb Free Space | 81,81% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: COOLCAT
Current User Name: Cool-Cat
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 60 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Cool-Cat\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe (Kaspersky Lab)
PRC - C:\Programme\Mobile Partner\Mobile Partner.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
PRC - C:\WINDOWS\ATK0100\HControl.exe ()
PRC - C:\WINDOWS\ATK0100\ATKOSD.exe ()
PRC - C:\Programme\ASUS\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)
PRC - C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Cool-Cat\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AVP) -- C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (aspnet_state) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NMSAccessU) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()
SRV - (usnjsvc) -- C:\Programme\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (LVUVC) Logitech QuickCam E3500(UVC) -- C:\WINDOWS\System32\DRIVERS\lvuvc.sys File not found
DRV - (LVRS) -- C:\WINDOWS\System32\DRIVERS\lvrs.sys File not found
DRV - (FilterService) -- C:\WINDOWS\System32\DRIVERS\lvuvcflt.sys File not found
DRV - (camfilt2) -- C:\WINDOWS\System32\DRIVERS\camfilt2.sys File not found
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (klbg) -- C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (hxctlflt) -- C:\WINDOWS\system32\drivers\hxctlflt.sys (Guillemot Corporation)
DRV - (tcpipBM) -- C:\WINDOWS\System32\drivers\tcpipBM.sys (Bytemobile, Inc.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (SNPSTD3) -- C:\WINDOWS\system32\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (risdptsk) -- C:\WINDOWS\system32\DRIVERS\risdptsk.sys (REDC)
DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (smserial) -- C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.)
DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ATKACPI.sys ()
DRV - (ASNDIS5) -- C:\WINDOWS\ATK0100\ASNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EE 71 C7 66 05 4F CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Playdom Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736
FF - prefs.js..extensions.enabledItems: {69d1a568-ffdf-4ef5-8919-7003582e0ee8}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {76aeea42-e04a-4b62-83ab-df4b2be2541e}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.2.5
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.06 14:33:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.08.26 03:21:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010.03.12 10:18:05 | 000,000,000 | ---D | M]
 
[2010.01.23 09:57:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Extensions
[2010.09.09 03:05:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions
[2010.08.23 20:12:17 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.08.25 15:42:50 | 000,000,000 | ---D | M] (City Life) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{2fba511a-ef96-4742-b322-986fef420695}
[2010.08.21 06:06:25 | 000,000,000 | ---D | M] (Playdom Toolbar) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{69d1a568-ffdf-4ef5-8919-7003582e0ee8}
[2010.09.09 03:04:28 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.08.21 21:50:14 | 000,000,000 | ---D | M] (MessengerPlusLive Germany TB Toolbar) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{76aeea42-e04a-4b62-83ab-df4b2be2541e}
[2010.08.26 03:47:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.08.23 20:12:04 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.02.23 09:46:48 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.09.05 03:47:42 | 000,002,565 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\searchplugins\askcom.xml
[2010.04.21 12:06:54 | 000,000,917 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Mozilla\Firefox\Profiles\1o3xp8x7.default\searchplugins\conduit.xml
[2010.09.09 03:05:10 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.02.26 19:44:47 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.04.14 11:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (MessengerPlusLive Germany TB Toolbar) - {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (MessengerPlusLive Germany TB Toolbar) - {76aeea42-e04a-4b62-83ab-df4b2be2541e} - C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (MessengerPlusLive Germany TB Toolbar) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe ()
O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
O4 - HKCU..\Run: [BatteryLife] C:\Programme\ASUS\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010.01.23 07:29:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - D:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007.11.06 17:41:52 | 000,000,047 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2009.05.20 18:08:30 | 000,000,100 | ---- | M] () - E:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{3b9e7a4a-b63d-11df-b4f7-0015af302683}\Shell - "" = AutoRun
O33 - MountPoints2\{3b9e7a4a-b63d-11df-b4f7-0015af302683}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3ba89200-2c3b-11df-b3a3-93ecde8ba532}\Shell - "" = AutoRun
O33 - MountPoints2\{3ba89200-2c3b-11df-b3a3-93ecde8ba532}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3ba89200-2c3b-11df-b3a3-93ecde8ba532}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6038ceb7-594d-11df-b430-b005f9467e8b}\Shell - "" = AutoRun
O33 - MountPoints2\{6038ceb7-594d-11df-b430-b005f9467e8b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6038ceb7-594d-11df-b430-b005f9467e8b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6038cebd-594d-11df-b430-b005f9467e8b}\Shell - "" = AutoRun
O33 - MountPoints2\{6038cebd-594d-11df-b430-b005f9467e8b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6038cebd-594d-11df-b430-b005f9467e8b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6038cebe-594d-11df-b430-b005f9467e8b}\Shell - "" = AutoRun
O33 - MountPoints2\{6038cebe-594d-11df-b430-b005f9467e8b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6038cebe-594d-11df-b430-b005f9467e8b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{c36ef040-5e26-11df-b43d-87d6863f7a6b}\Shell - "" = AutoRun
O33 - MountPoints2\{c36ef040-5e26-11df-b43d-87d6863f7a6b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c36ef040-5e26-11df-b43d-87d6863f7a6b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{f6028f14-07f0-11df-b33b-0015af302683}\Shell - "" = AutoRun
O33 - MountPoints2\{f6028f14-07f0-11df-b33b-0015af302683}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f6028f14-07f0-11df-b33b-0015af302683}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{fecf8250-5e24-11df-b43c-9ab543ef0eac}\Shell - "" = AutoRun
O33 - MountPoints2\{fecf8250-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fecf8250-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{fecf8252-5e24-11df-b43c-9ab543ef0eac}\Shell - "" = AutoRun
O33 - MountPoints2\{fecf8252-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fecf8252-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 60 Days ==========
 
[2010.09.09 16:12:59 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\OTL.exe
[2010.09.09 05:27:47 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Recent
[2010.09.08 16:15:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Malwarebytes
[2010.09.08 16:14:55 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.09.08 16:14:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.09.08 16:14:51 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.09.08 16:14:51 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.09.08 06:40:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\Help
[2010.09.06 17:53:52 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Thraex Software
[2010.09.06 17:53:51 | 000,000,000 | ---D | C] -- C:\Programme\Photo Pos Pro
[2010.09.02 05:02:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1
[2010.09.02 05:02:33 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Adobe AIR
[2010.08.29 15:57:56 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010.08.29 15:49:07 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010.08.28 19:40:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\Textures
[2010.08.28 19:40:24 | 000,065,776 | ---- | C] (JGsoft - Just Great Software) -- C:\WINDOWS\UnDeploy.exe
[2010.08.28 19:40:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\FotoMix Projects
[2010.08.28 19:40:19 | 000,000,000 | ---D | C] -- C:\Programme\Digital Photo Software
[2010.08.26 03:47:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.08.26 03:42:16 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET
[2010.08.26 03:33:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\Freemake
[2010.08.26 03:33:43 | 000,000,000 | ---D | C] -- C:\Programme\Freemake
[2010.08.21 22:02:07 | 000,126,448 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxinsi64.exe
[2010.08.21 22:02:07 | 000,123,888 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxcpyi64.exe
[2010.08.21 21:50:27 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2010.08.21 21:50:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\MessengerPlusLive_Germany_TB
[2010.08.21 21:50:18 | 000,000,000 | ---D | C] -- C:\Programme\MessengerPlusLive_Germany_TB
[2010.08.21 21:50:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX
[2010.08.18 23:11:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\Apple Computer
[2010.07.27 08:27:23 | 008,504,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2010.07.23 00:02:58 | 000,030,528 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\TURegOpt.exe
[2010.07.23 00:02:54 | 000,030,016 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
[2010.07.14 05:06:43 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010.03.12 21:19:59 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll
[2010.03.12 21:19:59 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 60 Days ==========
 
[2010.09.09 17:22:00 | 000,001,092 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.09.09 16:13:00 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\OTL.exe
[2010.09.09 14:41:06 | 000,000,609 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\Meine freigegebenen Ordner.lnk
[2010.09.09 14:33:36 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.09.09 13:07:32 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.09.09 13:07:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.09.09 05:31:43 | 004,194,304 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\ntuser.dat
[2010.09.09 05:31:33 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\ntuser.ini
[2010.09.08 16:14:58 | 000,000,682 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.08 15:29:49 | 000,000,507 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.09.08 15:29:49 | 000,000,246 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.09.08 15:29:49 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010.09.08 04:35:52 | 001,210,660 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.09.08 04:35:52 | 000,516,834 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.09.08 04:35:52 | 000,493,388 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.09.08 04:35:52 | 000,100,686 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.09.08 04:35:52 | 000,083,932 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.09.07 13:53:03 | 000,001,919 | ---- | M] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2010.09.06 17:57:29 | 000,000,022 | ---- | M] () -- C:\WINDOWS\System32\syoepk_lib0.dll
[2010.09.06 17:55:12 | 000,192,029 | ---- | M] () -- C:\WINDOWS\Photo Pos Pro Uninstaller.exe
[2010.09.06 17:54:17 | 000,001,604 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Photo Pos Pro.lnk
[2010.09.06 14:22:43 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.09.04 10:46:39 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.09.04 10:46:38 | 000,012,800 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.28 19:40:27 | 000,000,851 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FotoMix.lnk
[2010.08.26 03:46:05 | 000,001,047 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Free YouTube to MP3 Converter.lnk
[2010.08.26 03:33:48 | 000,000,857 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Freemake Video Converter.lnk
[2010.08.20 20:03:13 | 000,001,715 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2010.08.13 15:01:57 | 000,118,952 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.03 00:56:20 | 000,000,634 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\cc_20100803_005602.reg
[2010.08.01 18:15:03 | 044,166,672 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Second_Life_2-1-0-207030_Setup.exe
[2010.07.30 00:02:39 | 000,113,933 | ---- | M] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010.07.30 00:02:39 | 000,097,549 | ---- | M] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010.07.27 08:27:23 | 008,504,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2010.07.23 00:02:49 | 000,001,715 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TuneUp 1-Klick-Wartung.lnk
[2010.07.23 00:02:49 | 000,001,701 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TuneUp Utilities.lnk
[2010.07.21 05:43:21 | 000,003,550 | ---- | M] () -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\cc_20100721_054314.reg
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.09.09 03:20:36 | 000,000,682 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.09.07 13:27:12 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2010.09.06 17:57:29 | 000,000,098 | -HS- | C] () -- C:\WINDOWS\WSYS049.SYS
[2010.09.06 17:57:29 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\syoepk_lib0.dll
[2010.09.06 17:55:12 | 000,192,029 | ---- | C] () -- C:\WINDOWS\Photo Pos Pro Uninstaller.exe
[2010.09.06 17:54:14 | 000,001,604 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Photo Pos Pro.lnk
[2010.09.06 14:34:24 | 000,001,566 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\Mozilla Firefox.lnk
[2010.08.28 19:40:27 | 000,000,851 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FotoMix.lnk
[2010.08.26 04:11:00 | 000,001,047 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Free YouTube to MP3 Converter.lnk
[2010.08.26 04:05:06 | 000,123,434 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1409082233-861567501-1417001333-1003-0.dat
[2010.08.26 04:05:01 | 000,123,434 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.08.26 03:33:48 | 000,000,857 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Freemake Video Converter.lnk
[2010.08.26 03:20:26 | 000,001,524 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\CCleaner.lnk
[2010.08.03 00:56:04 | 000,000,634 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\cc_20100803_005602.reg
[2010.08.01 18:12:06 | 044,166,672 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Desktop\Second_Life_2-1-0-207030_Setup.exe
[2010.07.23 00:02:49 | 000,001,715 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TuneUp 1-Klick-Wartung.lnk
[2010.07.23 00:02:49 | 000,001,701 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TuneUp Utilities.lnk
[2010.07.21 05:43:18 | 000,003,550 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Eigene Dateien\cc_20100721_054314.reg
[2010.05.29 00:43:45 | 000,019,456 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2010.04.06 12:10:15 | 000,225,411 | ---- | C] () -- C:\WINDOWS\System32\PosPrKpLib.dll
[2010.04.06 12:10:07 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\PosTickerLib.dll
[2010.03.12 21:19:59 | 000,015,478 | ---- | C] () -- C:\WINDOWS\snpstd3.ini
[2010.02.26 20:13:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll
[2010.02.26 20:13:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll
[2010.02.26 20:13:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll
[2010.02.26 20:13:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll
[2010.02.26 20:13:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll
[2010.02.26 20:13:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll
[2010.02.26 20:13:58 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll
[2010.02.26 20:13:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll
[2010.02.26 20:13:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll
[2010.02.05 21:56:18 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.02.05 21:03:35 | 000,012,800 | ---- | C] () -- C:\Dokumente und Einstellungen\Cool-Cat\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.23 09:11:32 | 000,000,621 | ---- | C] () -- C:\WINDOWS\System32\drivers\AW1012d.ini
[2010.01.23 08:57:48 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATKACPI.sys
[2010.01.23 07:40:26 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005.09.23 13:52:14 | 000,078,848 | ---- | C] () -- C:\WINDOWS\System32\OneWay.dll
[2002.06.02 16:05:40 | 000,038,912 | ---- | C] () -- C:\WINDOWS\System32\1Way.dll
 
========== LOP Check ==========
 
[2010.02.05 21:56:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2010.03.13 19:55:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Messenger Plus!
[2010.01.23 07:13:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.01.23 07:13:34 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.03.12 23:32:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\.purple
[2010.02.05 21:56:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Canneverbe Limited
[2010.09.02 05:02:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1
[2010.08.26 03:47:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010.03.28 05:18:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Facebook
[2010.02.05 21:39:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Gutscheinmieze
[2010.03.12 22:55:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Leadertech
[2010.02.05 21:09:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\mmserver
[2010.01.24 02:39:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\OpenOffice.org
[2010.03.06 21:53:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\PhotoFiltre
[2010.09.08 05:24:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\PriceGong
[2010.05.13 02:24:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\T-Mobile
[2010.05.13 02:28:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\T-Mobile Internet Manager
[2010.05.29 00:41:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\Thomas Bach
[2010.01.23 07:14:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cool-Cat\Anwendungsdaten\TuneUp Software
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2010.04.25 18:04:44 | 000,000,000 | ---D | M](C:\WINDOWS\System32\?U?????¤d) -- C:\WINDOWS\System32\ﯼƯ뫢涍揼Œ新¤d
[2010.04.25 18:04:44 | 000,000,000 | ---D | C](C:\WINDOWS\System32\?U?????¤d) -- C:\WINDOWS\System32\ﯼƯ뫢涍揼Œ新¤d
< End of report >
--- --- ---
----------------------------------------------------------------------


Hoffe, das es adéquate Auskünfte über den Zustand meines Lapis gibt ... seufz
denn ich habe keine Ghost-Datei angelegt um mein Window XP zu retten ...
da bliebe nur Neu-Installation, falls die Viren mein Betriebs-System infiltriert haben :(

Hoffe ja, das ich mit nem blauen Auge davon gekommen bin :/

lieben Gruß by Dani

cosinus 09.09.2010 19:58
Wo ist denn das Log vom malwarebytes fullscan?

Coolcat 10.09.2010 00:38
DAS IST DER KOMPLETT-SCANN

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4571

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.09.2010 01:37:01
mbam-log-2010-09-10 (01-37-01).txt

Art des Suchlaufs: Vollständiger Suchlauf (E:\|)
Durchsuchte Objekte: 158782
Laufzeit: 12 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 10.09.2010 10:09
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Playdom Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (MessengerPlusLive Germany TB Toolbar) - {76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - C:\Programme\MessengerPlusLive_Germany_TB\tbMess.dll (Conduit Ltd.)
O32 - AutoRun File - [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - D:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007.11.06 17:41:52 | 000,000,047 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2009.05.20 18:08:30 | 000,000,100 | ---- | M] () - E:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{3b9e7a4a-b63d-11df-b4f7-0015af302683}\Shell - "" = AutoRun
O33 - MountPoints2\{3b9e7a4a-b63d-11df-b4f7-0015af302683}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3ba89200-2c3b-11df-b3a3-93ecde8ba532}\Shell - "" = AutoRun
O33 - MountPoints2\{3ba89200-2c3b-11df-b3a3-93ecde8ba532}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3ba89200-2c3b-11df-b3a3-93ecde8ba532}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6038ceb7-594d-11df-b430-b005f9467e8b}\Shell - "" = AutoRun
O33 - MountPoints2\{6038ceb7-594d-11df-b430-b005f9467e8b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6038ceb7-594d-11df-b430-b005f9467e8b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6038cebd-594d-11df-b430-b005f9467e8b}\Shell - "" = AutoRun
O33 - MountPoints2\{6038cebd-594d-11df-b430-b005f9467e8b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6038cebd-594d-11df-b430-b005f9467e8b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{6038cebe-594d-11df-b430-b005f9467e8b}\Shell - "" = AutoRun
O33 - MountPoints2\{6038cebe-594d-11df-b430-b005f9467e8b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6038cebe-594d-11df-b430-b005f9467e8b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{c36ef040-5e26-11df-b43d-87d6863f7a6b}\Shell - "" = AutoRun
O33 - MountPoints2\{c36ef040-5e26-11df-b43d-87d6863f7a6b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c36ef040-5e26-11df-b43d-87d6863f7a6b}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{f6028f14-07f0-11df-b33b-0015af302683}\Shell - "" = AutoRun
O33 - MountPoints2\{f6028f14-07f0-11df-b33b-0015af302683}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f6028f14-07f0-11df-b33b-0015af302683}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{fecf8250-5e24-11df-b43c-9ab543ef0eac}\Shell - "" = AutoRun
O33 - MountPoints2\{fecf8250-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fecf8250-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{fecf8252-5e24-11df-b43c-9ab543ef0eac}\Shell - "" = AutoRun
O33 - MountPoints2\{fecf8252-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fecf8252-5e24-11df-b43c-9ab543ef0eac}\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\AutoRun.exe -- [2008.04.23 23:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
[2010.04.25 18:04:44 | 000,000,000 | ---D | M](C:\WINDOWS\System32\?U?????¤d) -- C:\WINDOWS\System32\?U???Œ?¤d
[2010.04.25 18:04:44 | 000,000,000 | ---D | C](C:\WINDOWS\System32\?U?????¤d) -- C:\WINDOWS\System32\?U???Œ?¤d
[2010.09.06 17:57:29 | 000,000,098 | -HS- | C] () -- C:\WINDOWS\WSYS049.SYS
[2010.09.06 17:57:29 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\syoepk_lib0.dll
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:53 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131