Trojaner-Board - svchost.exe kontaminiert?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - svchost.exe kontaminiert? (https://www.trojaner-board.de/91433-svchost-exe-kontaminiert.html)

svchost.exe kontaminiert?

Moin Leute,
hab seit dem starten einer Anwendung ungeprüften Ursprungs mehrere Hinweise auf Veränderungen gehabt. Unter anderem tauchten nach der Anmeldung 2 Meldungen auf:
1. runtime error zu einer Anwendung
2. Fehlermeldung von Windows, Firefox sei abgestürzt.

Hier der HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:04, on 3.10.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\PeerGuardian2\pg2.exe
C:\Dokumente und Einstellungen\***\Eigene Dateien\...\HotSwap!.EXE
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\THIS.COM

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://web.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = fritz.box;*.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [LogonStudio] "C:\Programme\Stardock\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Programme\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [PeerGuardian] C:\Programme\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [HotSwap! Applet] "C:\Dokumente und Einstellungen\***\Eigene Dateien\...\HotSwap!.EXE"
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\Win32Gl\svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\Win32Gl\svchost.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - F:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - F:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6617E376-737B-42AE-AD1F-4342CD2FA520}: NameServer = 192.168.178.1,192.168.178.20
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\Skype4COM.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxdn_device - - C:\WINDOWS\system32\lxdncoms.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5945 bytes

Danke fürs lesen und folgende Beiträge. =)

T_M

:hallo:

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

netsvcs

drivers32 /all

%SYSTEMDRIVE%\*.*

%systemroot%\system32\*.wt

%systemroot%\system32\*.ruy

%systemroot%\Fonts\*.com

%systemroot%\Fonts\*.dll

%systemroot%\Fonts\*.ini

%systemroot%\Fonts\*.ini2

%systemroot%\system32\spool\prtprocs\w32x86\*.*

%systemroot%\REPAIR\*.bak1

%systemroot%\REPAIR\*.ini

%systemroot%\system32\*.jpg

%systemroot%\*.scr

%systemroot%\*._sy

%APPDATA%\Adobe\Update\*.*

%ALLUSERSPROFILE%\Favorites\*.*

%APPDATA%\Microsoft\*.*

%PROGRAMFILES%\*.*

%APPDATA%\Update\*.*

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\user32.dll /md5

%systemroot%\system32\ws2_32.dll /md5

%systemroot%\system32\ws2help.dll /md5

/md5start

explorer.exe

winlogon.exe

wininit.exe

/md5stop

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://larusso.trojaner-board.de/Images/otlfix2.jpg.
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Schritt 2

Rootkit-Suche mit Gmer

Was sind Rootkits?

Wichtig: Bei jedem Rootkit-Scans soll/en:

Deaktiviere zunächst nach dieser Anleitung evtl. vorhandene CD-Emulatoren wie Alcohol, Daemon-Tools oder ähnliche.
Alle anderen Programme gegen Viren, Spyware, usw. deaktiviert sein,
keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
nichts am Rechner getan werden,
nach jedem Scan der Rechner neu gestartet werden.
Nicht vergessen, nach dem Rootkit-Scan die Security-Programme wieder einzuschalten!

Lade Dir Gmer von dieser Seite herunter
(auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.

Alle anderen Programme sollen geschlossen sein.
Starte gmer.exe (hat einen willkürlichen Programm-Namen).
Vista-User mit Rechtsklick und als Administrator starten.
Gmer startet automatisch einen ersten Scan.
Sollte sich ein Fenster mit folgender Warnung öffnen:

Code:

WARNING !!! GMER has found system modification, which might have been caused by ROOTKIT activity. Do you want to fully scan your system?
Unbedingt auf "No" klicken,
in dem Fall über den Save-Button das bisherige Resultat auf dem Desktop als gmer_first.log speichern.

.
Falls das nicht der Fall war, wähle nun den Reiter "Rootkit/Malware",
Hake an: System, Sections, Devices, Modules, Processes, Threads, Libraries, Services, Registry und Files.
Wichtig: "Show all" darf nicht angehakt sein!
Starte den Scan durch Drücken des Buttons "Scan".
Mache nichts am Computer während der Scan läuft (unten links wird angezeigt, was gerade gescannt wird).
Wenn der Scan fertig ist, bleibt die Zeile leer.
Kllicke auf "Save" und speichere das Logfile als gmer.log auf dem Desktop.
Mit "Ok" wird Gmer beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Nun das Logfile in Code-Tags posten.

OTL.txt:

Code:

OTL logfile created on: 3.10.2010 22:12:19 - Run 1

OTL by OldTimer - Version 3.2.14.1     Folder = C:\...

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy

 

639,00 Mb Total Physical Memory | 338,00 Mb Available Physical Memory | 53,00% Memory free

3,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free

Paging file location(s): [Binary data over 100 bytes]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 37,26 Gb Total Space | 25,01 Gb Free Space | 67,11% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

Drive F: | 38,28 Gb Total Space | 24,80 Gb Free Space | 64,79% Space Free | Partition Type: NTFS

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: xy

Current User Name: xy

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

 
 ========== Processes (SafeList) ==========

 

PRC - [2010.10.03 22:08:55 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\Eigene Dateien\Radata\OTL.exe

PRC - [2010.09.17 22:04:21 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2010.05.04 19:44:14 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.06.05 11:48:14 | 000,144,712 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

PRC - [2008.11.22 15:12:34 | 001,333,016 | ---- | M] (Diskeeper Corporation) -- C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe

PRC - [2008.04.02 21:07:54 | 000,919,016 | ---- | M] (Zone Labs, LLC) -- C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe

PRC - [2008.04.02 21:07:54 | 000,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe

PRC - [2005.09.18 19:40:42 | 001,421,824 | ---- | M] (Methlabs) -- C:\Programme\PeerGuardian2\pg2.exe

PRC - [2004.08.04 00:58:06 | 000,160,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe

PRC - [2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2001.02.23 11:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2010.10.03 22:08:55 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\Eigene Dateien\Radata\OTL.exe

MOD - [2009.01.28 17:57:47 | 000,070,960 | ---- | M] (Stardock.net, Inc) -- C:\Programme\Stardock\Object Desktop\IconPackager\iprepair.dll

MOD - [2006.08.25 17:46:44 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

MOD - [2006.05.03 23:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll

MOD - [2004.08.03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010.05.04 19:44:14 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.06.05 11:48:14 | 000,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2008.11.22 15:12:34 | 001,333,016 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Programme\Diskeeper Corporation\Diskeeper\DkService.exe -- (Diskeeper)

SRV - [2008.04.02 21:07:54 | 000,075,304 | ---- | M] (Zone Labs, LLC) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)

SRV - [2008.02.28 01:07:26 | 000,594,600 | ---- | M] ( ) [Auto | Stopped] -- C:\WINDOWS\System32\lxdncoms.exe -- (lxdn_device)

SRV - [2007.01.09 18:16:12 | 000,061,440 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe -- (MZCCntrl)

SRV - [2005.11.21 12:34:24 | 000,081,920 | ---- | M] (AVM Berlin) [Auto | Stopped] -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (AVM IGD CTRL Service)

SRV - [2005.11.21 11:48:06 | 000,315,392 | ---- | M] (AVM Berlin) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe -- (de_serv)

SRV - [2005.04.04 01:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2001.02.23 11:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\RivaTuner\RivaTuner32.sys -- (RivaTuner32)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Ikarus\Anti Virus\bin\NTGUARD.SYS -- (NTGUARD)

DRV - [2010.03.01 09:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2010.02.16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.11.24 16:20:40 | 000,163,712 | ---- | M] () [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\drivers\vidstub.sys -- (BootScreen)

DRV - [2009.05.11 11:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2008.04.02 21:08:00 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)

DRV - [2008.02.27 04:10:44 | 000,051,176 | ---- | M] (Zone Labs, LLC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)

DRV - [2007.07.27 12:46:06 | 000,251,680 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\acehlp10.sys -- (acehlp10)

DRV - [2007.07.27 10:13:08 | 000,330,144 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ACEDRV10.sys -- (acedrv10)

DRV - [2007.07.19 16:10:28 | 000,127,768 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)

DRV - [2007.03.30 13:26:02 | 000,101,376 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ACEDRV07.sys -- (ACEDRV07)

DRV - [2006.10.22 13:22:00 | 003,994,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2006.10.09 16:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)

DRV - [2006.10.09 15:46:42 | 000,017,536 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)

DRV - [2006.10.04 10:14:26 | 000,017,280 | ---- | M] (Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MAcNdis5.sys -- (MACNDIS5)

DRV - [2006.06.26 18:27:48 | 000,494,848 | R--- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TUSB1150.sys -- (TUSB1150)

DRV - [2005.12.25 14:18:38 | 000,053,760 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SSHDRV76.sys -- (SSHDRV76)

DRV - [2005.11.21 11:41:50 | 000,367,104 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NETFWDSL.SYS -- (NETFWDSL)

DRV - [2005.11.21 11:41:50 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\netdsl.sys -- (NETDSL)

DRV - [2005.11.03 16:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)

DRV - [2005.09.18 19:02:52 | 000,005,632 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Programme\PeerGuardian2\pgfilter.sys -- (pgfilter)

DRV - [2005.08.30 18:59:00 | 000,094,000 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdm.sys -- (ss_mdm)

DRV - [2005.08.30 18:58:56 | 000,008,304 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdfl.sys -- (ss_mdfl)

DRV - [2005.08.30 18:57:18 | 000,058,320 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)

DRV - [2005.08.10 14:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)

DRV - [2005.05.16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)

DRV - [2005.04.18 17:15:54 | 000,015,104 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmunet.sys -- (AVMUNET)

DRV - [2004.08.04 01:10:00 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)

DRV - [2004.08.03 22:59:52 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)

DRV - [2004.03.09 12:18:09 | 000,065,504 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prohlp02.sys -- (prohlp02)

DRV - [2004.03.09 11:45:49 | 000,077,184 | ---- | M] (Protection Technology) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\prodrv06.sys -- (prodrv06)

DRV - [2004.01.28 16:03:26 | 000,021,456 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SilvrLnk.sys -- (SilverLink) Texas Instruments SilverLink (USB GraphLink)

DRV - [2003.12.05 11:46:36 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)

DRV - [2003.12.01 17:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp01.sys -- (sfhlp01)

DRV - [2003.09.06 14:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prosync1.sys -- (prosync1)

DRV - [2001.08.17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

DRV - [2001.08.17 13:20:04 | 000,096,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ac97intc.sys -- (ac97intc) Intel(r) 82801 Audiotreiber-Installationsdienst (WDM)

DRV - [2001.08.17 13:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://web.de/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box;*.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.selectedEngine: "Wiktionary (de)"

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "h**p://web.de/"

FF - prefs.js..extensions.enabledItems: {c36177c0-224a-11da-8cd6-0800200c9a66}:2.0.0

FF - prefs.js..extensions.enabledItems: {df4e4df5-5cb7-46b0-9aef-6c784c3249f8}:1.0.9

FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.1

FF - prefs.js..keyword.URL: "h**p://search.icq.com/search/afe_results.php?ch_id=afex&q="

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.17 22:04:32 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.17 22:04:32 | 000,000,000 | ---D | M]

 

[2009.07.11 13:15:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions

[2010.10.03 20:47:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\extensions

[2009.03.17 18:30:58 | 000,000,000 | ---D | M] (Fasterfox) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}

[2010.08.26 20:56:08 | 000,000,000 | ---D | M] (Fox!Box) -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}

[2008.03.13 23:08:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\extensions\en-GB@dictionaries.addons.mozilla.org

[2009.10.02 17:45:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\extensions\en-US@dictionaries.addons.mozilla.org

[2010.09.01 19:31:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\extensions\foxyproxy@eric.h.jung

[2008.12.30 15:22:30 | 000,001,863 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\ardapedia-deutsch.xml

[2009.09.12 21:18:39 | 000,002,272 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\geogen.xml

[2009.07.05 23:48:04 | 000,001,965 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\lastfm.xml

[2008.04.05 18:29:54 | 000,001,660 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\leo-deu-eng.xml

[2010.03.03 19:09:55 | 000,001,748 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\leo-deu-fra.xml

[2009.06.22 20:05:08 | 000,001,309 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\magistrix.xml

[2009.02.25 16:40:01 | 000,006,454 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\rezepte-wiki-de.xml

[2009.11.13 16:12:22 | 000,001,203 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\stupidedia-de.xml

[2009.12.05 22:25:19 | 000,002,273 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\uncyclopedia-de.xml

[2009.03.14 13:32:53 | 000,002,096 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\wikibooks-de.xml

[2010.08.30 12:46:14 | 000,002,492 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\wikimedia-commons.xml

[2009.04.09 15:54:04 | 000,001,330 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\wikipedia-en.xml

[2009.08.04 23:39:57 | 000,002,452 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\wikiquote-en.xml

[2009.01.28 21:56:41 | 000,001,334 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\wiktionary-de.xml

[2008.12.30 15:23:46 | 000,002,108 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\youtube-videosuche.xml

[2009.10.02 19:44:07 | 000,000,602 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\searchplugins\zappa-wiki-jawaka-engli.xml

[2010.10.03 20:48:00 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.05.01 10:22:58 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.05.01 10:22:58 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.05.01 10:22:58 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.05.01 10:22:58 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.05.01 10:22:58 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.12.31 15:25:04 | 000,326,480 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.123topsearch.com

O1 - Hosts: 127.0.0.1        123topsearch.com

O1 - Hosts: 127.0.0.1        www.132.com

O1 - Hosts: 127.0.0.1        132.com

O1 - Hosts: 127.0.0.1        www.136136.net

O1 - Hosts: 127.0.0.1        136136.net

O1 - Hosts: 127.0.0.1        www.163ns.com

O1 - Hosts: 127.0.0.1        163ns.com

O1 - Hosts: 11196 more lines...

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [BootSkin Startup Jobs] C:\Programme\Stardock\BootSkin\BootSkin.exe ()

O4 - HKLM..\Run: [HKLM] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O4 - HKLM..\Run: [LogonStudio] C:\Programme\Stardock\LogonStudio\logonstudio.exe (Stardock and Luca Saggese)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [ZoneAlarm Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC)

O4 - HKCU..\Run: [ccleaner] C:\Programme\CCleaner\ccleaner.exe (Piriform Ltd)

O4 - HKCU..\Run: [HKCU] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O4 - HKCU..\Run: [HotSwap! Applet] C:\Dokumente und Einstellungen\***\Eigene Dateien\..\HotSwap!.EXE (Kazuyuki Nakayama)

O4 - HKCU..\Run: [PeerGuardian] C:\Programme\PeerGuardian2\pg2.exe (Methlabs)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoAddPrinter = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileAssociate = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0

O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - F:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - F:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)

O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)

O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} h**p://download.microsoft.com/download/0/f/b/0fb0fab9-7f09-4bb6-86d8-8e791ba99ac5/VirtualEarth3D.cab (Reg Error: Key error.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} h**p://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)

O18 - Protocol\Handler\h**p\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\h**p\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\h**ps\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\h**ps\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UIHost - (C:\WINDOWS\system32\logonuiX.exe) - C:\WINDOWS\system32\logonuiX.exe (Microsoft Corporation)

O21 - SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - CLSID or File not found.

O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Programme\Stardock\Object Desktop\IconPackager\iprepair.dll (Stardock.net, Inc)

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {07C7156E-D651-4ACC-9AD3-498C916E9651} - Reg Error: Key error. File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.08.04 12:29:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - Unable to obtain root file information for disk F:\

O33 - MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\Shell - "" = AutoRun

O33 - MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\Shell\AutoRun\command - "" = H:\preinst.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)

Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)

Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)

Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)

Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)

Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: VIDC.FMVC - C:\WINDOWS\System32\fmcodec.DLL (Fox Magic Software)

Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)

Drivers32: vidc.iv31 - C:\WINDOWS\system32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\system32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)

Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)

Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)

Drivers32: VIDC.MP42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)

Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)

Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)

Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)

Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)

Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)

Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)

Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

 
 ========== Files/Folders - Created Within 90 Days ==========

 

[2010.10.03 20:25:39 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Halbeportion\Recent

[2010.09.30 22:32:04 | 000,000,000 | ---D | C] -- C:\directory

[2010.09.28 14:19:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\Titanic audio

[2010.09.27 19:57:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Guitar Pro 6

[2010.09.27 19:56:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Guitar Pro 6

[2010.09.27 16:45:37 | 000,000,000 | ---D | C] -- C:\Programme\Guitar Pro 6

[2010.09.07 17:15:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Halbeportion\Lokale Einstellungen\Anwendungsdaten\WMTools Downloaded Files

[2010.08.29 17:10:58 | 000,000,000 | ---D | C] -- C:\Programme\Adobe

[2010.08.01 20:01:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\Neuer Ordner

[2010.08.01 14:14:35 | 000,000,000 | ---D | C] -- C:\Programme\aTube Catcher

[2008.09.06 21:29:20 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\LXDNhcp.dll

[2008.09.06 21:29:19 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdninpa.dll

[2008.09.06 21:29:19 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdniesc.dll

[2008.09.06 21:29:18 | 001,101,824 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnserv.dll

[2008.09.06 21:29:18 | 000,843,776 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnusb1.dll

[2008.09.06 21:29:17 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnpmui.dll

[2008.09.06 21:29:17 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnlmpm.dll

[2008.09.06 21:29:17 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnprox.dll

[2008.09.06 21:29:15 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnhbn3.dll

[2008.09.06 21:29:13 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdncomc.dll

[2008.09.06 21:29:13 | 000,376,832 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdncomm.dll

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files - Modified Within 90 Days ==========

 

[2010.10.03 22:33:19 | 073,044,000 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat

[2010.10.03 22:31:38 | 000,024,652 | -H-- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\cglogs.dat

[2010.10.03 20:30:17 | 001,310,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\svchost.exe.crypted

[2010.10.03 20:26:17 | 000,358,382 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml

[2010.10.03 20:24:56 | 000,088,566 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2010.10.03 20:24:46 | 000,000,024 | ---- | M] () -- C:\WINDOWS\LogonStudio.ini

[2010.10.03 20:22:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.10.03 20:22:49 | 670,621,696 | -HS- | M] () -- C:\hiberfil.sys

[2010.10.03 20:09:37 | 000,860,516 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx

[2010.10.03 20:09:29 | 013,107,200 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\NTUSER.DAT

[2010.10.03 20:09:29 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\ntuser.ini

[2010.10.03 20:09:13 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.10.02 14:08:25 | 008,586,296 | -H-- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Lokale Einstellungen\Anwendungsdaten\IconCache.db

[2010.10.02 14:06:36 | 000,015,497 | -H-- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Halbeportionlog.dat

[2010.10.02 00:18:34 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2010.10.02 00:18:23 | 000,198,656 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.09.30 20:14:31 | 000,712,832 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\Alone( demo).mp3

[2010.09.30 16:46:47 | 000,052,769 | ---- | M] () -- C:\WINDOWS\CDPlayer.ini

[2010.09.29 21:24:17 | 000,098,881 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\.recently-used.xbel

[2010.09.26 20:52:52 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx

[2010.09.20 17:19:52 | 000,002,148 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\vortrag E.rtf

[2010.09.16 15:29:06 | 000,000,595 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\dnb.rtf

[2010.09.11 16:10:53 | 000,967,292 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.09.11 16:10:53 | 000,415,664 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.09.11 16:10:53 | 000,401,124 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.09.11 16:10:53 | 000,075,300 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.09.11 16:10:53 | 000,062,594 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.09.06 10:40:24 | 000,001,475 | ---- | M] () -- C:\WINDOWS\win.ini

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.10.03 20:30:17 | 001,310,752 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\svchost.exe.crypted

[2010.10.03 20:10:34 | 670,621,696 | -HS- | C] () -- C:\hiberfil.sys

[2010.09.30 20:13:28 | 000,712,832 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\Alone( demo).mp3

[2010.09.29 21:24:17 | 000,098,881 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\.recently-used.xbel

[2010.09.20 17:19:48 | 000,002,148 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\vortrag E.rtf

[2010.08.19 21:20:35 | 000,000,595 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\dnb.rtf

[2010.06.30 19:39:44 | 001,103,360 | ---- | C] () -- C:\WINDOWS\System32\cidfont.dll

[2010.04.18 19:41:20 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2010.03.23 19:42:50 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\TnetWCoInst.dll

[2010.01.19 20:16:32 | 000,000,008 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sysReserve.ini

[2009.06.07 13:27:20 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\vbzlib1.dll

[2009.02.26 20:26:15 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll

[2008.12.28 00:11:15 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2008.09.06 21:36:26 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdnvs.dll

[2008.09.06 21:36:19 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdncoin.dll

[2008.09.06 21:35:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lxdncaps.dll

[2008.09.06 21:35:00 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\lxdndrs.dll

[2008.09.06 21:35:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdncnv4.dll

[2008.09.06 21:34:13 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL

[2008.09.06 21:34:13 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL

[2008.09.06 21:33:53 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll

[2008.09.06 21:33:53 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL

[2008.09.06 21:29:36 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\lxdnrwrd.ini

[2008.09.06 21:29:20 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\LXDNinst.dll

[2008.09.06 21:29:15 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdngrd.dll

[2008.08.21 13:24:57 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll

[2008.08.21 13:24:57 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll

[2008.07.30 11:38:02 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.05.05 12:25:35 | 000,021,904 | ---- | C] () -- C:\WINDOWS\System32\imsinstall_loc0407.dll

[2008.05.05 12:25:35 | 000,017,808 | ---- | C] () -- C:\WINDOWS\System32\imslsp_install_loc0407.dll

[2008.05.05 12:24:08 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll

[2008.03.24 22:29:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini

[2008.03.21 20:37:32 | 000,040,960 | ---- | C] () -- C:\Programme\Uninstall_CDS.exe

[2008.01.31 18:18:14 | 000,009,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\FlashSys.sys

[2008.01.22 20:59:33 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2008.01.12 16:34:48 | 000,000,045 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2008.01.02 14:10:39 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll

[2007.10.31 22:55:59 | 000,000,052 | ---- | C] () -- C:\WINDOWS\Blink.ini

[2007.10.22 14:59:44 | 000,000,345 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2007.10.02 14:26:38 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll

[2007.06.17 15:57:21 | 000,000,145 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2007.03.30 13:21:17 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI

[2007.03.24 17:23:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI

[2007.03.15 12:15:51 | 000,000,012 | ---- | C] () -- C:\WINDOWS\dirsaver.ini

[2007.02.02 13:09:45 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\jesterss.dll

[2007.01.14 13:26:34 | 000,198,656 | ---- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006.10.22 13:22:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006.10.22 13:22:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2006.10.22 13:22:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006.10.22 13:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006.10.22 13:22:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006.10.22 13:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006.10.22 13:22:00 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2006.08.27 12:19:13 | 000,000,306 | ---- | C] () -- C:\WINDOWS\QTW.INI

[2006.07.31 17:14:54 | 000,000,024 | ---- | C] () -- C:\WINDOWS\clofghls.dll

[2006.07.28 18:36:03 | 000,000,238 | ---- | C] () -- C:\WINDOWS\mafosav.INI

[2006.06.10 20:36:35 | 000,052,769 | ---- | C] () -- C:\WINDOWS\CDPlayer.ini

[2006.05.25 00:47:11 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2006.05.15 13:16:26 | 000,024,508 | -H-- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\cglogs.dat

[2006.04.29 13:22:44 | 000,000,024 | ---- | C] () -- C:\WINDOWS\LogonStudio.ini

[2006.04.29 13:22:13 | 000,187,392 | ---- | C] () -- C:\WINDOWS\System32\JPGUtils.dll

[2006.04.14 21:02:17 | 000,163,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\vidstub.sys

[2006.03.22 16:37:25 | 000,000,096 | ---- | C] () -- C:\WINDOWS\MDS_Settings.ini

[2006.03.11 14:32:10 | 000,000,338 | ---- | C] () -- C:\WINDOWS\XDesktop.INI

[2006.03.08 16:23:58 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll

[2006.02.26 18:43:06 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2006.01.11 19:54:43 | 000,000,495 | ---- | C] () -- C:\WINDOWS\SDI.INI

[2005.12.28 15:38:19 | 000,038,912 | ---- | C] () -- C:\WINDOWS\System32\mgxasio.dll

[2005.12.28 15:34:46 | 000,002,856 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini

[2005.12.25 14:18:38 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\SSHDRV76.sys

[2005.12.21 16:42:14 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll

[2005.12.14 15:45:41 | 000,000,043 | ---- | C] () -- C:\WINDOWS\KA.INI

[2005.10.30 19:02:23 | 000,000,543 | ---- | C] () -- C:\WINDOWS\HOME.INI

[2005.09.20 19:19:32 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI

[2005.08.30 02:59:00 | 000,015,497 | -H-- | C] () -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Halbeportionlog.dat

[2005.08.28 13:11:42 | 000,000,512 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2005.02.05 21:46:00 | 000,004,608 | ---- | C] () -- C:\WINDOWS\fgexec.dll

[2005.01.07 11:40:30 | 000,499,712 | ---- | C] () -- C:\WINDOWS\System32\cmax30.dll

[2005.01.07 11:40:27 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\esam.dll

[2005.01.07 11:40:26 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\CDNdownload.dll

[2004.08.04 02:57:34 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2004.08.04 00:57:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll

[2004.07.17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[1999.01.23 03:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

 
 ========== LOP Check ==========

 

[2010.06.02 20:19:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Cakewalk

[2010.06.20 16:58:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Diskeeper Corporation

[2010.04.18 19:41:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF

[2010.09.27 19:57:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Guitar Pro 6

[2008.12.12 15:46:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MediaMonkey

[2010.01.12 21:19:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online

[2010.09.30 17:20:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Audacity

[2010.09.27 16:15:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Azureus

[2008.11.29 15:49:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Clonk Rage

[2010.04.18 18:32:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\foobar2000

[2010.01.12 21:03:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\FRITZ!

[2010.09.29 21:19:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\gtk-2.0

[2010.09.27 19:58:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Guitar Pro 6

[2010.10.03 22:11:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\ICQ

[2008.09.06 22:01:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Lexmark Productivity Studio

[2009.10.27 21:02:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\OpenOffice.org

[2009.05.08 14:54:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Red Kawa

[2009.09.04 12:45:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\SharePod

[2010.01.12 21:21:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\T-Online

[2009.04.11 18:12:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Teeworlds

[2008.04.05 19:06:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Teleca

[2008.01.02 23:22:49 | 000,000,336 | ---- | M] () -- C:\WINDOWS\Tasks\Uniblue SpyEraser.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*.* >

[2009.08.04 12:29:34 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2005.10.24 19:58:58 | 000,000,211 | -HS- | M] () -- C:\BOOT.BKK

[2010.06.20 15:04:34 | 000,000,231 | -HS- | M] () -- C:\boot.ini

[2010.04.18 13:38:47 | 000,003,552 | ---- | M] () -- C:\bootex.log

[2001.08.23 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin

[2009.08.04 12:29:34 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2009.07.24 11:04:03 | 000,003,216 | ---- | M] () -- C:\config.xml

[2005.10.02 18:31:56 | 001,480,092 | ---- | M] () -- C:\debug.log

[2008.04.05 20:38:30 | 000,000,102 | ---- | M] () -- C:\Delapp.bat

[2006.03.10 20:32:36 | 000,001,357 | ---- | M] () -- C:\EYEPATHR.DAT

[2006.02.25 16:16:48 | 000,001,081 | ---- | M] () -- C:\fnGetLangString.txt

[2010.04.18 20:10:36 | 000,000,660 | ---- | M] () -- C:\fpRedmon.log

[2010.10.03 20:22:49 | 670,621,696 | -HS- | M] () -- C:\hiberfil.sys

[2009.08.04 12:29:34 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2010.04.18 13:23:56 | 000,000,111 | ---- | M] () -- C:\lxdn.log

[2008.04.17 18:05:46 | 000,000,017 | -HS- | M] () -- C:\MSDOS.SYS

[2004.08.03 22:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2004.08.03 22:59:48 | 000,251,184 | RHS- | M] () -- C:\ntldr

[2006.06.06 09:14:53 | 000,000,010 | -H-- | M] () -- C:\ofqsqp.zia

[2010.10.03 20:22:47 | 1048,576,000 | -HS- | M] () -- C:\pagefile.sys

[2005.09.22 15:42:18 | 000,024,576 | ---- | M] () -- C:\t1sk.1e

[2009.11.24 13:33:55 | 000,000,045 | ---- | M] () -- C:\TEST.XML

[2010.01.12 21:20:45 | 000,000,317 | ---- | M] () -- C:\TO_InstallLog.txt

 
 < %systemroot%\system32\*.wt >

 
 < %systemroot%\system32\*.ruy >

 
 < %systemroot%\Fonts\*.com >

 
 < %systemroot%\Fonts\*.dll >

 
 < %systemroot%\Fonts\*.ini >

[2010.06.20 15:11:56 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

 
 < %systemroot%\Fonts\*.ini2 >

 
 < %systemroot%\system32\spool\prtprocs\w32x86\*.* >

[2008.02.27 13:05:40 | 000,115,200 | ---- | M] () -- C:\WINDOWS\system32\spool\PRTPROCS\W32X86\lxdndrpp.dll

 
 < %systemroot%\REPAIR\*.bak1 >

 
 < %systemroot%\REPAIR\*.ini >

 
 < %systemroot%\system32\*.jpg >

 
 < %systemroot%\*.scr >

 
 < %systemroot%\*._sy >

 
 < %APPDATA%\Adobe\Update\*.* >

 
 < %ALLUSERSPROFILE%\Favorites\*.* >

 
 < %APPDATA%\Microsoft\*.* >

[2010.03.23 19:47:40 | 000,001,610 | -H-- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\Microsoft\LastFlashConfig.WFC

 
 < %PROGRAMFILES%\*.* >

[2008.03.29 12:31:30 | 000,000,791 | -HS- | M] () -- C:\Programme\desktop.ini

[2004.10.01 16:00:16 | 000,040,960 | ---- | M] () -- C:\Programme\Uninstall_CDS.exe

 
 < %APPDATA%\Update\*.* >

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 < %systemroot%\Tasks\*.job /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2010.06.20 16:43:45 | 003,932,160 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2010.06.20 14:31:51 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav

[2010.06.20 16:43:45 | 027,000,832 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2010.06.20 16:43:45 | 007,077,888 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

 
 < %systemroot%\system32\user32.dll /md5 >

[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\system32\user32.dll

 
 < %systemroot%\system32\ws2_32.dll /md5 >

[2004.08.04 00:57:40 | 000,082,944 | ---- | M] (Microsoft Corporation) MD5=D569240A22421D5F670BB6FB6DD522B5 -- C:\WINDOWS\system32\ws2_32.dll

 
 < %systemroot%\system32\ws2help.dll /md5 >

[2004.08.04 00:57:40 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=B3ADA72D1E3E10A8F6430669DFC38ED0 -- C:\WINDOWS\system32\ws2help.dll

 

 
 < MD5 for: EXPLORER.EXE  >

[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\explorer.exe

[2004.08.04 00:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\system32\dllcache\explorer.exe

[2007.06.13 15:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe

[2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\SoftwareDistribution\Download\e94b50580b3d9c69a3c27b7653239432\sp2gdr\explorer.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2008-03-10 11:15:32

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 88 bytes -> C:\Delapp.bat:SummaryInformation

< End of report >

Extras.txt:

Code:

OTL Extras logfile created on: 3.10.2010 22:12:19 - Run 1

OTL by OldTimer - Version 3.2.14.1     Folder = F:\Eigene Dateien\Radata

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy

 

639,00 Mb Total Physical Memory | 338,00 Mb Available Physical Memory | 53,00% Memory free

3,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free

Paging file location(s): [Binary data over 100 bytes]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 37,26 Gb Total Space | 25,01 Gb Free Space | 67,11% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

Drive F: | 38,28 Gb Total Space | 24,80 Gb Free Space | 64,79% Space Free | Partition Type: NTFS

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: xy

Current User Name: xy

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

h**p [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

h**ps [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [CommandPrompt] -- cmd.exe /k cd "%1" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [MediaMonkey.1Play] -- "C:\Programme\MediaMonkey 3\MediaMonkey.exe" "%1" (Ventis Media Inc.)

Directory [MediaMonkey.2PlayNext] -- "C:\Programme\MediaMonkey 3\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)

Directory [MediaMonkey.3Enqueue] -- "C:\Programme\MediaMonkey 3\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 1

"FirewallDisableNotify" = 1

"UpdatesDisableNotify" = 1

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring" = 1

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"9999:TCP" = 9999:TCP:LocalSubNet:Enabled:DNA

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"F:\Programme\ICQ7.2\ICQ.exe" = F:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)

"F:\Programme\ICQ7.2\aolload.exe" = F:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found

"C:\Programme\FRITZ!DSL\IGDCTRL.EXE" = C:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Disabled:FRITZ!DSL - igdctrl.exe -- (AVM Berlin)

"C:\Programme\Gemeinsame Dateien\Nero\Nero Web\SetupX.exe" = C:\Programme\Gemeinsame Dateien\Nero\Nero Web\SetupX.exe:*:Enabled:Nero ControlCenter -- (Nero AG)

"C:\Dokumente und Einstellungen\...\Eigene Dateien\Meine  Dateien\Schriften\Battlefield Vietnam\bfvietnam.exe" = C:\Dokumente und Einstellungen\...\Eigene Dateien\...\Battlefield Vietnam\bfvietnam.exe:*:Enabled:bfvietnam -- File not found

"C:\WINDOWS\system32\lxdncoms.exe" = C:\WINDOWS\system32\lxdncoms.exe:*:Enabled:Lexmark Communications System -- ( )

"C:\Programme\Lexmark 2600 Series\lxdnamon.exe" = C:\Programme\Lexmark 2600 Series\lxdnamon.exe:*:Enabled:Lexmark Device Monitor -- ()

"C:\Programme\Lexmark 2600 Series\frun.exe" = C:\Programme\Lexmark 2600 Series\frun.exe:*:Enabled:Lexmark Productivity Studio -- ()

"C:\Programme\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe" = C:\Programme\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader -- (ABBYY (BIT Software))

"C:\Programme\Lexmark Fax Solutions\FaxCtr.exe" = C:\Programme\Lexmark Fax Solutions\FaxCtr.exe:*:Enabled:Fax software -- ()

"C:\Programme\Lexmark 2600 Series\lxdnmon.exe" = C:\Programme\Lexmark 2600 Series\lxdnmon.exe:*:Enabled:Printer Device Monitor -- ()

"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdnpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdnpswx.exe:*:Enabled:Printer Status Window Interface -- ()

"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdnjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdnjswx.exe:*:Enabled:Job Status Window Interface -- ()

"C:\Programme\uTorrent\uTorrent.exe" = C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- File not found

"F:\Programme\ICQ7.2\ICQ.exe" = F:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)

"F:\Programme\ICQ7.2\aolload.exe" = F:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{06604771-5346-492A-93C1-486B6CCD10AD}" = MP3 Player

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support

"{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1" = Guitar Pro 6

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{593D4F8A-5F11-4901-A74A-6E7971E45790}" = Diskeeper 2009 Pro Premier

"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6BF04C63-EAC0-4F19-9E88-9A745493E7BF}" = IconPackager

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{9781A96F-71AC-4738-984B-5AB597DFE678}" = Wer wird Millionär? 4te Edition

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A8B94669-8654-4126-BD28-D0D2412CDED6}" = TI Connect 1.6

"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support

"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.0 - Deutsch

"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint

"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution

"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser

"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1

"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack

"7-Zip" = 7-Zip 4.65

"AC3Filter_is1" = AC3Filter 1.61b

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Ashampoo WinOptimizer 4_is1" = Ashampoo WinOptimizer 4.40

"aTube Catcher" = aTube Catcher

"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.11 (Unicode)

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Azureus" = Azureus

"Bink and Smacker" = Bink and Smacker

"BootSkin" = BootSkin

"CCleaner" = CCleaner

"Clonk Rage" = Clonk Rage

"Counter-Strike: Source v17" = Counter-Strike: Source v17

"Defraggler" = Defraggler (remove only)

"DivX Setup.divx.com" = DivX-Setup

"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20

"FFmpeg for Audacity on Windows_is1" = FFmpeg for Audacity on Windows

"FMCODEC" = FM Screen Capture Codec (Remove Only)

"foobar2000" = foobar2000 v0.9.6.9

"FreePDF_XP" = FreePDF (Remove only)

"GPL Ghostscript 8.71" = GPL Ghostscript 8.71

"Guitar Pro 5_is1" = Guitar Pro 5.2

"HijackThis" = HijackThis 2.0.2

"IconPackager" = IconPackager

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager

"LAME for Audacity_is1" = LAME v3.98.2 for Audacity

"LastFM_is1" = Last.fm 1.5.4.24567

"Lexmark 2600 Series" = Lexmark 2600 Series

"Lexmark Fax Solutions" = Lexmark Fax-Lösungen

"Little Fighter 2" = Little Fighter 2 1.9c

"LogonStudio" = LogonStudio

"Macromedia Shockwave Player" = Macromedia Shockwave Player

"MediaMonkey_is1" = MediaMonkey 3.2

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)

"Nero - Burning Rom!UninstallKey" = Nero OEM

"NVIDIA Drivers" = NVIDIA Drivers

"office Convert Pdf to Jpg Jpeg Tiff Free_is1" = office Convert Pdf to Jpg Jpeg Tiff Free 6.4

"PeerGuardian_is1" = PeerGuardian 2.0

"Pistonsoft BPM Detector_is1" = Pistonsoft BPM Detector 1.0

"QuicktimeAlt_is1" = QuickTime Alternative 2.9.2

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.3

"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)

"Total Video Converter 3.12_is1" = Total Video Converter 3.12 080330

"Videora iPod Converter" = Videora iPod Converter 4.03

"WinAce Archiver" = WinAce Archiver

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 10

"WinGimp-2.0_is1" = GIMP 2.4.2

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"ZoneAlarm" = ZoneAlarm

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 28.12.2007 15:30:43 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.5730.11, fehlgeschlagenes

 Modul kernel32.dll, Version 5.1.2600.2180, Fehleradresse 0x0001eb33.

 

Error - 30.12.2007 08:55:10 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.5730.11, fehlgeschlagenes

 Modul kernel32.dll, Version 5.1.2600.2180, Fehleradresse 0x0001eb33.

 

Error - 30.12.2007 10:36:15 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung bfvietnam.exe, Version 0.0.0.0, fehlgeschlagenes

 Modul bfvietnam.exe, Version 0.0.0.0, Fehleradresse 0x00570d1c.

 

Error - 30.12.2007 12:20:04 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung bfvietnam.exe, Version 0.0.0.0, fehlgeschlagenes

 Modul bfvietnam.exe, Version 0.0.0.0, Fehleradresse 0x00633f69.

 

[ Application Events ]

Error - 28.12.2007 15:30:43 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.5730.11, fehlgeschlagenes

 Modul kernel32.dll, Version 5.1.2600.2180, Fehleradresse 0x0001eb33.

 

Error - 30.12.2007 08:55:10 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung iexplore.exe, Version 7.0.5730.11, fehlgeschlagenes

 Modul kernel32.dll, Version 5.1.2600.2180, Fehleradresse 0x0001eb33.

 

Error - 30.12.2007 10:36:15 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung bfvietnam.exe, Version 0.0.0.0, fehlgeschlagenes

 Modul bfvietnam.exe, Version 0.0.0.0, Fehleradresse 0x00570d1c.

 

Error - 30.12.2007 12:20:04 | Computer Name = GAME | Source = Application Error | ID = 1000

Description = Fehlgeschlagene Anwendung bfvietnam.exe, Version 0.0.0.0, fehlgeschlagenes

 Modul bfvietnam.exe, Version 0.0.0.0, Fehleradresse 0x00633f69.

 

[ System Events ]

Error - 3.10.2010 16:34:48 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:34:54 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:34:59 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:35:05 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:40:44 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:40:50 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:40:56 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:41:01 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:41:07 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

Error - 3.10.2010 16:41:13 | Computer Name = MAFGOHT | Source = Disk | ID = 262151

Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.

 

 

< End of report >

Gmer Log folgt.

Gmer Log:

Code:

GMER 1.0.15.15281 - h**p://www.gmer.net

Rootkit scan 2010-10-04 00:18:20

Windows 5.1.2600 Service Pack 2

Running: ph8eqr4i.exe; Driver: C:\DOKUME~1\HALBEP~1\LOKALE~1\Temp\ufldypod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwConnectPort [0xF6E8B040]

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwCreateFile [0xF6E87930]

SSDT            F925798E                                                                                                                                        ZwCreateKey

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwCreatePort [0xF6E8B510]

SSDT            F9257984                                                                                                                                        ZwCreateThread

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwCreateWaitablePort [0xF6E8B600]

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwDeleteFile [0xF6E87F20]

SSDT            F9257993                                                                                                                                        ZwDeleteKey

SSDT            F925799D                                                                                                                                        ZwDeleteValueKey

SSDT            F92579A2                                                                                                                                        ZwLoadKey

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwOpenFile [0xF6E87D70]

SSDT            F9257970                                                                                                                                        ZwOpenProcess

SSDT            F9257975                                                                                                                                        ZwOpenThread

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwRenameKey [0xF6E94250]

SSDT            F92579AC                                                                                                                                        ZwReplaceKey

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwRequestWaitReplyPort [0xF6E8AC00]

SSDT            F92579A7                                                                                                                                        ZwRestoreKey

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                                     ZwSetInformationFile [0xF6E88120]

SSDT            F9257998                                                                                                                                        ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           KERNEL1.EXE!_abnormal_termination + 144                                                                                                         804E27A0 8 Bytes  CALL A5C7BB9B 

.text           KERNEL1.EXE!_abnormal_termination + 34C                                                                                                         804E29A8 8 Bytes  JMP A5C7D6A3 

?               srescan.sys                                                                                                                                     Das System kann die angegebene Datei nicht finden. !

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                                        section is writeable [0xF8527360, 0x24BB1D, 0xE8000020]

.reloc          C:\WINDOWS\system32\drivers\acehlp10.sys                                                                                                        section is executable [0xF84C9B80, 0x37FC7, 0xE0000060]

.text           C:\WINDOWS\system32\drivers\SSHDRV76.sys                                                                                                        section is writeable [0xF6FB5000, 0x16204, 0xE8000020]

.pklstb         C:\WINDOWS\system32\drivers\SSHDRV76.sys                                                                                                        entry point in ".pklstb" section [0xF6FD3000]

.relo2          C:\WINDOWS\system32\drivers\SSHDRV76.sys                                                                                                        unknown last section [0xF6FE3000, 0x86, 0x42000040]

.text           C:\WINDOWS\system32\drivers\ACEDRV07.sys                                                                                                        section is writeable [0xBA472000, 0x328BA, 0xE8000020]

.pklstb         C:\WINDOWS\system32\drivers\ACEDRV07.sys                                                                                                        entry point in ".pklstb" section [0xBA4B6000]

.relo2          C:\WINDOWS\system32\drivers\ACEDRV07.sys                                                                                                        unknown last section [0xBA4D2000, 0x8E, 0x42000040]

.reloc          C:\WINDOWS\system32\drivers\acedrv10.sys                                                                                                        section is executable [0xB7EE4000, 0x459C1, 0xE0000060]
 

---- Devices - GMER 1.0.15 ----
 

Device          \Driver\Tcpip \Device\Ip                                                                                                                        vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device          \Driver\Tcpip \Device\Tcp                                                                                                                       vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device          \Driver\prodrv06 \Device\ProDrv06                                                                                                               E17C50D0

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                                              prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4                                                                                                     prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                                              prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c                                                                                                     prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18                                                                                                    prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20                                                                                                    prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)

Device          \Driver\prohlp02 \Device\ProHlp02                                                                                                               E102EE60

Device          \Driver\Tcpip \Device\Udp                                                                                                                       vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device          \Driver\Tcpip \Device\RawIp                                                                                                                     vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device          \Driver\Tcpip \Device\IPMULTICAST                                                                                                               vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

Device          \Driver\viamraid \Device\Scsi\viamraid1                                                                                                         prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                        fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Lexmark X2620@ChangeID                                                         26925062

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Lexmark X2620@Attributes                                                       2568

Reg             HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\InprocServer32@                                                              OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\InprocServer32@ThreadingModel                                                Both

Reg             HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\InprocServer32@ThreadingModel                                                Both

Reg             HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\InprocServer32@                                                              C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\VAIDDMGR.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\ProgID@                                                                      VAIDDManager.CacheSink.1

Reg             HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\Programmable@                                                                

Reg             HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\TypeLib@                                                                     {1C77DBD2-12C2-4086-91C0-A8CF727F7C1C}

Reg             HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\VersionIndependentProgID@                                                    VAIDDManager.CacheSink

Reg             HKLM\SOFTWARE\Classes\CLSID\{EFCB1236-8091-8A61-C175-2F6DEEA4E7AD}\InprocServer32@                                                              C:\Programme\Gemeinsame Dateien\System\ado\msado15.dll

Reg             HKLM\SOFTWARE\Classes\CLSID\{EFCB1236-8091-8A61-C175-2F6DEEA4E7AD}\InprocServer32@ThreadingModel                                                Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{EFCB1236-8091-8A61-C175-2F6DEEA4E7AD}\ProgID@                                                                      ADODB.Stream.2.8

Reg             HKLM\SOFTWARE\Classes\CLSID\{EFCB1236-8091-8A61-C175-2F6DEEA4E7AD}\VersionIndependentProgID@                                                    ADODB.Stream

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ABA0CBB1-4130-0C81-64A2-EF8067F533A7}                                 

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ABA0CBB1-4130-0C81-64A2-EF8067F533A7}@oagmilepbfdcgdnojmlpllpdeihpio  0x6A 0x61 0x70 0x63 ...

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ABA0CBB1-4130-0C81-64A2-EF8067F533A7}@namloldefikdjmnkflaclpejclll    0x6A 0x61 0x70 0x63 ...
 

---- EOF - GMER 1.0.15 ----

Schritt 1

Deine Javaversion ist veraltet. Da einige Schädlinge (z. B. Vundo) über Java-Exploits in das System eindringen, muss Java aktualisiert werden und alte Versionen müssen vom System entfernt werden, da die alten Versionen ein Sicherheitsrisiko darstellen. Lade JavaRa von prm753 herunter und entpacke es auf den Desktop. JavaRA ist geeignet für Windows 9x, 2k, XP und Vista (mit deaktivierter Benuterkontensteuerung).

Schließe alle Browserfenster.
Doppelklicke die JavaRa.exe, um das Programm zu starten.
Die Sprache auswählen, nimm Englisch und klicke "Select".
Klicke auf Additional Task, mache Haken bei Remove Useless JRE Files und [b]Remove Sun Download Manager[b].
Klicke auf Go und jeweils auf Ok und schließe das Fenster "Additional Tasks" wieder.
Klicke auf Remove Older Versions, um alte Java-Versionen, die auf dem Rechner installiert sind, zu entfernen.
Klicke auf Yes wenn es verlangt wird. Wenn JavaRa fertig, erscheint eine Notiz, dass ein Logfile erstellt wurde, klicke OK.
Das Logfile wird im Editor geöffnet, bitte speichern und später hier posten.
Kontrolliere in Systemsteuerung => Programme, ob noch Java-Versionen vorhanden sind und deinstalliere diese.
Rechner neu starten.

Downloade nun Java (Java Runtime Environment (JRE) 6 Update 21) von Oracle und installiere es. Vor dem Download musst Du die Lizenzbedingungen akzeptieren, indem Du "Accept License Agreement" aktivierst. Erweiterte Optionen anhaken, Sponsoren-Programm (Toolbar oder ähnliches) ggfs. abwählen.

Schritt 2

Sicherheitsrisiko Adobe Arcrobat Reader

Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Die Empfehlung lautet, die alte Version über Systemsteuerung => Software zu deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. Starte den Rechner neu und downloade den aktuellen Acrobat-Reader 9.3.x herunter und installiere ihn, achte bei der Installation darauf, Zusatzprogramme und/oder Toolbars abzuwählen.

Da der Adobe Acrobat Reader immer häufiger für gezielte Verbreitung von Malware genutzt wird, kannst Du stattdessen auch einen alternativen PDF-Anzeiger zu nutzen, beispielsweise den Foxit PDF Reader. Er ist "schlanker" und benutzt weniger Resourcen. Achte auch hier darauf, bei der Installation Zusatzprogramme und/oder Toolbars abzuwählen.

Schritt 3

Filesharing

Ich poste mal folgenden Hinweis, nicht mit erhobenem Zeigefinger, sondern weil Du Dir dessen vielleicht nicht bewusst bist. Du benutzt P2P-Programme. Wenn Du ein sauberes System bekommen respektive behalten möchtest, solltest Du auf den Download von Software aus solchen Quellen verzichten, denn auch wenn das P2P-Programm selbst "sauber" ist, bewahrt es Dich nicht davor, evtl. schädliche Programme auf Deinen Rechner zu holen.

Du siehst, die Gefahr ist sehr groß, sich über diese Wege zu infizieren. Aus diesem Grund bereinige ich lieber Systeme, die keine solchen Programme installiert haben und bitte Dich daher alle Programme, die in diese Richtung gehen, während unserer Bereinigung komplett und rückstandlos über Systemsteuerung => Software zu deinstallieren

Zitat:

Azureus
uTorrent

Schritt 4

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL
 

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.

O4 - HKLM..\Run: [HKLM] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O4 - HKCU..\Run: [HKCU] C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\Win32Gl\svchost.exe (CVeSyuu)

O32 - Unable to obtain root file information for disk F:\

O33 - MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\Shell - "" = AutoRun

O33 - MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\Shell\AutoRun\command - "" = H:\preinst.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

[2010.10.03 22:31:38 | 000,024,652 | -H-- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Anwendungsdaten\cglogs.dat

[2010.10.03 20:30:17 | 001,310,752 | ---- | M] () -- C:\Dokumente und Einstellungen\Halbeportion\Desktop\svchost.exe.crypted

[2010.09.26 20:52:52 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx

:Commands

[purity]

[emptytemp]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Code-Tags in Deinen Thread.

Schritt 5

Downloade Malwarebytes Anti-Malware (ca. 2 MB) von diesen Downloadspiegel:

Malwarebytes

Installiere das Programm in den vorgegebenen Pfad.
Denke daran, bei Vista das Programm als Admin zu starten, ansonsten per Doppelklick starten.
Lasse es online updaten (Reiter Updates), wenn das nicht automatisch passiert (ca. 1 MB).
Aktiviere "Komplett Scan durchführen" => Scan.
Wähle alle verfügbaren Laufwerke aus und starte den Scan.
Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
Versichere Dich, dass alle Funde markiert sind und drücke "Löschen".
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Scan-Berichte" finden.
Berichte, wie der Rechner nun läuft.

Hier findest Du eine ausführliche und bebilderte Anleitung.

JavaRa Log:

Code:

JavaRa 1.16 Removal Log.
 

Report follows after line.
 

------------------------------------
 

The JavaRa removal process was started on Mon Oct 04 11:42:21 2010
 

Found and removed: Software\JavaSoft\Java2D\1.5.0_06
 

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510006
 

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006
 

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510006
 

Found and removed: SOFTWARE\Classes\JavaPlugin.150_06
 

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0
 

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_06
 

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5
 

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510006
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006
 

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
 

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}
 

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}
 

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003
 

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003
 

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03
 

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03
 

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003
 

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_06
 

Found and removed: Software\Classes\JavaPlugin.160_03
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03
 

Found and removed: Software\JavaSoft\Java2D\1.6.0_03
 

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03
 

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
 

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
 

------------------------------------
 

Finished reporting.

OTL Log:

Code:

All processes killed

========== OTL ==========

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HKLM deleted successfully.

C:\WINDOWS\Win32Gl\svchost.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\HKCU deleted successfully.

File C:\WINDOWS\Win32Gl\svchost.exe not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\\Policies deleted successfully.

File C:\WINDOWS\Win32Gl\svchost.exe not found.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\Policies deleted successfully.

File C:\WINDOWS\Win32Gl\svchost.exe not found.

File  not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d06ca440-a7bd-11db-ac66-0004758debc5}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d06ca440-a7bd-11db-ac66-0004758debc5}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d06ca440-a7bd-11db-ac66-0004758debc5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d06ca440-a7bd-11db-ac66-0004758debc5}\ not found.

File H:\preinst.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.

C:\Dokumente und Einstellungen\***\Anwendungsdaten\cglogs.dat moved successfully.

C:\Dokumente und Einstellungen\***\Desktop\svchost.exe.crypted moved successfully.

C:\WINDOWS\WMSysPr9.prx moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 29184 bytes

->Temporary Internet Files folder emptied: 112094 bytes

->Flash cache emptied: 41 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Gast

->Temp folder emptied: 3652770 bytes

->Temporary Internet Files folder emptied: 567628 bytes

->Java cache emptied: 365540 bytes

->FireFox cache emptied: 40065837 bytes

->Flash cache emptied: 39533 bytes

 

User: ***

->Temp folder emptied: 1139 bytes

->Temporary Internet Files folder emptied: 32902 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 45499875 bytes

->Flash cache emptied: 5276 bytes

 

User: Home

 

User: LocalService

->Temp folder emptied: 65984 bytes

->Temporary Internet Files folder emptied: 37727 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: **

->Temp folder emptied: 1149080 bytes

->Temporary Internet Files folder emptied: 7747753 bytes

->FireFox cache emptied: 43439839 bytes

->Flash cache emptied: 7309 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2893757 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 512 bytes

RecycleBin emptied: 875296 bytes

 

Total Files Cleaned = 140,00 mb

 

 

OTL by OldTimer - Version 3.2.14.1 log created on 10042010_130228
 

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\ZLT03e46.TMP not found!

File\Folder C:\WINDOWS\temp\ZLT03e4a.TMP not found!
 

Registry entries deleted on Reboot...

Malwarebytes Anti-Malware Scan läuft.
Symptome seit OTL Fix verschwunden :)

Sehr gut :)

Dann poste noch das LOG wenn der Scan durch ist.

Malwarebytes Anti-Malware Log:

Code:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org
 

Datenbank Version: 4739
 

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180
 

4.10.2010 16:26:40

mbam-log-2010-10-04 (16-26-40).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)

Durchsuchte Objekte: 269099

Laufzeit: 2 Stunde(n), 30 Minute(n), 40 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 13

Infizierte Registrierungswerte: 1

Infizierte Dateiobjekte der Registrierung: 3

Infizierte Verzeichnisse: 2

Infizierte Dateien: 4
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{e4v6hjw0-7300-jv52-28v2-5xow7r6os476} (Generic.Bot.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{l43a4311-260f-n62x-5x17-6jt42mw778kn} (Generic.Bot.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1817219b-d6dc-450a-b913-41f12bc05019} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{98b55bd1-39bb-4446-895d-bf6a7a23ce70} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07c7156e-d651-4acc-9ad3-498c916e9651} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVFLTIP (Rogue.UnVirex) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DrvFltIp (Rogue.UnVirex) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{07c7156e-d651-4acc-9ad3-498c916e9651} (Trojan.Vundo) -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

C:\directory\CyberGate (Trojan.PWS) -> Quarantined and deleted successfully.

C:\directory\CyberGate\install (Trojan.PWS) -> Quarantined and deleted successfully.
 

Infizierte Dateien:

c:\directory\CyberGate\install\server.exe (Generic.Bot.H) -> Quarantined and deleted successfully.

F:\Programme\Rockstar Games\GTA San Andreas\trainer.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Gast\Anwendungsdaten\cglogs.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.

Windows hat nach dem Neustart eine Sicherheitswarnung angezeigt.

Zitat:

AntiVir Desktop hat gemeldet, dass es eventuell nicht mehr auf dem aktuellen Stand ist.

Update installiert. Windows is jetzt still. Keine Sicherheitswarnungen mehr, die Automatischen Updates hab ich aber deaktiviert gelassen.

Schritt 1

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.

**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**

http://i266.photobucket.com/albums/i...ownload_FF.gif

http://i94.photobucket.com/albums/l8...x-Download.png

Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
Doppel-klicke auf ComboFix.exe und folge den Aufforderungen.
- Wenn ComboFix fertig ist, wird es ein Log für dich erstellen.
- Bitte poste mir den Inhalt von C:\ComboFix.txt hier in de Thread.

Schritt 2

Downloade Dir bitte RKUnhookerLE und speichere die Datei auf deinem Desktop.

Deaktiviere alle Hintergrundwächter. Besonders den deiner Anti Virensoftware.
Starte die RKUnhookerLE.exe
Klicke auf den Report Tab und danach auf Scan
Setze ein Häckchen bei
- Drivers
- Stealth Code
Entferne alle anderen Hacken
Wenn Du gefragt wirst welcher Bereich gescannt werden soll, gehe sicher das deine Systemplatte ( meistens C: ) angehackt ist.
Klicke OK
Wenn der Scan beendet wurde
File --> Save Report
klicken.
Speichere die Datei als RKU.txt auf dem Desktop.
Klicke Close

Hinweis: Solltest Du folgende Warnung bekommen

Zitat:

"Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?"

einfach ignorieren.

Combo-Fix Log:

Code:

ComboFix 10-10-03.03 - ... 04.10.2010  18:37:16.1.1 - x86

Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.639.203 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\...\Desktop\Combo-Fix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windows\system\QTIM32.DLL

F:\AUTORUN.INF
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_BOONTY_GAMES
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-09-04 bis 2010-10-04  ))))))))))))))))))))))))))))))

.
 

2010-10-04 16:26 . 2010-10-04 16:28    --------    d-----r-    C:\32788R22FWJFW

2010-10-04 10:59 . 2010-10-04 10:59    --------    d-----w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Malwarebytes

2010-10-04 10:59 . 2010-04-29 13:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-04 10:59 . 2010-10-04 10:59    --------    d-----w-    c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-10-04 10:59 . 2010-10-04 10:59    --------    d-----w-    c:\programme\Malwarebytes' Anti-Malware

2010-10-04 10:59 . 2010-04-29 13:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys

2010-10-04 10:04 . 2010-10-04 10:04    503808    ----a-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-17b45cbd-n\msvcp71.dll

2010-10-04 10:04 . 2010-10-04 10:04    499712    ----a-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-17b45cbd-n\jmc.dll

2010-10-04 10:04 . 2010-10-04 10:04    348160    ----a-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-17b45cbd-n\msvcr71.dll

2010-10-04 10:04 . 2010-10-04 10:04    12800    ----a-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3cdfdbe5-n\decora-d3d.dll

2010-10-04 10:04 . 2010-10-04 10:04    61440    ----a-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-3cdfdbe5-n\decora-sse.dll

2010-10-04 10:03 . 2010-10-04 10:02    423656    ----a-w-    c:\windows\system32\deployJava1.dll

2010-09-30 20:32 . 2010-10-04 14:26    --------    d-----w-    C:\directory

2010-09-27 17:57 . 2010-09-27 17:57    --------    d-----w-    c:\dokumente und einstellungen\All Users\Anwendungsdaten\Guitar Pro 6

2010-09-27 17:56 . 2010-09-27 17:58    --------    d-----w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Guitar Pro 6

2010-09-27 14:45 . 2010-09-27 17:52    --------    d-----w-    c:\programme\Guitar Pro 6

2010-09-07 15:15 . 2010-09-13 10:59    --------    d-----w-    c:\dokumente und einstellungen\...\Lokale Einstellungen\Anwendungsdaten\WMTools Downloaded Files
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-04 16:58 . 2008-05-05 10:32    73390112    --sha-w-    c:\windows\system32\drivers\fidbox.dat

2010-10-04 16:57 . 2009-10-31 17:12    --------    d-----w-    c:\programme\PeerGuardian2

2010-10-04 16:50 . 2010-06-24 14:13    4273154    ----a-w-    c:\windows\Internet Logs\tvDebug.zip

2010-10-04 16:49 . 2008-05-05 10:32    865148    --sha-w-    c:\windows\system32\drivers\fidbox.idx

2010-10-04 10:11 . 2006-02-16 15:34    --------    d-----w-    c:\programme\Gemeinsame Dateien\Adobe

2010-10-04 10:04 . 2008-01-29 18:48    --------    d-----w-    c:\programme\Gemeinsame Dateien\Java

2010-10-04 10:02 . 2008-01-29 18:49    --------    d-----w-    c:\programme\Java

2010-10-04 06:48 . 2005-05-14 21:58    1607    ---ha-w-    c:\dokumente und einstellungen\Gast\Anwendungsdaten\Gastlog.dat

2010-10-03 23:07 . 2010-06-20 11:28    --------    d-----w-    c:\dokumente und einstellungen\...\Anwendungsdaten\ICQ

2010-10-02 12:06 . 2005-08-30 00:59    15497    ---ha-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\...log.dat

2010-10-01 16:21 . 2009-11-16 07:24    1    ----a-w-    c:\dokumente und einstellungen\Gast\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-09-30 18:08 . 2009-10-27 19:05    1    ----a-w-    c:\dokumente und einstellungen\...\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-09-30 15:20 . 2010-02-01 17:50    --------    d-----w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Audacity

2010-09-29 19:19 . 2010-06-28 21:06    --------    d-----w-    c:\dokumente und einstellungen\...\Anwendungsdaten\gtk-2.0

2010-09-27 18:36 . 2010-09-28 06:02    238080    ----a-w-    c:\windows\Internet Logs\xDBA.tmp

2010-09-27 14:15 . 2010-01-16 13:35    --------    d-----w-    c:\dokumente und einstellungen\...\Anwendungsdaten\Azureus

2010-09-22 16:24 . 2010-09-22 16:26    53248    ----a-w-    c:\windows\Internet Logs\xDB9.tmp

2010-09-20 19:06 . 2010-09-21 11:25    2876416    ----a-w-    c:\windows\Internet Logs\xDB8.tmp

2010-09-20 16:58 . 2010-09-20 16:59    2560000    ----a-w-    c:\windows\Internet Logs\xDB7.tmp

2010-09-20 16:58 . 2010-09-20 16:59    2801152    ----a-w-    c:\windows\Internet Logs\xDB6.tmp

2010-09-11 14:10 . 2001-08-23 12:00    75300    ----a-w-    c:\windows\system32\perfc007.dat

2010-09-11 14:10 . 2001-08-23 12:00    415664    ----a-w-    c:\windows\system32\perfh007.dat

2010-08-30 08:58 . 2008-02-26 13:21    --------    d-----w-    c:\programme\software4u

2010-08-29 19:05 . 2010-08-29 19:13    2531328    ----a-w-    c:\windows\Internet Logs\xDB5.tmp

2010-08-29 19:05 . 2010-08-29 19:13    546304    ----a-w-    c:\windows\Internet Logs\xDB4.tmp

2010-08-25 20:17 . 2010-08-26 07:35    570880    ----a-w-    c:\windows\Internet Logs\xDB3.tmp

2010-08-03 22:39 . 2010-08-04 09:30    283648    ----a-w-    c:\windows\Internet Logs\xDB2.tmp

2010-07-20 17:02 . 2010-07-20 17:03    3404800    ----a-w-    c:\windows\Internet Logs\xDB1.tmp

2004-10-01 14:00 . 2008-03-21 18:37    40960    ----a-w-    c:\programme\Uninstall_CDS.exe

2006-05-03 10:06 . 2009-02-26 18:25    163328    --sha-r-    c:\windows\system32\flvDX.dll

2007-02-21 11:47 . 2009-02-26 18:25    31232    --sha-r-    c:\windows\system32\msfDX.dll

2008-03-16 13:30 . 2009-02-26 18:25    216064    --sha-r-    c:\windows\system32\nbDX.dll

.
 

------- Sigcheck -------
 

[-] 2010-06-20 14:08 . CAB5F4D65D49C24FAA4EF0351B3755A3 . 23552 . . [1.0.0.4] . . c:\windows\system32\dllcache\ctfmon.exe

[-] 2010-06-20 14:08 . CAB5F4D65D49C24FAA4EF0351B3755A3 . 23552 . . [1.0.0.4] . . c:\windows\system32\ctfmon.exe

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccleaner"="c:\programme\CCleaner\ccleaner.exe" [2009-06-25 1578736]

"PeerGuardian"="c:\programme\PeerGuardian2\pg2.exe" [2005-09-18 1421824]

"HotSwap! Applet"="c:\dokumente und einstellungen\...\Eigene Dateien\Downloads\Nützliche Programme\HotSwap!.EXE" [2009-11-10 107520]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogonStudio"="c:\programme\Stardock\LogonStudio\logonstudio.exe" [2002-09-03 987187]

"ZoneAlarm Client"="c:\programme\Zone Labs\ZoneAlarm\zlclient.exe" [2008-04-02 919016]

"nwiz"="nwiz.exe" [2006-10-22 1622016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"BootSkin Startup Jobs"="c:\progra~1\Stardock\BootSkin\BootSkin.exe" [2004-04-26 270336]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]
 

c:\dokumente und einstellungen\Gast\Startmen\Programme\Autostart\

OpenOffice.org 3.1.lnk - c:\programme\OpenOffice\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoFileAssociate"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\windows\system32\logonuiX.exe"
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute    REG_MULTI_SZ       \0
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]

2008-03-27 15:13    320168    ----a-w-    c:\programme\Lexmark Fax Solutions\fm3032.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnamon]

2008-03-27 15:13    16040    ----a-w-    c:\programme\Lexmark 2600 Series\lxdnamon.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdnmon.exe]

2008-03-27 15:13    660136    ----a-w-    c:\programme\Lexmark 2600 Series\lxdnmon.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2008-05-30 13:54    21718312    ----a-r-    c:\programme\Skype\Phone\Skype.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 14:07    2260480    ----a-w-    c:\programme\Spybot - Search & Destroy\TeaTimer.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"StyleXPService"=2 (0x2)

"Boonty Games"=3 (0x3)

"de_serv"=3 (0x3)

"wuauserv"=2 (0x2)

"wscsvc"=2 (0x2)

"NMIndexingService"=3 (0x3)

"Nero BackItUp Scheduler 3"=2 (0x2)

"SCardSvr"=3 (0x3)

"SCardDrv"=3 (0x3)
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\FRITZ!DSL\\IGDCTRL.EXE"=

"c:\\Programme\\Gemeinsame Dateien\\Nero\\Nero Web\\SetupX.exe"=

"c:\\WINDOWS\\system32\\lxdncoms.exe"=

"c:\\Programme\\Lexmark 2600 Series\\lxdnamon.exe"=

"c:\\Programme\\Lexmark 2600 Series\\frun.exe"=

"c:\\Programme\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=

"c:\\Programme\\Lexmark Fax Solutions\\FaxCtr.exe"=

"c:\\Programme\\Lexmark 2600 Series\\lxdnmon.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

"f:\\Programme\\ICQ7.2\\ICQ.exe"=

"f:\\Programme\\ICQ7.2\\aolload.exe"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowRedirect"= 1 (0x1)
 

R1 NETDSL;AVM PPP over Ethernet;c:\windows\system32\drivers\netdsl.sys [19.1.2007 16:01 11264]

R1 SSHDRV76;SSHDRV76;c:\windows\system32\drivers\SSHDRV76.sys [25.12.2005 14:18 53760]

R2 acedrv10;acedrv10;c:\windows\system32\drivers\ACEDRV10.sys [27.7.2007 10:13 330144]

R2 acehlp10;acehlp10;c:\windows\system32\drivers\acehlp10.sys [27.7.2007 12:46 251680]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [6.4.2010 09:28 135336]

R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]

R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;c:\programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [12.1.2010 21:18 61440]

S3 AVMUNET;AVM FRITZ!Box;c:\windows\system32\drivers\avmunet.sys [19.1.2007 15:06 15104]

S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;c:\progra~1\GEMEIN~1\Marmiko Shared\MACNDIS5.SYS [12.1.2010 21:18 17280]

S3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\GEMEIN~1\Marmiko Shared\MInfraIS\MIINPazX.SYS [12.1.2010 21:18 17152]

S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;c:\progra~1\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyX.SYS [12.1.2010 21:16 17536]

S3 NETFWDSL;AVM FRITZ!web DSL PPP;c:\windows\system32\drivers\NETFWDSL.SYS [19.1.2007 16:01 367104]

S3 NTGUARD;NTGUARD;\??\c:\programme\Ikarus\Anti Virus\bin\NTGUARD.SYS --> c:\programme\Ikarus\Anti Virus\bin\NTGUARD.SYS [?]

S3 TUSB1150;devolo WLAN USB Stick;c:\windows\system32\drivers\TUSB1150.sys [23.3.2010 19:42 494848]

.

Inhalt des "geplante Tasks" Ordners

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://web.de/

mWindow Title = 

uInternet Settings,ProxyOverride = fritz.box;*.local

TCP: {6617E376-737B-42AE-AD1F-4342CD2FA520} = 192.168.178.1,192.168.178.20

DPF: Microsoft XML Parser for Java

FF - ProfilePath - c:\dokumente und einstellungen\...\Anwendungsdaten\Mozilla\Firefox\Profiles\tx1wktwv.default\

FF - prefs.js: browser.startup.homepage - hxxp://web.de/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=

FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
 

---- FIREFOX Richtlinien ----

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe

ActiveSetup-{B57CDEE7-3C45-5869-B36B-10F30855E5A3} - c:\windows\system32\Drivers\rundll32.exe

AddRemove-IconPackager - c:\dokumente und einstellungen\All Users\Anwendungsdaten\{B98A2B83-8BB0-42E7-AA1D-D6FA6E7C8F31}\IconPackager.exe

AddRemove-{6BF04C63-EAC0-4F19-9E88-9A745493E7BF} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\{B98A2B83-8BB0-42E7-AA1D-D6FA6E7C8F31}\IconPackager.exe
 
 
 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]

"ImagePath"="\??\c:\dokumente und einstellungen\...\Lokale Einstellungen\TEMP\ASFWHide"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\S-1-5-21-1482476501-1957994488-682003330-1011\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"

"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"

"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"

"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"

"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"

"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"

"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"

"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"

"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"

"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"

"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"

"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"

"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"

"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"

"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"

"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"

"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"

"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Programme\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"

"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"

"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"

"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"
 

[HKEY_USERS\S-1-5-21-1482476501-1957994488-682003330-1011\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ABA0CBB1-4130-0C81-64A2-EF8067F533A7}*]

"oagmilepbfdcgdnojmlpllpdeihpio"=hex:6a,61,70,63,67,68,6d,69,6e,6d,68,6f,6f,62,

   67,66,62,6d,65,65,00,07

"namloldefikdjmnkflaclpejclll"=hex:6a,61,70,63,67,68,6d,69,6e,6d,68,6f,6f,62,

   67,66,62,6d,65,65,00,07
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'explorer.exe'(1600)

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\programme\Stardock\Object Desktop\IconPackager\iprepair.dll

c:\windows\system32\DivXControlPanelApplet.cpl

c:\windows\system32\nvcpl.cpl

c:\windows\system32\nvCplUIR.dll

c:\windows\system32\nvtuicpl.cpl

c:\windows\system32\NVWRSDE.DLL

c:\windows\system32\QTW32.CPL

c:\progra~1\Avira\AntiVir Desktop\avconfig.cpl

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\FRITZ!DSL\IGDCTRL.EXE

c:\programme\Bonjour\mDNSResponder.exe

c:\programme\Diskeeper Corporation\Diskeeper\DkService.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\windows\system32\lxdncoms.exe

c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-10-04  19:04:04 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-10-04 17:03
 

Vor Suchlauf: 13 Verzeichnis(se), 26.463.518.720 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 26.376.491.008 Bytes frei
 

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /kernel=kernel1.exe
 

Current=1 Default=1 Failed=0 LastKnownGood=3 Sets=1,2,3,10

- - End Of File - - A7D62587942AB35474D415E1A8DD4253

RKU Log:

Code:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 2)

Number of processors #1

==============================================

>Drivers

==============================================

0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 4530176 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 93.71 )

0xF8527000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 3997696 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 93.71 )

0x804D7000 C:\WINDOWS\system32\KERNEL1.EXE 2194176 bytes (Microsoft Corporation, NT-Kernel und -System)

0x804D7000 PnpManager 2194176 bytes

0x804D7000 RAW 2194176 bytes

0x804D7000 WMIxWDM 2194176 bytes

0xBF800000 Win32k 1839104 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1839104 bytes (Microsoft Corporation, Mehrbenutzer-Win32-Treiber)

0xF89E8000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xF6CE8000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 454656 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xBA471000 C:\WINDOWS\system32\drivers\ACEDRV07.sys 401408 bytes (Protect Software GmbH, Helper Driver - Access Level 1a)

0xF6E58000 C:\WINDOWS\System32\vsdatant.sys 393216 bytes (Zone Labs, LLC, TrueVector Device Driver)

0xF6F01000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 360448 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xB88A6000 C:\WINDOWS\system32\drivers\acedrv10.sys 352256 bytes (Protect Software GmbH, Filter Driver ProtectDisc)

0xB7DA8000 C:\WINDOWS\system32\DRIVERS\srv.sys 339968 bytes (Microsoft Corporation, Server driver)

0xB7E85000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xF84C6000 C:\WINDOWS\system32\drivers\acehlp10.sys 245760 bytes (Protect Software GmbH, ProtectDisc Filter Driver)

0xF82CA000 C:\WINDOWS\system32\DRIVERS\update.sys 212992 bytes (Microsoft Corporation, Update Driver)

0xF839E000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 200704 bytes (Microsoft Corporation, Microsoft RDP Device redirector)

0xF6FC8000 C:\WINDOWS\system32\drivers\SSHDRV76.sys 196608 bytes (-, ProtectCD Copyprotection Helper I/O Driver for Accounts with limited Access Rights)

0xF8B60000 ACPI.sys 192512 bytes (Microsoft Corporation, ACPI-Treiber für NT)

0xB894C000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xF89BB000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xF6D6A000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 180224 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xB6C59000 C:\WINDOWS\system32\drivers\kmixer.sys 172032 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)

0xF6ED9000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xF8B0A000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, E/A-Treiber für NT Datenträgerverwaltung)

0xF8444000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xB7483000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 143360 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xF6FF8000 C:\WINDOWS\system32\DRIVERS\klif.sys 143360 bytes (Kaspersky Lab, Klif Mini-Filter)

0xF84A3000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xF8480000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 143360 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xF6E36000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0xF6CC6000 C:\WINDOWS\system32\DRIVERS\avipbb.sys 139264 bytes (Avira GmbH, Avira Driver for Security Enhancement)

0xF6EB8000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 135168 bytes (Microsoft Corporation, IP Network Address Translator)

0x806EF000 ACPI_HAL 131968 bytes

0x806EF000 C:\WINDOWS\system32\hal.dll 131968 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF8A9E000 fltMgr.sys 126976 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF8B30000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT-Datenträgertreiber)

0xF8AD5000 viamraid.sys 118784 bytes (VIA Technologies inc,.ltd, VIA AHCI RAID DRIVER FOR WIN XP/SRV2003)

0xF8967000 Mup.sys 110592 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF8468000 C:\WINDOWS\system32\drivers\ac97intc.sys 98304 bytes (Intel Corporation, Intel(r) Integrated Controller Hub Audio Driver)

0xF8AF2000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xF6CAE000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes

0xF8ABD000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)

0xF8A75000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xF8408000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xBA4D3000 C:\WINDOWS\system32\DRIVERS\avgntflt.sys 86016 bytes (Avira GmbH, Avira Minifilter Driver)

0xB7E70000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xF841F000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Treiber für parallelen Anschluss)

0xF89A7000 srescan.sys 81920 bytes

0xF8513000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xF6F59000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xF6D57000 C:\WINDOWS\System32\drivers\prodrv06.sys 77824 bytes (Protection Technology, StarForce Protection Environment Driver)

0xF8994000 sfvfs02.sys 77824 bytes (Protection Technology, StarForce Protection VFS Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF8982000 sfdrv01.sys 73728 bytes (Protection Technology, StarForce Protection Environment Driver)

0xF8A8C000 sr.sys 73728 bytes (Microsoft Corporation, Dateisystemfilter-Treiber der Systemwiederherstellung)

0xF8502000 C:\WINDOWS\system32\DRIVERS\el90xbc5.sys 69632 bytes (3Com Corporation, 3Com EtherLink PCI Driver)

0xF8B4F000 pci.sys 69632 bytes (Microsoft Corporation, NT-Plug & Play PCI-Enumerator)

0xF83F7000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xF8433000 C:\WINDOWS\system32\DRIVERS\serial.sys 69632 bytes (Microsoft Corporation, Treiber für serielle Geräte)

0xF838E000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xF8C10000 prohlp02.sys 65536 bytes (Protection Technology, StarForce Protection Helper Driver)

0xF8D50000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xF8D30000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook-Audiofiltertreiber)

0xB883E000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF8DF0000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF8BD0000 VolSnap.sys 57344 bytes (Microsoft Corporation, Volumeschattenkopie-Treiber)

0xF8D20000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 53248 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF8BF0000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xF8D60000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042-Anschlusstreiber)

0xF8D70000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF8D90000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xF8C20000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)

0xF8D10000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF8BC0000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF8D80000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF8D40000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 40960 bytes (GEAR Software Inc., CD DVD Filter)

0xF8DE0000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xF8DB0000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF8BE0000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF8C80000 C:\WINDOWS\System32\Drivers\Fips.SYS 36864 bytes (Microsoft Corporation, FIPS-Verschlüsselungstreiber)

0xF8E10000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)

0xB76D0000 C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 36864 bytes (Microsoft Corporation, IP FILTER DRIVER)

0xF8BB0000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP-ISA-Bustreiber)

0xF8DA0000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xF8C70000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xF8C90000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xF8C00000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xF8C60000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF8EB0000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modemgerätetreiber)

0xF8F10000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xF8E40000 sfhlp02.sys 32768 bytes (Protection Technology, StarForce Protection Helper Driver)

0xF8EA0000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xF8EE8000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xF8EA8000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 28672 bytes (Microsoft Corporation, Tastaturklassentreiber)

0xF8E30000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xF8E70000 C:\DOKUME~1\HALBEP~1\LOKALE~1\Temp\mbr.sys 24576 bytes

0xF8ED0000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mausklassentreiber)

0xF8E80000 C:\Programme\PeerGuardian2\pgfilter.sys 24576 bytes

0xF8F18000 C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 24576 bytes (Avira GmbH, AVIRA SnapShot Driver)

0xF8F00000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xF8ED8000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)

0xF8F08000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF8E38000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF8EC0000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF8EC8000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)

0xF8EB8000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xF8E98000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 20480 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0xF8F68000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xF9094000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xF9038000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xF9070000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF8FC0000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xF7062000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xF9074000 C:\WINDOWS\system32\DRIVERS\gameenum.sys 12288 bytes (Microsoft Corporation, Game Port Enumerator)

0xF88FB000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0xF9044000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID-Mausfiltertreiber)

0xF9078000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xF9050000 C:\WINDOWS\system32\DRIVERS\netdsl.sys 12288 bytes (Microsoft Corporation, AVM PPP over Ethernet)

0xF9064000 C:\WINDOWS\system32\drivers\pfc.sys 12288 bytes (Padus, Inc., Padus(R) ASPI Shell)

0xF9048000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xF90E2000 C:\Programme\Avira\AntiVir Desktop\avgio.sys 8192 bytes (Avira GmbH, Avira AntiVir Support for Minifilter)

0xF90D6000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF90B6000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)

0xF90EA000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes

0xF90D4000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF90B4000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Treiber)

0xF90B0000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xF90D8000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xF90C2000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM-Paralleltreiber)

0xF9136000 C:\WINDOWS\system32\Drivers\PROCEXP113.SYS 8192 bytes

0xF90BA000 prosync1.sys 8192 bytes (Protection Technology, StarForce Protection Synchronization Driver)

0xF90DA000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF90C6000 C:\WINDOWS\System32\Drivers\RootMdm.sys 8192 bytes (Microsoft Corporation, Legacy Non-Pnp Modem Device Driver)

0xF90B8000 sfhlp01.sys 8192 bytes (Protection Technology, StarForce Protection Helper Driver)

0xF90C8000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF90CE000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF90B2000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xF9288000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF91C2000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xF9287000 C:\WINDOWS\system32\drivers\msmpu401.sys 4096 bytes (Microsoft Corporation, MPU401 Adapter Driver)

0xF92BE000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xE100C0E8 unknown_irp_handler 3864 bytes

0xE17CAC30 unknown_irp_handler 976 bytes

==============================================

>Stealth

==============================================

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x821F7888 ] TID: 116

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8220F658 ] TID: 128

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x820E3DA8 ] TID: 136

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x820A57C0 ] TID: 176

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822E3A00 ] TID: 188

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x82430020 ] TID: 204

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x820A5DA8 ] TID: 208

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x822F0DA8 ] TID: 216

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x82125DA8 ] TID: 232, 8781830 bytes

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x822EB580 ] TID: 268

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x822E9278 ] TID: 284, 8781847 bytes

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x822E75F0 ] TID: 288

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x82505020 ] TID: 292, 8781867 bytes

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x822E79F8 ] TID: 296

0x80559480 Faked ServiceTable-->mdm.exe [ ETHREAD 0x82211808 ] TID: 376

0x80559480 Faked ServiceTable-->lxdncoms.exe [ ETHREAD 0x82267648 ] TID: 412

0x80559480 Faked ServiceTable-->lxdncoms.exe [ ETHREAD 0x82299DA8 ] TID: 416

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x822A5438 ] TID: 432

0x80559480 Faked ServiceTable-->lxdncoms.exe [ ETHREAD 0x822673D0 ] TID: 436, 8781903 bytes

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8205D020 ] TID: 440

0x80559480 Faked ServiceTable-->MZCCntrl.exe [ ETHREAD 0x82215BC8 ] TID: 472

0x80559480 Faked ServiceTable-->lxdncoms.exe [ ETHREAD 0x82219020 ] TID: 476, 8781903 bytes

0x80559480 Faked ServiceTable-->MZCCntrl.exe [ ETHREAD 0x82214DA8 ] TID: 480

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82210B30 ] TID: 504

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x820B4DA8 ] TID: 520

0x80559480 Faked ServiceTable-->smss.exe [ ETHREAD 0x827D58A0 ] TID: 568

0x80559480 Faked ServiceTable-->smss.exe [ ETHREAD 0x8289B020 ] TID: 572

0x80559480 Faked ServiceTable-->smss.exe [ ETHREAD 0x824C3810 ] TID: 576, 8781935 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821FDDA8 ] TID: 580

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8211A720 ] TID: 584

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x821FE528 ] TID: 588

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8220ADA8 ] TID: 596

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82204020 ] TID: 612

0x80559480 Faked ServiceTable-->csrss.exe [ ETHREAD 0x8249E020 ] TID: 628

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82204498 ] TID: 652

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x824AE020 ] TID: 660

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x824B2020 ] TID: 664

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x828B3BC0 ] TID: 672

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x82912A30 ] TID: 700

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x828FE5A0 ] TID: 704

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x827BE1A0 ] TID: 708

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x827C2390 ] TID: 712

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x824E3C08 ] TID: 716

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x824BEDA8 ] TID: 720

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82454DA8 ] TID: 724

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82455CB0 ] TID: 728

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x826AFC10 ] TID: 744

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x824513E8 ] TID: 756

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82435A20 ] TID: 764

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82433DA8 ] TID: 776, 3211313 bytes

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82407CB0 ] TID: 780

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82718B18 ] TID: 788

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8220F3E0 ] TID: 796

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x8247F760 ] TID: 812, 7929939 bytes

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x824274D8 ] TID: 820

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x8279D968 ] TID: 828

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x82440C70 ] TID: 836, 684808 bytes

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x82434238 ] TID: 864

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8246E3D0 ] TID: 868

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x824E54D8 ] TID: 876

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x82435020 ] TID: 884

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x827B3270 ] TID: 888

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x827D9498 ] TID: 892

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82208DA8 ] TID: 896

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x82475CD8 ] TID: 900

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x826B7600 ] TID: 920

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82415A50 ] TID: 924

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x824324D8 ] TID: 928

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827C6C00 ] TID: 932

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x824C0DA8 ] TID: 940

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82898DA8 ] TID: 944

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821F6DA8 ] TID: 952

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821F18B8 ] TID: 996

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827B6DA8 ] TID: 1000

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827CCA70 ] TID: 1004

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827DB9E8 ] TID: 1020

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821F1B30 ] TID: 1024

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x821FB808 ] TID: 1028

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x827B6210 ] TID: 1040

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x827D6DA8 ] TID: 1044

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821F1DA8 ] TID: 1048

0x80559480 Faked ServiceTable-->explorer.exe [ ETHREAD 0x8205D450 ] TID: 1056

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827CD9E8 ] TID: 1064

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827DCBD0 ] TID: 1108

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82395628 ] TID: 1156

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823953B0 ] TID: 1160

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82917DA8 ] TID: 1164

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8249B2F8 ] TID: 1176, 5767237 bytes

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x821E8C08 ] TID: 1184

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8249C5E0 ] TID: 1192, 196613 bytes

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8213AA00 ] TID: 1200

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x821ED9F0 ] TID: 1212, 196613 bytes

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x821C93E0 ] TID: 1228

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8220C4B8 ] TID: 1232, 33816579 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821DD4F8 ] TID: 1236

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82396DA8 ] TID: 1252, 6881399 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82396B30 ] TID: 1256

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x82468DA8 ] TID: 1260, 196611 bytes

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x824A4DA8 ] TID: 1264

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x82458DA8 ] TID: 1268, 7536761 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821DF968 ] TID: 1284

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x821D69E8 ] TID: 1340

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x82297838 ] TID: 1348

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x8245F518 ] TID: 1368

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x8242B948 ] TID: 1372

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x824A7248 ] TID: 1392

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8242EA40 ] TID: 1400

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x82492770 ] TID: 1432

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x82406A48 ] TID: 1436, 723808 bytes

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x8228A400 ] TID: 1448, 7471204 bytes

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x82289498 ] TID: 1464

0x80559480 Faked ServiceTable-->sched.exe [ ETHREAD 0x82460400 ] TID: 1480

0x80559480 Faked ServiceTable-->sched.exe [ ETHREAD 0x82425020 ] TID: 1488

0x80559480 Faked ServiceTable-->sched.exe [ ETHREAD 0x824BCBD8 ] TID: 1496, 7471172 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82896348 ] TID: 1508

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x827D7DA8 ] TID: 1512

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82424300 ] TID: 1516

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8245D808 ] TID: 1520

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x821D6DA8 ] TID: 1544

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82395020 ] TID: 1552

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8249D308 ] TID: 1556

0x80559480 Faked ServiceTable-->sched.exe [ ETHREAD 0x824675C8 ] TID: 1576

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x82272DA8 ] TID: 1580

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821D0BC8 ] TID: 1596

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82471DA8 ] TID: 1608

0x80559480 Faked ServiceTable-->sched.exe [ ETHREAD 0x824BBA40 ] TID: 1612

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x824A3A40 ] TID: 1616

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82453950 ] TID: 1640

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x8245C5D0 ] TID: 1660

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x8243C760 ] TID: 1668

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x8246EDA8 ] TID: 1672

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x82438760 ] TID: 1676

0x80559480 Faked ServiceTable-->AppleMobileDeviceService.exe [ ETHREAD 0x824B39B0 ] TID: 1704

0x80559480 Faked ServiceTable-->AppleMobileDeviceService.exe [ ETHREAD 0x824B3738 ] TID: 1708

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x82397020 ] TID: 1756

0x80559480 Faked ServiceTable-->avshadow.exe [ ETHREAD 0x826AEDA8 ] TID: 1764

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x823972F0 ] TID: 1768

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x8232F448 ] TID: 1772

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x826AE770 ] TID: 1776

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x8232FDA8 ] TID: 1780

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x82414830 ] TID: 1784

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x82397740 ] TID: 1788

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x826B0778 ] TID: 1792

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822FEBC8 ] TID: 1796

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822FE950 ] TID: 1800

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822FE6D8 ] TID: 1804

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822FE460 ] TID: 1808, 7929971 bytes

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822F8DA8 ] TID: 1812

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822F8B30 ] TID: 1816

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822F84F8 ] TID: 1820

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x822F8280 ] TID: 1824

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x82331020 ] TID: 1828

0x80559480 Faked ServiceTable-->IGDCTRL.EXE [ ETHREAD 0x8245B560 ] TID: 1836

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x821CD020 ] TID: 1856

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x821CC648 ] TID: 1860, 5767237 bytes

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x826B0B38 ] TID: 1868

0x80559480 Faked ServiceTable-->mDNSResponder.exe [ ETHREAD 0x822F56D8 ] TID: 1884

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x82331630 ] TID: 1896

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821D57A8 ] TID: 1900

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821D6770 ] TID: 1908

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82330DA8 ] TID: 1920

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x822F4020 ] TID: 1924

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82330B30 ] TID: 1932

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x822F2A20 ] TID: 1940

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x827CCDA8 ] TID: 1980

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x821CCBE8 ] TID: 1984

0x80559480 Faked ServiceTable-->mDNSResponder.exe [ ETHREAD 0x822E1DA8 ] TID: 2000

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x8227D9B0 ] TID: 2008

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x8219F9F0 ] TID: 2016

0x80559480 Faked ServiceTable-->AppleMobileDeviceService.exe [ ETHREAD 0x822E8498 ] TID: 2040

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821CBDA8 ] TID: 2072, 2097184 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82279DA8 ] TID: 2092

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821BF850 ] TID: 2096

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8294DDA8 ] TID: 2108

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821B5020 ] TID: 2124

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x82272B30 ] TID: 2128

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8296EDA8 ] TID: 2208

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x828BD5B8 ] TID: 2212

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8221DDA8 ] TID: 2228, 7143534 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821AE848 ] TID: 2232

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821D2DA8 ] TID: 2256

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82275A40 ] TID: 2260

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x8233D978 ] TID: 2264

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x822A7368 ] TID: 2268

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x821D4DA8 ] TID: 2272

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x821C0378 ] TID: 2288

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x821D3578 ] TID: 2308, 6094911 bytes

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x82509B28 ] TID: 2312

0x80559480 Faked ServiceTable-->spoolsv.exe [ ETHREAD 0x82282268 ] TID: 2316

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x82088680 ] TID: 2340

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x820EFDA8 ] TID: 2344

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82335020 ] TID: 2352

0x80559480 Faked ServiceTable-->DkService.exe [ ETHREAD 0x8250ADA8 ] TID: 2360

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x82307838 ] TID: 2364

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x821C1828 ] TID: 2372, 5767237 bytes

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x821E3DA8 ] TID: 2376

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8204BDA8 ] TID: 2392

0x80559480 Faked ServiceTable-->avgnt.exe [ ETHREAD 0x82180790 ] TID: 2444

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8219AB30 ] TID: 2452

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8205C8F0 ] TID: 2472

0x80559480 Faked ServiceTable-->winlogon.exe [ ETHREAD 0x82283DA8 ] TID: 2504

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x828F9628 ] TID: 2544

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8209FAF0 ] TID: 2552

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x823987F8 ] TID: 2556

0x80559480 Faked ServiceTable-->explorer.exe [ ETHREAD 0x822F7098 ] TID: 2568

0x80559480 Faked ServiceTable-->explorer.exe [ ETHREAD 0x823364B0 ] TID: 2596

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x8230C598 ] TID: 2604

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x823A6020 ] TID: 2608

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x82256BC8 ] TID: 2616

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x822FCA50 ] TID: 2620

0x80559480 Faked ServiceTable-->explorer.exe [ ETHREAD 0x820A2918 ] TID: 2624, 6094963 bytes

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x8230CCD8 ] TID: 2628

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x821FF9C0 ] TID: 2632

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x823A5448 ] TID: 2636

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x823A3848 ] TID: 2640

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x822FB690 ] TID: 2644

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x823A64C8 ] TID: 2648

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x828F9DA8 ] TID: 2652

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x822D47A0 ] TID: 2656, 3407926 bytes

0x80559480 Faked ServiceTable-->explorer.exe [ ETHREAD 0x822E6020 ] TID: 2660

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x822DFDA8 ] TID: 2668

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x821F9DA8 ] TID: 2672

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x822FBDA8 ] TID: 2684

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x828BD830 ] TID: 2688

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x823A5DA8 ] TID: 2700

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x8233A9E8 ] TID: 2704

0x80559480 Faked ServiceTable-->avguard.exe [ ETHREAD 0x823A69E8 ] TID: 2708, 5439577 bytes

0x80559480 Faked ServiceTable-->sched.exe [ ETHREAD 0x822DD020 ] TID: 2716

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823B7358 ] TID: 2740

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823B63E8 ] TID: 2744

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82337300 ] TID: 2788

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8239FBC8 ] TID: 2796

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82051020 ] TID: 2844, 7929939 bytes

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x822DBDA8 ] TID: 2884

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8296E948 ] TID: 2896

0x80559480 Faked ServiceTable-->services.exe [ ETHREAD 0x82063778 ] TID: 2900

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8238F298 ] TID: 2932

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82376808 ] TID: 2940

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821AC3A8 ] TID: 2944

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82332BC8 ] TID: 2948

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823D15A8 ] TID: 2952

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823763B0 ] TID: 2956

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82332950 ] TID: 2960

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821C2DA8 ] TID: 2964

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823D23D0 ] TID: 2968

0x80559480 Faked ServiceTable-->csrss.exe [ ETHREAD 0x823B67B0 ] TID: 2984

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823B4020 ] TID: 3000

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8295DBD0 ] TID: 3024

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82376DA8 ] TID: 3040

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x822DDDA8 ] TID: 3044

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82951020 ] TID: 3048

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823CC4C8 ] TID: 3064

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x823C7648 ] TID: 3072

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8296ADA8 ] TID: 3164

0x80559480 Faked ServiceTable-->jqs.exe [ ETHREAD 0x82058480 ] TID: 3188

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x821D2600 ] TID: 3252

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821EB520 ] TID: 3348

0x80559480 Faked ServiceTable-->explorer.exe [ ETHREAD 0x82355BC8 ] TID: 3448

0x80559480 Faked ServiceTable-->vsmon.exe [ ETHREAD 0x8217A640 ] TID: 3452

0x80559480 Faked ServiceTable-->alg.exe [ ETHREAD 0x82373BD0 ] TID: 3476

0x80559480 Faked ServiceTable-->alg.exe [ ETHREAD 0x8238ADA8 ] TID: 3480

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x821A1668 ] TID: 3492

0x80559480 Faked ServiceTable-->alg.exe [ ETHREAD 0x823A0658 ] TID: 3496

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8219D778 ] TID: 3568

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8236ADA8 ] TID: 3572

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8235F488 ] TID: 3576

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82960B30 ] TID: 3596

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x824AE5E0 ] TID: 3644

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82363590 ] TID: 3756

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x829525F0 ] TID: 3896

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82359360 ] TID: 3944

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x82353B30 ] TID: 3960

0x80559480 Faked ServiceTable-->lsass.exe [ ETHREAD 0x826B5DA8 ] TID: 4016

0x80559480 Faked ServiceTable-->svchost.exe [ ETHREAD 0x8237F550 ] TID: 4060

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x8212D270 ] TID: 4088

0x80559480 Faked ServiceTable-->firefox.exe [ ETHREAD 0x821BEDA8 ] TID: 4092

WARNING: Virus alike driver modification [pfc.sys]

WARNING: Virus alike driver modification [irenum.sys]

WARNING: Virus alike driver modification [imagedrv.sys]

WARNING: Virus alike driver modification [tdpipe.sys]

WARNING: Virus alike driver modification [fltMgr.sys]

WARNING: Virus alike driver modification [imagesrv.sys]

WARNING: Virus alike driver modification [rdpwd.sys]

WARNING: Virus alike driver modification [avmunet.sys]

WARNING: Virus alike driver modification [ccdecode.sys]

WARNING: Virus alike driver modification [wstcodec.sys]

WARNING: Virus alike driver modification [rdpdr.sys]

WARNING: Virus alike driver modification [SilvrLnk.sys]

WARNING: Virus alike driver modification [tdtcp.sys]

WARNING: Virus alike driver modification [Aadev.sys]

WARNING: Virus alike driver modification [NETFWDSL.SYS]

WARNING: Virus alike driver modification [wpdusb.sys]

WARNING: Virus alike driver modification [termdd.sys]

WARNING: Virus alike driver modification [sisagp.sys]

WARNING: Virus alike driver modification [viaagp.sys]

WARNING: Virus alike driver modification [alim1541.sys]

WARNING: Virus alike driver modification [amdagp.sys]

WARNING: Virus alike driver modification [PxHelp20.sys]

WARNING: Virus alike driver modification [uagp35.sys]

WARNING: Virus alike driver modification [agpcpq.sys]

WARNING: Virus alike driver modification [gagp30kx.sys]

WARNING: Virus alike driver modification [sfhlp01.sys]

WARNING: Virus alike driver modification [sfdrv01.sys]

WARNING: Virus alike driver modification [msdv.sys]

WARNING: Virus alike driver modification [DMusic.sys]

WARNING: Virus alike driver modification [SSHDRV76.sys]

WARNING: Virus alike driver modification [mstee.sys]

WARNING: Virus alike driver modification [redbook.sys]

WARNING: Virus alike driver modification [sfvfs02.sys]

WARNING: Virus alike driver modification [splitter.sys]

WARNING: Virus alike driver modification [prohlp02.sys]

WARNING: Virus alike driver modification [sfhlp02.sys]

WARNING: Virus alike driver modification [el90xbc5.sys]

WARNING: Virus alike driver modification [prosync1.sys]

WARNING: Virus alike driver modification [StMp3Rec.sys]

WARNING: Virus alike driver modification [sr.sys]

WARNING: Virus alike driver modification [WudfPf.sys]

WARNING: Virus alike driver modification [WudfRd.sys]

WARNING: Virus alike driver modification [nabtsfec.sys]

WARNING: Virus alike driver modification [cdr4_xp.sys]

WARNING: Virus alike driver modification [cdralw2k.sys]

WARNING: Virus alike driver modification [ac97intc.sys]

AVZ Antiviral Toolkit ist ein russisches Projekt, welches auch in englisch verfügbar ist. Das Programm prüft auf Viren, Adware, Spyware, Dialer, verdächtige Software (Risktools), Hacktools und Rootkits. AVZ ist ein sehr mächtiges Tool, bitte nichts "auf eigene Faust" machen.

Lege Dir nun auf der Festplatte C: den Ordner AVZ an.
Bitte lade AVZ4 ( by oleg ) herunter und speichere es unter C:\AVZ.

Öffne den Ordner avz4 und benenne die avz.exe in iwas.com um.
Doppelklick auf die iwas.com um das Tool zu starten.
Wähle Links oben File und hier Database- Update. Danach drücke den Start Button.
Nachdem das Update erfolgreich durchgeführt wurde wähle erneut File aus und gehe auf Standard Skripts.
Note: Sollte AVZ sich nicht updaten lassen, poste mir die erstellte Fehlermeldung. Fahre aber bitte mit den nächsten Schritte normal fort.
Setze ein Häckchen bei 3. Advanced System Analysis with malware removal enabled..
Klicke nun den Button Execute selected scripts.

Daraufhin wird die Log-Datei virusinfo_syscure.zip im Unterverzeichnis C:\AVZ\LOG gespeichert.

Starte den Rechner neu auf

Starte AVZ erneut durch Klick auf die iwas.com.
Danach wähle im Menü File Standard Skripts.
Setze nun ein Häkchen bei 2. Advanced System Analysis.

Es wird eine virusinfo_syscheck.zip Datei im Unterverzeichnis C:\AVZ\LOG gespeichert.

Starte den Rechner erneut neu auf

Hänge nun folgende Dateien hier an.
virusinfo_syscheck.zip
virusinfo_syscure.zip

Hier findest Du eine bebilderte Anleitung für AVZ.
Wie hänge ich Dateien an?

Den Neustart nach

Zitat:

3. Advanced System Analysis with malware removal enabled..

musste ich wiederholen. Programme ließen sich nicht starten und im TaskManager wurde der 'Benutzername' der Prozesse nicht angezeigt. Es is also irgendein wichtiger Dienst nicht gestartet.
Jetzt funktioniert aber scheinbar alles normal.
Logs angehängt.

Hast Du denn noch irgendwelche Probleme?

=D Nein, nicht das ich wüsste. Ich musste ein bis zwei Benachrichtigungseinstellungen von Windows wieder ändern. Aber jetzt scheint alles wie vorher. Wenn was auftaucht schrei ich.
Danke für deine Hilfe. ;)
MfG T_M

Wir sind noch nicht durch :)
Hier noch die letzten paar Schritte zur Säuberung Deines Rechners.

Schritt 1

Temp File Cleaner

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Schritt 2

Systemwiederherstellung mit OTL leeren

Lade Dir (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop.

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:Commands

[CLEARALLRESTOREPOINTS]

[emptytemp]

[reboot]

und füge es hier ein:
http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klicke auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart wird Dein Editor mit einem Textdokument geöffnet.
Kopiere den Inhalt hier in Code-Tags in Deinen Thread.

Schritt 3

Tool CleanUp

Starte bitte die OTL.exe.
Klicke nun auf den Bereinigung Button. Dies wird die meisten Tools und Logfiles entfernen.
Sollte denoch etwas bestehen bleiben, bitte manuell entfernen sowie den Papierkorb leeren.

Schritt 4

Automatische Updates

Sehen wir nach ob die Updates für Windows sich automatisch downloaden. Das ist der beste Weg um all die Sicherheits- Patches und Fixes zu erhalten.

Windows + R Taste drücken. Kopiere nun folgenden Text in die Kommandozeile

RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

und klicke auf OK.
Stelle sicher das die automatischen Updates aktiviert sind.

Du hast Das SP3 nich von XP. Es wird dir dicherlich angeboten. Dann installiere es UNBEDINGT!

Schritt 5

Um Dich für die Zukunft vor weiteren Infizierungen zu schützen empfehle ich Dir noch ein paar Programme.

SpywareBlaster
Ein Tutorial zur Verwendung findest Du Hier
MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
Hinweis: MBAM ersetzt keine Anti- Viren- Software.
Temp File Cleaner
TFC ist ein wirklich starkes Tool zum entfernen von Temp Dateien vom IE und WIndows, leert den Papierkorb und noch viel mehr.
Ausserdem hilft es Deinen Computer zu beschleunigen.
Du kannst Dir TFC ( by OldTimer ) hier downloaden.
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
Halte Dein System aktuell
Ich kann gar nicht oft genug betonen, wie wichtig es ist, dass der PC auf dem aktuellsten Stand der Dinge ist.
Es werden oft genug Sicherheitslücken in Windows eigenen Anwendungen gefunden. Diese "Löcher" gehören entfernt, weil Angreifer diese womöglich nutzen um unauthorisiert auf Dein System zu zugreifen.
Jeden zweiten Dienstag im Monat ist Update Tag. Besuche bitte dazu die Microsoft Update Seite.
Halte Deine Software aktuell
Der einfachste Weg dafür ist der Secunia Online Software.

Schritt 6

Tipps für sicheres Surfen

Das sind meine Vorschläge.
Verwende einen alternativen Browser statt den IE.
Ich empfehle Mozilla Firefox.

Für Firefox gibt es verschiedenste AddOns um sicher durch das WWW zu kommen.

NoScript
Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
AdblockPlus
Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
Es spart ausserdem Downloadkapazität.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

OTL Log:

Code:

All processes killed

========== COMMANDS ==========

Unable to start service SRService!

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Gast

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: xy

->Temp folder emptied: 401 bytes

->Temporary Internet Files folder emptied: 32902 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 13871734 bytes

->Flash cache emptied: 566 bytes

 

User: Home

 

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Xx

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 921 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 13,00 mb

 

 

OTL by OldTimer - Version 3.2.14.1 log created on 10052010_174039
 

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\ZLT06438.TMP not found!

File\Folder C:\WINDOWS\temp\ZLT07dc9.TMP not found!
 

Registry entries deleted on Reboot...

Joaa, alles wunderbar. Läuft alles ein bisschen flüssiger und keine Probleme mehr. Das flüssiger laufen kann aber auch beeinflusste Warnehmung sein, wegen der Erfolge =D
Nochma schönen Dank, einige angebotene Programme und ähnliches gefallen mir sehr gut :)

MfG T_M.