Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" (https://www.trojaner-board.de/91831-norton-meldet-zwischenfall-http-malicious-toolkit-variant-activity-13-a.html)

Swisstreasure 25.10.2010 20:36
Erneuter CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Maikeost 26.10.2010 10:32
OTL Logfile:
Code:
OTL logfile created on: 26.10.2010 11:08:36 - Run 2
OTL by OldTimer - Version 3.2.15.2    Folder = C:\Users\Maike\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 68,90 Gb Free Space | 46,23% Space Free | Partition Type: NTFS
Drive D: | 137,33 Gb Total Space | 136,16 Gb Free Space | 99,15% Space Free | Partition Type: NTFS
Drive F: | 149,04 Gb Total Space | 148,83 Gb Free Space | 99,86% Space Free | Partition Type: NTFS
Drive G: | 149,04 Gb Total Space | 148,95 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: MAIKESPC | User Name: Maike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days
 
========== Processes (SafeList) ==========
 
PRC - [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
PRC - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.02.26 02:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe
PRC - [2009.08.04 03:29:47 | 000,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe
PRC - [2009.05.06 08:54:13 | 007,440,928 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.04 19:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
PRC - [2009.02.21 06:08:12 | 000,211,512 | ---- | M] (ATK) -- C:\Program files\P4G\BatteryLife.exe
PRC - [2008.12.30 01:32:54 | 000,237,693 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe
PRC - [2008.12.29 12:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe
PRC - [2008.12.10 00:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008.10.01 08:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
PRC - [2008.08.19 19:34:04 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe
PRC - [2008.08.18 19:56:22 | 000,098,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
PRC - [2008.07.19 04:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2008.04.01 08:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe
PRC - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
PRC - [2005.07.07 00:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
MOD - [2010.09.20 21:26:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\ASOEHOOK.DLL
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2009.07.12 10:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\Microsoft.VC90.CRT\MSVCR90.dll
MOD - [2009.07.12 10:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\Microsoft.VC90.CRT\MSVCP90.dll
MOD - [2008.01.21 04:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.26 02:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe -- (NIS)
SRV - [2009.12.04 11:23:14 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009.08.04 03:03:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2009.08.04 03:03:05 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2008.12.29 12:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2008.12.08 17:01:58 | 000,533,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipswuio.sys -- (ipswuio)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Combo-Fix\catchme.sys -- (catchme)
DRV - [2010.10.19 22:36:22 | 000,353,840 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101025.001\IDSvix86.sys -- (IDSVix86)
DRV - [2010.09.29 17:32:22 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101025.021\NAVEX15.SYS -- (NAVEX15)
DRV - [2010.09.29 17:32:21 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101025.021\NAVENG.SYS -- (NAVENG)
DRV - [2010.09.01 00:57:04 | 000,692,272 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010.05.27 07:52:53 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010.05.27 07:52:52 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.05.06 06:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010.04.29 07:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS -- (SymIRON)
DRV - [2010.04.22 05:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS -- (SymEFA)
DRV - [2010.04.22 04:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS -- (SRTSP)
DRV - [2010.04.22 04:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010.02.26 02:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys -- (ccHP)
DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2009.12.30 15:58:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.12.30 15:58:16 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.11.14 17:11:08 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009.11.06 00:06:13 | 000,328,752 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS -- (SymDS)
DRV - [2009.07.02 01:59:00 | 009,786,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.05.04 11:25:55 | 002,365,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009.02.11 11:11:49 | 000,329,752 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008.12.08 17:01:52 | 000,055,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2008.08.11 04:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.08.07 02:26:07 | 000,124,928 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.07.29 00:53:46 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.07.10 03:16:21 | 000,081,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2008.06.25 00:55:12 | 000,047,104 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008.06.03 08:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008.05.14 07:02:25 | 000,017,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2008.05.14 07:02:23 | 000,100,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2008.01.29 20:46:57 | 000,029,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwl2cap.sys -- (btwl2cap)
DRV - [2008.01.21 04:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008.01.21 04:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008.01.21 04:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008.01.21 04:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008.01.21 04:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008.01.21 04:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008.01.21 04:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008.01.21 04:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008.01.21 04:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008.01.21 04:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008.01.21 04:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008.01.21 04:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008.01.21 04:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008.01.21 04:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008.01.21 04:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008.01.21 04:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008.01.21 04:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008.01.21 04:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008.01.21 04:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008.01.21 04:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007.12.19 02:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2007.12.06 12:12:47 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2007.08.11 05:19:26 | 000,029,752 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm)
DRV - [2007.08.03 22:26:22 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2007.07.30 20:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.07.30 19:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007.07.24 20:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006.12.14 09:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006.11.02 09:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006.11.02 09:30:56 | 000,194,048 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.29
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.2
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:3.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.5
FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009050101
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.10.02 13:25:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010.05.26 07:24:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010.01.27 10:36:29 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.21 18:14:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.21 18:14:22 | 000,000,000 | ---D | M]
 
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Extensions
[2010.10.25 16:46:44 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions
[2010.09.27 18:03:03 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.07.26 20:31:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.13 15:16:48 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\finder@meingutscheincode.de
[2010.03.24 16:13:02 | 000,000,917 | ---- | M] () -- C:\Users\Maike\AppData\Roaming\Mozilla\FireFox\Profiles\n98g2py1.default\searchplugins\conduit.xml
[2010.10.02 15:26:08 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009.08.23 08:50:01 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Program Files\mozilla firefox\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2009.09.08 12:52:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2009.08.23 08:50:06 | 000,000,000 | ---D | M] (Session Manager) -- C:\Program Files\mozilla firefox\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2009.08.23 08:50:07 | 000,000,000 | ---D | M] (Site Launcher) -- C:\Program Files\mozilla firefox\extensions\{20291fcc-1471-46c8-8213-5911f5ce6d67}
[2009.09.08 12:52:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2009.08.23 08:50:04 | 000,000,000 | ---D | M] (Minimap Addon) -- C:\Program Files\mozilla firefox\extensions\{398e77b8-2304-11dc-8314-0800200c9a66}
[2010.04.26 08:12:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.08.23 08:50:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2009.08.23 08:49:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2009.08.23 08:50:01 | 000,000,000 | ---D | M] (FoxTab) -- C:\Program Files\mozilla firefox\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2009.08.23 08:50:02 | 000,000,000 | ---D | M] (GooglePreview) -- C:\Program Files\mozilla firefox\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
[2009.09.08 12:52:22 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\autopager@mozilla.org
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de
[2009.08.23 08:50:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\CompactMenuCE@Merci.chao
[2009.08.23 08:50:03 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\lazarus@interclue.com
[2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de
[2009.09.08 12:52:23 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\printpdf@pavlov.net
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\chrome
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\defaults
[2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\chrome
[2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\defaults
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009.11.13 17:39:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2009.11.13 17:39:34 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2009.11.13 17:39:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2009.11.13 17:39:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2009.11.13 17:39:34 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.10.25 18:16:53 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG
O24 - Desktop BackupWallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.10.25 18:24:13 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.10.25 18:24:13 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\temp
[2010.10.25 18:16:59 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2010.10.25 17:53:33 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.10.25 17:53:33 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.10.25 17:53:33 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.10.25 17:53:21 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.10.25 17:51:31 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.10.25 17:50:59 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.10.21 17:02:59 | 000,962,560 | ---- | C] (East Wind Software) -- C:\Windows\System32\advdaudio.ocx
[2010.10.21 17:02:58 | 000,634,880 | ---- | C] (Online Media Technologies Ltd.) -- C:\Windows\System32\NCTAudioEditor2.dll
[2010.10.21 17:02:57 | 000,522,752 | ---- | C] (Online Media Technologies Ltd.) -- C:\Windows\System32\NCTAudioTransform2.dll
[2010.10.21 17:02:57 | 000,467,968 | ---- | C] (Online Media Technologies Ltd.) -- C:\Windows\System32\NCTAudioRecord2.dll
[2010.10.21 17:02:56 | 000,966,144 | ---- | C] (Online Media Technologies Ltd.) -- C:\Windows\System32\NCTAudioInformation2.dll
[2010.10.21 17:02:56 | 000,467,456 | ---- | C] (Online Media Technologies Ltd.) -- C:\Windows\System32\NCTAudioPlayer2.dll
[2010.10.21 17:02:55 | 000,877,568 | ---- | C] (NCT Company Ltd.) -- C:\Windows\System32\NCTAudioFile2.dll
[2010.10.21 17:02:54 | 000,413,696 | ---- | C] (Gabest) -- C:\Windows\System32\flvsplitter.ax
[2010.10.21 17:02:53 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\concept design
[2010.10.18 16:48:05 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\strickanleitungen
[2010.10.18 12:24:13 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.10.18 11:59:47 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Maike\Desktop\TFC.exe
[2010.10.17 13:32:29 | 000,000,000 | -HSD | C] -- C:\ProgramData\System Restore
[2010.10.16 17:07:48 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010.10.16 16:50:31 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.10.15 16:34:50 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
[2010.10.14 17:35:49 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Simply Super Software
[2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2010.10.14 16:59:20 | 000,000,000 | ---D | C] -- C:\Users\Maike\Logs
[2010.10.14 16:41:45 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2010.10.14 15:13:49 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\SUPERAntiSpyware.com
[2010.10.14 15:13:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010.10.14 15:13:40 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010.10.13 21:57:14 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\Audible
[2010.10.13 21:57:13 | 000,000,000 | ---D | C] -- C:\Program Files\Audible
[2010.10.13 20:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.10.13 20:35:29 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.10.13 20:33:19 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.10.13 15:19:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer
[2010.10.13 15:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\vokabeltrainer
[2010.10.13 15:16:57 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2010.10.04 18:09:49 | 000,000,000 | ---D | C] -- C:\Program Files\Joomla
[2010.09.28 16:19:25 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\FireShot
[2010.09.04 14:40:31 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\mirko
[2010.09.02 17:55:39 | 000,000,000 | ---D | C] -- C:\Users\Maike\Phone Browser
[2010.09.02 17:14:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Apple Computer
[2010.09.02 17:14:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\Apple Computer
[2010.09.02 17:13:13 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.09.02 17:12:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010.09.02 17:12:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\Apple
[2010.09.02 17:11:57 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010.09.02 17:10:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2010.09.02 17:10:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010.08.30 14:32:45 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\gitarre_lehre
[2010.08.12 14:36:46 | 000,000,000 | ---D | C] -- C:\Users\Maike\chords
[2010.08.08 13:20:01 | 000,000,000 | ---D | C] -- C:\Program Files\Ankh
[2010.08.08 13:15:17 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Ankh
[2010.04.02 13:40:25 | 000,454,656 | ---- | C] (Simon Tatham) -- C:\Program Files\putty06.exe
[2008.06.03 08:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
 
========== Files - Modified Within 90 Days ==========
 
[2010.10.26 11:12:09 | 002,162,502 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1108000.005\Cat.DB
[2010.10.26 10:55:49 | 000,633,580 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.10.26 10:55:49 | 000,600,138 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.10.26 10:55:49 | 000,128,990 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.10.26 10:55:49 | 000,106,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.10.26 10:40:24 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.26 10:40:24 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.26 08:41:41 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.10.26 08:41:40 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.10.26 08:40:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.26 08:40:18 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys
[2010.10.25 22:16:10 | 000,079,872 | ---- | M] () -- C:\Windows\MBR.exe
[2010.10.25 18:48:54 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.10.25 18:16:53 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010.10.25 17:49:36 | 003,886,177 | R--- | M] () -- C:\Users\Maike\Desktop\Combo-Fix.exe
[2010.10.22 11:56:09 | 000,009,728 | ---- | M] () -- C:\Users\Maike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.20 12:38:11 | 000,133,632 | ---- | M] () -- C:\Users\Maike\Desktop\RKUnhookerLE.EXE
[2010.10.18 12:00:32 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\TFC.exe
[2010.10.16 17:07:12 | 002,672,312 | ---- | M] () -- C:\Users\Maike\Desktop\esetsmartinstaller_enu.exe
[2010.10.15 17:11:38 | 000,293,376 | ---- | M] () -- C:\Users\Maike\Desktop\9gni6flu.exe
[2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
[2010.10.14 15:13:45 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.10.14 14:42:53 | 001,750,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.10.13 20:36:48 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.13 15:18:54 | 000,000,834 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2010.10.02 15:39:41 | 000,000,600 | ---- | M] () -- C:\Users\Maike\AppData\Local\PUTTY.RND
[2010.09.20 23:52:57 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1108000.005\isolate.ini
[2010.09.17 12:04:09 | 000,014,931 | ---- | M] () -- C:\Users\Maike\Documents\finnland.xlsx
[2010.09.02 18:04:11 | 000,000,019 | ---- | M] () -- C:\Windows\SoundConverter.INI
[2010.08.30 09:37:05 | 002,329,923 | R--- | M] () -- C:\Users\Maike\Documents\TS_Preise_Fahrplaene_2010.pdf
 
========== Files Created - No Company Name ==========
 
[2010.10.25 17:53:33 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.10.25 17:53:33 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.10.25 17:53:33 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.10.25 17:53:33 | 000,079,872 | ---- | C] () -- C:\Windows\MBR.exe
[2010.10.25 17:53:33 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.10.25 17:46:52 | 003,886,177 | R--- | C] () -- C:\Users\Maike\Desktop\Combo-Fix.exe
[2010.10.21 17:02:59 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll
[2010.10.21 17:02:59 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll
[2010.10.21 17:02:55 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.10.20 12:37:39 | 000,133,632 | ---- | C] () -- C:\Users\Maike\Desktop\RKUnhookerLE.EXE
[2010.10.16 17:06:05 | 002,672,312 | ---- | C] () -- C:\Users\Maike\Desktop\esetsmartinstaller_enu.exe
[2010.10.15 17:10:49 | 000,293,376 | ---- | C] () -- C:\Users\Maike\Desktop\9gni6flu.exe
[2010.10.14 17:28:38 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2010.10.14 17:28:38 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2010.10.14 17:28:38 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2010.10.14 17:28:37 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2010.10.14 15:13:45 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.10.13 20:36:48 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.13 15:18:54 | 000,000,834 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2010.09.02 18:04:11 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI
[2010.08.30 09:37:05 | 002,329,923 | R--- | C] () -- C:\Users\Maike\Documents\TS_Preise_Fahrplaene_2010.pdf
[2010.08.30 09:35:42 | 000,014,931 | ---- | C] () -- C:\Users\Maike\Documents\finnland.xlsx
[2010.05.31 16:01:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.05.18 13:31:29 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2010.05.01 13:59:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.04.29 20:39:38 | 000,000,680 | ---- | C] () -- C:\Users\Maike\AppData\Local\d3d9caps.dat
[2010.04.26 08:25:00 | 000,000,600 | ---- | C] () -- C:\Users\Maike\AppData\Local\PUTTY.RND
[2010.01.14 14:04:26 | 000,004,096 | -H-- | C] () -- C:\Users\Maike\AppData\Local\keyfile3.drm
[2009.12.30 15:58:16 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.12.30 15:58:16 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.11.06 17:28:02 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2009.10.31 12:05:11 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.10.27 21:13:20 | 000,009,728 | ---- | C] () -- C:\Users\Maike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.02 13:17:58 | 000,001,161 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.09.12 12:40:31 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.09.12 10:58:15 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.09.01 10:39:04 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.08.30 15:32:19 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.19 20:00:02 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.08.04 03:03:20 | 000,004,352 | ---- | C] () -- C:\Windows\System32\cfgfx.ini
[2009.08.04 03:03:20 | 000,000,735 | ---- | C] () -- C:\Windows\FF05_Render_Spk_Hp.ini
[2009.08.04 03:03:20 | 000,000,508 | ---- | C] () -- C:\Windows\FF05_not_Spk_Hp.ini
[2009.08.04 03:02:21 | 000,148,480 | ---- | C] () -- C:\Windows\System32\APOMngr.DLL
[2009.08.04 03:02:21 | 000,073,728 | ---- | C] () -- C:\Windows\System32\CmdRtr.DLL
[2008.08.11 04:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.07.30 02:33:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\BtwNamespaceExt2.dll
[2008.05.12 05:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.04.16 12:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.03.09 03:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2003.02.20 15:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2001.11.14 22:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2010.08.08 13:15:17 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ankh
[2010.05.18 13:04:22 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Atari
[2010.10.21 17:12:13 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\concept design
[2010.09.29 17:55:38 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FileZilla
[2010.09.28 16:19:25 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FireShot
[2010.10.14 17:28:31 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Simply Super Software
[2010.04.22 16:08:11 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SmartDraw
[2010.03.16 20:18:23 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SparweltGutschein
[2010.04.07 18:30:51 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Tific
[2009.12.30 16:02:02 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ubisoft
[2010.10.25 18:48:54 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2010.05.18 13:32:43 | 000,453,006 | ---- | M] () -- C:\AnalysisLog.sr0
[2009.03.12 04:11:47 | 000,000,023 | ---- | M] () -- C:\app3.LOG
[2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008.04.16 13:27:17 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2007.04.04 21:01:54 | 000,000,019 | ---- | M] () -- C:\CA21.txt
[2010.10.25 18:24:09 | 000,018,235 | ---- | M] () -- C:\ComboFix.txt
[2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010.07.21 12:34:25 | 000,286,720 | ---- | M] () -- C:\Debug.txt
[2009.08.04 03:45:04 | 000,019,994 | ---- | M] () -- C:\devlist.txt
[2009.06.23 08:28:11 | 000,000,027 | ---- | M] () -- C:\Driver.20
[2009.08.03 13:48:21 | 000,000,769 | ---- | M] () -- C:\faclog.txt
[2009.08.04 03:41:42 | 000,000,009 | ---- | M] () -- C:\Finish.log
[2009.06.07 17:31:15 | 000,000,021 | ---- | M] () -- C:\Fix.log
[2009.05.27 08:02:07 | 001,048,576 | RH-- | M] () -- C:\G60VxAS.BIN
[2010.10.26 08:40:18 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys
[2009.08.04 03:37:50 | 001,546,580 | ---- | M] () -- C:\if.log
[2009.08.04 02:27:34 | 000,000,481 | ---- | M] () -- C:\igoogle_log.txt
[2009.08.04 02:58:55 | 022,216,704 | ---- | M] () -- C:\inject.log
[2009.08.04 02:58:55 | 019,533,351 | ---- | M] () -- C:\inject.log.txt
[2010.06.14 12:11:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010.06.14 12:11:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008.08.08 09:22:19 | 000,000,030 | ---- | M] () -- C:\NERO.LOG
[2009.01.07 11:16:08 | 000,000,030 | ---- | M] () -- C:\NIS2009.TXT
[2007.03.16 01:18:45 | 000,000,025 | ---- | M] () -- C:\OFFICE2007_A.TXT
[2010.10.26 08:40:17 | 3533,873,152 | -HS- | M] () -- C:\pagefile.sys
[2009.08.03 14:34:44 | 000,000,146 | ---- | M] () -- C:\Pass.txt
[2009.06.19 14:10:05 | 000,003,502 | ---- | M] () -- C:\Patch.LOG
[2009.01.15 10:13:21 | 000,000,017 | ---- | M] () -- C:\READER_A.TXT
[2009.03.31 05:04:29 | 000,000,022 | ---- | M] () -- C:\RECOVERY.DAT
[2009.08.04 03:02:22 | 000,001,783 | ---- | M] () -- C:\RHDSetup.log
[2010.07.21 12:36:42 | 000,000,166 | ---- | M] () -- C:\setup.log
[2006.05.14 18:22:24 | 000,000,005 | ---- | M] () -- C:\store.log
[2009.08.04 02:17:16 | 000,000,170 | ---- | M] () -- C:\SumHidd.txt
[2009.08.04 02:16:22 | 000,000,098 | ---- | M] () -- C:\SumOS.txt
[2010.07.01 15:27:15 | 000,002,433 | ---- | M] () -- C:\test.spr
[2009.06.02 13:11:40 | 000,000,024 | ---- | M] () -- C:\v55.txt
[2009.02.09 07:30:41 | 000,000,041 | ---- | M] () -- C:\WindowsLive_A.TXT
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009.08.30 15:38:25 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006.11.02 11:46:03 | 000,070,144 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNBPP3.DLL
[2008.10.28 12:49:30 | 000,321,536 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp696.dll
[2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007.04.09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2008.12.05 00:19:40 | 000,308,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2008.01.21 04:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
[2010.04.02 13:40:46 | 000,454,656 | ---- | M] (Simon Tatham) -- C:\Program Files\putty06.exe
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\user32.dll /md5 >
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.01.21 04:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2006.11.02 11:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll
 
 
< MD5 for: EXPLORER.EXE  >
[2009.08.04 02:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009.08.04 02:45:44 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009.08.04 02:45:44 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.08.04 02:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-13 20:58:23

< End of report >
--- --- ---


Das ist der einzige Log, der auf dem Desktop erstellt wurde.

Swisstreasure 26.10.2010 22:08
Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen
Code:
c:\windows\System32\AmbRunE.dll
Also gehe wie hier beschrieben vor:
  • Öffne diese Webseite: virustotal
  • Klicke auf "Durchsuchen"
  • Suche die Datei auf deinem Rechner--> Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
  • "Senden der Datei"
  • Warte, bis der Scandurchlauf aller Virenscanner beendet ist
  • Auf "Filter" klicken
  • dann auf "Ergebnisse"
  • das Ergebnis (wie Du es bekommst )
    komplett markieren und hier rein kopieren
Sollte die Datei als schädlich erkannt werden bitte noch nicht entfernen

Maikeost 31.10.2010 13:23
Es ergab keine Ergebnisse - konnte auch nirgendwo "Filter" anclicken, daher poste ich das ganze jetzt mal so:



Antivirus Version Last Update Result
AhnLab-V3 2010.10.31.00 2010.10.30 -
AntiVir 7.10.13.74 2010.10.29 -
Antiy-AVL 2.0.3.7 2010.10.31 -
Authentium 5.2.0.5 2010.10.31 -
Avast 4.8.1351.0 2010.10.31 -
Avast5 5.0.594.0 2010.10.31 -
AVG 9.0.0.851 2010.10.31 -
BitDefender 7.2 2010.10.31 -
CAT-QuickHeal 11.00 2010.10.26 -
ClamAV 0.96.2.0-git 2010.10.31 -
Comodo 6570 2010.10.31 -
DrWeb 5.0.2.03300 2010.10.30 -
Emsisoft 5.0.0.50 2010.10.31 -
eSafe 7.0.17.0 2010.10.28 -
eTrust-Vet 36.1.7943 2010.10.29 -
F-Prot 4.6.2.117 2010.10.30 -
F-Secure 9.0.16160.0 2010.10.31 -
Fortinet 4.2.249.0 2010.10.31 -
GData 21 2010.10.31 -
Ikarus T3.1.1.90.0 2010.10.31 -
Jiangmin 13.0.900 2010.10.31 -
K7AntiVirus 9.67.2865 2010.10.29 -
Kaspersky 7.0.0.125 2010.10.31 -
McAfee 5.400.0.1158 2010.10.31 -
McAfee-GW-Edition 2010.1C 2010.10.30 -
Microsoft 1.6301 2010.10.31 -
NOD32 5578 2010.10.31 -
Norman 6.06.10 2010.10.31 -
nProtect 2010-10-31.01 2010.10.31 -
Panda 10.0.2.7 2010.10.30 -
PCTools 7.0.3.5 2010.10.31 -
Prevx 3.0 2010.10.31 -
Rising 22.71.03.02 2010.10.29 -
Sophos 4.59.0 2010.10.31 -
Sunbelt 7177 2010.10.31 -
SUPERAntiSpyware 4.40.0.1006 2010.10.31 -
Symantec 20101.2.0.161 2010.10.31 -
TheHacker 6.7.0.1.074 2010.10.30 -
TrendMicro 9.120.0.1004 2010.10.31 -
TrendMicro-HouseCall 9.120.0.1004 2010.10.31 -
VBA32 3.12.14.1 2010.10.29 -
ViRobot 2010.10.30.4121 2010.10.31 -
VirusBuster 12.70.13.0 2010.10.30 -


Additional information
Show all
MD5 : 574c1fbc726c89faf309332e17d029cc
SHA1 : 72802109c051e09e063414192d9ebc092bb964df
SHA256: e0ebc26689d1271d4e950c8e69b06c3ab7c50fffa3b7d309474556c30bda629c
ssdeep: 384:Z4W7oTOY231pnM3d47Wg3z/Y4pWrENO29:foqh8dUhRF
File size : 14848 bytes
First seen: 2009-08-05 19:07:40
Last seen : 2010-10-31 12:18:13
TrID:
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
sigcheck:
publisher....: Creative Technology Ltd.
copyright....: Copyright (C) 2009
product......: AmbRun Endpoints Dynamic Link Library
description..: AmbRun Endpoints Dynamic Link Library
original name: AmbRunE.dll
internal name: AmbRunE
file version.: 1, 1, 2, 0
comments.....:
signers......: -
signing date.: -
verified.....: Unsigned
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x2D4E
timedatestamp....: 0x49A6156C (Thu Feb 26 04:07:08 2009)
machinetype......: 0x14c (I386)

[[ 4 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x29BA, 0x2A00, 6.35, c51062977604e7a9aab07df7c14d0154
.data, 0x4000, 0x3D0, 0x200, 0.28, 38a465ab13e516ac4d90e19854e125b5
.rsrc, 0x5000, 0x420, 0x600, 2.46, f2d712b54e70a35d899e65b3028ae430
.reloc, 0x6000, 0x34E, 0x400, 4.67, 653e1f6b0a1bed3fca7ad0db4e6ca429

[[ 6 import(s) ]]
msvcrt.dll: _adjust_fdiv, _amsg_exit, _except_handler4_common, _initterm, free, malloc, _XcptFilter, _vsnwprintf, __2@YAPAXI@Z, _purecall, _vsnprintf, __3@YAXPAX@Z
KERNEL32.dll: InterlockedExchange, Sleep, InterlockedCompareExchange, GetTickCount, CreateEventA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, InitializeCriticalSection, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, WaitForSingleObject, CloseHandle, SetEvent, CreateThread, QueryPerformanceCounter
USER32.dll: TranslateMessage, DispatchMessageA, GetMessageA
ADVAPI32.dll: RegCloseKey, RegQueryValueExW, RegOpenKeyExA, RegEnumKeyExA
ole32.dll: CoTaskMemAlloc, IIDFromString, PropVariantClear, CoTaskMemFree, CoInitialize, CoUninitialize, CoCreateInstance
SHELL32.dll: ShellExecuteW, SHGetFolderPathA

[[ 1 export(s) ]]
RunDLLEntry
ExifTool:
file metadata
CharacterSet: Unicode
CodeSize: 10752
Comments:
CompanyName: Creative Technology Ltd.
EntryPoint: 0x2d4e
FileDescription: AmbRun Endpoints Dynamic Link Library
FileFlagsMask: 0x0017
FileOS: Win32
FileSize: 14 kB
FileSubtype: 0
FileType: Win32 DLL
FileVersion: 1, 1, 2, 0
FileVersionNumber: 1.1.2.0
ImageVersion: 6.0
InitializedDataSize: 3584
InternalName: AmbRunE
LanguageCode: English (U.S.)
LegalCopyright: Copyright (C) 2009
LegalTrademarks:
LinkerVersion: 8.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 6.0
ObjectFileType: Dynamic link library
OriginalFilename: AmbRunE.dll
PEType: PE32
PrivateBuild:
ProductName: AmbRun Endpoints Dynamic Link Library
ProductVersion: 1, 1, 2, 0
ProductVersionNumber: 1.1.2.0
SpecialBuild:
Subsystem: Windows GUI
SubsystemVersion: 6.0
TimeStamp: 2009:02:26 05:07:08+01:00
UninitializedDataSize: 0

Swisstreasure 31.10.2010 21:18
Wie läufts zur Zeit?

Maikeost 02.11.2010 18:42
habe seit mehreren Tagen keine Meldungen von Norton mehr erhalten. Wollte dem Freiden aber erstmal nicht trauen, da vorher auch nur bei ca. jedem 2ten Mal die Meldung angezeigt wurde.

Wie gesagt seit ca. 4 Tagen keine Meldungen mehr. Meinst du, das ist ein gutes Zeichen? ;-)

Swisstreasure 02.11.2010 18:45
Ich würde sagen sehr gut. Beobachte es einmal einige Zeit. Und mach noch folgenden Scan. Ich bin diese Woche nicht mehr hier. Werde mich danach wieder melden.
  • Panda
  • Panda (ohne Registrierung)
    • Unterstützte Betriebssysteme: Windows 2000/XP (32- und 64-Bit)/Vista (32 und 64-Bit)
    • Voraussetzung: Internet Explorer 5.01 oder höher
    • Anmerkung für Vista-User: Bitte den Browser unbedingt als Administrator starten.
    • Du musst Dich registrieren - Newsletter abhaken!
    • Kompletter Scan anhaken und auf den grünen Button "Jetzt scannen" klicken.
      • Bei Nutzung über Mozilla Firefox:
      • ActiveScan 2.0 heruntergeladen.
      • ActiveScan 2.0 installieren.
      • Scan starten.
      • Bei Nutzung über Internet Explorer:
      • ActiveX-Steuerelemente erlauben.
      • ActiveX-Steuerelement installieren lassen,
      • die Signaturen werden heruntergeladen, ebenfalls installieren lassen.
      • Der Scan startet automatisch.
    • Am Ende des Scans die Funde über den Link "Anzeigen" einblenden lassen, kopieren und hier posten.
    • Das ist wichtig, denn Panda entfernt die Funde nur in der kostenpflichtigen Version.
    • Der Helfer vom Forum wird Dir helfen, die Funde zu entfernen.

    • http://www.hijackthis-forum.de/attac...5&d=1211975179
    • Im Fall von Problemen bitte zunächst die FAQ lesen.
    • Deinstallation:
    • Das Programm wird nach C:\Programme\PandaSecurity\ActiveScan 2.0 installiert.
    • Das Programm über Systemsteuerung => Software (Panda ActiveScan) deinstallieren.

Maikeost 05.12.2010 15:53
Hallo Swiss!
Nach einigen Wochen ohne erneuten Angriff hat mein Norton heute wieder etwas gemeldet:

ame des Risikos: HTTP Malicious Toolkit Variant Activity 13
Angreifender PC: MAIKESPC
Angreifer URL: bikleman.com/sex/index.php?s=IBB@G
Zieladresse: bikleman.com (62.157.140.133, 80)
Quelladresse: 192.168.2.106
Beschreibung des Datenverkehrs: TCP, Port 50629

Habe gerade meine ITunes geupdated. Meinst du, das könnte damit in Verbindung stehen?

Vielen Dank und viele Grüße
Maikeost

Swisstreasure 05.12.2010 21:23
Schritt 1

Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Maikeost 07.12.2010 11:32
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5260

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

07.12.2010 11:31:02
mbam-log-2010-12-07 (11-31-02).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 166246
Laufzeit: 7 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Maikeost 07.12.2010 11:56
OTL Logfile:
Code:
OTL logfile created on: 07.12.2010 11:34:54 - Run 3
OTL by OldTimer - Version 3.2.17.3    Folder = C:\Users\Maike\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 74,39 Gb Free Space | 49,91% Space Free | Partition Type: NTFS
Drive D: | 137,33 Gb Total Space | 136,11 Gb Free Space | 99,11% Space Free | Partition Type: NTFS
Drive F: | 149,04 Gb Total Space | 87,44 Gb Free Space | 58,67% Space Free | Partition Type: NTFS
Drive G: | 149,04 Gb Total Space | 148,95 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: MAIKESPC | User Name: Maike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2010.12.07 11:33:28 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
PRC - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.07.23 06:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
PRC - [2009.08.04 02:29:47 | 000,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe
PRC - [2009.05.06 07:54:13 | 007,440,928 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.04 18:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
PRC - [2009.02.21 05:08:12 | 000,211,512 | ---- | M] (ATK) -- C:\Program files\P4G\BatteryLife.exe
PRC - [2008.12.30 00:32:54 | 000,237,693 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe
PRC - [2008.12.29 11:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe
PRC - [2008.12.09 23:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008.10.01 07:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
PRC - [2008.08.19 18:34:04 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe
PRC - [2008.08.18 18:56:22 | 000,098,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
PRC - [2008.07.19 03:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2008.04.01 07:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
PRC - [2008.03.31 10:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2007.11.30 19:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe
PRC - [2007.08.03 11:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.12.07 11:33:28 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
MOD - [2010.08.31 16:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2010.08.17 04:39:11 | 000,413,552 | R--- | M] (Symantec Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\18.1.0.37\ASOEHOOK.DLL
MOD - [2009.07.12 08:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\18.1.0.37\Microsoft.VC90.CRT\MSVCR90.dll
MOD - [2009.07.12 08:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\18.1.0.37\Microsoft.VC90.CRT\MSVCP90.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.07.23 06:05:56 | 000,126,904 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe -- (NIS)
SRV - [2010.03.18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.04 10:23:14 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.09.25 02:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009.08.04 02:03:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2009.08.04 02:03:05 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2008.12.29 11:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2008.12.08 16:01:58 | 000,533,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2008.08.14 04:59:52 | 000,100,920 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2008.03.31 10:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2007.08.03 11:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipswuio.sys -- (ipswuio)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Combo-Fix\catchme.sys -- (catchme)
DRV - [2010.11.23 03:20:07 | 000,691,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010.11.16 17:50:08 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101206.049\NAVEX15.SYS -- (NAVEX15)
DRV - [2010.11.16 17:50:08 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010.11.16 17:50:08 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101206.049\NAVENG.SYS -- (NAVENG)
DRV - [2010.11.16 16:43:14 | 000,126,512 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010.11.09 01:50:30 | 000,353,912 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101201.001\IDSvix86.sys -- (IDSVix86)
DRV - [2010.07.29 04:33:05 | 000,666,672 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NIS\1201000.025\SYMEFA.SYS -- (SymEFA)
DRV - [2010.07.29 03:54:36 | 000,489,008 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\Drivers\NIS\1201000.025\SRTSP.SYS -- (SRTSP)
DRV - [2010.07.29 03:54:36 | 000,050,096 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1201000.025\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010.07.13 02:20:20 | 000,331,312 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1201000.025\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010.06.27 05:05:55 | 000,134,704 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1201000.025\Ironx86.SYS -- (SymIRON)
DRV - [2010.06.13 11:50:57 | 000,339,504 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NIS\1201000.025\SYMDS.SYS -- (SymDS)
DRV - [2010.05.27 06:52:52 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2009.12.30 14:58:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.12.30 14:58:16 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.07.02 00:59:00 | 009,786,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.05.04 10:25:55 | 002,365,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009.02.11 10:11:49 | 000,329,752 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008.12.08 16:01:52 | 000,055,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2008.08.11 03:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.08.07 01:26:07 | 000,124,928 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.07.28 23:53:46 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.07.10 02:16:21 | 000,081,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2008.06.24 23:55:12 | 000,047,104 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008.05.14 06:02:25 | 000,017,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2008.05.14 06:02:23 | 000,100,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2008.01.29 19:46:57 | 000,029,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwl2cap.sys -- (btwl2cap)
DRV - [2008.01.21 03:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008.01.21 03:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008.01.21 03:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008.01.21 03:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008.01.21 03:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008.01.21 03:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008.01.21 03:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008.01.21 03:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008.01.21 03:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008.01.21 03:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008.01.21 03:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008.01.21 03:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008.01.21 03:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008.01.21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008.01.21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008.01.21 03:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008.01.21 03:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008.01.21 03:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008.01.21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008.01.21 03:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008.01.21 03:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008.01.21 03:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008.01.21 03:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007.12.19 01:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2007.12.06 11:12:47 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2007.08.11 04:19:26 | 000,029,752 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm)
DRV - [2007.08.03 21:26:22 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2007.07.30 19:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.07.30 18:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.11.02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006.11.02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006.11.02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006.11.02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006.11.02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006.11.02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006.11.02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006.11.02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006.11.02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006.11.02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006.11.02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006.11.02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006.11.02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006.11.02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006.11.02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006.11.02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006.11.02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.11.02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006.11.02 08:30:56 | 000,194,048 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.29
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.2
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.87
FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:3.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.1
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.5
FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009050101
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.10.02 12:25:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2010.11.16 16:54:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2010.11.16 16:42:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.05 16:14:39 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.05 16:14:39 | 000,000,000 | ---D | M]
 
[2009.09.08 11:52:05 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Extensions
[2010.12.07 11:02:01 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions
[2010.11.18 12:25:54 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.07.26 19:31:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.13 14:16:48 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\finder@meingutscheincode.de
[2010.03.24 15:13:02 | 000,000,917 | ---- | M] () -- C:\Users\Maike\AppData\Roaming\Mozilla\FireFox\Profiles\n98g2py1.default\searchplugins\conduit.xml
[2010.11.16 18:27:26 | 000,002,449 | ---- | M] () -- C:\Users\Maike\AppData\Roaming\Mozilla\FireFox\Profiles\n98g2py1.default\searchplugins\safesearch.xml
[2010.10.02 14:26:08 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009.08.23 07:50:01 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Program Files\mozilla firefox\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2009.09.08 11:52:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2009.08.23 07:50:06 | 000,000,000 | ---D | M] (Session Manager) -- C:\Program Files\mozilla firefox\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2009.08.23 07:50:07 | 000,000,000 | ---D | M] (Site Launcher) -- C:\Program Files\mozilla firefox\extensions\{20291fcc-1471-46c8-8213-5911f5ce6d67}
[2009.09.08 11:52:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2009.08.23 07:50:04 | 000,000,000 | ---D | M] (Minimap Addon) -- C:\Program Files\mozilla firefox\extensions\{398e77b8-2304-11dc-8314-0800200c9a66}
[2010.04.26 07:12:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.08.23 07:50:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2009.08.23 07:49:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2009.08.23 07:50:01 | 000,000,000 | ---D | M] (FoxTab) -- C:\Program Files\mozilla firefox\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2009.08.23 07:50:02 | 000,000,000 | ---D | M] (GooglePreview) -- C:\Program Files\mozilla firefox\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
[2009.09.08 11:52:22 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\autopager@mozilla.org
[2009.09.08 11:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de
[2009.08.23 07:50:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\CompactMenuCE@Merci.chao
[2009.08.23 07:50:03 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\lazarus@interclue.com
[2009.09.08 11:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de
[2009.09.08 11:52:23 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\printpdf@pavlov.net
[2009.09.08 11:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\chrome
[2009.09.08 11:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\defaults
[2009.09.08 11:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\chrome
[2009.09.08 11:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\defaults
[2010.04.12 16:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009.11.13 16:39:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2009.11.13 16:39:34 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2009.11.13 16:39:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2009.11.13 16:39:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2009.11.13 16:39:34 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.10.25 17:16:53 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG
O24 - Desktop BackupWallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.07 11:32:59 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
[2010.12.07 11:18:20 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Malwarebytes
[2010.12.07 11:18:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.12.07 11:18:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.12.07 11:18:05 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.12.07 11:18:05 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010.12.05 17:48:05 | 000,000,000 | R-SD | C] -- C:\Users\Maike\Documents\My Stationery
[2010.12.05 16:19:02 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.12.05 16:18:59 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.12.05 16:13:50 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.12.05 16:08:40 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.11.17 14:39:11 | 000,000,000 | ---D | C] -- C:\Program Files\Panasonic P2
[2010.11.17 14:30:56 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations
[2010.11.09 14:52:52 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\TrainIt
[2010.04.02 12:40:25 | 000,454,656 | ---- | C] (Simon Tatham) -- C:\Program Files\putty06.exe
[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.07 11:33:28 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
[2010.12.07 11:18:10 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.07 10:50:56 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.12.07 10:50:19 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.12.07 10:50:02 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.07 10:50:02 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.07 10:49:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.07 10:49:40 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.05 20:11:36 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.12.05 16:20:26 | 000,001,671 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.12.05 16:11:19 | 002,167,536 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1201000.025\Cat.DB
[2010.12.03 09:38:49 | 000,633,580 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.12.03 09:38:49 | 000,600,138 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.12.03 09:38:49 | 000,106,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.12.03 09:38:48 | 000,128,990 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.11.17 17:55:18 | 000,000,130 | ---- | M] () -- C:\Windows\System32\~.inf
[2010.11.17 14:42:11 | 000,001,043 | ---- | M] () -- C:\Users\Public\Desktop\P2 Viewer.lnk
[2010.11.16 16:53:29 | 000,002,220 | ---- | M] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2010.11.16 16:43:14 | 000,126,512 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010.11.16 16:43:14 | 000,007,456 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2010.11.16 16:43:14 | 000,000,805 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2010.11.09 14:52:46 | 000,001,838 | ---- | M] () -- C:\Users\Maike\Desktop\TrainIt.lnk
[2010.11.07 15:27:42 | 002,529,622 | ---- | M] () -- C:\Users\Maike\AppData\Local\[j0002]-[p05].bmp
[2010.11.07 15:27:31 | 002,529,622 | ---- | M] () -- C:\Users\Maike\AppData\Local\[j0002]-[p04].bmp
[2010.11.07 15:27:21 | 002,529,622 | ---- | M] () -- C:\Users\Maike\AppData\Local\[j0002]-[p03].bmp
[2010.11.07 15:27:12 | 002,529,622 | ---- | M] () -- C:\Users\Maike\AppData\Local\[j0002]-[p02].bmp
[2010.11.07 15:27:01 | 002,529,622 | ---- | M] () -- C:\Users\Maike\AppData\Local\[j0002]-[p01].bmp
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.07 11:18:10 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.12.05 16:20:26 | 000,001,671 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.11.17 14:42:10 | 000,001,043 | ---- | C] () -- C:\Users\Public\Desktop\P2 Viewer.lnk
[2010.11.16 16:53:29 | 000,002,220 | ---- | C] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2010.11.09 14:52:46 | 000,001,838 | ---- | C] () -- C:\Users\Maike\Desktop\TrainIt.lnk
[2010.11.07 15:27:33 | 002,529,622 | ---- | C] () -- C:\Users\Maike\AppData\Local\[j0002]-[p05].bmp
[2010.11.07 15:27:23 | 002,529,622 | ---- | C] () -- C:\Users\Maike\AppData\Local\[j0002]-[p04].bmp
[2010.11.07 15:27:13 | 002,529,622 | ---- | C] () -- C:\Users\Maike\AppData\Local\[j0002]-[p03].bmp
[2010.11.07 15:27:03 | 002,529,622 | ---- | C] () -- C:\Users\Maike\AppData\Local\[j0002]-[p02].bmp
[2010.11.07 15:26:54 | 002,529,622 | ---- | C] () -- C:\Users\Maike\AppData\Local\[j0002]-[p01].bmp
[2010.10.21 16:02:59 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll
[2010.10.21 16:02:59 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll
[2010.10.21 16:02:55 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.09.02 17:04:11 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI
[2010.05.31 15:01:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.05.18 12:31:29 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2010.05.01 12:59:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.04.29 19:39:38 | 000,000,680 | ---- | C] () -- C:\Users\Maike\AppData\Local\d3d9caps.dat
[2010.04.26 07:25:00 | 000,000,600 | ---- | C] () -- C:\Users\Maike\AppData\Local\PUTTY.RND
[2010.01.14 13:04:26 | 000,004,096 | -H-- | C] () -- C:\Users\Maike\AppData\Local\keyfile3.drm
[2009.12.30 14:58:16 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.12.30 14:58:16 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.11.06 16:28:02 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2009.10.31 11:05:11 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.10.27 20:13:20 | 000,009,728 | ---- | C] () -- C:\Users\Maike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.02 12:17:58 | 000,001,161 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.09.12 11:40:31 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.09.12 09:58:15 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.09.01 09:39:04 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.08.30 14:32:19 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.19 19:00:02 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.08.04 02:03:20 | 000,004,352 | ---- | C] () -- C:\Windows\System32\cfgfx.ini
[2009.08.04 02:03:20 | 000,000,735 | ---- | C] () -- C:\Windows\FF05_Render_Spk_Hp.ini
[2009.08.04 02:03:20 | 000,000,508 | ---- | C] () -- C:\Windows\FF05_not_Spk_Hp.ini
[2009.08.04 02:02:21 | 000,148,480 | ---- | C] () -- C:\Windows\System32\APOMngr.DLL
[2009.08.04 02:02:21 | 000,073,728 | ---- | C] () -- C:\Windows\System32\CmdRtr.DLL
[2008.08.11 03:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.07.30 01:33:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\BtwNamespaceExt2.dll
[2008.05.12 04:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2003.02.20 14:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2001.11.14 21:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2010.08.08 12:15:17 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ankh
[2010.05.18 12:04:22 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Atari
[2010.10.21 16:12:13 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\concept design
[2010.10.26 12:33:38 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FileZilla
[2010.09.28 15:19:25 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FireShot
[2010.04.22 15:08:11 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SmartDraw
[2010.03.16 19:18:23 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SparweltGutschein
[2010.04.07 17:30:51 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Tific
[2010.11.09 18:02:21 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\TrainIt
[2009.12.30 15:02:02 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ubisoft
[2010.12.05 20:11:37 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2010.05.18 12:32:43 | 000,453,006 | ---- | M] () -- C:\AnalysisLog.sr0
[2009.03.12 03:11:47 | 000,000,023 | ---- | M] () -- C:\app3.LOG
[2006.09.18 22:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009.04.11 07:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008.04.16 12:27:17 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2007.04.04 20:01:54 | 000,000,019 | ---- | M] () -- C:\CA21.txt
[2010.10.25 17:24:09 | 000,018,235 | ---- | M] () -- C:\ComboFix.txt
[2006.09.18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010.07.21 11:34:25 | 000,286,720 | ---- | M] () -- C:\Debug.txt
[2009.08.04 02:45:04 | 000,019,994 | ---- | M] () -- C:\devlist.txt
[2009.06.23 07:28:11 | 000,000,027 | ---- | M] () -- C:\Driver.20
[2009.08.03 12:48:21 | 000,000,769 | ---- | M] () -- C:\faclog.txt
[2009.08.04 02:41:42 | 000,000,009 | ---- | M] () -- C:\Finish.log
[2009.06.07 16:31:15 | 000,000,021 | ---- | M] () -- C:\Fix.log
[2009.05.27 07:02:07 | 001,048,576 | RH-- | M] () -- C:\G60VxAS.BIN
[2010.12.07 10:49:40 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys
[2009.08.04 02:37:50 | 001,546,580 | ---- | M] () -- C:\if.log
[2009.08.04 01:27:34 | 000,000,481 | ---- | M] () -- C:\igoogle_log.txt
[2009.08.04 01:58:55 | 022,216,704 | ---- | M] () -- C:\inject.log
[2009.08.04 01:58:55 | 019,533,351 | ---- | M] () -- C:\inject.log.txt
[2010.06.14 11:11:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010.06.14 11:11:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008.08.08 08:22:19 | 000,000,030 | ---- | M] () -- C:\NERO.LOG
[2009.01.07 10:16:08 | 000,000,030 | ---- | M] () -- C:\NIS2009.TXT
[2007.03.16 00:18:45 | 000,000,025 | ---- | M] () -- C:\OFFICE2007_A.TXT
[2010.12.07 10:49:39 | 3533,873,152 | -HS- | M] () -- C:\pagefile.sys
[2009.08.03 13:34:44 | 000,000,146 | ---- | M] () -- C:\Pass.txt
[2009.06.19 13:10:05 | 000,003,502 | ---- | M] () -- C:\Patch.LOG
[2009.01.15 09:13:21 | 000,000,017 | ---- | M] () -- C:\READER_A.TXT
[2009.03.31 04:04:29 | 000,000,022 | ---- | M] () -- C:\RECOVERY.DAT
[2009.08.04 02:02:22 | 000,001,783 | ---- | M] () -- C:\RHDSetup.log
[2010.07.21 11:36:42 | 000,000,166 | ---- | M] () -- C:\setup.log
[2006.05.14 17:22:24 | 000,000,005 | ---- | M] () -- C:\store.log
[2009.08.04 01:17:16 | 000,000,170 | ---- | M] () -- C:\SumHidd.txt
[2009.08.04 01:16:22 | 000,000,098 | ---- | M] () -- C:\SumOS.txt
[2010.07.01 14:27:15 | 000,002,433 | ---- | M] () -- C:\test.spr
[2009.06.02 12:11:40 | 000,000,024 | ---- | M] () -- C:\v55.txt
[2009.02.09 06:30:41 | 000,000,041 | ---- | M] () -- C:\WindowsLive_A.TXT
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.11.02 13:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 13:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 13:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009.08.30 14:38:25 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2006.09.18 22:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006.11.02 10:46:03 | 000,070,144 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNBPP3.DLL
[2008.10.28 11:49:30 | 000,321,536 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp696.dll
[2006.11.02 13:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007.04.09 12:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006.10.26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2008.12.04 23:19:40 | 000,308,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2008.01.21 03:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
[2010.04.02 12:40:46 | 000,454,656 | ---- | M] (Simon Tatham) -- C:\Program Files\putty06.exe
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 07:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 07:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\user32.dll /md5 >
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.01.21 03:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %systemroot%\system32\ws2help.dll /md5 >
[2006.11.02 10:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
 
< MD5 for: EXPLORER.EXE  >
[2009.08.04 01:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009.08.04 01:45:44 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009.08.04 01:45:44 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.08.04 01:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-11-24 16:22:12
 
<          >

< End of report >
--- --- ---

Swisstreasure 07.12.2010 18:02
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**

http://i266.photobucket.com/albums/i...ownload_FF.gif

http://i94.photobucket.com/albums/l8...x-Download.png
  • Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
  • Doppel-klicke auf ComboFix.exe und folge den Aufforderungen.
    • Wenn ComboFix fertig ist, wird es ein Log für dich erstellen.
    • Bitte poste mir den Inhalt von C:\ComboFix.txt hier in de Thread.

Maikeost 08.12.2010 16:45
Combofix Logfile:
Code:
ComboFix 10-12-07.04 - Maike 08.12.2010  16:14:32.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3070.1832 [GMT 1:00]
ausgeführt von:: c:\users\Maike\Desktop\Combo-Fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\~.inf

Infizierte Kopie von c:\windows\system32\userinit.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\ERDNT\cache\userinit.exe wurde wiederhergestellt

.
(((((((((((((((((((((((  Dateien erstellt von 2010-11-08 bis 2010-12-08  ))))))))))))))))))))))))))))))
.

2010-12-08 15:28 . 2010-12-08 15:32        --------        d-----w-        c:\users\Maike\AppData\Local\temp
2010-12-08 15:28 . 2010-12-08 15:28        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-12-08 15:28 . 2010-12-08 15:28        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-12-08 15:28 . 2010-12-08 15:28        --------        d-----w-        c:\users\Arbeit\AppData\Local\temp
2010-12-07 10:18 . 2010-12-07 10:18        --------        d-----w-        c:\users\Maike\AppData\Roaming\Malwarebytes
2010-12-07 10:18 . 2010-11-29 16:42        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-07 10:18 . 2010-12-07 10:18        --------        d-----w-        c:\programdata\Malwarebytes
2010-12-07 10:18 . 2010-12-07 10:18        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-12-07 10:18 . 2010-11-29 16:42        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-12-05 15:19 . 2010-12-05 15:19        --------        d-----w-        c:\program files\iPod
2010-12-05 15:18 . 2010-12-05 15:20        --------        d-----w-        c:\program files\iTunes
2010-11-24 06:57 . 2010-10-19 04:27        7680        ----a-w-        c:\program files\Internet Explorer\iecompat.dll
2010-11-17 13:39 . 2010-11-17 13:42        --------        d-----w-        c:\program files\Panasonic P2
2010-11-17 13:30 . 2010-11-17 13:38        --------        d-----w-        c:\windows\Downloaded Installations
2010-11-16 15:42 . 2010-11-16 15:51        --------        d-----w-        c:\windows\system32\drivers\NIS\1201000.025
2010-11-11 16:46 . 2010-10-07 11:37        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2010-11-09 13:52 . 2010-11-09 17:02        --------        d-----w-        c:\users\Maike\AppData\Roaming\TrainIt

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-17 16:55 . 2010-10-26 10:10        966205        ----a-w-        c:\windows\system32\~.tmp
2010-11-16 15:43 . 2009-11-14 15:11        126512        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS
2010-09-28 14:44 . 2010-09-28 14:44        41984        ----a-w-        c:\windows\system32\drivers\usbaapl.sys
2010-09-28 14:44 . 2010-09-28 14:44        4184352        ----a-w-        c:\windows\system32\usbaaplrc.dll
2010-09-13 13:56 . 2010-10-13 13:23        8147456        ----a-w-        c:\windows\system32\wmploc.DLL
2010-04-02 11:40 . 2010-04-02 11:40        454656        ----a-w-        c:\program files\putty06.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08        143360        ----a-w-        c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-06 7440928]
"VolPanel"="c:\program files\Creative\SB Audigy\Volume Panel\VolPanlu.exe" [2008-12-29 237693]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-08-19 159744]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-10-01 851968]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-08-04 33136]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-17 421160]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Audible Download Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
backup=c:\windows\pss\Audible Download Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^P2 Card Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\P2 Card Manager.lnk
backup=c:\windows\pss\P2 Card Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07        932288        ----a-r-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2009-08-04 01:29        47672        ----a-w-        c:\windows\AsScrProlog.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 10:17        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLLEntry]
2009-02-26 19:07        14848        ----a-w-        c:\windows\System32\AmbRunE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43        248040        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-25 07:41        198160        ----a-w-        c:\program files\Common Files\Real\Update_OB\realsched.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-01-29 29736]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-08-04 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-08-04 79360]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1201000.025\SYMDS.SYS [2010-06-13 339504]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1201000.025\SYMEFA.SYS [2010-07-29 666672]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys [2010-11-23 691248]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101208.001\IDSvix86.sys [2010-11-09 353912]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1201000.025\Ironx86.SYS [2010-06-27 134704]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\NIS\1201000.025\SYMTDIV.SYS [2010-07-13 331312]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [2010-07-23 126904]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-11-16 102448]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-12-19 54784]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~3\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programme\Real Player\Netscape6\nppl3260.dll
FF - plugin: c:\programme\Real Player\Netscape6\nprjplug.dll
FF - plugin: c:\programme\Real Player\Netscape6\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: ColorfulTabs: {0545b830-f0aa-4d7e-8820-50a4629a56fe} - c:\program files\Mozilla Firefox\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
FF - Extension: Session Manager: {1280606b-2510-4fe0-97ef-9b5a22eafe30} - c:\program files\Mozilla Firefox\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
FF - Extension: Split Browser: {29c4afe1-db19-4298-8785-fcc94d1d6c1d} - c:\program files\Mozilla Firefox\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Extension: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - c:\program files\Mozilla Firefox\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
FF - Extension: GooglePreview: {EF522540-89F5-46b9-B6FE-1829E2B572C6} - c:\program files\Mozilla Firefox\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
FF - Extension: FireShot: {0b457cAA-602d-484a-8fe7-c1d894a011ba} - c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
FF - Extension: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn
FF - Extension: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
MSConfigStartUp-TrojanScanner - c:\program files\Trojan Remover\Trjscan.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-12-08 16:33
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


C:\ADSM_PData_0150

Scan erfolgreich abgeschlossen
versteckte Dateien: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(2112)
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\windows\system32\conime.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-12-08  16:38:53 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-12-08 15:38
ComboFix2.txt  2010-10-25 16:24

Vor Suchlauf: 15 Verzeichnis(se), 86.063.906.816 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 85.875.261.440 Bytes frei

- - End Of File - - 38ADE13C1AB7AFCBBB0208AC29096E63
--- --- ---

Swisstreasure 09.12.2010 19:05
Bitte lasse die Dateien aus der Code-Box bei Virustotal überprüfen
Code:
c:\program files\putty06.exe
Also gehe wie hier beschrieben vor:
  • Öffne diese Webseite: virustotal
  • Klicke auf "Durchsuchen"
  • Suche die Datei auf deinem Rechner--> Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
  • "Senden der Datei"
  • Warte, bis der Scandurchlauf aller Virenscanner beendet ist
  • Auf "Filter" klicken
  • dann auf "Ergebnisse"
  • das Ergebnis (wie Du es bekommst )
    komplett markieren und hier rein kopieren
Sollte die Datei als schädlich erkannt werden bitte noch nicht entfernen

Maikeost 12.12.2010 12:16
VT Community Sign in ▼ My account ▼ Sign out Signing out... Languages ▼
VirusTotal's website has changed, we need new translations, do you feel like helping the community?
info@virustotal.com
Sign in to VT Community

Safety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.
email
password
Keep me logged in

Sign in
Signing in, please wait...
Login failed, please try again
Forgot your password? Create an account
Edit my profile
View my profile
Inbox
Virus Total
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
10 VT Community user(s) with a total of 1882 reputation credit(s) say(s) this sample is goodware. 1 VT Community user(s) with a total of 1169 reputation credit(s) say(s) this sample is malware.
File name:
putty.exe
Submission date:
2010-12-11 16:58:26 (UTC)
Current status:
finished
Result:
0 /43 (0.0%)

VT Community

goodware
Safety score: 61.7%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.12.11.00 2010.12.10 -
AntiVir 7.10.14.255 2010.12.10 -
Antiy-AVL 2.0.3.7 2010.12.11 -
Avast 4.8.1351.0 2010.12.11 -
Avast5 5.0.677.0 2010.12.11 -
AVG 9.0.0.851 2010.12.11 -
BitDefender 7.2 2010.12.11 -
CAT-QuickHeal 11.00 2010.12.11 -
ClamAV 0.96.4.0 2010.12.11 -
Command 5.2.11.5 2010.12.11 -
Comodo 7024 2010.12.11 -
DrWeb 5.0.2.03300 2010.12.11 -
Emsisoft 5.1.0.1 2010.12.11 -
eSafe 7.0.17.0 2010.12.09 -
eTrust-Vet 36.1.8034 2010.12.10 -
F-Prot 4.6.2.117 2010.12.11 -
F-Secure 9.0.16160.0 2010.12.11 -
Fortinet 4.2.254.0 2010.12.11 -
GData 21 2010.12.11 -
Ikarus T3.1.1.90.0 2010.12.11 -
Jiangmin 13.0.900 2010.12.11 -
K7AntiVirus 9.72.3219 2010.12.11 -
Kaspersky 7.0.0.125 2010.12.11 -
McAfee 5.400.0.1158 2010.12.11 -
McAfee-GW-Edition 2010.1C 2010.12.11 -
Microsoft 1.6402 2010.12.11 -
NOD32 5694 2010.12.11 -
Norman 6.06.12 2010.12.11 -
nProtect 2010-12-11.01 2010.12.11 -
Panda 10.0.2.7 2010.12.11 -
PCTools 7.0.3.5 2010.12.11 -
Prevx 3.0 2010.12.11 -
Rising 22.77.04.00 2010.12.11 -
Sophos 4.60.0 2010.12.11 -
SUPERAntiSpyware 4.40.0.1006 2010.12.11 -
Symantec 20101.3.0.103 2010.12.11 -
TheHacker 6.7.0.1.098 2010.12.11 -
TrendMicro 9.120.0.1004 2010.12.11 -
TrendMicro-HouseCall 9.120.0.1004 2010.12.11 -
VBA32 3.12.14.2 2010.12.10 -
VIPRE 7604 2010.12.11 -
ViRobot 2010.12.11.4196 2010.12.11 -
VirusBuster 13.6.87.0 2010.12.11 -
Additional information
Show all
MD5 : 9bb6826905965c13be1c84cc0ff83f42
SHA1 : ae7734e7a54353ab13ecba780ed62344332fbc6f
SHA256: cfa4f56807405fd36e406688feb970a0d0d4854456ba2da72e4a33a27b01d9ae
ssdeep: 12288:yLXmgMb4Xd+Uh8ggdE8Ox4GoyPV4qOr1nBMIQn6:yDmgMbVujg9u4GBPVLOr1nvM6
File size : 454656 bytes
First seen: 2007-07-14 15:01:39
Last seen : 2010-12-11 16:58:26
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
InstallShield setup (37.7%)
Win32 Executable MS Visual C++ (generic) (33.0%)
Windows Screen Saver (11.4%)
Win32 Executable Generic (7.4%)
Win32 Dynamic Link Library (generic) (6.6%)
sigcheck:
publisher....: Simon Tatham
copyright....: Copyright (c) 1997-2007 Simon Tatham.
product......: PuTTY suite
description..: SSH, Telnet and Rlogin client
original name: PuTTY
internal name: PuTTY
file version.: Release 0.60
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD: -
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x4777F
timedatestamp....: 0x463484D0 (Sun Apr 29 11:43:12 2007)
machinetype......: 0x14C (Intel I386)

[[ 4 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x4E4D1, 0x4F000, 6.63, 2f6fa9117dbe61d9723c63816f6e49fd
.rdata, 0x50000, 0x19536, 0x1A000, 6.12, 528f4201171d63b6057d28346d31f26b
.data, 0x6A000, 0x7064, 0x1000, 3.97, 427740272b7cbb5da523a05992b88b4f
.rsrc, 0x72000, 0x3AB0, 0x4000, 3.78, d0531fa0b83a47042fed7f07849032ff
ThreatExpert:
hxxp://www.threatexpert.com/report.aspx?md5=9bb6826905965c13be1c84cc0ff83f42
ExifTool:
file metadata
CharacterSet: Unicode
CodeSize: 323584
CompanyName: Simon Tatham
EntryPoint: 0x4777f
FileDescription: SSH, Telnet and Rlogin client
FileFlagsMask: 0x000b
FileOS: Win32
FileSize: 444 kB
FileSubtype: 0
FileType: Win32 EXE
FileVersion: Release 0.60
FileVersionNumber: 0.60.0.0
ImageVersion: 0.0
InitializedDataSize: 155648
InternalName: PuTTY
LanguageCode: English (British)
LegalCopyright: Copyright 1997-2007 Simon Tatham.
LinkerVersion: 7.1
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 4.0
ObjectFileType: Executable application
OriginalFilename: PuTTY
PEType: PE32
ProductName: PuTTY suite
ProductVersion: Release 0.60
ProductVersionNumber: 0.60.0.0
Subsystem: Windows GUI
SubsystemVersion: 4.0
TimeStamp: 2007:04:29 13:43:12+02:00
UninitializedDataSize: 0
Symantec reputation:Suspicious.Insight

VT Community

12

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-08-28 17:22:52 (UTC)
Good To Go ! -XTC-

Was this comment helpful? Yes (0) | No (0) | Report abuse Reported as abuseful

User:
demonicalmonk
Reputation:
15 credits
Comment date:
2010-08-29 12:13:41 (UTC)
Official putty client.
Tags: Goodware,

Was this comment helpful? Yes (2) | No (0) | Report abuse Reported as abuseful

User:
bartblaze
Reputation:
1612 credits
Comment date:
2010-09-02 07:02:59 (UTC)
Tags: Goodware,

Was this comment helpful? Yes (4) | No (0) | Report abuse Reported as abuseful

User:
CRDF
Reputation:
1169 credits
Comment date:
2010-09-11 10:00:03 (UTC)
The file is a malware known as "CaM.Malware.Win32.PEx.C.286220132". - 30271 -
Tags: malware

Was this comment helpful? Yes (0) | No (9) | Report abuse Reported as abuseful

User:
TJM
Reputation:
242 credits
Comment date:
2010-09-14 09:06:30 (UTC)
The user above me must be joking, this is putty 0.60 downloaded from the homepage.
Tags: Goodware,

Was this comment helpful? Yes (2) | No (0) | Report abuse Reported as abuseful

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-08-28 17:22:52 (UTC)
Good To Go ! -XTC-

Was this comment helpful? Yes (0) | No (0) | Report abuse Reported as abuseful

User:
demonicalmonk
Reputation:
15 credits
Comment date:
2010-08-29 12:13:41 (UTC)
Official putty client.
Tags: Goodware,

Was this comment helpful? Yes (2) | No (0) | Report abuse Reported as abuseful

User:
bartblaze
Reputation:
1612 credits
Comment date:
2010-09-02 07:02:59 (UTC)
Tags: Goodware,

Was this comment helpful? Yes (4) | No (0) | Report abuse Reported as abuseful

User:
CRDF
Reputation:
1169 credits
Comment date:
2010-09-11 10:00:03 (UTC)
The file is a malware known as "CaM.Malware.Win32.PEx.C.286220132". - 30271 -
Tags: malware

Was this comment helpful? Yes (0) | No (9) | Report abuse Reported as abuseful

User:
TJM
Reputation:
242 credits
Comment date:
2010-09-14 09:06:30 (UTC)
The user above me must be joking, this is putty 0.60 downloaded from the homepage.
Tags: Goodware,

Was this comment helpful? Yes (2) | No (0) | Report abuse Reported as abuseful
Loading...

Prev123Next



Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
You can add basic styles to your comments using the following accepted bbcode tags:

text -- bold
text -- italics
text -- underline
text -- strikethrough
Code:
text
- preformatted text

You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.

Goodware
Malware
Spam attachment/link

P2P download
Propagating via IM
Network worm

Drive-by-download


Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.
Preview comment Edit comment
Post comment
Posting comment...
Comment successfully posted




ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com - Terms of Service & Privacy Policy


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:05 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19