Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Google verlinkt mich auf andere Seiten Windows XP Internet Explorer 8 (https://www.trojaner-board.de/95067-google-verlinkt-mich-andere-seiten-windows-xp-internet-explorer-8-a.html)

jubauer 26.01.2011 06:34
Google verlinkt mich auf andere Seiten Windows XP Internet Explorer 8
 
Hallo Trojaner Board Formgemeinde,

habe natürlich die Suche auch schon bemüht, doch leider brauche ich nun Euer Fachwissen :-)
Ich habe folgendes Problem, wenn ich bei Google einen Seite suche, werde ich bei 10 Versuchen ca. 5 Mal auf irgend eine andere Seite verlinkt.
z.B.
h**p://wide.fullpageads.info/
h**p://xml.click9.com/click.php

Nachdem ich nur simpler PC USER bin, wäre ich Euch sehr dankbar, wenn Ihr mir sagen könnt, wie ich mit meinem Problem weiterkomme. Habe gelesen es gab hier schon mal so ein ähnliches Problem, wäre echt super wenn mir hier auch mit simplen Schritten geholfen werden kann.

Hier ist das Logfile von hijackthis
HTML-Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:51:43, on 25.01.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Programme\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\DAEMON Tools Pro\DTProAgent.exe
C:\Programme\Logitech\Z Cinema\Z Cinema.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm\HiJackThis204.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.jasc.com/command.asp?app=jasc&function=privacy&lang=German
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 206.64.92.16:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Adobe PDF Link Helper - {2828310E-7769-5CDD-1563-396C44656799} - C:\WINDOWS\system32\SS32EVNT1.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programme\BitComet\tools\BitCometBHO_1.4.12.6.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton 360\Engine\4.3.0.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton 360\Engine\4.3.0.5\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360\Engine\4.3.0.5\coIEPlg.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Programme\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Z Cinema.lnk = ?
O8 - Extra context menu item: &Alles mit BitComet herunterladen - res://C:\Programme\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
O8 - Extra context menu item: Mit BitComet herunter&laden - res://C:\Programme\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Programme\BitComet\tools\BitCometBHO_1.4.12.6.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Geräteerkennung) - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284201600109
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284302790187
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} (Navigram Control) - hxxp://www.navigram.com/engine/v1026/Navigram.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: KMService - Unknown owner - C:\WINDOWS\system32\srvany.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Programme\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9249 bytes

Als Virenschutz habe ich Northon 360 und dieser kann leider auch nichts finden.....:killpc:
Vielen Dank schon mal im Voraus für Eure Hilfe :dankeschoen:#

Grüße
Jürgen

cosinus 26.01.2011 09:37
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

jubauer 27.01.2011 03:54
Hallo Arne,

vielen Dank das Du Dich dem Problem widmest :-)

Hatte auch noch ältere Lockfiles von Malwewarebytes, deshalb poste ich hier wie gewünscht alle Files.


HTML-Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5608

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.01.2011 06:38:28
mbam-log-2011-01-26 (06-38-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 228530
Laufzeit: 1 Stunde(n), 21 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


HTML-Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5606

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

25.01.2011 21:10:08
mbam-log-2011-01-25 (21-10-08).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 138465
Laufzeit: 5 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

HTML-Code:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5608

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.01.2011 06:38:28
mbam-log-2011-01-26 (06-38-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 228530
Laufzeit: 1 Stunde(n), 21 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

HTML-Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5608

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.01.2011 18:40:23
mbam-log-2011-01-26 (18-40-23).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 141167
Laufzeit: 11 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Nun kommen die OTL Logfiles

OTL Logfile:
Code:
OTL logfile created on: 26.01.2011 18:28:15 - Run 1
OTL by OldTimer - Version 3.2.20.6    Folder = C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 57,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 49,57 Gb Free Space | 66,52% Space Free | Partition Type: NTFS
 
Computer Name: JUERGEN | User Name: Jürgen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Norton 360\Engine\4.3.0.5\ccsvchst.exe (Symantec Corporation)
PRC - C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Logitech\Z Cinema\Z Cinema.exe (Logitech(c))
PRC - C:\Programme\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd.)
PRC - C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
PRC - C:\Program Files\Launch Manager\WButton.exe ()
PRC - C:\Program Files\Launch Manager\LaunchAp.exe ()
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm\OTL.exe (OldTimer Tools)
MOD - C:\Programme\Norton 360\Engine\4.3.0.5\asoehook.dll (Symantec Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AppMgmt) --  File not found
SRV - (KMService) -- C:\WINDOWS\system32\srvany.exe ()
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (N360) -- C:\Programme\Norton 360\Engine\4.3.0.5\ccSvcHst.exe (Symantec Corporation)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (NAVEX15) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110125.040\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110125.040\NAVENG.SYS (Symantec Corporation)
DRV - (BHDrvx86) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110114.001\BHDrvx86.sys (Symantec Corporation)
DRV - (IDSxpx86) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110125.002\IDSXpx86.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\N360\0403000.005\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIRON) -- C:\WINDOWS\system32\drivers\N360\0403000.005\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\WINDOWS\system32\drivers\N360\0403000.005\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) -- C:\WINDOWS\System32\Drivers\N360\0403000.005\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\WINDOWS\system32\drivers\N360\0403000.005\SRTSPX.SYS (Symantec Corporation)
DRV - (ccHP) -- C:\WINDOWS\system32\drivers\N360\0403000.005\ccHPx86.sys (Symantec Corporation)
DRV - (SCR3XX2K) -- C:\WINDOWS\system32\drivers\SCR3XX2K.sys (SCM Microsystems Inc.)
DRV - (SymDS) -- C:\WINDOWS\system32\drivers\N360\0403000.005\SYMDS.SYS (Symantec Corporation)
DRV - (HTCAND32) -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (ZCinema_TSHD) -- C:\WINDOWS\system32\drivers\ZCinema_SRS_i386.sys (SRS Labs, Inc.)
DRV - (RemoteControl-USBLAN) -- C:\WINDOWS\system32\drivers\rcblan.sys (Belcarra Technologies)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (HSFHWATI) -- C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (Hotkey) -- C:\WINDOWS\System32\drivers\HOTKEY.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://dict.leo.org/ende?lang=de&lp=ende [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 206.64.92.16:80
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010.09.12 18:37:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010.09.11 02:32:17 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2004.08.04 04:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {2828310E-7769-5CDD-1563-396C44656799} - C:\WINDOWS\system32\SS32EVNT1.DLL ()
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programme\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton 360\Engine\4.3.0.5\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton 360\Engine\4.3.0.5\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360\Engine\4.3.0.5\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton 360\Engine\4.3.0.5\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe (Wistron)
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe ()
O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Programme\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Z Cinema.lnk = C:\WINDOWS\Installer\{EE885042-228A-446F-A30D-64ECBDC93859}\StartupShortcut_EE885042228A446FA30D64ECBDC93859.exe (Macrovision Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Alles mit BitComet herunterladen - C:\Programme\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Mit BitComet herunter&laden - C:\Programme\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Se&nd to OneNote - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Programme\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Geräteerkennung)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284201600109 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284302790187 (MUWebControl Class)
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://www.navigram.com/engine/v1026/Navigram.cab (Navigram Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.10 21:02:01 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{114d6550-ce73-11df-8075-00904bde961c}\Shell\AutoRun\command - "" = E:\urDrive.exe
O33 - MountPoints2\{114d6551-ce73-11df-8075-00904bde961c}\Shell\AutoRun\command - "" = F:\urDrive.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.01.25 21:43:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\TEMP
[2011.01.25 20:41:21 | 000,000,000 | ---D | C] -- C:\Avenger
[2011.01.16 12:17:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Eigene Dateien\Outlook-Dateien
[2011.01.16 07:08:53 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft ActiveSync
[2011.01.15 11:48:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Startmenü\Programme\Convar
[2011.01.14 19:33:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\Malwarebytes
[2011.01.14 19:33:01 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.01.14 19:33:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.01.14 19:32:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.01.14 19:32:54 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.01.14 19:32:54 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.01.14 19:29:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm
[2011.01.11 22:00:27 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll
[2011.01.11 21:55:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\HTC
[2011.01.11 21:55:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\Teleca
[2011.01.11 21:53:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HTC
[2011.01.11 21:53:38 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Teleca Shared
[2011.01.11 21:53:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
[2011.01.11 21:51:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HTC
[2011.01.11 21:51:08 | 001,122,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoInstaller01007.dll
[2011.01.11 21:51:08 | 000,024,576 | ---- | C] (HTC, Corporation) -- C:\WINDOWS\System32\drivers\ANDROIDUSB.sys
[2011.01.11 21:50:25 | 000,000,000 | ---D | C] -- C:\Programme\Spirent Communications
[2011.01.11 21:49:30 | 000,000,000 | ---D | C] -- C:\Programme\HTC
[2011.01.11 21:46:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
[2011.01.11 05:06:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Volvo 850 Kombi
[2011.01.09 13:56:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Desktop\WAMA
[2011.01.09 12:03:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Bilder Wohnung Mering
[2011.01.09 02:50:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Silverlight
[2011.01.07 16:15:35 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft
[2011.01.07 16:15:11 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Silverlight
[2011.01.07 16:13:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\HpUpdate
[2011.01.07 16:12:17 | 000,273,256 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPDiscoPM5312.dll
[2011.01.07 16:12:08 | 001,907,560 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\HPScanMiniDrv_OJ8500_A910.dll
[2011.01.07 16:12:02 | 000,232,296 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinksts5312.dll
[2011.01.07 16:12:02 | 000,213,352 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinkcoi5312.dll
[2011.01.07 16:12:01 | 000,264,552 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpinksts5312LM.dll
[2011.01.05 17:56:10 | 000,000,000 | ---D | C] -- C:\Programme\KMS Activator for Microsoft Office 2010 Applications x86 x64 Multilingual-FIXISO~DiBYA
[2011.01.04 18:15:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google
[2011.01.04 18:07:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SharePoint
[2011.01.04 18:07:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Office
[2011.01.04 18:07:06 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\DESIGNER
[2011.01.04 18:05:21 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Synchronization Services
[2011.01.04 18:03:53 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft.NET
[2011.01.04 18:03:53 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Sync Framework
[2011.01.04 18:03:53 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft SQL Server Compact Edition
[2011.01.04 18:03:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Microsoft
[2011.01.04 18:01:29 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 8
[2011.01.04 18:00:00 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Analysis Services
[2011.01.04 17:59:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\SHELLNEW
[2011.01.04 17:57:23 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2011.01.03 19:00:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Ahead
[2011.01.03 18:06:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1006
[2010.12.30 14:14:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Eigene Dateien\NeroVision
[2010.12.30 14:14:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\Ahead
[2010.12.30 10:39:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Pro
[2010.12.30 10:39:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\DAEMON Tools Pro
[2010.12.30 10:28:03 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Pro
[2010.12.30 10:08:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Temp
[2010.12.30 10:08:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.12.30 10:04:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\Google
[2010.12.30 10:03:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
[2010.12.30 10:03:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Google
[2010.12.30 10:01:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\BitComet
[2010.12.30 10:01:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\BitComet
[2010.12.30 10:01:44 | 000,000,000 | ---D | C] -- C:\Programme\BitComet
[2010.12.30 10:01:43 | 000,000,000 | ---D | C] -- C:\Programme\Google
[2010.12.30 06:31:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.12.29 08:10:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jürgen\Desktop\FTP Programm
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.01.26 18:26:45 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{36752CBE-DE6D-46DA-A502-4EE96E8A4C2D}.job
[2011.01.26 18:24:04 | 000,000,394 | -H-- | M] () -- C:\WINDOWS\tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_JUERGEN_Jürgen.job
[2011.01.25 20:43:24 | 000,002,333 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Z Cinema.lnk
[2011.01.25 20:42:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.01.25 19:45:53 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.01.24 21:26:32 | 000,460,562 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Küche Augsburg.pdf
[2011.01.24 21:25:17 | 000,274,755 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Küche Neu Ulm.pdf
[2011.01.23 07:38:12 | 000,001,120 | ---- | M] () -- C:\WINDOWS\tasks\hpwebreg_xxxxxxxxxx.job
[2011.01.18 20:36:33 | 001,269,518 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\TheftAware2_00_Android_User_Guide_Deutsch.pdf
[2011.01.17 21:56:42 | 000,446,932 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.01.17 21:56:42 | 000,072,748 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.01.17 21:56:41 | 000,465,226 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.01.17 21:56:41 | 000,086,188 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.01.17 08:23:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.01.16 20:44:00 | 000,028,619 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Abmeldung Southern California Gascompany.pdf
[2011.01.16 15:52:14 | 000,043,031 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Abmeldung EDISON Bestätigung.pdf
[2011.01.16 15:29:56 | 000,052,540 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Abmeldung EDISON.pdf
[2011.01.16 07:09:54 | 000,002,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\$_hpcst$.hpc
[2011.01.14 19:53:52 | 000,270,984 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.01.14 19:33:04 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.01.14 19:17:36 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.01.11 22:00:38 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
[2011.01.11 22:00:36 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2011.01.11 22:00:35 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.01.09 17:41:31 | 000,000,279 | ---- | M] () -- C:\WINDOWS\WINCMD.INI
[2011.01.09 13:41:19 | 000,354,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Weber Grill Delivery.pdf
[2011.01.05 18:06:43 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\srvany.exe
[2010.12.30 10:28:11 | 000,001,559 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DAEMON Tools Pro.lnk
[2010.12.30 10:23:40 | 000,685,816 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.01.24 21:26:32 | 000,460,562 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Küche Augsburg.pdf
[2011.01.24 21:25:17 | 000,274,755 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Küche Neu Ulm.pdf
[2011.01.18 20:36:32 | 001,269,518 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\TheftAware2_00_Android_User_Guide_Deutsch.pdf
[2011.01.16 20:44:00 | 000,028,619 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Abmeldung Southern California Gascompany.pdf
[2011.01.16 15:52:14 | 000,043,031 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Abmeldung EDISON Bestätigung.pdf
[2011.01.16 15:29:56 | 000,052,540 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Abmeldung EDISON.pdf
[2011.01.16 07:09:54 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Anwendungsdaten\$_hpcst$.hpc
[2011.01.14 19:33:04 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.01.11 22:00:38 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf
[2011.01.11 22:00:36 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2011.01.09 13:41:19 | 000,354,933 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Desktop\Weber Grill Delivery.pdf
[2011.01.07 22:32:59 | 000,001,120 | ---- | C] () -- C:\WINDOWS\tasks\hpwebreg_xxxxxxxxxx.job
[2011.01.07 16:14:43 | 000,001,091 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Live ID.lnk
[2011.01.07 16:13:43 | 000,000,637 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\I.R.I.S. OCR-Registrierung.lnk
[2011.01.05 17:58:37 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\srvany.exe
[2010.12.30 10:28:09 | 000,001,559 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DAEMON Tools Pro.lnk
[2010.12.30 10:23:39 | 000,685,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010.10.27 20:17:01 | 000,000,279 | ---- | C] () -- C:\WINDOWS\WINCMD.INI
[2010.10.01 17:48:23 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010.10.01 17:48:13 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.11 17:19:01 | 000,000,227 | ---- | C] () -- C:\WINDOWS\hbcikrnl.ini
[2010.09.11 03:13:58 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2010.09.11 02:31:40 | 000,221,184 | ---- | C] () -- C:\WINDOWS\System32\SS32EVNT1.DLL
[2010.09.11 00:07:28 | 000,075,024 | ---- | C] () -- C:\WINDOWS\System32\ZCinemaCoinst_i386.dll
[2010.09.11 00:07:28 | 000,052,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\tshd4_kern_i386.sys
[2010.09.10 22:57:53 | 000,004,586 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpzinstall.log
[2010.09.10 21:44:57 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.09.10 21:31:40 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.09.10 21:21:53 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2010.09.10 21:21:43 | 000,009,867 | ---- | C] () -- C:\WINDOWS\System32\drivers\HOTKEY.sys
[2010.09.10 21:06:27 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2007.03.12 18:59:00 | 000,299,008 | ---- | C] () -- C:\Programme\navigram_register.exe
[2005.02.16 06:47:24 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
[2005.02.01 17:19:08 | 000,005,058 | ---- | C] () -- C:\WINDOWS\UN021217.INI
[2004.08.04 04:00:00 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2004.08.04 04:00:00 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2004.08.04 04:00:00 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2004.08.04 04:00:00 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2004.08.04 04:00:00 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll

< End of report >
--- --- ---

[/HTML]


OTL Logfile:
Code:
OTL Extras logfile created on: 26.01.2011 18:28:15 - Run 1
OTL by OldTimer - Version 3.2.20.6    Folder = C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 57,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 49,57 Gb Free Space | 66,52% Space Free | Partition Type: NTFS
 
Computer Name: JUERGEN | User Name: Jürgen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with Paint Shop Pro 9] -- "C:\Programme\Jasc Software Inc\Paint Shop Pro 9\\Paint Shop Pro 9.exe" "/Browse" "%L" (Jasc Software, Inc.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"11673:TCP" = 11673:TCP:*:Enabled:BitComet 11673 TCP
"11673:UDP" = 11673:UDP:*:Enabled:BitComet 11673 UDP
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"D:\setup\HPZnui01.exe" = D:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
"C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
"C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe
"C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe
"C:\Programme\HP\HP Software Update\HPWUCli.exe" = C:\Programme\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe
"C:\Programme\HP\Digital Imaging\bin\hpqpse.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe
"C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe
"C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe
"C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\setup\HPZnui01.exe" = D:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
"C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
"C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
"C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
"C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
"C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe
"C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe
"C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe
"C:\Programme\HP\HP Software Update\HPWUCli.exe" = C:\Programme\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\Smart Web Printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe
"C:\Programme\HP\Digital Imaging\bin\hpqpse.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe
"C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Programme\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe
"C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe
"C:\Programme\ITunes\iTunes.exe" = C:\Programme\ITunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 -- ()
"C:\Programme\BitComet\BitComet.exe" = C:\Programme\BitComet\BitComet.exe:*:Enabled:BitComet.exe -- (www.BitComet.com)
"C:\Programme\Microsoft Office\Office14\GROOVE.EXE" = C:\Programme\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\HP\HP Officejet Pro 8500 A910\Bin\DeviceSetup.exe" = C:\Programme\HP\HP Officejet Pro 8500 A910\Bin\DeviceSetup.exe:LocalSubNet:Enabled:HP Geräteeinrichtung -- (Hewlett-Packard Co.)
"C:\Programme\HP\HP Officejet Pro 8500 A910\Bin\HPNetworkCommunicator.exe" = C:\Programme\HP\HP Officejet Pro 8500 A910\Bin\HPNetworkCommunicator.exe:LocalSubNet:Enabled:HP Netzwerkkommunikator -- (Hewlett-Packard Co.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{13D324E9-9DB1-478D-944C-28BBE1BB80DC}" = HP Officejet Pro 8500 A910 Hilfe
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 22
"{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6FDCF790-49AF-4E3B-8EB2-C07E2DBA55EA}" = StarMoney 5.0 S-Edition
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
"{885F5AC6-4413-4D30-99A9-F4494BFA4923}" = Logitech Harmony Remote Software 7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14
"{90140000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (English) 14
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2010
"{90140000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{C08C11B8-E402-4AAE-B221-85E5B3308F85}" = StarMoney
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.3.4
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DEB23231-0851-4E3E-A2DB-EED8A40B0883}" = HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät
"{DFAA3C20-5968-46A3-B7B0-0AF72D758A59}" = HTC Sync
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E7A744FD-E1B8-4FF6-ADC1-EA4C32181457}" = TIxx21/x515
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{EE885042-228A-446F-A30D-64ECBDC93859}" = Z Cinema
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ALUpdate_is1" = ALTools Update
"ALZip_is1" = ALZip
"ATI Display Driver" = ATI Display Driver
"BitComet" = BitComet 1.25
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Network Adapter
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.1.0.1195
"CNXT_MODEM_PCI_VEN_1002&DEV_4378&SUBSYS_10921734" = SoftV90 Data Fax Modem with SmartCP
"GPL Ghostscript Lite_is1" = GPL Ghostscript Lite 8.70
"ie8" = Windows Internet Explorer 8
"InstallShield_{E7A744FD-E1B8-4FF6-ADC1-EA4C32181457}" = Texas Instruments PCIxx21/x515 drivers.
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"N360" = Norton 360
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Office14.OMUI.de-de" = Microsoft Office Language Pack 2010 - German/Deutsch
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Shop for HP Supplies" = Shop for HP Supplies
"StarMoney 3.0 S-Edition" = StarMoney 3.0 S-Edition
"Sweet Home 3D_is1" = Sweet Home 3D version 2.6
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"UN021217" = BUFFALO INC. TeraStation Utility
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 23.01.2011 16:55:41 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4140
 
Error - 23.01.2011 21:51:06 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 23.01.2011 21:51:06 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2890
 
Error - 23.01.2011 21:51:06 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2890
 
Error - 23.01.2011 21:51:11 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 23.01.2011 21:51:11 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7828
 
Error - 23.01.2011 21:51:11 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7828
 
Error - 26.01.2011 21:11:58 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 26.01.2011 21:11:58 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 37863688
 
Error - 26.01.2011 21:11:58 | Computer Name = JUERGEN | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 37863688
 
[ System Events ]
Error - 25.01.2011 23:28:32 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842784
Description = Abhängige Assemblierung "Microsoft.VC80.MFCLOC" konnte nicht gefunden
 werden. "Last Error": Die referenzierte Assemblierung ist nicht auf dem Computer
 installiert. 
 
Error - 25.01.2011 23:28:32 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly ist für Microsoft.VC80.MFCLOC fehlgeschlagen.
Referenzfehlermeldung:
 Die referenzierte Assemblierung ist nicht auf dem Computer installiert.  .
 
Error - 25.01.2011 23:28:32 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842811
Description = Generate Activation Context ist für C:\Downloads\osam_autorun_manager_5_0_portable\MFC80U.DLL
 fehlgeschlagen.  Referenzfehlermeldung: Der Vorgang wurde erfolgreich beendet.  .
 
Error - 26.01.2011 00:05:55 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842784
Description = Abhängige Assemblierung "Microsoft.VC80.MFCLOC" konnte nicht gefunden
 werden. "Last Error": Die referenzierte Assemblierung ist nicht auf dem Computer
 installiert. 
 
Error - 26.01.2011 00:05:55 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly ist für Microsoft.VC80.MFCLOC fehlgeschlagen.
Referenzfehlermeldung:
 Die referenzierte Assemblierung ist nicht auf dem Computer installiert.  .
 
Error - 26.01.2011 00:05:55 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842811
Description = Generate Activation Context ist für C:\Downloads\osam_autorun_manager_5_0_portable\MFC80U.DLL
 fehlgeschlagen.  Referenzfehlermeldung: Der Vorgang wurde erfolgreich beendet.  .
 
Error - 26.01.2011 00:05:56 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842784
Description = Abhängige Assemblierung "Microsoft.VC80.MFCLOC" konnte nicht gefunden
 werden. "Last Error": Die referenzierte Assemblierung ist nicht auf dem Computer
 installiert. 
 
Error - 26.01.2011 00:05:56 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly ist für Microsoft.VC80.MFCLOC fehlgeschlagen.
Referenzfehlermeldung:
 Die referenzierte Assemblierung ist nicht auf dem Computer installiert.  .
 
Error - 26.01.2011 00:05:56 | Computer Name = JUERGEN | Source = SideBySide | ID = 16842811
Description = Generate Activation Context ist für C:\Downloads\osam_autorun_manager_5_0_portable\MFC80U.DLL
 fehlgeschlagen.  Referenzfehlermeldung: Der Vorgang wurde erfolgreich beendet.  .
 
Error - 26.01.2011 00:42:21 | Computer Name = JUERGEN | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
 wurde angehalten.
 
 
< End of report >
--- --- ---


[/HTML]



Was muss ich den nun als nächstes machen?

Vielen Dank auf jeden Fall schon mal im Voraus :dankeschoen:

Jürgen

cosinus 27.01.2011 09:47
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
SRV - (KMService) -- C:\WINDOWS\system32\srvany.exe ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 206.64.92.16:80
O4 - HKLM..\Run: []  File not found
O33 - MountPoints2\{114d6550-ce73-11df-8075-00904bde961c}\Shell\AutoRun\command - "" = E:\urDrive.exe
O33 - MountPoints2\{114d6551-ce73-11df-8075-00904bde961c}\Shell\AutoRun\command - "" = F:\urDrive.exe
:Files
C:\WINDOWS\tasks\*.job
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

jubauer 27.01.2011 14:10
Hallo Arne,

vielen Dank :dankeschoen:

Habe alles genauso gemacht, wie Du mir gesagt hast.

Hier ist das Logfile.


HTML-Code:
All processes killed
========== OTL ==========
Service KMService stopped successfully!
Service KMService deleted successfully!
C:\WINDOWS\system32\srvany.exe moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{114d6550-ce73-11df-8075-00904bde961c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{114d6550-ce73-11df-8075-00904bde961c}\ not found.
File E:\urDrive.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{114d6551-ce73-11df-8075-00904bde961c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{114d6551-ce73-11df-8075-00904bde961c}\ not found.
File F:\urDrive.exe not found.
========== FILES ==========
C:\WINDOWS\tasks\hpwebreg_xxxxxxxxxx.job moved successfully.
C:\WINDOWS\tasks\User_Feed_Synchronization-{36752CBE-DE6D-46DA-A502-4EE96E8A4C2D}.job moved successfully.
C:\WINDOWS\tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_JUERGEN_Jürgen.job moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Jürgen
 
User: Jürgen
->Temp folder emptied: 1709878 bytes
->Temporary Internet Files folder emptied: 141068684 bytes
->Java cache emptied: 72969 bytes
->Flash cache emptied: 2875746 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 201562305 bytes
%systemroot% .tmp files removed: 2195157 bytes
%systemroot%\System32 .tmp files removed: 2833287 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 32784458 bytes
 
Total Files Cleaned = 367,00 mb
 
 
OTL by OldTimer - Version 3.2.20.6 log created on 01272011_045039

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Kann es sein das es an der Proxyserver Adresse lag, die im Internet Explorer eingetragen war, diese war zwar nicht aktiv, aber habe davon keine Ahnung.....

Aber so wie es aussieht, klappts jetzt wieder ohne umgeleitet zu werden :taenzer:

Vielen Dank für Deine Unterstüzung Arne! :taenzer::taenzer: Ohne diese hätte ich wahrscheinlich den Rechner nochmal platt gemacht.....



Grüße
Jürgen

cosinus 27.01.2011 14:12
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

jubauer 28.01.2011 05:35
Hallo,

habe alles exact so gemacht, wie von Dir vorgeschlagen.

Hier ist nun das Lofgile von ComboFix.


HTML-Code:
Combofix Logfile:
[CODE]ComboFix 11-01-27.02 - Jürgen 27.01.2011  20:18:53.2.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1918.1338 [GMT -8:00]
ausgeführt von:: c:\dokumente und einstellungen\Jürgen\Desktop\cofi.exe
AV: Norton 360 *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

(((((((((((((((((((((((  Dateien erstellt von 2010-12-28 bis 2011-01-28  ))))))))))))))))))))))))))))))
.

2011-01-28 00:24 . 2011-01-28 00:24        --------        d-----w-        c:\programme\CCleaner
2011-01-27 12:50 . 2011-01-27 12:50        --------        d-----w-        C:\_OTL
2011-01-16 15:08 . 2011-01-16 15:55        --------        d-----w-        c:\programme\Microsoft ActiveSync
2011-01-15 03:33 . 2011-01-15 03:33        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Anwendungsdaten\Malwarebytes
2011-01-15 03:33 . 2010-12-21 02:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-15 03:32 . 2011-01-15 03:32        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-01-15 03:32 . 2011-01-15 03:33        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2011-01-15 03:32 . 2010-12-21 02:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-01-12 06:00 . 2007-11-27 11:24        14640        ------w-        c:\windows\system32\spmsgXP_2k3.dll
2011-01-12 05:55 . 2011-01-12 05:55        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\HTC
2011-01-12 05:55 . 2011-01-12 06:01        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Anwendungsdaten\Teleca
2011-01-12 05:53 . 2011-01-12 05:53        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\HTC
2011-01-12 05:53 . 2011-01-12 05:53        --------        d-----w-        c:\programme\Gemeinsame Dateien\Teleca Shared
2011-01-12 05:53 . 2011-01-12 05:53        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Teleca
2011-01-12 05:51 . 2009-06-10 08:49        24576        ----a-w-        c:\windows\system32\drivers\ANDROIDUSB.sys
2011-01-12 05:51 . 2009-06-09 22:41        1122664        ----a-w-        c:\windows\system32\WdfCoInstaller01007.dll
2011-01-12 05:50 . 2011-01-12 05:50        --------        d-----w-        c:\programme\Spirent Communications
2011-01-12 05:49 . 2011-01-12 05:53        --------        d-----w-        c:\programme\HTC
2011-01-12 05:46 . 2011-01-12 05:46        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
2011-01-08 00:15 . 2011-01-16 15:53        --------        d-----w-        c:\programme\Microsoft
2011-01-08 00:15 . 2011-01-10 00:34        --------        d-----w-        c:\programme\Microsoft Silverlight
2011-01-08 00:13 . 2011-01-08 17:44        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Anwendungsdaten\HpUpdate
2011-01-08 00:12 . 2010-06-15 00:04        273256        ------w-        c:\windows\system32\HPDiscoPM5312.dll
2011-01-08 00:12 . 2010-06-14 19:58        1907560        ----a-w-        c:\windows\system32\HPScanMiniDrv_OJ8500_A910.dll
2011-01-08 00:12 . 2010-06-14 19:58        232296        ----a-w-        c:\windows\system32\hpinksts5312.dll
2011-01-08 00:12 . 2010-06-14 19:58        213352        ----a-w-        c:\windows\system32\hpinkcoi5312.dll
2011-01-08 00:12 . 2010-06-14 19:58        264552        ----a-w-        c:\windows\system32\hpinksts5312LM.dll
2011-01-06 01:56 . 2011-01-06 01:56        --------        d-----w-        c:\programme\KMS Activator for Microsoft Office 2010 Applications x86 x64 Multilingual-FIXISO~DiBYA
2011-01-05 02:05 . 2011-01-05 02:05        --------        d-----w-        c:\programme\Microsoft Synchronization Services
2011-01-05 02:03 . 2011-01-05 02:03        --------        d-----w-        c:\programme\Microsoft Sync Framework
2011-01-05 02:03 . 2011-01-05 02:03        --------        d-----w-        c:\programme\Microsoft SQL Server Compact Edition
2011-01-05 02:03 . 2011-01-05 02:03        --------        d-----w-        c:\dokumente und einstellungen\All Users\Microsoft
2011-01-05 02:01 . 2011-01-05 02:01        --------        d-----w-        c:\programme\Microsoft Visual Studio 8
2011-01-05 02:00 . 2011-01-05 02:00        --------        d-----w-        c:\programme\Microsoft Analysis Services
2011-01-05 01:59 . 2011-01-13 03:43        --------        d-----w-        c:\windows\SHELLNEW
2011-01-05 01:57 . 2011-01-05 01:57        --------        d-----r-        C:\MSOCache
2011-01-04 03:00 . 2011-01-04 03:00        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Ahead
2011-01-04 02:06 . 2011-01-04 02:06        --------        d-----w-        c:\windows\system32\1006
2010-12-30 22:14 . 2010-12-30 22:14        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Anwendungsdaten\Ahead
2010-12-30 18:39 . 2010-12-30 18:40        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DAEMON Tools Pro
2010-12-30 18:39 . 2010-12-30 18:39        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Anwendungsdaten\DAEMON Tools Pro
2010-12-30 18:28 . 2010-12-30 18:49        --------        d-----w-        c:\programme\DAEMON Tools Pro
2010-12-30 18:23 . 2010-12-30 18:23        685816        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-12-30 18:08 . 2010-12-30 18:08        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Temp
2010-12-30 18:08 . 2010-12-30 18:08        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
2010-12-30 18:03 . 2010-12-30 18:03        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
2010-12-30 18:03 . 2011-01-05 01:38        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Lokale Einstellungen\Anwendungsdaten\Google
2010-12-30 18:01 . 2011-01-26 04:37        --------        d-----w-        c:\dokumente und einstellungen\Jürgen\Anwendungsdaten\BitComet
2010-12-30 18:01 . 2010-12-30 18:01        --------        d-----w-        c:\programme\BitComet
2010-12-30 18:01 . 2011-01-06 01:22        --------        d-----w-        c:\programme\Google
2010-12-30 14:31 . 2010-12-30 14:31        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2010-09-11 04:58        86016        ----a-w-        c:\windows\system32\isign32.dll
2010-11-09 14:51 . 2004-08-04 12:00        249856        ----a-w-        c:\windows\system32\odbc32.dll
2010-11-06 00:21 . 2004-09-29 18:47        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-11-06 00:21 . 2004-08-04 12:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2010-11-06 00:21 . 2004-08-04 12:00        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2004-08-04 12:00        385024        ----a-w-        c:\windows\system32\html.iec
2010-11-02 15:17 . 2004-08-04 12:00        40960        ----a-w-        c:\windows\system32\drivers\ndproxy.sys
2007-03-13 02:59 . 2007-03-13 02:59        299008        ----a-w-        c:\programme\navigram_register.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2828310E-7769-5CDD-1563-396C44656799}]
2010-09-11 10:31        221184        ----a-w-        c:\windows\system32\SS32EVNT1.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\programme\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Z Cinema.lnk - c:\windows\Installer\{EE885042-228A-446F-A30D-64ECBDC93859}\StartupShortcut_EE885042228A446FA30D64ECBDC93859.exe [2010-9-11 172032]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\ITunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\Programme\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Programme\\BitComet\\BitComet.exe"=
"c:\\Programme\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Programme\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"427:UDP"= 427:UDP:SLP_Port(427)
"11673:TCP"= 11673:TCP:BitComet 11673 TCP
"11673:UDP"= 11673:UDP:BitComet 11673 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.12.2010 10:23 685816]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\symds.sys [24.09.2010 23:27 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\symefa.sys [24.09.2010 23:27 173104]
R1 BHDrvx86;BHDrvx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [18.01.2011 18:03 691248]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\cchpx86.sys [24.09.2010 23:27 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\ironx86.sys [24.09.2010 23:27 116784]
R2 N360;Norton 360;c:\programme\Norton 360\Engine\4.3.0.5\ccsvchst.exe [24.09.2010 23:26 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11.09.2010 02:59 102448]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [10.09.2010 21:22 200192]
R3 IDSxpx86;IDSxpx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110126.001\IDSXpx86.sys [26.01.2011 18:38 341944]
R3 osppsvc;Office Software Protection Platform;c:\programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09.01.2010 20:37 4640000]
R3 ZCinema_TSHD;ZCinema TruSurround HD driver;c:\windows\system32\drivers\ZCinema_SRS_i386.sys [11.09.2010 00:07 21392]
S1 mailKmd;mailKmd; [x]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [11.01.2011 21:51 24576]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\programme\Microsoft Office\Office14\GROOVE.EXE [21.01.2010 17:51 30963576]
S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [30.10.2010 04:34 39704]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [06.01.2010 13:19 57856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.jasc.com/command.asp?app=jasc&function=privacy&lang=German
uInternet Settings,ProxyOverride = *.local
IE: &Alles mit BitComet herunterladen - c:\programme\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Mit BitComet herunter&laden - c:\programme\BitComet\BitComet.exe/AddLink.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-01-27 20:23
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\programme\Norton 360\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\programme\Norton 360\Engine\4.3.0.5\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1715567821-261903793-682003330-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1715567821-261903793-682003330-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{24814FEA-00DA-9347-E0D2-76E5A9E41D8A}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(3348)
c:\progra~1\GEMEIN~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~2\Office14\1031\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2011-01-27  20:26:00
ComboFix-quarantined-files.txt  2011-01-28 04:25

Vor Suchlauf: 12 Verzeichnis(se), 53.371.097.088 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 53.358.325.760 Bytes frei

- - End Of File - - E1EBAB23F5E693D1EC669F3F4A1E0A49
[/CODE]
--- --- ---

Welche Schritte müssen jetzt Unternommen werden?

Auf jeden Fall vielen Dank für die Hilfe.

Grüße

Jürgen

cosinus 28.01.2011 10:35
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

jubauer 29.01.2011 02:04
Hallo Arne,

vielen Dank das Du die ganze Sache wirklich gut beschreibst und mir da zur Seite stehst :dankeschoen:

Hier ist das GMER Log File

[HTML]

GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-28 06:31:21
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHT2080AT rev.0022
Running: fv0q5ndi.exe; Driver: C:\DOKUME~1\JRGEN~1\LOKALE~1\Temp\fwldypob.sys


---- System - GMER 1.0.15 ----

SSDT            894D6050                                                                                                            ZwAlertResumeThread
SSDT            894D7050                                                                                                            ZwAlertThread
SSDT            894C5398                                                                                                            ZwAllocateVirtualMemory
SSDT            894CE050                                                                                                            ZwAssignProcessToJobObject
SSDT            89B66ED0                                                                                                            ZwConnectPort
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                          ZwCreateKey [0xB06AE210]
SSDT            894C4AF8                                                                                                            ZwCreateMutant
SSDT            894C45E0                                                                                                            ZwCreateSymbolicLinkObject
SSDT            89A12648                                                                                                            ZwCreateThread
SSDT            894CF050                                                                                                            ZwDebugActiveProcess
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                          ZwDeleteKey [0xB06AE490]
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                          ZwDeleteValueKey [0xB06AE9F0]
SSDT            894C54F0                                                                                                            ZwDuplicateObject
SSDT            sptd.sys                                                                                                            ZwEnumerateKey [0xB9EC3FB2]
SSDT            sptd.sys                                                                                                            ZwEnumerateValueKey [0xB9EC4340]
SSDT            894C51F8                                                                                                            ZwFreeVirtualMemory
SSDT            894D4050                                                                                                            ZwImpersonateAnonymousToken
SSDT            894D5050                                                                                                            ZwImpersonateThread
SSDT            89B71E58                                                                                                            ZwLoadDriver
SSDT            89B453C0                                                                                                            ZwMapViewOfSection
SSDT            894D3050                                                                                                            ZwOpenEvent
SSDT            sptd.sys                                                                                                            ZwOpenKey [0xB9EBE0B0]
SSDT            894C5690                                                                                                            ZwOpenProcess
SSDT            89A633B8                                                                                                            ZwOpenProcessToken
SSDT            894D1050                                                                                                            ZwOpenSection
SSDT            894C55C0                                                                                                            ZwOpenThread
SSDT            894C46B0                                                                                                            ZwProtectVirtualMemory
SSDT            sptd.sys                                                                                                            ZwQueryKey [0xB9EC4418]
SSDT            sptd.sys                                                                                                            ZwQueryValueKey [0xB9EC4298]
SSDT            894D8050                                                                                                            ZwResumeThread
SSDT            89A6C1B0                                                                                                            ZwSetContextThread
SSDT            894C4008                                                                                                            ZwSetInformationProcess
SSDT            894D0050                                                                                                            ZwSetSystemInformation
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                          ZwSetValueKey [0xB06AEC40]
SSDT            894D2050                                                                                                            ZwSuspendProcess
SSDT            894D9050                                                                                                            ZwSuspendThread
SSDT            89A6F910                                                                                                            ZwTerminateProcess
SSDT            894DA050                                                                                                            ZwTerminateThread
SSDT            89A23C90                                                                                                            ZwUnmapViewOfSection
SSDT            894C52C8                                                                                                            ZwWriteVirtualMemory

Code            \??\C:\DOKUME~1\JRGEN~1\LOKALE~1\Temp\catchme.sys                                                                  pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 2488                                                                                80501CC0 4 Bytes  JMP 6504CD2F
?              C:\WINDOWS\system32\drivers\sptd.sys                                                                                Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
?              SYMDS.SYS                                                                                                          Das System kann die angegebene Datei nicht finden. !
?              SYMEFA.SYS                                                                                                          Das System kann die angegebene Datei nicht finden. !
.text          USBPORT.SYS!DllUnload                                                                                              B8EE48AC 5 Bytes  JMP 89B64770
init            C:\WINDOWS\system32\drivers\tifm21.sys                                                                              entry point in "init" section [0xB8E0A23F]
?              System32\Drivers\alwp58b5.SYS                                                                                      Das System kann den angegebenen Pfad nicht finden. !
?              C:\WINDOWS\system32\Drivers\PROCEXP113.SYS                                                                          Das System kann die angegebene Datei nicht finden. !
?              C:\DOKUME~1\JRGEN~1\LOKALE~1\Temp\catchme.sys                                                                      Das System kann die angegebene Datei nicht finden. !

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                  [B9EBEAD4] sptd.sys
IAT            atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                          [B9EBEC1A] sptd.sys
IAT            atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                [B9EBEB9C] sptd.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                        [B9EBF748] sptd.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                [B9EBF61E] sptd.sys
IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                  [B9ED429A] sptd.sys

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              89D6C1E8

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                            SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          \Driver\usbohci \Device\USBPDO-0                                                                                    89B8B1E8
Device          \Driver\usbohci \Device\USBPDO-1                                                                                    89B8B1E8
Device          \Driver\usbehci \Device\USBPDO-2                                                                                    89B8C1E8
Device          \Driver\PCI_NTPNP2568 \Device\00000053                                                                              sptd.sys

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                          SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                              89D011E8
Device          \Driver\Cdrom \Device\CdRom0                                                                                        89A4F698
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                        [B9E19B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  [B9E19B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  [B9E19B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e                                                                        [B9E19B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\Cdrom \Device\CdRom1                                                                                        89A4F698
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                            89A2D790
Device          \Driver\NetBT \Device\NetBT_Tcpip_{08025741-828A-4BCE-AE7F-DEFD156D956D}                                            89A2D790
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                    89A2D790

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                          SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                        SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\usbohci \Device\USBFDO-0                                                                                    89B8B1E8
Device          \Driver\usbohci \Device\USBFDO-1                                                                                    89B8B1E8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                  89A9D790
Device          \Driver\usbehci \Device\USBFDO-2                                                                                    89B8C1E8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                        89A9D790
Device          \Driver\Ftdisk \Device\FtControl                                                                                    89D011E8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{9A336E63-BBCF-42C3-9421-81281251841A}                                            89A2D790
Device          \Driver\alwp58b5 \Device\Scsi\alwp58b51Port2Path0Target0Lun0                                                        89AB6790
Device          \Driver\alwp58b5 \Device\Scsi\alwp58b51                                                                            89AB6790
Device          \FileSystem\Cdfs \Cdfs                                                                                              88D3E790

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Programme\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x0E 0x94 0xEF 0x3C ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0xF3 0x66 0xA0 0x05 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x37 0xD6 0x01 0x52 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Programme\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x0E 0x94 0xEF 0x3C ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xF3 0x66 0xA0 0x05 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x37 0xD6 0x01 0x52 ...
Reg            HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{24814FEA-00DA-9347-E0D2-76E5A9E41D8A}   

---- EOF - GMER 1.0.15 ----
--- --- ---



Hier ist das OSAM Logfile

HTML-Code:
OSAM Logfile:
[CODE]Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:56:27 on 28.01.2011

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File signed by Microsoft | File found, but it contains no detailed information)
"BCMWLCPL.CPL" - "Broadcom Corporation" - C:\WINDOWS\system32\BCMWLCPL.CPL
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
"TSSMPM" - "Teleca Sweden AB" - C:\Programme\HTC\HTC Sync\Mobile Phone Monitor\tssmpm.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AEGIS Protocol (IEEE 802.1x) v3.2.0.3" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys
"axt4cbws" (axt4cbws) - ? - C:\WINDOWS\system32\drivers\axt4cbws.sys  (Hidden registry entry, rootkit activity | File not found)
"BHDrvx86" (BHDrvx86) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110114.001\BHDrvx86.sys
"catchme" (catchme) - ? - C:\DOKUME~1\JRGEN~1\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"EraserUtilRebootDrv" (EraserUtilRebootDrv) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
"Hotkey" (Hotkey) - ? - C:\WINDOWS\system32\drivers\Hotkey.sys  (File found, but it contains no detailed information)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"IDSxpx86" (IDSxpx86) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110126.001\IDSxpx86.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"mailKmd" (mailKmd) - ? - C:\WINDOWS\system32\drivers\mailKmd.sys  (File not found)
"NAVENG" (NAVENG) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110126.035\NAVENG.SYS
"NAVEX15" (NAVEX15) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110126.035\NAVEX15.SYS
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"Symantec Data Store" (SymDS) - "Symantec Corporation" - C:\WINDOWS\System32\drivers\N360\0403000.005\SYMDS.SYS
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
"Symantec Extended File Attributes" (SymEFA) - "Symantec Corporation" - C:\WINDOWS\System32\drivers\N360\0403000.005\SYMEFA.SYS
"Symantec Hash Provider" (ccHP) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\N360\0403000.005\ccHPx86.sys
"Symantec Iron Driver" (SymIRON) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\N360\0403000.005\Ironx86.SYS
"Symantec Network Dispatch Driver" (SYMTDI) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\N360\0403000.005\SYMTDI.SYS
"Symantec Real Time Storage Protection" (SRTSP) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\N360\0403000.005\SRTSP.SYS
"Symantec Real Time Storage Protection (PEL)" (SRTSPX) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\N360\0403000.005\SRTSPX.SYS
"SymEvent" (SymEvent) - "Symantec Corporation" - C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
"Wbutton" (Wbutton) - ? - C:\WINDOWS\system32\drivers\Wbutton.sys  (File not found)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{4EB37360-49E8-11D3-95B5-004033382980} "ALZip 7.0 Context Menu Shell Extension" - "ESTsoft Corp." - C:\Programme\ESTsoft\ALZip\AZCTM.dll
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\VISSHE.DLL
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\VISSHE.DLL
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLSHEXT.DLL
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\OLKFSTUB.DLL
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Workspaces" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "{555D4D79-4BD2-4094-A395-CFC534424A05}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Norton Toolbar" - "Symantec Corporation" - C:\Programme\Norton 360\Engine\4.3.0.5\coIEPlg.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{0067DBFC-A752-458C-AE6E-B9C7E63D4824} "Geräteerkennung" - "Logitech, Inc." - C:\WINDOWS\DOWNLO~1\LOGITE~1.OCX / hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{6E718D87-6909-4FCE-92D4-EDCB2F725727} "Navigram Control" - "Navigram" - C:\Programme\Navigram\NavigramEngine\navigram.ocx / hxxp://www.navigram.com/engine/v1026/Navigram.cab
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}" - ? -  (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll
"BitComet" - ? - res://C:\Programme\BitComet\tools\BitCometBHO_1.4.12.6.dll/206  (File not found)
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} "Norton Toolbar" - "Symantec Corporation" - C:\Programme\Norton 360\Engine\4.3.0.5\coIEPlg.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{2828310E-7769-5CDD-1563-396C44656799} "Adobe PDF Link Helper" - ? - C:\WINDOWS\system32\SS32EVNT1.DLL  (File found, but it contains no detailed information)
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} "BitComet Helper" - "BitComet" - C:\Programme\BitComet\tools\BitCometBHO_1.4.12.6.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
{6D53EC84-6AAE-4787-AEEE-F4628F01010C} "Symantec Intrusion Prevention" - "Symantec Corporation" - C:\Programme\Norton 360\Engine\4.3.0.5\IPSBHO.DLL
{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} "Symantec NCO BHO" - "Symantec Corporation" - C:\Programme\Norton 360\Engine\4.3.0.5\coIEPlg.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Z Cinema.lnk" - "Logitech(c)" - C:\Programme\Logitech\Z Cinema\Z Cinema.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Jürgen\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Pro Agent" - "DT Soft Ltd." - "C:\Programme\DAEMON Tools Pro\DTProAgent.exe"

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"Broadcom Logon Provider" - "Broadcom Corporation" - C:\WINDOWS\System32\BCMLogon.dll

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Bullzip PDF Print Monitor" - "Bullzip" - C:\WINDOWS\system32\bzpdf.dll
"HP Discovery Port Monitor (HP Officejet Pro 8500 A910)" - "Hewlett-Packard Co." - C:\WINDOWS\system32\HPDiscoPM5312.dll
"PCL Language Monitor" - "Hewlett-Packard Company" - C:\WINDOWS\system32\hpz3l692.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Broadcom Wireless LAN Tray Service" (wltrysvc) - ? - C:\WINDOWS\System32\wltrysvc.exe  (File found, but it contains no detailed information)
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\GROOVE.EXE
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZinw12.dll
"Norton 360" (N360) - "Symantec Corporation" - C:\Programme\Norton 360\Engine\4.3.0.5\ccSvcHst.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZipm12.dll
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
[/CODE]
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Hier ist das MBR Check Logfile

HTML-Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows XP Home Edition
Windows Information:                Service Pack 3 (build 2600)
Logical Drives Mask:                0x0000001c

Kernel Drivers (total 155):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806D1000 \WINDOWS\system32\hal.dll
  0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
  0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
  0xB9EBD000 sptd.sys
  0xBA5AA000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xB9EA5000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xB9E76000 ACPI.sys
  0xB9E65000 pci.sys
  0xBA0A8000 ohci1394.sys
  0xBA0B8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xBA0C8000 isapnp.sys
  0xBA4BC000 compbatt.sys
  0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
  0xBA670000 pciide.sys
  0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xB9E47000 pcmcia.sys
  0xBA0D8000 MountMgr.sys
  0xB9E28000 ftdisk.sys
  0xBA4C4000 ACPIEC.sys
  0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
  0xBA330000 PartMgr.sys
  0xBA0E8000 VolSnap.sys
  0xB9E10000 atapi.sys
  0xBA0F8000 disk.sys
  0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xB9DF0000 fltmgr.sys
  0xB9D9A000 SYMDS.SYS
  0xB9D88000 sr.sys
  0xB9D5B000 SYMEFA.SYS
  0xB9D44000 KSecDD.sys
  0xB9CB7000 Ntfs.sys
  0xB9C8A000 NDIS.sys
  0xB9C70000 Mup.sys
  0xBA2E8000 \SystemRoot\system32\DRIVERS\AmdK8.sys
  0xB9C2B000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0xB8E11000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
  0xB8DFD000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xBA3E0000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xB8DD9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xBA3E8000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xBA308000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xBA318000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA128000 \SystemRoot\system32\DRIVERS\redbook.sys
  0xB8DB6000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA3F0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0xBA138000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xBA3F8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xB8D87000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0xBA5E2000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xBA400000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xB9C27000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0xB8D2C000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
  0xB8D1A000 \SystemRoot\system32\DRIVERS\Rtlnicxp.sys
  0xBA148000 \SystemRoot\system32\DRIVERS\nic1394.sys
  0xB8CF6000 \SystemRoot\system32\drivers\tifm21.sys
  0xB8AC0000 \SystemRoot\system32\drivers\ALCXWDM.SYS
  0xB8A9C000 \SystemRoot\system32\drivers\portcls.sys
  0xBA158000 \SystemRoot\system32\drivers\drmk.sys
  0xB8A6B000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
  0xB896D000 \SystemRoot\system32\DRIVERS\HSF_DP.sys
  0xB88C1000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
  0xBA408000 \SystemRoot\System32\Drivers\Modem.SYS
  0xB8859000 \SystemRoot\System32\Drivers\axt4cbws.SYS
  0xBA74E000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA178000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xB9749000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xB8842000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xBA188000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA198000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xBA470000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB8831000 \SystemRoot\system32\DRIVERS\psched.sys
  0xBA1A8000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xBA478000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xBA480000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA1B8000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xBA5F6000 \SystemRoot\system32\DRIVERS\serscan.sys
  0xBA5F8000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB87D3000 \SystemRoot\system32\DRIVERS\update.sys
  0xB9741000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xBA1C8000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB8F97000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xBA610000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xBA799000 \SystemRoot\System32\Drivers\Null.SYS
  0xBA612000 \SystemRoot\System32\Drivers\Beep.SYS
  0xBA360000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xBA368000 \SystemRoot\System32\drivers\vga.sys
  0xBA614000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xBA616000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xBA370000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xBA378000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xBA5A0000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB0758000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB06FF000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB06A8000 \SystemRoot\System32\Drivers\N360\0403000.005\SYMTDI.SYS
  0xB0683000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
  0xB065D000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xB8F47000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB8F37000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0xB05DD000 \??\C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110126.001\IDSxpx86.sys
  0xB05B5000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xB0593000 \SystemRoot\System32\drivers\afd.sys
  0xB8F27000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xB04D4000 \SystemRoot\system32\drivers\N360\0403000.005\Ironx86.SYS
  0xBA1E8000 \SystemRoot\system32\drivers\N360\0403000.005\SRTSPX.SYS
  0xB04A9000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xB0439000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB9C1F000 \SystemRoot\System32\Drivers\Hotkey.SYS
  0xBA1F8000 \SystemRoot\System32\Drivers\Fips.SYS
  0xB03DB000 \??\C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
  0xB03BE000 \??\C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
  0xB033F000 \SystemRoot\system32\drivers\N360\0403000.005\ccHPx86.sys
  0xB0293000 \??\C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110114.001\BHDrvx86.sys
  0xBA218000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xBA3C8000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0xB87B7000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0xBA248000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xBA258000 \SystemRoot\system32\drivers\usbaudio.sys
  0xB87B3000 \SystemRoot\system32\drivers\ZCinema_SRS_i386.sys
  0xBA268000 \SystemRoot\system32\drivers\tshd4_kern_i386.sys
  0xB87AF000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xB9729000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0xB0253000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xBA636000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xB0651000 \SystemRoot\System32\drivers\Dxapi.sys
  0xBA3D8000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xBA75B000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32\ati2dvag.dll
  0xBF04E000 \SystemRoot\System32\ati2cqag.dll
  0xBF080000 \SystemRoot\System32\atikvmag.dll
  0xBF0B2000 \SystemRoot\System32\ati3duag.dll
  0xBF2E3000 \SystemRoot\System32\ativvaxx.dll
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xAE06F000 \SystemRoot\system32\DRIVERS\AegisP.sys
  0xAE00F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xADCEE000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xADDD7000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
  0xADB7E000 \SystemRoot\system32\DRIVERS\srv.sys
  0xADB41000 \SystemRoot\system32\drivers\wdmaud.sys
  0xADDAB000 \SystemRoot\system32\drivers\sysaudio.sys
  0xAD42C000 \SystemRoot\System32\Drivers\N360\0403000.005\SRTSP.SYS
  0xAD129000 \??\C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110126.035\NAVEX15.SYS
  0xAD075000 \??\C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110126.035\NAVENG.SYS
  0xBA5D8000 \SystemRoot\system32\drivers\splitter.sys
  0xAD0A9000 \SystemRoot\system32\drivers\swmidi.sys
  0xAD099000 \SystemRoot\system32\drivers\DMusic.sys
  0xBA7C9000 \SystemRoot\system32\drivers\drmkaud.sys
  0xAD0F9000 \SystemRoot\system32\DRIVERS\SCR3XX2K.sys
  0xB9BFB000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS
  0xACCEE000 \SystemRoot\System32\Drivers\HTTP.sys
  0xACD3B000 \SystemRoot\system32\DRIVERS\asyncmac.sys
  0xAC605000 \SystemRoot\system32\drivers\kmixer.sys
  0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 40):
      0 System Idle Process
      4 System
    664 C:\WINDOWS\system32\smss.exe
    732 csrss.exe
    768 C:\WINDOWS\system32\winlogon.exe
    812 C:\WINDOWS\system32\services.exe
    824 C:\WINDOWS\system32\lsass.exe
    976 C:\WINDOWS\system32\ati2evxx.exe
    1012 C:\WINDOWS\system32\svchost.exe
    1068 svchost.exe
    1144 C:\WINDOWS\system32\svchost.exe
    1244 svchost.exe
    1336 svchost.exe
    1612 C:\WINDOWS\system32\WLTRYSVC.EXE
    1628 C:\WINDOWS\system32\BCMWLTRY.EXE
    1696 C:\WINDOWS\system32\spoolsv.exe
    1744 scardsvr.exe
    1800 svchost.exe
    1832 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    1848 C:\Programme\Bonjour\mDNSResponder.exe
    1888 C:\Programme\Java\jre6\bin\jqs.exe
    2012 C:\Programme\Norton 360\Engine\4.3.0.5\ccsvchst.exe
    356 C:\WINDOWS\system32\ati2evxx.exe
    424 C:\WINDOWS\explorer.exe
    580 C:\WINDOWS\system32\svchost.exe
    604 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
    476 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    1920 C:\Programme\Norton 360\Engine\4.3.0.5\ccsvchst.exe
    2576 C:\Programme\DAEMON Tools Pro\DTProAgent.exe
    2696 C:\Programme\Logitech\Z Cinema\Z Cinema.exe
    2700 C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE
    2728 C:\Programme\Internet Explorer\iexplore.exe
    2732 C:\Programme\StarMoney 5.0 S-Edition\StarMoney.exe
    2788 C:\WINDOWS\system32\ctfmon.exe
    816 OSPPSVC.EXE
    2976 C:\Programme\Internet Explorer\iexplore.exe
    3092 C:\Programme\Internet Explorer\iexplore.exe
    744 C:\Programme\Internet Explorer\iexplore.exe
    2940 C:\WINDOWS\system32\wuauclt.exe
    1256 C:\Dokumente und Einstellungen\Jürgen\Desktop\AntyMaleWareProgramm\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHT2080AT, Rev: 0022   

      Size  Device Name          MBR Status
  --------------------------------------------
    74 GB  \\.\PhysicalDrive0  Windows XP MBR code detected
            SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11


Done!
Wie geht es den nun weiter Arne?

Vielen vielen Dank auf jeden Fall für die Hilfe :dankeschoen:
Jürgen

cosinus 30.01.2011 13:21
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:39 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27