Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Logs sauber? Bitte überprüfen (https://www.trojaner-board.de/85939-logs-sauber-bitte-ueberpruefen.html)

shorts77 10.05.2010 14:11
Logs sauber? Bitte überprüfen
 
hallo,
ich hatte auf meinem notebook wohl ein rootkit wesewegen ich es jetzt formatieren werde. gmer hat zumindest behauptet die atapi.sys wäre verändert (evtl. durch emulationssoftware vielleicht?) combofix meinte dann noch tdx.sys wäre verdächtig und hat das gelöscht...alle haben sie aber keinerlei angaben über die rootkitart gemacht. eine exe datei die wohl oldot.exe sein sollte hat er auch gelöscht...

hier geht es aber um meinen office pc.
anbei füge ich logs von diesem pc auf dem egtl nichts passiert sein sollte mit der bitte drüberzusehen.

symantec endpoint protection findet nichts
eset online scanner findet nichts
superantispyware findet nichts bis auf ein paar cookies

im otl log lese ich was von steelwerks direkt nachdem ich combofix ausgeführt habe..hat wohl was mit uer acls etc zu tun. nutzt combofix das?

die dateiinfo der drei steelwerx files sagt jeweils freeware implementation....by frank staal
edit: scheint wohl von combofix zu kommen- habe gerade einen passenden eintrag ergoogelt.


OTL LOG

Code:
OTL logfile created on: 10.05.2010 14:49:50 - Run 1
OTL by OldTimer - Version 3.2.4.1    Folder = C:\Dokumente und Einstellungen\xxxDesktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 35,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 42,32 Gb Free Space | 56,79% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive I: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive M: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive P: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive S: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive T: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive U: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
 
Computer Name: xxx
Current User Name: xxx
NOT logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Prevx\prevx.exe (Prevx)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Programme\Symantec AntiVirus\SmcGui.exe (Symantec Corporation)
PRC - C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe (Symantec Corporation)
PRC - C:\Programme\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Programme\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
PRC - C:\Programme\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
PRC - C:\Programme\Spybot - Search & Destroy\SDUpdate.exe (Safer Networking Limited)
PRC - C:\Programme\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
 
========== Driver Services (SafeList) ==========
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.74
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.05.10 12:07:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.05.10 12:07:40 | 000,000,000 | ---D | M]
 
[2009.03.30 14:54:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions
[2010.05.10 12:25:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\extensions
[2010.05.10 12:09:23 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.05.10 12:11:39 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.05.10 12:25:04 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2007.04.03 15:14:56 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.09.13 00:05:42 | 000,124,240 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\CCMSDK.dll
[2009.09.13 00:06:22 | 000,070,488 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\CgpCore.dll
[2009.09.13 00:06:32 | 000,091,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\confmgr.dll
[2009.09.13 00:06:28 | 000,022,360 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\ctxlogging.dll
[2009.09.13 00:08:36 | 000,406,864 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\npicaN.dll
[2005.06.25 17:08:08 | 006,153,728 | ---- | M] (VideoLAN Team) -- C:\Programme\Mozilla Firefox\plugins\npvlc.dll
[2009.09.13 00:06:24 | 000,023,896 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\TcpPServ.dll
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.04.21 08:49:27 | 000,305,259 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 10509 more lines...
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\WINDOWS\system32\PxSecure.dll (Prevx)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Programme\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [Symantec Backup Exec System Recovery 2010] C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [vmware-tray] C:\Programme\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office 2003\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Programme\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Programme\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O15 - HKCU\..Trusted Domains: google.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: google.com ([mail] https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: immobilienscout24.de ([www] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: superantispyware.com ([www] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Vertrauenswürdige Sites)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1241594555898 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab (DLC Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_18)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xxxSYSTEM.DE
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.dll - C:\Programme\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.03.24 14:43:07 | 000,000,031 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.10 14:49:08 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe
[2010.05.10 12:15:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\Downloads
[2010.05.10 11:20:46 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.05.10 11:19:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.05.10 11:07:53 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\xxx\Recent
[2010.05.10 10:51:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
[2010.05.10 10:50:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\SUPERAntiSpyware.com
[2010.05.10 10:50:49 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2010.05.10 10:50:30 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
[2010.05.10 09:27:31 | 000,061,440 | ---- | C] (Prevx) -- C:\WINDOWS\System32\PxSecure.dll
[2010.05.10 09:27:30 | 000,054,792 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys
[2010.05.10 09:27:30 | 000,030,320 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys
[2010.05.10 09:27:30 | 000,024,400 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys
[2010.05.10 09:27:29 | 000,000,000 | ---D | C] -- C:\Programme\Prevx
[2010.05.10 09:27:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PrevxCSI
[2010.05.10 09:13:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Malwarebytes
[2010.05.10 09:13:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.05.10 09:13:09 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.05.10 09:13:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.05.10 09:13:08 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.05.10 09:10:32 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2010.05.06 12:39:16 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.05.06 12:39:16 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.05.06 12:39:16 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.05.06 12:39:16 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.05.06 12:39:08 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010.05.06 12:39:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[34 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.10 14:49:11 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe
[2010.05.10 14:03:02 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.05.10 12:14:37 | 000,023,773 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.05.10 12:14:33 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.05.10 12:14:22 | 000,000,280 | -HS- | M] () -- C:\Dokumente und Einstellungen\xxx\ntuser.ini
[2010.05.10 12:14:08 | 005,505,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\NTUSER.DAT
[2010.05.10 12:07:50 | 000,001,572 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.05.10 11:36:11 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 11:35:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 11:32:20 | 005,367,202 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.05.10 11:22:17 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.05.10 11:21:41 | 000,002,433 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\HiJackThis.lnk
[2010.05.10 11:14:07 | 000,000,624 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.10 11:14:07 | 000,000,335 | -HS- | M] () -- C:\boot.ini
[2010.05.10 11:14:07 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.05.10 11:00:35 | 000,001,518 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\CCleaner.lnk
[2010.05.10 10:50:52 | 000,000,758 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.05.10 09:27:31 | 000,061,440 | ---- | M] (Prevx) -- C:\WINDOWS\System32\PxSecure.dll
[2010.05.10 09:27:30 | 000,054,792 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys
[2010.05.10 09:27:30 | 000,030,320 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys
[2010.05.10 09:27:30 | 000,024,400 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys
[2010.05.10 09:27:19 | 000,000,049 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.05.10 09:13:13 | 000,000,682 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.04.29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.04.26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010.04.20 15:05:45 | 010,719,027 | ---- | M] () -- C:\cop.zip
[2010.04.14 05:07:10 | 000,001,893 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk
[34 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.05.10 12:07:50 | 000,001,572 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.05.10 11:20:47 | 000,002,433 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\HiJackThis.lnk
[2010.05.10 11:17:53 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010.05.10 11:00:35 | 000,001,518 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\CCleaner.lnk
[2010.05.10 10:50:52 | 000,000,758 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.05.10 09:27:19 | 000,000,049 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010.05.10 09:13:13 | 000,000,682 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.06 12:39:16 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.05.06 12:39:16 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.05.06 12:39:16 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.05.06 12:39:16 | 000,077,312 | R--- | C] () -- C:\WINDOWS\MBR.exe
[2010.05.06 12:39:16 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.04.14 05:07:10 | 000,001,893 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk
[2009.11.04 16:33:21 | 000,055,856 | R--- | C] () -- C:\WINDOWS\System32\vnetinst.dll
[2009.03.18 17:17:32 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2009.03.18 17:16:34 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2008.05.26 23:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008.05.26 23:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008.05.26 23:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008.05.23 23:18:45 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL
[2007.08.06 13:07:30 | 000,008,784 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll
[2007.07.06 14:04:07 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007.07.06 14:04:07 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2007.05.23 15:12:35 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2007.05.22 16:40:36 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2007.04.12 16:42:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2007.04.03 15:00:23 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2007.04.03 14:52:49 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.03.05 13:34:28 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007.02.23 11:27:53 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2007.02.23 11:25:48 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2007.02.23 11:08:28 | 000,001,124 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.03.30 10:46:22 | 000,029,035 | ---- | C] () -- C:\WINDOWS\cstasp.ini
[2001.10.28 17:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2001.03.30 22:58:36 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\Property.dll
< End of report >
OTL EXTRAS

Code:
OTL logfile created on: 10.05.2010 14:49:50 - Run 1
OTL by OldTimer - Version 3.2.4.1    Folder = C:\Dokumente und Einstellungen\xxxDesktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 35,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 42,32 Gb Free Space | 56,79% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive I: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive M: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive P: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive S: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive T: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
Drive U: | 465,66 Gb Total Space | 205,88 Gb Free Space | 44,21% Space Free | Partition Type: NTFS
 
Computer Name: xxx
Current User Name: xxx
NOT logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Prevx\prevx.exe (Prevx)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Programme\Symantec AntiVirus\SmcGui.exe (Symantec Corporation)
PRC - C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe (Symantec Corporation)
PRC - C:\Programme\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Programme\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
PRC - C:\Programme\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
PRC - C:\Programme\Spybot - Search & Destroy\SDUpdate.exe (Safer Networking Limited)
PRC - C:\Programme\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
 
========== Driver Services (SafeList) ==========
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.74
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.05.10 12:07:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.05.10 12:07:40 | 000,000,000 | ---D | M]
 
[2009.03.30 14:54:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions
[2010.05.10 12:25:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\extensions
[2010.05.10 12:09:23 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.05.10 12:11:39 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.05.10 12:25:04 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2007.04.03 15:14:56 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009.09.13 00:05:42 | 000,124,240 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\CCMSDK.dll
[2009.09.13 00:06:22 | 000,070,488 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\CgpCore.dll
[2009.09.13 00:06:32 | 000,091,480 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\confmgr.dll
[2009.09.13 00:06:28 | 000,022,360 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\ctxlogging.dll
[2009.09.13 00:08:36 | 000,406,864 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\npicaN.dll
[2005.06.25 17:08:08 | 006,153,728 | ---- | M] (VideoLAN Team) -- C:\Programme\Mozilla Firefox\plugins\npvlc.dll
[2009.09.13 00:06:24 | 000,023,896 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\TcpPServ.dll
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.04.21 08:49:27 | 000,305,259 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 10509 more lines...
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\WINDOWS\system32\PxSecure.dll (Prevx)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Programme\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [Symantec Backup Exec System Recovery 2010] C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [vmware-tray] C:\Programme\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office 2003\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Programme\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Programme\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O15 - HKCU\..Trusted Domains: google.com ([]* in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: google.com ([mail] https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: immobilienscout24.de ([www] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: superantispyware.com ([www] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Vertrauenswürdige Sites)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1241594555898 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab (DLC Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_18)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xxxSYSTEM.DE
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.dll - C:\Programme\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.03.24 14:43:07 | 000,000,031 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.10 14:49:08 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe
[2010.05.10 12:15:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\Downloads
[2010.05.10 11:20:46 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.05.10 11:19:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.05.10 11:07:53 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\xxx\Recent
[2010.05.10 10:51:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
[2010.05.10 10:50:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\SUPERAntiSpyware.com
[2010.05.10 10:50:49 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware
[2010.05.10 10:50:30 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
[2010.05.10 09:27:31 | 000,061,440 | ---- | C] (Prevx) -- C:\WINDOWS\System32\PxSecure.dll
[2010.05.10 09:27:30 | 000,054,792 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys
[2010.05.10 09:27:30 | 000,030,320 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys
[2010.05.10 09:27:30 | 000,024,400 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys
[2010.05.10 09:27:29 | 000,000,000 | ---D | C] -- C:\Programme\Prevx
[2010.05.10 09:27:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PrevxCSI
[2010.05.10 09:13:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Malwarebytes
[2010.05.10 09:13:10 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.05.10 09:13:09 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.05.10 09:13:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.05.10 09:13:08 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.05.10 09:10:32 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2010.05.06 12:39:16 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.05.06 12:39:16 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.05.06 12:39:16 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.05.06 12:39:16 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.05.06 12:39:08 | 000,000,000 | --SD | C] -- C:\ComboFix
[2010.05.06 12:39:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[34 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.10 14:49:11 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe
[2010.05.10 14:03:02 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.05.10 12:14:37 | 000,023,773 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010.05.10 12:14:33 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.05.10 12:14:22 | 000,000,280 | -HS- | M] () -- C:\Dokumente und Einstellungen\xxx\ntuser.ini
[2010.05.10 12:14:08 | 005,505,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\NTUSER.DAT
[2010.05.10 12:07:50 | 000,001,572 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.05.10 11:36:11 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.05.10 11:35:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.05.10 11:32:20 | 005,367,202 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.05.10 11:22:17 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.05.10 11:21:41 | 000,002,433 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\HiJackThis.lnk
[2010.05.10 11:14:07 | 000,000,624 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.05.10 11:14:07 | 000,000,335 | -HS- | M] () -- C:\boot.ini
[2010.05.10 11:14:07 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.05.10 11:00:35 | 000,001,518 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\CCleaner.lnk
[2010.05.10 10:50:52 | 000,000,758 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.05.10 09:27:31 | 000,061,440 | ---- | M] (Prevx) -- C:\WINDOWS\System32\PxSecure.dll
[2010.05.10 09:27:30 | 000,054,792 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys
[2010.05.10 09:27:30 | 000,030,320 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys
[2010.05.10 09:27:30 | 000,024,400 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys
[2010.05.10 09:27:19 | 000,000,049 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.05.10 09:13:13 | 000,000,682 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.04.29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.04.29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.04.26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010.04.20 15:05:45 | 010,719,027 | ---- | M] () -- C:\cop.zip
[2010.04.14 05:07:10 | 000,001,893 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk
[34 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.05.10 12:07:50 | 000,001,572 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2010.05.10 11:20:47 | 000,002,433 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\HiJackThis.lnk
[2010.05.10 11:17:53 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010.05.10 11:00:35 | 000,001,518 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\CCleaner.lnk
[2010.05.10 10:50:52 | 000,000,758 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.05.10 09:27:19 | 000,000,049 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010.05.10 09:13:13 | 000,000,682 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.06 12:39:16 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.05.06 12:39:16 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.05.06 12:39:16 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.05.06 12:39:16 | 000,077,312 | R--- | C] () -- C:\WINDOWS\MBR.exe
[2010.05.06 12:39:16 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.04.14 05:07:10 | 000,001,893 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Earth.lnk
[2009.11.04 16:33:21 | 000,055,856 | R--- | C] () -- C:\WINDOWS\System32\vnetinst.dll
[2009.03.18 17:17:32 | 000,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2009.03.18 17:16:34 | 000,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2008.05.26 23:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008.05.26 23:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008.05.26 23:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008.05.23 23:18:45 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL
[2007.08.06 13:07:30 | 000,008,784 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll
[2007.07.06 14:04:07 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2007.07.06 14:04:07 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2007.05.23 15:12:35 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2007.05.22 16:40:36 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2007.04.12 16:42:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2007.04.03 15:00:23 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2007.04.03 14:52:49 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.03.05 13:34:28 | 000,676,224 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2007.02.23 11:27:53 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2007.02.23 11:25:48 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2007.02.23 11:08:28 | 000,001,124 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.03.30 10:46:22 | 000,029,035 | ---- | C] () -- C:\WINDOWS\cstasp.ini
[2001.10.28 17:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2001.03.30 22:58:36 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\Property.dll
< End of report >
HJT

Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:21:58, on 10.05.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Symantec AntiVirus\Smc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\LogMeIn\x86\RaMaint.exe
C:\Programme\LogMeIn\x86\LogMeIn.exe
C:\Programme\LogMeIn\x86\LMIGuardian.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\vmnat.exe
C:\Programme\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Programme\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\LogMeIn\x86\LogMeInSystray.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\VMware\VMware Workstation\vmware-tray.exe
C:\Programme\Citrix\ICA Client\concentr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe
C:\Programme\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Citrix\ICA Client\wfcrun32.exe
C:\Programme\Symantec AntiVirus\SmcGui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Programme\Prevx\prevx.exe
C:\Programme\Prevx\prevx.exe
C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\windows-kb890830-v3.6-delta.exe
c:\4a3c5e67e19194cd26cc1e\mrtstub.exe
C:\WINDOWS\system32\MRT.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Programme\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://xxxx-9:30464/xxxxsportal
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SafeOnline BHO - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\WINDOWS\system32\PxSecure.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAShCut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programme\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [vmware-tray] "C:\Programme\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Programme\Citrix\ICA Client\concentr.exe" /startup
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Backup Exec System Recovery 2010] "C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programme\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\programme\vmware\vmware workstation\vsocklib.dll
O15 - Trusted Zone: hxxp://www.immobilienscout24.de
O15 - Trusted Zone: hxxp://www.superantispyware.com
O15 - Trusted IP range: hxxp://217.175.232.208
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1241594555898
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - hxxp://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xxxxSYSTEM.DE
O17 - HKLM\Software\..\Telephony: DomainName = xxxxSYSTEM.DE
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F7093D-BC3A-472E-BC15-1B844946C29E}: NameServer = 192.51.32.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xxxxSYSTEM.DE
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Backup Exec System Recovery - Symantec Corporation - C:\Programme\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: CSIScanner - Prevx - C:\Programme\Prevx\prevx.exe
O23 - Service: GenericMount Helper Service - Symantec - C:\Programme\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelper.exe
O23 - Service: Google Update Service (gupdate1c9a0c72696d508) (gupdate1c9a0c72696d508) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Programme\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Programme\LogMeIn\x86\LogMeIn.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Programme\Symantec AntiVirus\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Programme\Symantec AntiVirus\SNAC.EXE
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Programme\Symantec AntiVirus\Rtvscan.exe
O23 - Service: SymSnapService - Symantec - C:\Programme\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapService.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Programme\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Programme\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 11158 bytes
MBAM

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4085

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.05.2010 10:41:07
mbam-log-2010-05-10 (10-41-07).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 152707
Laufzeit: 10 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

shorts77 10.05.2010 14:11
hier teil 2 der logs:

GMER

Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-05-10 08:16:40
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOKUME~1\xxx\LOKALE~1\Temp\uxtdapog.sys


---- System - GMER 1.0.15 ----

SSDT            89E31B00                                                                                      ZwAlertResumeThread
SSDT            89E32308                                                                                      ZwAlertThread
SSDT            8A3F32E8                                                                                      ZwAllocateVirtualMemory
SSDT            8A3C9330                                                                                      ZwConnectPort
SSDT            89E352D0                                                                                      ZwCreateMutant
SSDT            8A512548                                                                                      ZwCreateThread
SSDT            8A46E3A8                                                                                      ZwFreeVirtualMemory
SSDT            89E30B00                                                                                      ZwImpersonateAnonymousToken
SSDT            89E31348                                                                                      ZwImpersonateThread
SSDT            8A42BF30                                                                                      ZwMapViewOfSection
SSDT            89E30348                                                                                      ZwOpenEvent
SSDT            8A3BF3E0                                                                                      ZwOpenProcessToken
SSDT            8A42BB98                                                                                      ZwOpenThreadToken
SSDT            \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)  ZwProtectVirtualMemory [0xBA9ED6B0]
SSDT            8A3C73E0                                                                                      ZwResumeThread
SSDT            8A3EA750                                                                                      ZwSetContextThread
SSDT            8A405990                                                                                      ZwSetInformationProcess
SSDT            8A3C5558                                                                                      ZwSetInformationThread
SSDT            89E2F348                                                                                      ZwSuspendProcess
SSDT            8A4DF9F8                                                                                      ZwSuspendThread
SSDT            8A4DAB78                                                                                      ZwTerminateProcess
SSDT            8A5102B8                                                                                      ZwTerminateThread
SSDT            89E2FB40                                                                                      ZwUnmapViewOfSection
SSDT            8A3F3258                                                                                      ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 2C14                                                          805044B0 4 Bytes  CALL 14DA83E7

---- User code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\SearchIndexer.exe[2436] kernel32.dll!WriteFile                            7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!DialogBoxParamW                  7E3747AB 5 Bytes  JMP 4119541D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!CreateWindowExW                  7E37D0A3 5 Bytes  JMP 4126D6EC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!DialogBoxIndirectParamW          7E382072 5 Bytes  JMP 4136441F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!MessageBoxIndirectA              7E38A082 5 Bytes  JMP 41364351 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!DialogBoxParamA                  7E38B144 5 Bytes  JMP 413643BC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!MessageBoxExW                    7E3A0838 5 Bytes  JMP 41364222 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!MessageBoxExA                    7E3A085C 5 Bytes  JMP 41364284 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!DialogBoxIndirectParamA          7E3A6D7D 5 Bytes  JMP 41364482 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[4648] USER32.dll!MessageBoxIndirectW              7E3B64D5 5 Bytes  JMP 413642E6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!DialogBoxParamW                  7E3747AB 5 Bytes  JMP 4119541D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!SetWindowsHookExW                7E37820F 5 Bytes  JMP 41269865 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!CallNextHookEx                    7E37B3C6 5 Bytes  JMP 4125CEE9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!CreateWindowExW                  7E37D0A3 5 Bytes  JMP 4126D6EC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!UnhookWindowsHookEx              7E37D5F3 5 Bytes  JMP 411D4602 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!DialogBoxIndirectParamW          7E382072 5 Bytes  JMP 4136441F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!MessageBoxIndirectA              7E38A082 5 Bytes  JMP 41364351 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!DialogBoxParamA                  7E38B144 5 Bytes  JMP 413643BC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!MessageBoxExW                    7E3A0838 5 Bytes  JMP 41364222 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!MessageBoxExA                    7E3A085C 5 Bytes  JMP 41364284 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!DialogBoxIndirectParamA          7E3A6D7D 5 Bytes  JMP 41364482 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] USER32.dll!MessageBoxIndirectW              7E3B64D5 5 Bytes  JMP 413642E6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] ole32.dll!CoCreateInstance                  774D057E 5 Bytes  JMP 4126D748 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[5544] ole32.dll!OleLoadFromStream                  774F9C85 5 Bytes  JMP 413647A0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device                                                                                                        Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device                                                                                                        Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
Device          \Driver\Tcpip \Device\Ip                                                                      wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                      SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\Tcpip \Device\Tcp                                                                      wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                      SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device                                                                                                        rdpdr.sys (Microsoft RDP Device redirector/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                        symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device          \Driver\usbhub \Device\00000078                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbhub \Device\00000079                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\Tcpip \Device\Udp                                                                      wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                      SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\Tcpip \Device\RawIp                                                                    wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                    SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\usbuhci \Device\USBFDO-0                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-1                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbhub \Device\0000007a                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbehci \Device\USBFDO-2                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\Tcpip \Device\IPMULTICAST                                                              wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)
Device          \Driver\usbhub \Device\0000007b                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-3                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)
Device                                                                                                        mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device          \Driver\usbhub \Device\0000007c                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-4                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbhub \Device\0000007d                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-5                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbhub \Device\0000007e                                                                hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbehci \Device\USBFDO-6                                                              hcmon.sys (VMware USB monitor/VMware, Inc.)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout            15
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                10000
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                              yes
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                           
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout            90
Reg            HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota              10000

---- EOF - GMER 1.0.15 ----

shorts77 11.05.2010 11:37
hallo community,

ich verstehe nicht so ganz, warum ich keinen reply bekomme?

welche regel habe ich mißachtet(?) :-/

cosinus 11.05.2010 11:54
Hallo,

Zitat:
ich verstehe nicht so ganz, warum ich keinen reply bekomme?
Du bist nicht der einzige der Hilfe will! Geduld braucht der Mensch! :blabla:
Poste bitte das Combofix Logfile. Aber *eigentlich* soll CF nur auf explizite Anweisung hin ausgeführt werden, nun gut Du hast es gemacht ;)

Mach auch bitte einen Vollscan mit Malwarebytes.

shorts77 11.05.2010 12:05
recht hast du =) ich hatte nur die meisten, neueren post bereits als beantwortet gesehen.

es gibt keinen combofix log, hatte es nach dem ersten popup(keine rootkitmeldung) nach dem start glaube ich abgebrochen und mir nun vorsorglich auf der kiste hier adminrechte entzogen.
mit malwarebytes hatte ich auch einen vollscan durchgeführt, ebenso ESET online. keine funde.

prevx 3 findet auch nichts. ich lasse gerade damit einen vollscan laufen (heuristik überall auf maximum gestellt) hängt gerade bei 63% wobei das auch mit mbam realtime und symantec endpoitn protection schutz inteferieren kann (..?)

habe mir von sysinternals tcpview gezogen und kann dort auch keine ungereimheiten oder komischen verbindungen (oder verb.versuche) zu merkwürdigen ips erkennen.

bin ich bei meinem office pc hier vllt. etwas zu paranoid, da mein notebook befallen war ....?

ich habe mir von diesem pc hier die ultimatebootcd, knoppix und win7 64 bit (legal, msdn) gezogen um mein notebook damit zu betanken. aus paranoia traue ich mich jetzt nicht mal die isos hier zu brennen...


kann ich meine worddateien per knoppixboot vom befallenen notebook sichern? sind keine macros drin...oder laufe ich risiko dass das potentielle rootkit oder andere software alles verseucht hat, wobei malwarebytes/ KIS2010/ drweb vollscan auf dem notebook nichts an viren findet.

notebook: lediglich gmer hatte die atapi.sys (suspcisious) moniert (evtl. emulationssoftware die daran schuld ist?) und combofix meinte rootkit in tdx.sys und hat vier weitere files gelöscht...ich traue mich nicht das notebook mit dem netz zwecks analyse oder logpost zu verbinden oder anderweitig daten rüberzuspielen...

EDIT: ich sehe gerade, dass prevx wohl nur in der vollversion die komplette festplatte scannt? hört bei mir hier immer nach ca 40.000 files auf, mbam full 120.000

cosinus 11.05.2010 12:54
Zitat:
es gibt keinen combofix log,
Was ist hier => C:\ComboFix.txt (auch wenn CF nicht richtig durchlief)

Zitat:
aus paranoia traue ich mich jetzt nicht mal die isos hier zu brennen...
Das kannst Du aber ruhig machen.

Zitat:
kann ich meine worddateien per knoppixboot vom befallenen notebook sichern?
geht auch von Windows, gefährlich sind idR nur ausführbare Dateien.

Zitat:
notebook: lediglich GMER hatte die atapi.sys (suspcisious) moniert
Zeigt es nun aber nicht mehr an. Es gibt Rootkits, die die atapi.sys oder andere Systemtreiber manipulieren (tdss macht das) und CF kann das idR entfernen bzw. GMER erkennen und falls CF das nicht entfernt kann man über ne Live-CD die manipulierte Systemdatei löschen und ein Original zurückkopieren.

shorts77 11.05.2010 13:02
nein, habe garkein combofix log.

das gmer log ist von meinem office pc hier, der egtl sauber sein müsste. alle logs hier sind von meinem office pc, nur uas sicherheit, verdachtsmomente auf befall hatte ich keine.

von meinem notebook habe ich keine logs gepostet aber die analyse einer datei die CF darauf gelöscht hatte wird bei prevx (identische größe) als information stealer deklariert...
ich bin jetzt paranoiderweise natürlich hoch besorgt, dass irgendwo meine ganez hdd 1:1 gespiegelt ist, samt bankdaten, kontoständen, persönlicher dateien, emails...

falls du es für nötig erachtest, würde ich versuchen hier am office pc CF nochmal auszuführen, allerdings müsste ich dann an dem rechner hier das admin pw eintippen :D

cosinus 11.05.2010 13:19
So ich will jetzt hier nicht durcheinanderkommen, sonst verzetteln wir uns hier mit Logfiles von unterschiedlichen Systemen!!

1) Sind die Logs jetzt nur von Deinem Office-PC? Offensichtlich ja, die sind unauffällig!
2) Hast Du Logfiles vom (infizierten) Rechner? (Notebook?)
3) Wurde das Notebook schon geplättet?

shorts77 11.05.2010 13:22
1) alle logs sind nur von meinem office
2) ich habe logfiles (mbam, otl, hjt, gmer, cf) vom infzierten system, auch noch den qoobox order aber angst in irgendeiner form dateien von dort zu transferieren.
3) das infizierte notebook hatte ich vor nach boot von livecd und datensicherung + mehrmaliges, langwierirges formatieren , mit win 7 64bit neuzuinstallieren

Zitat:
Zitat von cosinus (Beitrag 524733)
So ich will jetzt hier nicht durcheinanderkommen, sonst verzetteln wir uns hier mit Logfiles von unterschiedlichen Systemen!!

1) Sind die Logs jetzt nur von Deinem Office-PC? Offensichtlich ja, die sind unauffällig!
2) Hast Du Logfiles vom (infizierten) Rechner? (Notebook?)
3) Wurde das Notebook schon geplättet?

shorts77 11.05.2010 15:19
ich habe gerade combofix durchlaufen lassen- hat 3 dateien gelöscht!
die dateien habe ich alle von jotti udn virustotal analysieren lassen, alles virenfrei.

warum hat combofix diese files gelöscht? müssen doch keine viren sein...?



Code:
ComboFix 10-05-10.03 - xxx 11.05.2010  15:59:31.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2046.1406 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\xxx\Desktop\jgjh.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr0.dat
c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr1.dat
C:\Install.exe

----- BITS: Eventuell infizierte Webseiten -----

hxxp://xxx-7
.
(((((((((((((((((((((((  Dateien erstellt von 2010-04-11 bis 2010-05-11  ))))))))))))))))))))))))))))))
.

2010-05-10 17:14 . 2010-05-10 17:14        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\ImgBurn
2010-05-10 17:12 . 2010-05-10 17:12        --------        d-----w-        c:\programme\ImgBurn
2010-05-10 16:41 . 2010-05-10 17:07        --------        d-----w-        c:\windows\BDOSCAN8
2010-05-10 16:34 . 2010-05-10 16:34        --------        d-----w-        c:\programme\Panda Security
2010-05-10 09:20 . 2010-05-10 09:20        388096        ----a-r-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-05-10 09:20 . 2010-05-10 09:20        --------        d-----w-        c:\programme\Trend Micro
2010-05-10 08:51 . 2010-05-10 08:51        63488        ----a-w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-05-10 08:51 . 2010-05-10 08:51        52224        ----a-w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-05-10 08:51 . 2010-05-10 08:51        117760        ----a-w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-10 08:51 . 2010-05-10 08:51        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2010-05-10 08:50 . 2010-05-10 08:50        --------        d-----w-        c:\programme\SUPERAntiSpyware
2010-05-10 08:50 . 2010-05-10 08:50        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\SUPERAntiSpyware.com
2010-05-10 08:50 . 2010-05-10 08:50        --------        d-----w-        c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-05-10 07:27 . 2010-05-10 07:27        61440        ----a-w-        c:\windows\system32\PxSecure.dll
2010-05-10 07:27 . 2010-05-10 07:27        54792        ----a-w-        c:\windows\system32\drivers\pxrts.sys
2010-05-10 07:27 . 2010-05-10 07:27        30320        ----a-w-        c:\windows\system32\drivers\pxscan.sys
2010-05-10 07:27 . 2010-05-10 07:27        24400        ----a-w-        c:\windows\system32\drivers\pxkbf.sys
2010-05-10 07:27 . 2010-05-10 07:27        --------        d-----w-        c:\programme\Prevx
2010-05-10 07:27 . 2010-05-11 11:08        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\PrevxCSI
2010-05-10 07:13 . 2010-05-10 07:13        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\Malwarebytes
2010-05-10 07:13 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-10 07:13 . 2010-05-10 07:13        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-05-10 07:13 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-05-10 07:13 . 2010-05-10 07:13        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-05-10 07:10 . 2010-05-10 07:10        --------        d-----w-        c:\programme\ESET

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-11 13:47 . 2009-11-04 14:30        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\VMware
2010-05-11 13:37 . 2009-11-23 19:09        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\ICAClient
2010-05-11 13:37 . 2010-05-11 13:37        5480448        ---ha-w-        c:\dokumente und einstellungen\xxx\ntuser.tmp
2010-05-11 07:16 . 2010-05-11 07:11        193801        ----a-w-        c:\programme\netstat1.log
2010-05-11 06:54 . 2007-04-12 14:39        --------        d-----w-        c:\programme\Symantec AntiVirus
2010-05-11 06:44 . 2004-08-04 12:00        96558        ----a-w-        c:\windows\system32\perfc007.dat
2010-05-11 06:44 . 2004-08-04 12:00        490160        ----a-w-        c:\windows\system32\perfh007.dat
2010-05-11 06:43 . 2009-11-04 14:41        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\VMware
2010-05-11 06:42 . 2009-01-27 15:28        --------        d-----w-        c:\programme\LogMeIn
2010-05-10 12:46 . 2007-04-03 13:23        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-05-10 09:23 . 2009-03-18 13:18        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
2010-05-10 09:00 . 2009-04-21 06:37        --------        d-----w-        c:\programme\CCleaner
2010-05-10 08:05 . 2009-04-21 08:42        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\Alcatel PIMphony
2010-04-20 13:05 . 2009-07-06 13:25        10719027        ----a-w-        C:\cop.zip
2010-04-14 03:06 . 2009-03-02 11:57        --------        d-----w-        c:\programme\Google
2010-03-27 06:55 . 2010-02-06 12:36        162048        ----a-w-        c:\windows\system32\drivers\WpsHelper.sys
2010-03-10 06:15 . 2004-08-04 12:00        420352        ----a-w-        c:\windows\system32\vbscript.dll
2010-02-24 13:11 . 2004-10-28 01:14        455680        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:04 . 2004-08-04 12:00        2148864        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-02-16 19:04 . 2004-08-04 00:50        2027008        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:33 . 2004-08-04 12:00        100864        ----a-w-        c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2004-08-04 12:00        226880        ----a-w-        c:\windows\system32\drivers\tcpip6.sys
2009-09-12 22:05 . 2009-09-12 22:05        124240        ----a-w-        c:\programme\mozilla firefox\plugins\CCMSDK.dll
2009-09-12 22:06 . 2009-09-12 22:06        13136        ----a-w-        c:\programme\mozilla firefox\plugins\cgpcfg.dll
2009-09-12 22:06 . 2009-09-12 22:06        70488        ----a-w-        c:\programme\mozilla firefox\plugins\CgpCore.dll
2009-09-12 22:06 . 2009-09-12 22:06        91480        ----a-w-        c:\programme\mozilla firefox\plugins\confmgr.dll
2009-09-12 22:06 . 2009-09-12 22:06        22360        ----a-w-        c:\programme\mozilla firefox\plugins\ctxlogging.dll
2009-09-12 22:07 . 2009-09-12 22:07        255312        ----a-w-        c:\programme\mozilla firefox\plugins\ctxmui.dll
2009-09-12 22:06 . 2009-09-12 22:06        31064        ----a-w-        c:\programme\mozilla firefox\plugins\icafile.dll
2009-09-12 22:06 . 2009-09-12 22:06        40280        ----a-w-        c:\programme\mozilla firefox\plugins\icalogon.dll
2009-08-14 12:33 . 2009-08-14 12:33        652640        ----a-w-        c:\programme\mozilla firefox\plugins\sslsdk_b.dll
2009-09-12 22:06 . 2009-09-12 22:06        23896        ----a-w-        c:\programme\mozilla firefox\plugins\TcpPServ.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 61952]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-02-24 5537792]
"nwiz"="nwiz.exe" [2005-02-24 1495040]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-02-24 86016]
"LogMeIn GUI"="c:\programme\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"vmware-tray"="c:\programme\VMware\VMware Workstation\vmware-tray.exe" [2009-08-14 96816]
"ConnectionCenter"="c:\programme\Citrix\ICA Client\concentr.exe" [2009-09-12 103768]
"ccApp"="c:\programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [2010-02-06 115560]
"Symantec Backup Exec System Recovery 2010"="c:\programme\Symantec\Backup Exec System Recovery\Agent\VProTray.exe" [2009-10-01 2596712]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21        548352        ----a-w-        c:\programme\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-10-01 15:31        87352        ----a-w-        c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^xxx^Startmenü^Programme^Autostart^hamachi.lnk]
path=c:\dokumente und einstellungen\xxx\Startmenü\Programme\Autostart\hamachi.lnk
backup=c:\windows\pss\hamachi.lnkStartup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^xxx^Startmenü^Programme^Autostart^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\dokumente und einstellungen\xxx\Startmenü\Programme\Autostart\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04        39792        ----a-w-        c:\programme\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-09-26 10:02        2356088        ----a-r-        c:\programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44        31072        ----a-w-        c:\programme\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-06-28 13:54        16248320        ----a-w-        c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 17:04        2879488        ----a-w-        c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07        2260480        --sha-w-        c:\programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-18 13:54        136600        ----a-w-        c:\programme\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-05-06 15:04        2017280        ----a-w-        c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\COP\\COP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Alcatel_PIMphony\\aoconfig.exe"=
"c:\\Programme\\Alcatel_PIMphony\\uaproc.exe"=
"%windir%\\system32\\abers.exe"=
"c:\\Programme\\Alcatel_PIMphony\\appdiag\\appdiag.exe"=
"c:\\Programme\\Alcatel_PIMphony\\aocphone.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [10.05.2010 09:27 30320]
R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [08.09.2009 19:13 65584]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [17.02.2010 11:25 12872]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [06.05.2010 17:10 68168]
R2 Backup Exec System Recovery;Backup Exec System Recovery;c:\programme\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe [01.10.2009 20:55 4585312]
R2 CSIScanner;CSIScanner;c:\programme\Prevx\prevx.exe [10.05.2010 09:27 6367576]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\programme\LogMeIn\x86\rainfo.sys [24.07.2008 19:46 12856]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [10.05.2010 09:13 304464]
R2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [10.05.2010 09:27 54792]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [14.08.2009 21:20 54960]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [07.02.2010 21:02 102448]
R3 GenericMount;Generic Mount Driver;c:\windows\system32\drivers\GenericMount.sys [21.09.2009 21:26 46192]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10.05.2010 09:13 20952]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [10.05.2010 09:27 24400]
R3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [24.07.2008 19:45 12192]
R3 SymSnapService;SymSnapService;c:\programme\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapService.exe [21.09.2009 21:19 1964528]
S2 gupdate1c9a0c72696d508;Google Update Service (gupdate1c9a0c72696d508);c:\programme\Google\Update\GoogleUpdate.exe [09.03.2009 16:55 133104]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [06.02.2010 14:35 23888]
S3 GenericMount Helper Service;GenericMount Helper Service;c:\programme\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelper.exe [21.09.2009 21:25 1571336]
S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [04.08.2004 14:00 5120]
.
Inhalt des "geplante Tasks" Ordners

2010-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-03-09 14:55]

2010-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-03-09 14:55]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://xxx-9:30464/xxxsportal
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\programme\VMware\VMware Workstation\vsocklib.dll
Trusted Zone: google.com
Trusted Zone: google.com\mail
Trusted Zone: immobilienscout24.de\www
Trusted Zone: superantispyware.com\www
TCP: {81F7093D-BC3A-472E-BC15-1B844946C29E} = 192.51.32.2
FF - ProfilePath - c:\dokumente und einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\9d1yxpk1.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.de
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npicaN.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Notify-NavLogon - (no file)
Notify-WgaLogon - (no file)
SafeBoot-Symantec Antvirus
MSConfigStartUp-Skype - c:\programme\Skype\Phone\Skype.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-05-11 16:04
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1160)
c:\programme\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\LMIinit.dll
.
Zeit der Fertigstellung: 2010-05-11  16:07:11
ComboFix-quarantined-files.txt  2010-05-11 14:07

Vor Suchlauf: 15 Verzeichnis(se), 43.464.839.168 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 43.436.126.208 Bytes frei

- - End Of File - - E2EA840C600452765B2B16478F1856B5
Code:
2010-05-11 14:06:00 . 2010-05-11 14:06:00              616 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Skype.reg.dat
2010-05-11 14:05:59 . 2010-05-11 14:05:59              582 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\SafeBoot-Symantec Antvirus.reg.dat
2010-05-11 14:05:50 . 2010-05-11 14:05:50              332 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\Notify-WgaLogon.reg.dat
2010-05-11 14:05:50 . 2010-05-11 14:05:50              306 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\Notify-NavLogon.reg.dat
2010-05-11 14:03:03 . 2010-05-11 14:03:03            9,446 ----a-w-  C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2010-05-11 13:57:49 . 2010-05-11 13:57:49              51 ----a-w-  C:\Qoobox\Quarantine\catchme.log
2007-11-07 07:03:18 . 2007-11-07 07:03:18          562,688 ----a-w-  C:\Qoobox\Quarantine\C\install.exe.vir
2007-02-23 09:46:14 . 2010-05-10 06:36:43            4,232 ----a-w-  C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr0.dat.vir
2007-02-23 09:46:14 . 2010-05-10 06:36:42            5,590 ----a-w-  C:\Qoobox\Quarantine\C\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr1.dat.vir
Code:
7-Zip 4.42
Adobe Flash Player 10 ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.3 - Deutsch
Adobe Shockwave Player
AFPL Ghostscript 8.54
AFPL Ghostscript Fonts
Alcatel PIMphony 5.1.353
CCleaner
CD Audio Reader Filter (remove only)
Citrix Online Plug-in - Web
Citrix Online Plug-in (DV)
Citrix Online Plug-in (HDX)
Citrix Online Plug-in (USB)
Citrix Online Plug-in (Web)
COP - Compare & Procure
DirectVobSub (remove only)
DivX Content Uploader
DivX Web Player
DS-MP3 Source 1.30
DScaler 5 Mpeg Decoders
ESET Online Scanner v3
ffdshow [rev 1058+] [2007-03-22]
FreePDF XP (Remove only)
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GTK+ 2.10.6-1 runtime environment
High Definition Audio - KB888111
HiJackThis
Hotfix für Windows Media Player 11 (KB939683)
Hotfix für Windows XP (KB961118)
Hotfix für Windows XP (KB969084)
Hotfix für Windows XP (KB970653-v3)
Hotfix für Windows XP (KB976098-v2)
Hotfix für Windows XP (KB979306)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB954550-v5)
ImgBurn
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_18
Java(TM) 6 Update 11
LiveUpdate 3.3 (Symantec Corporation)
LogMeIn
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 German Language Pack
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (German) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (German) 2007
Microsoft Office Groove MUI (German) 2007
Microsoft Office InfoPath MUI (German) 2007
Microsoft Office OneNote MUI (German) 2007
Microsoft Office Outlook MUI (German) 2007
Microsoft Office PowerPoint MUI (German) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Italian) 2007
Microsoft Office Proofing (German) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (German) 2007
Microsoft Office Shared MUI (German) 2007
Microsoft Office Word MUI (German) 2007
Microsoft Report Viewer Redistributable 2005
Microsoft Software Update for Web Folders  (German) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.3)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser und SDK
NVIDIA Drivers
OpenSource Flash Video Splitter (remove only)
PDFCreator
Prevx
RealMedia (remove only)
Realtek High Definition Audio Driver
RedMon - Redirection Port Monitor
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB978380)
Security Update for Microsoft Office Excel 2007 (KB978382)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB980470)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Windows Search 4 - KB963093
SHOUTcast Source (remove only)
Sicherheitsupdate für Step by Step Interactive Training (KB898458)
Sicherheitsupdate für Windows Internet Explorer 7 (KB963027)
Sicherheitsupdate für Windows Internet Explorer 8 (KB969897)
Sicherheitsupdate für Windows Internet Explorer 8 (KB971961)
Sicherheitsupdate für Windows Internet Explorer 8 (KB972260)
Sicherheitsupdate für Windows Internet Explorer 8 (KB974455)
Sicherheitsupdate für Windows Internet Explorer 8 (KB976325)
Sicherheitsupdate für Windows Internet Explorer 8 (KB981332)
Sicherheitsupdate für Windows Media Player (KB911564)
Sicherheitsupdate für Windows Media Player (KB954155)
Sicherheitsupdate für Windows Media Player (KB968816)
Sicherheitsupdate für Windows Media Player (KB973540)
Sicherheitsupdate für Windows Media Player 11 (KB954154)
Sicherheitsupdate für Windows Media Player 6.4 (KB925398)
Sicherheitsupdate für Windows Media Player 9 (KB911565)
Sicherheitsupdate für Windows Media Player 9 (KB936782)
Sicherheitsupdate für Windows XP (KB923689)
Sicherheitsupdate für Windows XP (KB923789)
Sicherheitsupdate für Windows XP (KB956744)
Sicherheitsupdate für Windows XP (KB956844)
Sicherheitsupdate für Windows XP (KB958869)
Sicherheitsupdate für Windows XP (KB960859)
Sicherheitsupdate für Windows XP (KB961371-v2)
Sicherheitsupdate für Windows XP (KB961501)
Sicherheitsupdate für Windows XP (KB968537)
Sicherheitsupdate für Windows XP (KB969059)
Sicherheitsupdate für Windows XP (KB969898)
Sicherheitsupdate für Windows XP (KB969947)
Sicherheitsupdate für Windows XP (KB970238)
Sicherheitsupdate für Windows XP (KB970430)
Sicherheitsupdate für Windows XP (KB971468)
Sicherheitsupdate für Windows XP (KB971486)
Sicherheitsupdate für Windows XP (KB971557)
Sicherheitsupdate für Windows XP (KB971633)
Sicherheitsupdate für Windows XP (KB971657)
Sicherheitsupdate für Windows XP (KB972270)
Sicherheitsupdate für Windows XP (KB973346)
Sicherheitsupdate für Windows XP (KB973354)
Sicherheitsupdate für Windows XP (KB973507)
Sicherheitsupdate für Windows XP (KB973525)
Sicherheitsupdate für Windows XP (KB973869)
Sicherheitsupdate für Windows XP (KB973904)
Sicherheitsupdate für Windows XP (KB974112)
Sicherheitsupdate für Windows XP (KB974318)
Sicherheitsupdate für Windows XP (KB974392)
Sicherheitsupdate für Windows XP (KB974571)
Sicherheitsupdate für Windows XP (KB975025)
Sicherheitsupdate für Windows XP (KB975467)
Sicherheitsupdate für Windows XP (KB975560)
Sicherheitsupdate für Windows XP (KB975561)
Sicherheitsupdate für Windows XP (KB975713)
Sicherheitsupdate für Windows XP (KB977165-v2)
Sicherheitsupdate für Windows XP (KB977816)
Sicherheitsupdate für Windows XP (KB977914)
Sicherheitsupdate für Windows XP (KB978037)
Sicherheitsupdate für Windows XP (KB978251)
Sicherheitsupdate für Windows XP (KB978262)
Sicherheitsupdate für Windows XP (KB978338)
Sicherheitsupdate für Windows XP (KB978601)
Sicherheitsupdate für Windows XP (KB978706)
Sicherheitsupdate für Windows XP (KB979309)
Sicherheitsupdate für Windows XP (KB979683)
Sicherheitsupdate für Windows XP (KB980232)
Spybot - Search & Destroy
Storeserver Generator 2.1
Storeserver Generator 3.0
SUPERAntiSpyware Free Edition
Symantec Backup Exec System Recovery 2010
Symantec Endpoint Protection-Client
The GIMP 2.2.14
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update für Microsoft Windows (KB971513)
Update für Windows Internet Explorer 8 (KB973874)
Update für Windows Internet Explorer 8 (KB976662)
Update für Windows XP (KB955759)
Update für Windows XP (KB968389)
Update für Windows XP (KB971737)
Update für Windows XP (KB973687)
Update für Windows XP (KB973815)
Update for 2007 Microsoft Office System (KB967642)
Update for 2007 Microsoft Office System (KB981715)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office Word 2007 (KB974561)
Update for Outlook 2007 Junk Email Filter (kb981433)
VideoLAN VLC media player 0.8.2
VMware Infrastructure Client 2.5
VMware Infrastructure Update
VMware Workstation
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
XML Paper Specification Shared Components Language Pack 1.0

shorts77 11.05.2010 15:53
die beiden gelöschten .dat files gehören zu symantec backup exec habe ich gerade herausgefunden:

hxxp://www.symantec.com/connect/de/forums/gmgr0dat-gmgr1dat

edit: die install.exe passt von erstelldatum zu einer install.ini und noch ein paar install.res. dlls die noch auf c-root liegen. inhalt der ini: Microsoft Visual C++ 2008 Redistributable Package. somit scheint das wohl auch nur ein FP gewesen sein, da combofix wohl gerne unbekannte exe files aus dem root löscht.

die reg files enthalten lediglich symantec settings.

wenn ich mit tcpview keine seltsamen verbindungsversuche zu merkwürdigen ips entdecke, ist das doch auch schon mal poisitiv...oder können die rootkits owas auch verstecken?

puh, ich bin beruhigt...jetzt brauche ich nur noch bestätigung, dass die kiste wirklich astrein ist :D um meine paranoia loszuwerden.

cosinus 12.05.2010 13:22
Zitat:
warum hat combofix diese files gelöscht? müssen doch keine viren sein...?
CF scannt nicht auf Viren. Es kann aber auch Dateien löschen, die schädlich/unnötig sind, die aber noch von keinem Virenscanner gemeldet werden!
Und niemand hat behauptet, dass CF perfekt sei, es gibt keine komplexe Software, die zu 100% fehlerfrei arbeitet.

Zitat:
da combofix wohl gerne unbekannte exe files aus dem root löscht.
Weil diese Dateien grundsätztlich verdächtig und unnötig sind. Wer will *.exe direkt im Wurzelverzeichnis? Dann noch mit so treffenden Namen wie install.exe? Oder weißt Du was sich da installiert wenn Du c:\install.exe ausführst?

Ansonsten, Log ist ok und der Rechner arbeitet (wieder?) normal?

shorts77 12.05.2010 14:21
dank dir arne!

es geht ja die ganze zeit noch um den office pc, der hat sich nie komisch verhalten, die ganzen tests waren nur zur vorsicht.

die pn mit der SAS meldung gen-cryptor war ein FP, da bib ich mir sicher. legitimes program und jotti/totalvirus finden auch nichts.

gegen löschen von solchen exe files aus dem root spricht absolut garnichts =)
von combofix und dessen funktion im detail weiss ich nichts.

ich würde interresshalber gerne die dateien aus der quarantäne vom notebook untersuchen lassen.
kann ich von einer knoppix live cd booten, ins internet gehen und die dateien zu jotti etc. hochlaen oder besteht da irgendein risiko?

dann würde ich auch die log files von besagtem notebook hier posten.

cosinus 12.05.2010 14:30
Zitat:
ich würde interresshalber gerne die dateien aus der quarantäne vom notebook untersuchen lassen.
kann ich von einer knoppix live cd booten, ins internet gehen und die dateien zu jotti etc. hochlaen oder besteht da irgendein risiko?
Wenn das Fehlalarme waren braucht es kein Knoppix dazu. Schaden können infizierte Daten auch nur anrichten, wenn man diese ausführt. CF legt die in Qoobox mit der Endung .vir an, die kann man nicht mal eben versehentlich durch Doppelklicken ausführen. Außerdem arbeitest Du als sicherheitsbewusster Benutzer selbstverständlich nicht mit administrativen Rechten :)

shorts77 13.05.2010 10:05
alle logs, die ich ab jetzt poste, sind vom befallenen notebook. ich bin gerade per knoppix live cd damit online, um vor der formatierung noch festzustellen, womit es befallen war...

alle dateien, die combofix gelöscht oder alsinfiziert moniert hat, habe ich auch bei virustotal scannen lassen- sauber.

die atapi.sys, die gmer als suspicious tituliert hatte, wurde bei virustotal nur von einem scanner als trojan erkannt. evtl. fp durch emulationssoftware?

er eigentliche bösewicht scheint die tdx.sys zu sein!

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.50        2010.05.10        Rootkit.Win32.TDSS!IK
AhnLab-V3        2010.05.13.01        2010.05.13        -
AntiVir        8.2.1.242        2010.05.12        TR/Patched.Gen
Antiy-AVL        2.0.3.7        2010.05.13        -
Authentium        5.2.0.5        2010.05.13        W32/SYStroj.AB2.gen!Eldorado
Avast        4.8.1351.0        2010.05.13        Win32:Alureon-FZ
Avast5        5.0.332.0        2010.05.13        Win32:Alureon-FZ
AVG        9.0.0.787        2010.05.13        Win32/Patched.DP
BitDefender        7.2        2010.05.13        Rootkit.Patched.TDSS.Gen
CAT-QuickHeal        10.00        2010.05.13        -
ClamAV        0.96.0.3-git        2010.05.13        -
Comodo        4831        2010.05.13        TrojWare.Win32.Rootkit.TDL3.gen
DrWeb        5.0.2.03300        2010.05.13        BackDoor.Tdss.2459
eSafe        7.0.17.0        2010.05.11        -
eTrust-Vet        35.2.7485        2010.05.13        Win32/Alureon.A!generic
F-Prot        4.5.1.85        2010.05.13        W32/SYStroj.AB2.gen!Eldorado
F-Secure        9.0.15370.0        2010.05.13        Rootkit.Patched.TDSS.Gen
Fortinet        4.1.133.0        2010.05.13        -
GData        21        2010.05.13        Rootkit.Patched.TDSS.Gen
Ikarus        T3.1.1.84.0        2010.05.13        -
Jiangmin        13.0.900        2010.05.13        Rootkit.TDSS.dgu
Kaspersky        7.0.0.125        2010.05.13        Rootkit.Win32.TDSS.ap
McAfee        5.400.0.1158        2010.05.13        Patched-SYSFile.d
McAfee-GW-Edition        2010.1        2010.05.13        -
Microsoft        1.5703        2010.05.13        Virus:Win32/Alureon.H
NOD32        5111        2010.05.13        Win32/Olmarik.ZC
Norman        6.04.12        2010.05.13        W32/tdss.drv.gen8
nProtect        2010-05-13.01        2010.05.13        -
Panda        10.0.2.7        2010.05.12        -
PCTools        7.0.3.5        2010.05.13        Backdoor.Tidserv
Prevx        3.0        2010.05.13        -
Rising        22.47.03.02        2010.05.13        RootKit.Win32.TDSS.c
Sophos        4.53.0        2010.05.13        Mal/TDSSRt-A
Sunbelt        6297        2010.05.13        LooksLike.Win32.PatchedDriver!A (v)
Symantec        20101.1.0.89        2010.05.13        Backdoor.Tidserv!inf
TheHacker        6.5.2.0.280        2010.05.13        -
TrendMicro        9.120.0.1004        2010.05.13        Mal_TIDIES-12
TrendMicro-HouseCall        9.120.0.1004        2010.05.13        Mal_TIDIES-12
VBA32        3.12.12.4        2010.05.13        Rootkit.Win32.TDSL.b
ViRobot        2010.5.13.2313        2010.05.13        -
VirusBuster        5.0.27.0        2010.05.12        Rootkit.TDSS.Gen.3
weitere Informationen
File size: 74240 bytes
MD5...: 04ef9dbce73821ff81a892b59997cacd
SHA1..: 8539597746d97d0a623c6426a547df2019cca247
SHA256: cefffabccae263062d4a843538bcead26239ccb871fff55a9a3a11c2b4c67ba3
ssdeep: 1536:QklJmrevoqvFyQ9/ffrQWxo953f4kTPeV1i5/sqOJFdl5w8+SXO3O:5lN3s
c5AQkie5/spJFdlq8+Le
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x14014
timedatestamp.....: 0x4a5bbf4a (Mon Jul 13 23:12:10 2009)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe8b3 0xea00 6.41 12b2ae36fea8454f6e82aff577dd708c
.rdata 0x10000 0x6ec 0x800 4.21 b80f2bcd1969979c6f9b482d727a021f
.data 0x11000 0x3a0 0x200 2.77 bc7cad3945605ccc34a21697e84021b3
PAGE 0x12000 0x4dc 0x600 5.27 ec945ab7bb158456785f47acb1c85d34
INIT 0x13000 0xcbc 0xe00 5.29 9e8be2845d580dde6a1e865be349fcab
.rsrc 0x14000 0x3e8 0x400 7.12 758383fa8c20ba9a046346f57f55db74
.reloc 0x15000 0x100c 0x1200 6.18 d8ef5378864e86186167874ce25a9c07

( 5 imports )
> ntoskrnl.exe: KeSetTimer, IoFreeWorkItem, IoQueueWorkItem, ZwQueryValueKey, ZwOpenKey, _vsnwprintf, KeFlushQueuedDpcs, KeCancelTimer, KeDelayExecutionThread, KeInitializeDpc, KeInitializeTimer, IoAllocateWorkItem, KeInitializeMutex, KeSetEvent, IoGetIrpExtraCreateParameter, MmUnlockPages, IoFreeMdl, KeReleaseSemaphore, KeReleaseMutex, IoAllocateMdl, ExAllocatePoolWithTagPriority, IoWMIWriteEvent, MmGetSystemRoutineAddress, IoWMIRegistrationControl, IoGetCurrentProcess, KeQueryMaximumProcessorCountEx, KeQuerySystemTime, RtlCopyUnicodeString, KeTickCount, KeBugCheckEx, RtlUnwind, KefAcquireSpinLockAtDpcLevel, KefReleaseSpinLockFromDpcLevel, ObfDereferenceObject, RtlInitUnicodeString, ExCreateCallback, RtlCompareMemory, IoCreateDevice, IoCreateSymbolicLink, IoDeleteSymbolicLink, IoDeleteDevice, KeInitializeSemaphore, IoFileObjectType, ObReferenceObjectByHandle, MmMapLockedPagesSpecifyCache, KeGetCurrentProcessorNumberEx, IoAcquireCancelSpinLock, IoReleaseCancelSpinLock, memcpy, ExAllocatePoolWithTag, ObDereferenceSecurityDescriptor, SeLockSubjectContext, IoGetFileObjectGenericMapping, SeAssignSecurity, SeUnlockSubjectContext, ObLogSecurityDescriptor, ExFreePoolWithTag, IoGetTopLevelIrp, memset, KeInitializeEvent, ExNotifyCallback, PsGetCurrentProcess, KeWaitForSingleObject, IofCompleteRequest, RtlUnicodeStringToInteger, RtlGetCallersAddress, KeReleaseInStackQueuedSpinLockFromDpcLevel, KeAcquireInStackQueuedSpinLockAtDpcLevel, IoInitializeWorkItem, IoSizeofWorkItem, IoUninitializeWorkItem, IoQueueWorkItemEx, MmProbeAndLockPages, KeGetCurrentThread
> HAL.dll: KeAcquireInStackQueuedSpinLock, KeGetCurrentIrql, KfLowerIrql, KfAcquireSpinLock, KfReleaseSpinLock, KeReleaseInStackQueuedSpinLock
> NETIO.SYS: NmrRegisterProvider, RtlCopyMdlToMdl, RtlCopyBufferToMdl, NsiGetParameter, NsiFreeTable, NsiAllocateAndGetTable, NmrClientDetachProviderComplete, NmrClientAttachProvider, NsiDeregisterChangeNotification, NsiSetAllParameters, NmrProviderDetachClientComplete, NmrDeregisterProvider, NmrWaitForProviderDeregisterComplete, RtlCopyMdlToBuffer, NmrRegisterClient, NsiRegisterChangeNotification, NsiGetAllParameters, NmrDeregisterClient, NmrWaitForClientDeregisterComplete
> TDI.SYS: TdiDeregisterProvider, TdiProviderReady, TdiRegisterProvider, TdiDeregisterDeviceObject, TdiDeregisterNetAddress, TdiRegisterDeviceObject, TdiRegisterNetAddress, TdiPnPPowerRequest, TdiMapUserRequest
> NDIS.SYS: NdisIfGetInterfaceIndexFromNetLuid

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Code:
ComboFix 10-05-05.07 - me 06.05.2010  15:32:16.1.2 - x86 MINIMAL
Microsoft Windows 7 Enterprise  6.1.7600.0.1252.49.1033.18.3054.2612 [GMT 2:00]
ausgeführt von:: c:\users\me\Desktop\ComboFix.exe
FW: WatchGuard Mobile VPN Firewall *disabled* {33F684F9-95EF-4FC3-9196-012CF0A4D310}
SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
        /wow section - STAGE 3


((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Fonts\Code_39b.ttf
c:\windows\system32\ICON.ico
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\test.dll

c:\windows\system32\wuauclt.exe . . . ist infiziert!!

.
(((((((((((((((((((((((  Dateien erstellt von 2010-04-06 bis 2010-05-06  ))))))))))))))))))))))))))))))
.

2010-05-06 13:41 . 2010-05-06 13:47        --------        d-----w-        c:\users\me\AppData\Local\temp
2010-05-06 13:41 . 2010-05-06 13:41        --------        d-----w-        c:\users\test\AppData\Local\temp
2010-05-06 13:41 . 2010-05-06 13:41        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-05-06 13:41 . 2010-05-06 13:41        --------        d-----w-        c:\users\Ctx_StreamingSvc\AppData\Local\temp
2010-05-06 13:41 . 2010-05-06 13:41        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2010-05-06 13:17 . 2010-05-06 13:17        --------        d-----w-        D:\MSBuild
2010-05-06 13:17 . 2010-05-06 13:17        --------        d-----w-        D:\Windows Journal
2010-05-06 13:17 . 2010-05-06 13:17        --------        d-----w-        D:\Windows Defender
2010-05-06 13:17 . 2010-05-06 13:17        --------        d-----w-        D:\Windows Mail
2010-05-06 13:17 . 2010-05-06 13:17        --------        d-----w-        D:\Common Files
2010-05-06 09:58 . 2010-05-06 09:58        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com
2010-05-06 09:57 . 2010-05-06 09:57        --------        d-----w-        D:\SUPERAntiSpyware
2010-05-06 09:57 . 2010-05-06 09:57        --------        d-----w-        c:\users\me\AppData\Roaming\SUPERAntiSpyware.com
2010-05-06 09:43 . 2010-05-06 09:53        --------        d-----w-        D:\WhatsRunning
2010-05-05 09:05 . 2010-05-05 09:05        --------        d-----w-        c:\users\me\AppData\Local\Evernote
2010-05-05 09:01 . 2010-05-05 09:01        --------        d-----w-        D:\Evernote
2010-05-04 10:01 . 2010-05-04 10:02        --------        d-----w-        c:\users\me\AppData\Roaming\Foxit Software
2010-05-03 09:05 . 2009-05-28 06:28        991232        ----a-w-        c:\windows\system32\ncpgina1.dll
2010-05-03 09:05 . 2009-10-08 09:27        81224        ----a-w-        c:\windows\system32\drivers\ncpvaxp.sys
2010-05-03 07:06 . 2010-05-03 07:08        --------        d-----w-        c:\users\me\AppData\Local\Xobni
2010-05-03 07:06 . 2010-05-03 07:07        --------        d-----w-        D:\Xobni
2010-04-29 20:11 . 2010-04-29 20:11        --------        d-----w-        D:\iPod
2010-04-29 20:11 . 2010-04-29 20:12        --------        d-----w-        D:\iTunes
2010-04-29 20:08 . 2010-04-29 20:08        --------        d-----w-        D:\Bonjour
2010-04-28 06:25 . 2009-09-26 05:58        194488        ----a-w-        c:\windows\system32\drivers\fvevol.sys
2010-04-28 06:25 . 2009-12-11 07:44        133720        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2010-04-28 06:25 . 2009-12-11 07:38        1037312        ----a-w-        c:\windows\system32\lsasrv.dll
2010-04-27 10:09 . 2010-04-27 11:20        --------        d-----w-        c:\program files\Common Files\Adobe
2010-04-22 09:50 . 2010-04-22 09:50        --------        d-----w-        D:\TweetDeck
2010-04-17 14:04 . 2010-04-17 14:04        --------        d--h--w-        c:\windows\system32\CanonIJ Uninstaller Information
2010-04-17 14:03 . 2008-12-15 09:29        417792        ----a-w-        c:\windows\system32\CNQ9601L.DLL
2010-04-17 14:03 . 2008-10-07 09:20        1331200        ----a-w-        c:\windows\system32\CNQ9601C.DLL
2010-04-17 14:03 . 2008-10-07 09:20        98304        ----a-w-        c:\windows\system32\CNQ9601I.DLL
2010-04-17 14:03 . 2008-07-16 07:39        192512        ----a-w-        c:\windows\system32\CNQ9601O.DLL
2010-04-14 06:26 . 2010-03-08 21:33        427520        ----a-w-        c:\windows\system32\vbscript.dll
2010-04-14 06:26 . 2010-02-27 12:07        3954568        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-04-14 06:26 . 2010-02-27 12:07        3899280        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-04-14 06:26 . 2010-02-27 07:32        221696        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 06:26 . 2010-02-27 07:32        95744        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 06:26 . 2010-02-27 07:32        123392        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 06:25 . 2009-12-29 06:55        172032        ----a-w-        c:\windows\system32\wintrust.dll
2010-04-14 06:25 . 2010-01-09 06:52        132608        ----a-w-        c:\windows\system32\cabview.dll
2010-04-08 11:20 . 2010-04-08 11:20        91424        ----a-w-        c:\windows\system32\dnssd.dll
2010-04-08 11:20 . 2010-04-08 11:20        107808        ----a-w-        c:\windows\system32\dns-sd.exe

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-06 13:46 . 2009-12-04 11:12        --------        d-----w-        c:\users\me\AppData\Roaming\Dropbox
2010-05-06 13:46 . 2009-08-18 14:11        --------        d-----w-        c:\programdata\Kaspersky Lab
2010-05-06 13:17 . 2009-10-20 07:15        --------        d-sh--w-        D:\$$PendingFiles
2010-05-06 12:27 . 2009-08-18 14:05        649360        ----a-w-        c:\windows\system32\perfh007.dat
2010-05-06 12:27 . 2009-08-18 14:05        128244        ----a-w-        c:\windows\system32\perfc007.dat
2010-05-06 10:18 . 2009-08-31 11:34        --------        d-----w-        c:\users\me\AppData\Roaming\Skype
2010-05-06 10:10 . 2009-12-02 10:41        --------        d-----w-        D:\ABBYY FineReader 10
2010-05-06 10:00 . 2010-05-06 10:00        63488        ----a-w-        c:\users\me\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-05-06 10:00 . 2010-05-06 09:58        117760        ----a-w-        c:\users\me\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-06 09:58 . 2010-05-06 09:58        52224        ----a-w-        c:\users\me\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-05-06 09:57 . 2009-08-26 15:21        --------        d-----w-        c:\program files\Common Files\Wise Installation Wizard
2010-05-06 09:53 . 2010-05-06 09:52        8050208        ----a-w-        c:\programdata\Kaspersky Lab\SandboxShared\SUPERAntiSpyware.exe
2010-05-06 09:41 . 2010-05-06 09:41        4684526        ----a-w-        c:\programdata\Kaspersky Lab\SandboxShared\WhatsRunning3_0_Setup.exe
2010-05-06 09:41 . 2010-05-06 09:40        4684526        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume4\DL\WhatsRunning3_0_Setup.exe
2010-05-06 09:37 . 2009-08-18 19:11        --------        d-----w-        c:\users\me\AppData\Roaming\gSyncit
2010-05-06 09:18 . 2010-05-06 09:18        745312        ----a-w-        c:\programdata\Kaspersky Lab\SandboxShared\MobileNoterSetup.exe
2010-05-06 09:17 . 2010-05-06 09:17        745312        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume4\DL\MobileNoterSetup(2).exe
2010-05-06 09:17 . 2010-05-06 09:17        371208        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Local\Apps\2.0\DQO0VP9P.K54\O1255HJB.Y7B\mobi..tion_539a7baec8853c3a_0001.0003_3a357e67dc92d0df\MobileNoter.PermissionResolver.exe
2010-05-06 09:17 . 2010-05-06 09:17        371208        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Local\Apps\2.0\DQO0VP9P.K54\O1255HJB.Y7B\mobi...exe_539a7baec8853c3a_0001.0003_none_3b6060ea3e8b684b\MobileNoter.PermissionResolver.exe
2010-05-06 09:17 . 2010-05-06 09:17        5632        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Local\Apps\2.0\DQO0VP9P.K54\O1255HJB.Y7B\mobi..tion_539a7baec8853c3a_0001.0003_3a357e67dc92d0df\MobileNoter.Restart.exe
2010-05-06 09:17 . 2010-05-06 09:17        5632        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Local\Apps\2.0\DQO0VP9P.K54\O1255HJB.Y7B\mobi...exe_539a7baec8853c3a_0001.0003_none_3b6060ea3e8b684b\MobileNoter.Restart.exe
2010-05-06 09:17 . 2010-05-06 09:17        53256        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Local\Temp\VSDD1A2.tmp\Office2007PIARedist\ComponentCheck.exe
2010-05-06 09:16 . 2010-05-06 09:16        745312        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume4\DL\MobileNoterSetup.exe
2010-05-06 08:27 . 2010-05-06 08:26        469840        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\inficon.exe
2010-05-06 08:27 . 2010-05-06 08:26        34128        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\oisicon.exe
2010-05-06 08:27 . 2010-05-06 08:26        326480        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\joticon.exe
2010-05-06 08:27 . 2010-05-06 08:26        303440        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\outicon.exe
2010-05-06 08:27 . 2010-05-06 08:26        19280        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\cagicon.exe
2010-05-06 08:27 . 2010-05-06 08:26        178512        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\grvicons.exe
2010-05-06 08:27 . 2010-05-06 08:26        1449296        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\accicons.exe
2010-05-06 08:27 . 2010-05-06 08:26        571728        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\misc.exe
2010-05-06 08:27 . 2010-05-06 08:26        415568        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\pubs.exe
2010-05-06 08:27 . 2010-05-06 08:26        3792720        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\pptico.exe
2010-05-06 08:27 . 2010-05-06 08:26        1858384        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
2010-05-06 08:27 . 2010-05-06 08:26        1479504        ----a-r-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Windows\Installer\{20140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
2010-05-06 08:04 . 2009-11-09 08:43        --------        d-----w-        D:\Malwarebytes' Anti-Malware
2010-05-06 08:03 . 2010-01-26 09:01        6153352        ----a-w-        c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-05-06 07:18 . 2009-08-31 11:34        --------        d-----w-        c:\users\me\AppData\Roaming\skypePM
2010-05-06 07:04 . 2009-09-02 07:49        --------        d-----w-        D:\TechSmith
2010-05-05 22:08 . 2010-05-06 09:25        701608        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-05-05 22:08 . 2010-05-06 09:25        865896        ----a-w-        c:\programdata\Kaspersky Lab\Sandbox\KLSB1\Device\HarddiskVolume2\Users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-05-05 06:49 . 2009-08-18 14:11        97549        ----a-w-        c:\windows\system32\drivers\klick.dat
2010-05-05 06:49 . 2009-08-18 14:11        113933        ----a-w-        c:\windows\system32\drivers\klin.dat
2010-05-05 06:45 . 2009-10-02 19:46        147112        ---ha-w-        c:\windows\system32\mlfcache.dat
2010-05-04 12:17 . 2009-08-18 14:57        --------        d-----w-        D:\StarMoney 7.0
2010-05-04 09:59 . 2009-08-18 15:01        --------        d-----w-        D:\Foxit Software
2010-05-04 06:32 . 2009-08-18 15:17        114864        ----a-w-        c:\users\me\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-04 06:28 . 2009-08-18 14:32        --------        d-----w-        c:\programdata\Microsoft Help
2010-05-03 12:13 . 2009-08-24 08:43        --------        d-----w-        c:\programdata\STAMPIT
2010-05-03 08:33 . 2009-08-18 14:43        --------        d-----w-        D:\Config.Msi
2010-04-29 20:11 . 2010-02-04 14:02        --------        d-----w-        c:\program files\Common Files\Apple
2010-04-29 20:07 . 2010-04-29 20:07        73000        ----a-w-        c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe
2010-04-29 13:39 . 2009-11-09 08:43        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2009-11-09 08:43        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-04-28 14:26 . 2010-03-04 12:43        --------        d-----w-        D:\Defraggler
2010-04-27 10:02 . 2009-11-09 08:49        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2010-04-17 14:20 . 2009-08-24 19:03        --------        d-----w-        c:\users\me\AppData\Roaming\Canon
2010-04-17 14:19 . 2009-08-24 19:06        --------        d--h--w-        c:\programdata\CanonIJScan
2010-04-15 13:25 . 2009-10-02 16:17        --------        d-----w-        D:\Google
2010-04-15 13:20 . 2010-03-08 13:24        --------        d-----w-        D:\Digsby
2010-04-12 07:26 . 2009-08-19 08:00        353330        ----a-w-        c:\users\me\AppData\Roaming\nvModes.dat
2010-04-12 06:50 . 2009-11-02 08:57        --------        d-----w-        D:\Mozilla Thunderbird
2010-04-07 13:28 . 2010-04-15 09:04        253952        ----a-w-        c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\ietab@ip.cn\plugins\npCoralIETab.dll
2010-04-03 09:25 . 2010-02-15 15:09        --------        d-----w-        c:\users\me\AppData\Roaming\Apple Computer
2010-04-03 09:24 . 2010-04-03 09:24        --------        d-----w-        D:\Safari
2010-04-03 09:23 . 2010-04-03 09:23        79144        ----a-w-        c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-04-02 19:13 . 2009-12-04 11:13        91696        ----a-w-        c:\users\me\AppData\Roaming\Dropbox\bin\Uninstall.exe
2010-04-02 19:13 . 2010-04-02 19:13        13264416        ----a-w-        c:\users\me\AppData\Roaming\Dropbox\cache\Dropbox-update-0.7.110.exe
2010-04-02 09:59 . 2010-04-02 09:58        --------        d-----w-        c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-02 09:55 . 2010-04-02 09:54        --------        d-----w-        D:\QuickTime
2010-03-31 12:20 . 2010-02-01 15:00        --------        d-----w-        D:\MF Global-Futures-754-STASR
2010-03-30 15:27 . 2010-03-30 15:27        --------        d-----w-        c:\program files\Common Files\ABBYY
2010-03-30 13:24 . 2009-12-21 18:22        --------        d-----w-        D:\NinjaTrader 7
2010-03-29 08:18 . 2010-03-29 08:18        81        ----a-w-        C:\CTX.DAT
2010-03-27 16:29 . 2010-03-27 16:29        --------        d-----w-        D:\Senstic
2010-03-27 10:23 . 2010-03-27 10:18        --------        d-----w-        D:\Auktionatrix
2010-03-26 17:52 . 2010-03-26 17:52        --------        d-----w-        D:\RealVNC
2010-03-25 15:32 . 2010-03-25 15:32        86016        ----a-w-        c:\windows\system32\NtDirect.dll
2010-03-25 07:45 . 2010-03-25 07:45        --------        d-----w-        c:\users\me\AppData\Roaming\VMware
2010-03-25 07:45 . 2010-03-24 14:56        --------        d-----w-        c:\programdata\VMware
2010-03-24 15:52 . 2010-03-24 15:52        --------        d-----w-        c:\users\me\AppData\Roaming\FSL
2010-03-24 15:52 . 2010-03-24 15:52        --------        d-----w-        D:\FSL
2010-03-24 14:56 . 2010-03-24 14:56        --------        d-----w-        D:\VMware
2010-03-23 09:19 . 2009-10-02 18:38        --------        d-----w-        D:\Unlocker
2010-03-19 07:29 . 2009-08-27 09:42        --------        d-----w-        D:\FXCM MT4 powered by BT
2010-03-19 07:29 . 2009-10-13 16:58        --------        d-----w-        D:\Gigaset DECT
2010-03-10 08:01 . 2009-08-23 19:57        --------        d-----w-        D:\NewsBin
2010-03-08 13:29 . 2010-03-08 13:25        --------        d-----w-        c:\users\me\AppData\Roaming\Digsby
2010-03-08 13:29 . 2010-03-08 13:25        --------        d-----w-        c:\programdata\Digsby
2010-03-07 11:49 . 2010-04-09 07:30        3862528        ----a-w-        c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
2010-02-26 05:10 . 2010-02-26 05:10        21979992        ----a-w-        c:\users\me\AppData\Roaming\Dropbox\bin\Dropbox.exe
2010-02-23 12:35 . 2010-02-23 12:35        80400        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-02-23 12:35 . 2010-02-23 12:35        397328        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\oeas.dll
2010-02-23 12:35 . 2010-02-23 12:35        311312        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\sys\i386\6.0\klif.sys
2010-02-23 12:35 . 2010-02-23 12:35        19472        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\kloehk.dll
2010-02-23 12:35 . 2010-02-23 12:35        109072        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\mzvkbd3.dll
2010-02-23 12:35 . 2010-02-23 12:35        397328        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\oeas.dll
2010-02-23 12:35 . 2010-02-23 12:35        80400        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-02-23 12:35 . 2010-02-23 12:35        17936        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\kloehk.dll
2010-02-23 12:35 . 2010-02-23 12:35        109072        ----a-w-        c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\mzvkbd3.dll
2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat
2006-05-03 09:06 . 2009-12-30 14:12        163328        --sh--r-        c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-12-30 14:12        31232        --sh--r-        c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-12-30 14:12        216064        --sh--r-        c:\windows\System32\nbDX.dll
2009-08-18 14:13 . 2009-08-18 14:13        604140        --sha-w-        c:\windows\System32\drivers\ISwift3.dat
2009-07-14 01:14 . 2009-07-13 23:42        396800        --sha-w-        c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
2009-11-03 20:12        556432        ----a-w-        d:\mic30f~1\Office14\URLREDIR.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\me\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\me\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\me\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\spybot - search & destroy\TeaTimer.exe" [2009-03-05 2260480]
"OfficeSyncProcess"="d:\microsoft office 2010\Office14\MSOSYNC.EXE" [2009-11-03 649072]
"gSyncit"="d:\gsyncit\gsyncit.exe" [2010-02-13 21504]
"SUPERAntiSpyware"="d:\superantispyware\SUPERAntiSpyware.exe" [2010-04-27 2020592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IRW"="c:\windows\system32\IRW.exe" [2008-04-15 147456]
"Apple_KbdMgr"="d:\boot camp\KbdMgr.exe" [2008-04-15 423216]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-04-15 92704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-15 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-15 88608]
"Symantec Backup Exec System Recovery 8.5"="d:\symantec\Backup Exec System Recovery\Agent\VProTray.exe" [2009-06-29 2274664]
"IntelliPoint"="d:\microsoft intellipoint\ipoint.exe" [2009-05-28 1468296]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-08 4702208]
"ConnectionCenter"="d:\citrix\ICA Client\concentr.exe" [2009-09-12 103768]
"iTunesHelper"="d:\itunes\iTunesHelper.exe" [2010-04-28 142120]
"NcpBudgetGui"="d:\watchguard\Mobile VPN\NcpBudgetGui.exe" [2009-10-19 989696]
"NcpPopup"="d:\watchguard\Mobile VPN\ncppopup.exe" [2009-08-26 578560]
"NcpRsuGui"="d:\watchguard\Mobile VPN\rwsrsu.exe" [2009-10-12 819712]
"Malwarebytes' Anti-Malware"="d:\malwarebytes' anti-malware\mbamgui.exe" [2010-04-29 437584]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]

c:\users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
HotSpot Manager.lnk - d:\hotspot manager\HotSpotMgr.exe [2010-2-16 839680]

c:\users\me\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\me\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
HotSpot Manager.lnk - d:\hotspot manager\HotSpotMgr.exe [2010-2-16 839680]
IconRestorer.lnk - d:\fsl\IconRestorer\IconRestorer.exe [2010-3-24 1654272]
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - d:\microsoft office 2010\Office14\ONENOTEM.EXE [2009-11-3 225680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
taskmgr.lnk - c:\windows\System32\taskmgr.exe [2009-7-14 227328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\superantispyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21        548352        ----a-w-        d:\superantispyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u wsauth

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader - Schnellstart.lnk
backup=c:\windows\pss\Adobe Reader - Schnellstart.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^CAPI - Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\CAPI - Monitor.lnk
backup=c:\windows\pss\CAPI - Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Desktop Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Desktop Manager.lnk
backup=c:\windows\pss\Desktop Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Omega Research Task Scheduler.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Omega Research Task Scheduler.lnk
backup=c:\windows\pss\Omega Research Task Scheduler.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Online Plug-in.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Online Plug-in.lnk
backup=c:\windows\pss\Online Plug-in.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^sipgate X-Lite.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\sipgate X-Lite.lnk
backup=c:\windows\pss\sipgate X-Lite.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^talk&surf 6.0 - Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\talk&surf 6.0 - Monitor.lnk
backup=c:\windows\pss\talk&surf 6.0 - Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Update Agent.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Update Agent.lnk
backup=c:\windows\pss\Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^me^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\me\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2009-09-26 22:32        83312        ----a-w-        d:\microsoft office 2010\Office14\BCSSync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bonus.SSR.FR10]
2010-03-30 15:35        941320        ----a-w-        d:\abbyy finereader 10\Bonus.ScreenshotReader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ConnectionCenter]
2009-09-12 22:09        103768        ----a-w-        d:\citrix\ICA Client\concentr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-08-24 19:19        133104        ----atw-        c:\users\me\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 09:44        31072        ----a-w-        d:\microsoft office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService]
2007-09-25 12:59        532776        ----a-w-        c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lion]
2009-06-03 13:57        235378        ----a-w-        d:\lion\Lion.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\phonostarTimer]
2009-10-07 10:02        37376        ----a-w-        d:\phonostar-player\phonostarTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-10-08 18:59        4702208        ----a-w-        c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SerExt]
2005-03-01 08:40        61440        ----a-w-        c:\windows\System32\SerExt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 08:52        149280        ----a-w-        d:\java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Windows Defender"=d:\\Windows Defender\MSASCui.exe -hide

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

R2 gupdate;Google Update Service (gupdate);d:\google\Update\GoogleUpdate.exe [2009-11-03 135664]
R2 StarMoney 7.0 OnlineUpdate;StarMoney 7.0 OnlineUpdate;d:\starmoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [2010-04-12 541192]
R3 BthAudioHF;BthAudioHF Service;c:\windows\system32\DRIVERS\BthAudioHF.sys [2009-12-21 43008]
R3 BthKicker;Apple Bluetooth Device Driver;c:\windows\system32\DRIVERS\BthKicker.sys [2007-10-08 7424]
R3 CQG.CustomerExperience.AgentService;CQG Customer Experience Agent 1.74.5020;d:\cqg\CustomerExperience\Agent\CQG.CustomerExperience.AgentService.exe [2009-04-29 5120]
R3 DectEnum;DectEnum;c:\windows\system32\Drivers\DectEnum.sys [2005-03-01 8448]
R3 G6FTPServer;Gene6 FTP Server;d:\program files\Gene6 FTP Server\G6FTPSERVER.EXE [2007-10-22 470016]
R3 Gigusb;Dect USB Driver;c:\windows\system32\Drivers\Gigusb.sys [2005-03-01 53632]
R3 HRCMPA;ISDN Wan driver (Ver. 1.20.0032);c:\windows\system32\DRIVERS\hrcmpa.sys [2004-09-08 263751]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-06-22 100736]
R3 IUAPIWDM;ISDN USB Interface (Ver. 1.20.0032);c:\windows\system32\DRIVERS\IUAPIWDM.sys [2004-09-08 50759]
R3 NcpFilt;Ncp Filter Service;c:\windows\system32\DRIVERS\ncpvaxp.sys [2009-10-08 81224]
R3 ncplelhp;WatchGuard Secure Client NDIS6 Driver;c:\windows\system32\DRIVERS\ncplelhp.sys [x]
R3 ncpvaxp;NCP Secure Client Virtual Adapter Driver;c:\windows\system32\DRIVERS\ncpvaxp.sys [2009-10-08 81224]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-03-19 136704]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-03-19 8320]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-09-26 4639136]
R3 siellif;siellif;c:\windows\system32\Drivers\siellif.sys [2005-03-01 113408]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
R4 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-21 814344]
R4 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [2008-04-15 132400]
R4 AppleTimeSrv;Apple-Time-Server;c:\windows\system32\AppleTimeSrv.exe [2008-04-15 99632]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
S0 Ramdisk;Ramdisk [ QSoft ];c:\windows\system32\DRIVERS\ramdisk.sys [2002-12-06 21:46 8192]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-02 691696]
S1 cdfdrv;cdfdrv;c:\windows\system32\DRIVERS\cdfdrv.sys [2009-08-11 28704]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2009-09-08 65584]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-09-14 21520]
S1 SASDIFSV;SASDIFSV;d:\superantispyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;d:\superantispyware\SASKUTIL.SYS [2010-04-27 61440]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Backup Exec System Recovery;Backup Exec System Recovery;d:\symantec\Backup Exec System Recovery\Agent\VProSvc.exe [2009-06-29 4687200]
S2 CAPI;CAPI 2.0 Service;c:\windows\system32\DRIVERS\capi.sys [2004-09-08 28740]
S2 ctxpidmn;ctxpidmn;c:\windows\system32\DRIVERS\ctxpidmn.sys [2009-08-24 22816]
S2 CtxSbx;CtxSbx;c:\windows\system32\DRIVERS\CtxSbx.sys [2009-08-24 201248]
S2 HFGService;Handsfree Headset Service;c:\windows\system32\svchost.exe [2009-07-14 20992]
S2 inpout32;inpout32;c:\windows\system32\Drivers\inpout32.sys [2010-02-04 11936]
S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [2008-04-15 5504]
S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [2008-04-15 6528]
S2 MBAMService;MBAMService;d:\malwarebytes' anti-malware\mbamservice.exe [2010-04-29 304464]
S2 ncpclcfg;ncpclcfg;d:\watchguard\Mobile VPN\ncpclcfg.exe [2008-06-30 86016]
S2 ncprwsnt;ncprwsnt;d:\watchguard\Mobile VPN\ncprwsnt.exe [2009-10-19 1085960]
S2 NcpSec;NcpSec;d:\watchguard\Mobile VPN\ncpsec.exe [2008-10-06 32768]
S2 NDISCAPI;NDIS CAPI Service;c:\windows\system32\DRIVERS\ndiscapi.sys [2004-09-08 41037]
S2 NfsClnt;Client für NFS;c:\windows\system32\nfsclnt.exe [2009-07-14 52736]
S2 RadeSvc;Citrix Streamingdienst;d:\citrix\Streaming Client\RadeSvc.exe [2009-09-10 636232]
S2 rwsrsu;rwsrsu;d:\watchguard\Mobile VPN\rwsrsu.exe [2009-10-12 819712]
S2 SBSDWSCService;SBSD Security Center Service;d:\spybot - search & destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2009-07-14 7168]
S2 TeamViewer5;TeamViewer 5;d:\teamviewer\Version5\TeamViewer_Service.exe [2010-01-12 185640]
S2 wsnm;VMware View Client Service;d:\vmware\VMware View\Client\bin\wsnm.exe [2010-02-10 151552]
S2 XobniService;XobniService;d:\xobni\XobniService.exe [2010-04-14 55016]
S3 aapltctp;Apple Trackpad Enabler;c:\windows\system32\DRIVERS\aapltctp.sys [2007-10-08 4224]
S3 aapltp;Apple Trackpad;c:\windows\system32\DRIVERS\aapltp.sys [2007-10-08 35072]
S3 applebt;Apple Built-in Bluetooth;c:\windows\system32\DRIVERS\applebt.sys [2008-04-15 9088]
S3 csr_a2dp;Bluetooth AV Profile;c:\windows\system32\drivers\bthav.sys [2009-12-21 61952]
S3 ctxusbf;Citrix USB Filter Driver;c:\windows\system32\DRIVERS\ctxusbf.sys [2009-02-02 56632]
S3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\DRIVERS\IRFilter.sys [2008-04-15 16512]
S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys [2008-04-15 19968]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-04-29 20952]
S3 NcpFiltMP;NcpFiltMP;c:\windows\system32\DRIVERS\ncpvaxp.sys [2009-10-08 81224]
S3 NfsRdr;Client für NFS-Redirector;c:\windows\system32\drivers\nfsrdr.sys [2009-07-13 201216]
S3 RpcXdr;Server für NFS Open RPC (ONCRPC);c:\windows\system32\drivers\rpcxdr.sys [2009-07-13 86528]
S3 SymSnapService;SymSnapService;d:\symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapService.exe [2009-06-04 1562096]
S3 WSUSBDMAN;VMware View Virtual Client USB Manager;c:\windows\system32\DRIVERS\WSUSBDMAN.sys [2010-02-10 26928]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
bthaudiosvc        REG_MULTI_SZ          HFGService
.
Inhalt des "geplante Tasks" Ordners

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\google\Update\GoogleUpdate.exe [2009-11-03 11:24]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\google\Update\GoogleUpdate.exe [2009-11-03 11:24]

2009-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-60349161-937599409-2425357435-1000Core.job
- c:\users\me\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-24 19:19]

2009-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-60349161-937599409-2425357435-1000UA.job
- c:\users\me\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-24 19:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to &Evernote - d:\evernote\Evernote3.5\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - d:\mic30f~1\Office14\ONBttnIE.dll/105
IE: Hinzufügen zu Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Nach Microsoft E&xel exportieren - d:\mic30f~1\Office14\EXCEL.EXE/3000
IE: {{E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - d:\evernote\Evernote3.5\enbar.dll
Trusted Zone: learningsystem.de\fh-riedlingen-dls
Trusted Zone: uzsystem.de\uzcrm
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
DPF: {DBDC1CDA-B64B-49F7-9535-6317AA416E51} - hxxps://192.51.32.233/downloads/VMware-viewclient.cab
FF - ProfilePath - c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - component: c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\lazarus@interclue.com\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - plugin: c:\users\me\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\ietab@ip.cn\plugins\npCoralIETab.dll
FF - plugin: c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF - plugin: c:\users\me\AppData\Roaming\Mozilla\Firefox\Profiles\ezw2jevm.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: d:\citrix\Streaming Client\nprade.dll
FF - plugin: d:\google\Google Earth\plugin\npgeplugin.dll
FF - plugin: d:\google\Picasa3\npPicasa3.dll
FF - plugin: d:\google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: d:\mic30f~1\Office14\NPAUTHZ.DLL
FF - plugin: d:\micros~1\Office14\NPSPWRAP.DLL
FF - plugin: d:\windows live\Photo Gallery\NPWLPG.dll

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",  1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",      2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",      1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",  25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",    5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "hxxp://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
MSConfigStartUp-BlackBerryAutoUpdate - c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
MSConfigStartUp-GizmoDriveDelegate - d:\gizmo\GDRIVE.DLL
MSConfigStartUp-VirtualCloneDrive - c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'lsass.exe'(612)
c:\windows\system32\wsauth.DLL

- - - - - - - > 'Explorer.exe'(5612)
c:\users\me\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
d:\microsoft virtual pc\VPCShExH.DLL
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
d:\spybot~1\SDHelper.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
d:\citrix\ICA Client\ssonsvr.exe
d:\bonjour\mDNSResponder.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Citrix\System32\CdfSvc.exe
c:\windows\system32\conhost.exe
c:\windows\system32\UI0Detect.exe
c:\windows\System32\msdtc.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
d:\citrix\ICA Client\WFCRUN32.EXE
d:\ipod\bin\iPodService.exe
c:\program files\Common Files\T-Com\HotspotMgr\HotSpotFSvc.exe
c:\windows\system32\cscript.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-05-06  15:58:46 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-05-06 13:58

Vor Suchlauf: 8.819.519.488 Bytes frei
Nach Suchlauf: 8.809.881.600 Bytes frei

- - End Of File - - 8EE5B8A562BC72F4D940746F3E14E071

alle von combofix gelöschten dateien habe ich bei virustotal untersuchen lassen- sauber (?)


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:50 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131