Trojaner-Board
Seite 1 von 8 1 23 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Hilfe - iexplore.exe und kein sound mehr. Kein Virus? Trojaner? (https://www.trojaner-board.de/87805-hilfe-iexplore-exe-kein-sound-mehr-kein-virus-trojaner.html)

van 05.07.2010 13:02
Hilfe - iexplore.exe und kein sound mehr. Kein Virus? Trojaner?
 
Hallo,

auffälligkeiten: Im Taskmanager erscheint 2 oder drei oder sogar 4 mal der IEXPLORE.EXE... nach manuellem beenden taucht dieser wieder auf. Zusätzlich geht mein wave Regler runter... ob da ein zusammenhang besteht?

Mein hijackthis logfile:

Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:37:34, on 05.07.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\system32\svchost.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\WINXP\system32\FsUsbExService.Exe
C:\WINXP\system32\svchost.exe
C:\WINXP\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINXP\system32\ctfmon.exe
C:\WINXP\system32\msiexec.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Spybot - Search & Destroy\SpybotSD.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Mozilla Firefox\plugin-container.exe
C:\Programme\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugi n.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Programme\HyperCam Toolbar\tbcore3.dll
O3 - Toolbar: HyperCam Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Programme\HyperCam Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" /S
O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - Startup: PRT.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/windowsu...?1260566609343
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINXP\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINXP\system32\browseui.dll
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: FsUsbExService - Teruten - C:\WINXP\system32\FsUsbExService.Exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4330 bytes

Bitte helft mir :(

van

cosinus 05.07.2010 15:15
Hallo,

bitte nen Vollscan mit malwarebytes machen und Log posten. Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

van 05.07.2010 15:37
Hallo :)

LOG von Malwarebyte's:
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4277

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

05.07.2010 16:29:40
mbam-log-2010-07-05 (16-29-40).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 158582
Laufzeit: 5 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Log 1 von Oldtimer
Code:
OTL Extras logfile created on: 05.07.2010 16:33:16 - Run 2
OTL by OldTimer - Version 3.2.7.1    Folder = C:\Dokumente und Einstellungen\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 59,62 Gb Total Space | 44,81 Gb Free Space | 75,16% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 996,19 Mb Total Space | 988,56 Mb Free Space | 99,23% Space Free | Partition Type: NTFS
 
Computer Name: PC1
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{289338AE-2213-4509-AED2-450414C1260C}_is1" = ICQ Update Patch 1.6
"{300578F9-9EFF-4B93-9AB1-C0E5707EF463}" = ACDSee Foto-Manager 2009
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{7184F382-8A6C-4B85-A3AC-B63734B1E241}" = SAMSUNG Mobile USB Driver
"{793FCE60-DE5E-4977-A942-A7B69A45B17D}" = MainConcept DTV Decoder Pro
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{993A94A9-DCE3-4774-B35D-D8C74FC1E0BE}" = Royale Remixed Theme
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1031-7B44-A92000000001}" = Adobe Reader 9.2 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}" = NVIDIA PhysX
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE9F9FBC-5253-46D2-9883-09E55003D794}" = TechniSat DVB-PC TV Star
"{D75814C1-5AA5-4198-BFF6-093A226D9F0D}" = O&O Defrag Professional
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{D96E4F13-2635-4CBD-9308-F99228929C41}" = RamDisk Plus 10.0
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"7-Zip" = 7-Zip 4.65
"AC3Filter_is1" = AC3Filter 1.63b
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ALPHACOOL USB DISPLAY SOFTWARE_is1" = ALPHACOOL USB DISPLAY 1.0.0
"alphaLCD" = Alphacool alphaLCD
"AutoItv3" = AutoIt v3.3.0.0
"AVI Splitter_is1" = AVI Splitter
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CANONBJ_Deinstall_CNMCP64.DLL" = Canon PIXMA iP4000
"C-Media Oxygen HD Sound" = ASUS Xonar D2X Audio
"CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.53
"CrystalDiskMark_is1" = CrystalDiskMark 3.0.0 Beta2
"DivX Setup.divx.com" = DivX-Setup
"DVBViewer TE2_is1" = DVBViewer TE2
"FastStone Capture" = FastStone Capture 5.3
"ffdshow_is1" = ffdshow [rev 2527] [2008-12-19]
"Fraps" = Fraps
"HaaliMkx" = Haali Media Splitter
"HD Tune_is1" = HD Tune 2.55
"HyperCam 2" = HyperCam 2
"HyperCam Toolbar" = HyperCam Toolbar
"ICQLite" = ICQ 5.1
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"OpenAL" = OpenAL
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"SAMSUNG Android USB Modem" = SAMSUNG Android USB Modem Software
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"SAMSUNG Mobile Modem V2" = SAMSUNG Mobile Modem V2 Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Download Driver" = SAMSUNG Mobile USB Download Driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Samsung Mobile USB Modem Device" = Samsung Mobile USB Modem Device Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SpeedFan" = SpeedFan (remove only)
"Steam App 240" = Counter-Strike: Source
"The KMPlayer" = The KMPlayer (remove only)
"Trojancheck_is1" = Trojancheck 6
"USB-Display Driver" = Alphacool USB-Display Driver
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.3
"Winamp" = Winamp
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"Move Media Player" = Move Media Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 17.05.2010 14:01:25 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3743, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x006b006f.
 
Error - 11.06.2010 15:55:17 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divx plus player.exe, Version 10.1.0.428,
 fehlgeschlagenes Modul msvcr80.dll, Version 8.0.50727.4053, Fehleradresse 0x00017401.
 
Error - 13.06.2010 06:42:56 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung firefox.exe, Version 1.9.2.3743, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x0c0c1068.
 
Error - 18.06.2010 05:18:42 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divx plus player.exe, Version 10.1.0.428,
 fehlgeschlagenes Modul msvcr80.dll, Version 8.0.50727.4053, Fehleradresse 0x00017401.
 
Error - 24.06.2010 18:22:51 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung dvbviewerte.exe, Version 1.0.4.69, fehlgeschlagenes
 Modul , Version 6.5.2600.5933, Fehleradresse 0x000ae2aa.
 
Error - 25.06.2010 12:57:27 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung hycam2.exe, Version 2.17.2.0, fehlgeschlagenes
 Modul hycam2.exe, Version 2.17.2.0, Fehleradresse 0x000974ed.
 
Error - 26.06.2010 05:57:45 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung mpc-hc.exe, Version 1.3.1249.0, fehlgeschlagenes
 Modul mpc-hc.exe, Version 1.3.1249.0, Fehleradresse 0x0017d923.
 
Error - 27.06.2010 17:51:21 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3814,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b.
 
Error - 28.06.2010 10:51:52 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.3828,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x0000100b.
 
Error - 04.07.2010 17:23:58 | Computer Name = PC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung smss.exe, Version 1.0.0.1, fehlgeschlagenes
 Modul ntdll.dll, Version 5.1.2600.5755, Fehleradresse 0x00036a76.
 
[ System Events ]
Error - 01.05.2010 05:53:05 | Computer Name = PC1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1068" aufgetreten, als der Dienst "upnphost"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {204810B9-73B2-11D4-BF42-00B0D0118B56}
 
Error - 01.05.2010 05:53:05 | Computer Name = PC1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Universeller Plug & Play-Gerätehost" ist vom Dienst "SSDP-Suchdienst"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1058
 
Error - 02.05.2010 18:20:07 | Computer Name = PC1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1068" aufgetreten, als der Dienst "upnphost"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {204810B9-73B2-11D4-BF42-00B0D0118B56}
 
Error - 02.05.2010 18:20:08 | Computer Name = PC1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Universeller Plug & Play-Gerätehost" ist vom Dienst "SSDP-Suchdienst"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1058
 
Error - 02.05.2010 18:20:34 | Computer Name = PC1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1068" aufgetreten, als der Dienst "upnphost"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {204810B9-73B2-11D4-BF42-00B0D0118B56}
 
Error - 02.05.2010 18:20:34 | Computer Name = PC1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Universeller Plug & Play-Gerätehost" ist vom Dienst "SSDP-Suchdienst"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1058
 
Error - 03.05.2010 09:46:42 | Computer Name = PC1 | Source = atapi | ID = 262159
Description = Das Gerät \Device\Ide\IdePort1 ist für den Zugriff noch nicht bereit.
 
Error - 04.05.2010 03:00:16 | Computer Name = PC1 | Source = atapi | ID = 262159
Description = Das Gerät \Device\Ide\IdePort1 ist für den Zugriff noch nicht bereit.
 
Error - 04.05.2010 18:02:16 | Computer Name = PC1 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1068" aufgetreten, als der Dienst "upnphost"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {204810B9-73B2-11D4-BF42-00B0D0118B56}
 
Error - 04.05.2010 18:02:16 | Computer Name = PC1 | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Universeller Plug & Play-Gerätehost" ist vom Dienst "SSDP-Suchdienst"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1058
 
 
< End of report >

Log 2 von Oldtimer

Code:
OTL logfile created on: 05.07.2010 16:33:16 - Run 2
OTL by OldTimer - Version 3.2.7.1    Folder = C:\Dokumente und Einstellungen\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 80,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 92,00% Paging File free
Paging file location(s): [Binary data over 100 bytes]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 59,62 Gb Total Space | 44,81 Gb Free Space | 75,16% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 996,19 Mb Total Space | 988,56 Mb Free Space | 99,23% Space Free | Partition Type: NTFS
 
Computer Name: PC1
Current User Name: Administrator
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINXP\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINXP\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (NMSAccessU) -- C:\Programme\CDBurnerXP\NMSAccessU.exe ()
SRV - (FsUsbExService) -- C:\WINXP\system32\FsUsbExService.Exe (Teruten)
SRV - (O&O Defrag) -- C:\Programme\OO Software\Defrag\oodag.exe (O&O Software GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBAAPL) -- C:\WINXP\System32\Drivers\usbaapl.sys File not found
DRV - (nv) -- C:\WINXP\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (sptd) -- C:\WINXP\System32\Drivers\sptd.sys ()
DRV - (avgntflt) -- C:\WINXP\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (yukonwxp) -- C:\WINXP\system32\drivers\yk51x86.sys ()
DRV - (FsUsbExDisk) -- C:\WINXP\system32\FsUsbExDisk.Sys ()
DRV - (RivaTuner32) -- C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys ()
DRV - (MTSBDA) -- C:\WINXP\system32\drivers\MtsBda.sys (TechniSat Provide)
DRV - (MtsHID) -- C:\WINXP\system32\drivers\MtsHID.sys (TechniSat Provide)
DRV - (pavboot) -- C:\WINXP\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (SscRdBus) Virtual bus device (SuperSpeed LLC) -- C:\WINXP\system32\DRIVERS\SscRdBus.sys (SuperSpeed LLC)
DRV - (cmudaxp) -- C:\WINXP\system32\drivers\cmudaxp.sys (C-Media Inc)
DRV - (ssmdrv) -- C:\WINXP\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINXP\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (cpuz132) -- C:\WINXP\system32\drivers\cpuz132_x32.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (ss_bmdm) -- C:\WINXP\system32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) -- C:\WINXP\system32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) -- C:\WINXP\system32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (MPE) -- C:\WINXP\system32\drivers\MPE.sys (Microsoft Corporation)
DRV - (libusb0) -- C:\WINXP\system32\drivers\libusb0.sys (hxxp://libusb-win32.sourceforge.net)
DRV - (SscRdCls) RAM Disk (SuperSpeed LLC) -- C:\WINXP\system32\DRIVERS\SscRdCls.sys (SuperSpeed LLC)
DRV - (StarOpen) -- C:\WINXP\System32\drivers\StarOpen.sys ()
DRV - (speedfan) -- C:\WINXP\system32\speedfan.sys (Windows (R) 2000 DDK provider)
DRV - (MTsensor) -- C:\WINXP\system32\drivers\ASACPI.sys ()
DRV - (giveio) -- C:\WINXP\system32\giveio.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bild.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EC 45 FE 68 6D 18 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.hardwareluxx.de/community/?styleid=71"
FF - prefs.js..extensions.enabledItems: {75656794-AB59-4712-BFBC-5D816D56F3BC}:1.1.0
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.06.27 23:51:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.06.27 23:51:28 | 000,000,000 | ---D | M]
 
[2009.12.11 22:16:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2010.07.05 10:35:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o13vwr8q.default\extensions
[2010.04.27 21:08:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o13vwr8q.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.02.25 21:30:31 | 000,000,000 | ---D | M] (HyperCam Toolbar) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o13vwr8q.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2009.12.11 22:26:29 | 000,000,000 | ---D | M] (Password Exporter) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o13vwr8q.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}
[2010.07.05 10:35:12 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.03.15 19:54:46 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.15 19:54:46 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.15 19:54:46 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.15 19:54:46 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.15 19:54:46 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.12.19 17:02:02 | 000,000,939 | ---- | M]) - C:\WINXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1 dvbviewer.com
O1 - Hosts: 127.0.0.1 www.dvbviewer.com
O1 - Hosts: 127.0.0.1 server1.dvbviewer.com
O1 - Hosts: 127.0.0.1 www.dvbviewer.info
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Programme\HyperCam Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (HyperCam Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Programme\HyperCam Toolbar\tbcore3.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (HyperCam Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Programme\HyperCam Toolbar\tbcore3.dll ()
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [RivaTunerStartupDaemon] C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\PRT.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (ICQ Ltd.)
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (ICQ Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260566609343 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINXP\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.12.11 22:02:12 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINXP\System32\OODBS.exe (O&O Software GmbH)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.05 16:20:00 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
[2010.07.05 15:47:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
[2010.07.05 15:47:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINXP\System32\drivers\mbamswissarmy.sys
[2010.07.05 15:47:47 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINXP\System32\drivers\mbam.sys
[2010.07.05 15:47:47 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.07.05 15:47:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.07.05 15:47:37 | 006,153,648 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Administrator\Desktop\mbam-setup.exe
[2010.07.05 14:38:31 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\Recent
[2010.07.05 13:32:41 | 000,028,552 | ---- | C] (Panda Security, S.L.) -- C:\WINXP\System32\drivers\pavboot.sys
[2010.07.05 13:32:28 | 000,000,000 | ---D | C] -- C:\Programme\Panda Security
[2010.07.05 13:27:43 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.07.05 13:26:46 | 000,000,000 | ---D | C] -- C:\Programme\Trojancheck 6
[2010.07.05 13:15:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Toolbar4
[2010.07.05 11:48:48 | 008,126,464 | ---- | C] (C-Media Corporation) -- C:\WINXP\System\CmiCnfgP.cpl
[2010.07.05 11:48:48 | 000,299,008 | ---- | C] (C-Media Electronics Inc.) -- C:\WINXP\System32\cmasiop.dll
[2010.07.05 11:48:48 | 000,294,912 | ---- | C] (C-Media Corporation) -- C:\WINXP\System32\CMRMDRVP.EXE
[2010.07.05 11:48:48 | 000,122,880 | ---- | C] (CMedia Electronics Inc.) -- C:\WINXP\System32\Cm_Oal.dll
[2010.07.05 11:48:32 | 000,102,400 | ---- | C] (C-Media Corporation) -- C:\WINXP\CmiPCIUninstall.exe
[2010.07.05 11:48:30 | 000,000,000 | ---D | C] -- C:\MediaCenterAudio
[2010.07.05 11:48:29 | 002,034,304 | ---- | C] (C-Media Inc) -- C:\WINXP\System32\drivers\cmudaxp.sys
[2010.07.05 11:48:29 | 000,315,392 | ---- | C] (C-Media Electronics Inc.) -- C:\WINXP\System\CmiFltr.dll
[2010.07.05 11:48:29 | 000,032,768 | ---- | C] (C-Media Electronics Inc.) -- C:\WINXP\System32\cmudaxp.dll
[2010.07.05 11:48:29 | 000,000,000 | ---D | C] -- C:\Programme\ASUS Xonar D2X Audio
[2010.07.05 11:48:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2010.07.05 11:47:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DNA
[2010.07.05 11:47:45 | 000,000,000 | ---D | C] -- C:\Programme\DNA
[2010.07.05 11:47:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DNA
[2010.07.05 11:19:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2010.07.05 11:19:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2010.07.05 10:37:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FastStone
[2010.07.05 10:37:50 | 000,000,000 | ---D | C] -- C:\Programme\FastStone Capture
[2010.07.05 10:30:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop\sicherheit win xp SSD
[2010.07.02 11:48:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\NPS
[2010.07.02 11:47:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\My Art
[2010.07.02 11:45:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2010.07.02 11:45:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Suite
[2010.07.02 11:44:08 | 000,319,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\DIFxAPI.dll
[2010.07.02 11:43:56 | 000,090,624 | ---- | C] (Nokia) -- C:\WINXP\System32\nmwcdcls.dll
[2010.07.02 11:43:52 | 000,021,632 | ---- | C] (Nokia) -- C:\WINXP\System32\drivers\pccsmcfd.sys
[2010.07.02 11:43:47 | 000,121,856 | ---- | C] (MCCI Corporation) -- C:\WINXP\System32\drivers\ss_bmdm.sys
[2010.07.02 11:43:47 | 000,090,112 | ---- | C] (MCCI) -- C:\WINXP\System32\drivers\ss_bbus.sys
[2010.07.02 11:43:47 | 000,014,976 | ---- | C] (MCCI Corporation) -- C:\WINXP\System32\drivers\ss_bmdfl.sys
[2010.07.02 11:43:47 | 000,012,160 | ---- | C] (MCCI Corporation) -- C:\WINXP\System32\drivers\ss_bwhnt.sys
[2010.07.02 11:43:47 | 000,012,160 | ---- | C] (MCCI Corporation) -- C:\WINXP\System32\drivers\ss_bwh.sys
[2010.07.02 11:43:47 | 000,012,160 | ---- | C] (MCCI Corporation) -- C:\WINXP\System32\drivers\ss_bcmnt.sys
[2010.07.02 11:43:47 | 000,012,160 | ---- | C] (MCCI Corporation) -- C:\WINXP\System32\drivers\ss_bcm.sys
[2010.07.02 11:43:36 | 000,000,000 | ---D | C] -- C:\WINXP\System32\Samsung_USB_Drivers
[2010.07.02 11:43:36 | 000,000,000 | ---D | C] -- C:\Programme\DIFX
[2010.07.02 11:43:35 | 000,238,952 | ---- | C] (Teruten) -- C:\WINXP\System32\FsUsbExService.Exe
[2010.07.02 11:43:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Samsung
[2010.07.02 11:43:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\My NPS Files
[2010.07.02 11:43:29 | 000,000,000 | ---D | C] -- C:\Programme\MarkAny
[2010.07.02 11:43:28 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2010.07.02 11:43:20 | 000,000,000 | ---D | C] -- C:\Programme\Samsung
[2010.07.02 11:43:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
[2010.06.29 22:52:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\NVIDIA
[2010.06.27 00:06:45 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iedvtool.dll
[2010.06.22 21:40:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Administrator\IECompatCache
[2010.06.15 04:16:24 | 000,086,016 | ---- | C] (Beepa P/L) -- C:\WINXP\System32\frapsvid.dll
[2010.06.10 19:53:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop\Dokumente
[2010.06.10 01:31:14 | 000,000,000 | ---D | C] -- C:\Programme\avisplit
[2010.06.07 17:35:38 | 000,081,920 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvwddi.dll
[2010.06.07 17:35:30 | 000,253,952 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsth.dll
[2010.06.07 17:35:30 | 000,249,856 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrseng.dll
[2010.06.07 17:35:28 | 000,331,776 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrshe.dll
[2010.06.07 17:35:28 | 000,282,624 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsel.dll
[2010.06.07 17:35:28 | 000,274,432 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsnl.dll
[2010.06.07 17:35:28 | 000,274,432 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsesm.dll
[2010.06.07 17:35:28 | 000,253,952 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsda.dll
[2010.06.07 17:35:28 | 000,249,856 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsfi.dll
[2010.06.07 17:35:28 | 000,126,976 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrszht.dll
[2010.06.07 17:35:26 | 000,335,872 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsar.dll
[2010.06.07 17:35:26 | 000,286,720 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsfr.dll
[2010.06.07 17:35:26 | 000,282,624 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsit.dll
[2010.06.07 17:35:26 | 000,282,624 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrses.dll
[2010.06.07 17:35:26 | 000,278,528 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsde.dll
[2010.06.07 17:35:26 | 000,274,432 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrspt.dll
[2010.06.07 17:35:26 | 000,270,336 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsru.dll
[2010.06.07 17:35:26 | 000,270,336 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsptb.dll
[2010.06.07 17:35:26 | 000,270,336 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsja.dll
[2010.06.07 17:35:26 | 000,266,240 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsko.dll
[2010.06.07 17:35:26 | 000,262,144 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrshu.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrstr.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrssl.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrssk.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrspl.dll
[2010.06.07 17:35:26 | 000,253,952 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrssv.dll
[2010.06.07 17:35:26 | 000,253,952 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsno.dll
[2010.06.07 17:35:26 | 000,249,856 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrscs.dll
[2010.06.07 17:35:26 | 000,229,376 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvrszhc.dll
[2010.06.07 17:35:24 | 000,277,608 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvmccs.dll
[2010.06.07 17:35:24 | 000,110,696 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvmctray.dll
[2010.06.07 17:35:22 | 013,902,440 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvcpl.dll
[2010.06.07 17:35:22 | 000,145,000 | ---- | C] (NVIDIA Corporation) -- C:\WINXP\System32\nvcolor.exe
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.05 16:24:08 | 000,000,000 | ---- | M] () -- C:\wiper.dat
[2010.07.05 16:23:49 | 000,001,084 | ---- | M] () -- C:\WINXP\tasks\GoogleUpdateTaskMachineCore.job
[2010.07.05 16:23:48 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat
[2010.07.05 16:23:48 | 000,000,006 | -H-- | M] () -- C:\WINXP\tasks\SA.DAT
[2010.07.05 16:23:41 | 000,261,580 | ---- | M] () -- C:\WINXP\System32\oodbs.lor
[2010.07.05 16:23:17 | 008,650,752 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\NTUSER.DAT
[2010.07.05 16:23:17 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.ini
[2010.07.05 16:20:01 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe
[2010.07.05 16:17:48 | 000,004,507 | ---- | M] () -- C:\WINXP\imsins.BAK
[2010.07.05 16:17:47 | 001,040,640 | ---- | M] () -- C:\WINXP\System32\PerfStringBackup.INI
[2010.07.05 16:17:47 | 000,448,726 | ---- | M] () -- C:\WINXP\System32\perfh007.dat
[2010.07.05 16:17:47 | 000,432,492 | ---- | M] () -- C:\WINXP\System32\perfh009.dat
[2010.07.05 16:17:47 | 000,080,290 | ---- | M] () -- C:\WINXP\System32\perfc007.dat
[2010.07.05 16:17:47 | 000,067,448 | ---- | M] () -- C:\WINXP\System32\perfc009.dat
[2010.07.05 15:47:50 | 000,000,677 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.05 15:47:39 | 006,153,648 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Administrator\Desktop\mbam-setup.exe
[2010.07.05 15:43:11 | 000,001,088 | ---- | M] () -- C:\WINXP\tasks\GoogleUpdateTaskMachineUA.job
[2010.07.05 14:42:28 | 000,002,447 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\HiJackThis.lnk
[2010.07.05 13:34:11 | 000,000,507 | ---- | M] () -- C:\WINXP\win.ini
[2010.07.05 13:34:11 | 000,000,260 | ---- | M] () -- C:\WINXP\system.ini
[2010.07.05 13:34:11 | 000,000,212 | -HS- | M] () -- C:\boot.ini
[2010.07.05 13:27:36 | 001,402,880 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\HiJackThis.msi
[2010.07.05 13:26:46 | 000,000,659 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Trojancheck.lnk
[2010.07.05 13:26:39 | 001,273,071 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\tc6_install.exe
[2010.07.05 12:37:19 | 000,111,784 | ---- | M] () -- C:\WINXP\System32\FNTCACHE.DAT
[2010.07.05 11:48:48 | 000,000,806 | ---- | M] () -- C:\WINXP\System\Cmicnfgp.ini
[2010.07.05 11:48:48 | 000,000,154 | ---- | M] () -- C:\WINXP\Cmicnfgp.ini.cfl
[2010.07.05 11:48:32 | 000,413,696 | ---- | M] (Creative Labs) -- C:\WINXP\System32\wrap_oal.dll
[2010.07.05 11:48:32 | 000,102,400 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINXP\System32\OpenAL32.dll
[2010.07.05 10:37:50 | 000,000,723 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FastStone Capture.lnk
[2010.07.05 10:36:02 | 000,000,479 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Fraps.lnk
[2010.07.05 09:58:49 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\wiper.dat
[2010.07.04 22:47:13 | 000,169,984 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.04 22:34:31 | 000,102,646 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\13.jpg
[2010.07.04 22:26:28 | 000,009,358 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\plan neue woche.odt
[2010.07.04 19:53:58 | 000,002,206 | ---- | M] () -- C:\WINXP\System32\wpa.dbl
[2010.07.02 11:43:33 | 000,002,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\$_hpcst$.hpc
[2010.07.02 11:43:30 | 000,001,852 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Samsung New PC Studio.lnk
[2010.06.29 22:36:02 | 000,217,180 | ---- | M] () -- C:\WINXP\System32\nvdrsdb1.bin
[2010.06.29 22:36:02 | 000,000,001 | ---- | M] () -- C:\WINXP\System32\nvdrssel.bin
[2010.06.29 22:36:01 | 000,000,022 | ---- | M] () -- C:\WINXP\System32\nvModes.dat
[2010.06.29 22:32:59 | 000,217,180 | ---- | M] () -- C:\WINXP\System32\nvdrsdb0.bin
[2010.06.29 22:32:58 | 000,000,000 | ---- | M] () -- C:\WINXP\System32\nvdrswr.lk
[2010.06.29 22:24:40 | 000,272,291 | ---- | M] () -- C:\WINXP\System32\NvApps.xml
[2010.06.15 04:16:24 | 000,086,016 | ---- | M] (Beepa P/L) -- C:\WINXP\System32\frapsvid.dll
[2010.06.14 17:05:46 | 005,552,128 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Brother.mp3
[2010.06.10 19:37:26 | 000,000,803 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\CoreTemp.ini
[2010.06.08 01:57:00 | 015,192,064 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvoglnt.dll
[2010.06.08 01:57:00 | 010,531,200 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\drivers\nv4_mini.sys
[2010.06.08 01:57:00 | 010,531,200 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\dllcache\nv4_mini.sys
[2010.06.08 01:57:00 | 010,256,384 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcompiler.dll
[2010.06.08 01:57:00 | 006,300,544 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nv4_disp.dll
[2010.06.08 01:57:00 | 004,554,752 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcuda.dll
[2010.06.08 01:57:00 | 002,632,296 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcuvenc.dll
[2010.06.08 01:57:00 | 002,186,342 | ---- | M] () -- C:\WINXP\System32\nvdata.bin
[2010.06.08 01:57:00 | 002,165,352 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcuvid.dll
[2010.06.08 01:57:00 | 001,359,872 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvapi.dll
[2010.06.08 01:57:00 | 000,232,040 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcodins.dll
[2010.06.08 01:57:00 | 000,232,040 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcod.dll
[2010.06.08 01:57:00 | 000,061,440 | ---- | M] (Khronos Group) -- C:\WINXP\System32\OpenCL.dll
[2010.06.08 01:57:00 | 000,007,959 | ---- | M] () -- C:\WINXP\System32\nvinfo.pb
[2010.06.07 17:35:38 | 000,081,920 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvwddi.dll
[2010.06.07 17:35:30 | 000,253,952 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsth.dll
[2010.06.07 17:35:30 | 000,249,856 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrseng.dll
[2010.06.07 17:35:28 | 000,331,776 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrshe.dll
[2010.06.07 17:35:28 | 000,282,624 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsel.dll
[2010.06.07 17:35:28 | 000,274,432 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsnl.dll
[2010.06.07 17:35:28 | 000,274,432 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsesm.dll
[2010.06.07 17:35:28 | 000,253,952 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsda.dll
[2010.06.07 17:35:28 | 000,249,856 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsfi.dll
[2010.06.07 17:35:28 | 000,126,976 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrszht.dll
[2010.06.07 17:35:26 | 000,335,872 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsar.dll
[2010.06.07 17:35:26 | 000,286,720 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsfr.dll
[2010.06.07 17:35:26 | 000,282,624 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsit.dll
[2010.06.07 17:35:26 | 000,282,624 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrses.dll
[2010.06.07 17:35:26 | 000,278,528 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsde.dll
[2010.06.07 17:35:26 | 000,274,432 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrspt.dll
[2010.06.07 17:35:26 | 000,270,336 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsru.dll
[2010.06.07 17:35:26 | 000,270,336 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsptb.dll
[2010.06.07 17:35:26 | 000,270,336 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsja.dll
[2010.06.07 17:35:26 | 000,266,240 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsko.dll
[2010.06.07 17:35:26 | 000,262,144 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrshu.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrstr.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrssl.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrssk.dll
[2010.06.07 17:35:26 | 000,258,048 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrspl.dll
[2010.06.07 17:35:26 | 000,253,952 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrssv.dll
[2010.06.07 17:35:26 | 000,253,952 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrsno.dll
[2010.06.07 17:35:26 | 000,249,856 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrscs.dll
[2010.06.07 17:35:26 | 000,229,376 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvrszhc.dll
[2010.06.07 17:35:24 | 000,277,608 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvmccs.dll
[2010.06.07 17:35:24 | 000,110,696 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvmctray.dll
[2010.06.07 17:35:22 | 013,902,440 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcpl.dll
[2010.06.07 17:35:22 | 000,145,000 | ---- | M] (NVIDIA Corporation) -- C:\WINXP\System32\nvcolor.exe
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.07.05 15:47:50 | 000,000,677 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.05 13:27:43 | 000,002,447 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\HiJackThis.lnk
[2010.07.05 13:27:36 | 001,402,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\HiJackThis.msi
[2010.07.05 13:26:46 | 000,000,659 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Trojancheck.lnk
[2010.07.05 13:26:39 | 001,273,071 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\tc6_install.exe
[2010.07.05 11:48:48 | 000,000,806 | ---- | C] () -- C:\WINXP\System\Cmicnfgp.ini
[2010.07.05 11:48:48 | 000,000,154 | ---- | C] () -- C:\WINXP\Cmicnfgp.ini.cfl
[2010.07.05 11:48:48 | 000,000,054 | ---- | C] () -- C:\WINXP\System32\cmasiop.ini
[2010.07.05 11:48:32 | 000,003,466 | ---- | C] () -- C:\WINXP\Cmicnfgp.ini.cfg
[2010.07.05 11:48:30 | 000,000,541 | ---- | C] () -- C:\WINXP\cmudaxp.ini
[2010.07.05 10:37:50 | 000,000,723 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\FastStone Capture.lnk
[2010.07.04 22:34:31 | 000,102,646 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\13.jpg
[2010.07.02 11:43:35 | 000,110,592 | ---- | C] () -- C:\WINXP\System32\FsUsbExDevice.Dll
[2010.07.02 11:43:35 | 000,036,608 | ---- | C] () -- C:\WINXP\System32\FsUsbExDisk.Sys
[2010.07.02 11:43:33 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\$_hpcst$.hpc
[2010.07.02 11:43:30 | 000,001,852 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Samsung New PC Studio.lnk
[2010.06.29 22:32:59 | 000,217,180 | ---- | C] () -- C:\WINXP\System32\nvdrsdb0.bin
[2010.06.29 22:32:58 | 000,217,180 | ---- | C] () -- C:\WINXP\System32\nvdrsdb1.bin
[2010.06.29 22:32:58 | 000,000,001 | ---- | C] () -- C:\WINXP\System32\nvdrssel.bin
[2010.06.29 22:32:58 | 000,000,000 | ---- | C] () -- C:\WINXP\System32\nvdrswr.lk
[2010.06.20 01:45:37 | 000,009,358 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\plan neue woche.odt
[2010.06.14 17:05:30 | 005,552,128 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Brother.mp3
[2010.01.08 21:05:03 | 000,691,696 | ---- | C] () -- C:\WINXP\System32\drivers\sptd.sys
[2010.01.06 16:21:42 | 000,021,063 | ---- | C] () -- C:\WINXP\Ascd_tmp.ini
[2010.01.06 16:21:41 | 000,005,810 | R--- | C] () -- C:\WINXP\System32\drivers\ASACPI.sys
[2010.01.06 16:21:32 | 000,005,824 | ---- | C] () -- C:\WINXP\System32\drivers\ASUSHWIO.SYS
[2010.01.03 17:40:30 | 000,003,584 | ---- | C] () -- C:\WINXP\System32\drivers\DLPORTIO.sys
[2009.12.23 18:17:40 | 000,007,680 | ---- | C] () -- C:\WINXP\System32\CNMVS64.DLL
[2009.12.19 16:57:47 | 000,363,520 | ---- | C] () -- C:\WINXP\System32\PsisDecd.dll
[2009.12.12 00:33:09 | 000,057,344 | ---- | C] () -- C:\WINXP\System32\ff_vfw.dll
[2009.12.12 00:33:09 | 000,000,547 | ---- | C] () -- C:\WINXP\System32\ff_vfw.dll.manifest
[2009.10.21 11:22:00 | 000,298,752 | ---- | C] () -- C:\WINXP\System32\drivers\yk51x86.sys
[2008.05.04 17:39:34 | 000,002,560 | ---- | C] () -- C:\WINXP\System32\ViaClassCoInstaller.dll
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\WINXP\System32\drivers\StarOpen.sys
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINXP\System32\giveio.sys
< End of report >
Danke! :party:

btw: Alle paar Minuten verschwindet mein Ton, das heißt,der wave Regler geht von alleine auf 0 und ich muss den dann wieder hochschieben. Ich konnte über google schon herausfinden dass das evt. etwas miteinander zu tun hat... aber eine Lösung habe ich bisher nicht.

cosinus 05.07.2010 18:37
Du solltest einen Vollscan mit Malwarebytes machen!

van 05.07.2010 19:09
Hallo, es gibt nur drei arten des scanns...quick, voll, flash...

"Art des Suchlaufs: Vollständiger Suchlauf (C:\|)"

kann ich oben heraus lesen.

Wenn ich mich nun geirrt habe, dann entschuldigung.. wie mache ich denn einen richtigen Vollscan?

cosinus 05.07.2010 19:37
Zitat:
Hallo, es gibt nur drei arten des scanns...quick, voll, flash...
Öhm, Du hast ja einen Vollscan gemacht? :dummguck:
Irgendwie müssen mich meine Sinne getäuscht haben, aber wie kann ein Vollscan nur 5 Minuten dauern? :confused:

van 05.07.2010 19:38
ich habe ein sehr aufgeräumtes windows xp und eine ssd... dann geht sowas ratz fatz. :D


aber zurück zum thema... kannst du denn irgendwie erkennen ob da was nicht stimmt? bei mir geht alle paar min der ton aus und zwischendurch kommen IE fenster mit werbung... iexplore.exe ist immer noch reichlich vertreten.. das ganze nervt extrem :(

cosinus 05.07.2010 19:41
Zitat:
und eine ssd... dann geht sowas ratz fatz.
Als ich meinen letzten Beitrag hier abgeschickt hatte dachte ich mir das schon :D

Bitte mal Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

van 05.07.2010 19:59
ist in Arbeit... das GMER braucht etwas länger :D...

poste gleich die logs... hoffe du kannst da was finden :(

so einmal GMER:

GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-07-05 21:02:07
Windows 5.1.2600 Service Pack 3
Running: x1xx73is.exe; Driver: Z:\temp\uxtdapow.sys


---- System - GMER 1.0.15 ----

SSDT            B87E3906                                                                                                            ZwCreateKey
SSDT            B87E38FC                                                                                                            ZwCreateThread
SSDT            B87E390B                                                                                                            ZwDeleteKey
SSDT            B87E3915                                                                                                            ZwDeleteValueKey
SSDT            spfk.sys                                                                                                            ZwEnumerateKey [0xB7ECDDA4]
SSDT            spfk.sys                                                                                                            ZwEnumerateValueKey [0xB7ECE132]
SSDT            B87E391A                                                                                                            ZwLoadKey
SSDT            spfk.sys                                                                                                            ZwOpenKey [0xB7EB50C0]
SSDT            B87E38E8                                                                                                            ZwOpenProcess
SSDT            B87E38ED                                                                                                            ZwOpenThread
SSDT            spfk.sys                                                                                                            ZwQueryKey [0xB7ECE20A]
SSDT            spfk.sys                                                                                                            ZwQueryValueKey [0xB7ECE08A]
SSDT            B87E3924                                                                                                            ZwReplaceKey
SSDT            B87E391F                                                                                                            ZwRestoreKey
SSDT            B87E3910                                                                                                            ZwSetValueKey
SSDT            B87E38F7                                                                                                            ZwTerminateProcess

INT 0x63        ?                                                                                                                  8A4D8BF8
INT 0x63        ?                                                                                                                  8A4D8BF8
INT 0x63        ?                                                                                                                  8A4D8BF8
INT 0x63        ?                                                                                                                  8A4D8BF8
INT 0x63        ?                                                                                                                  8A1F4BF8
INT 0x63        ?                                                                                                                  8A4D8BF8
INT 0x73        ?                                                                                                                  8A1F4BF8
INT 0x83        ?                                                                                                                  8A1F4BF8
INT 0xA4        ?                                                                                                                  8A1F4BF8
INT 0xA4        ?                                                                                                                  8A1F4BF8
INT 0xA4        ?                                                                                                                  8A1F4BF8
INT 0xB4        ?                                                                                                                  8A1F4BF8

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 2DB8                                                                                80504654 4 Bytes  CALL B708C491 \SystemRoot\system32\drivers\cmudaxp.sys (C-Media Audio WDM Driver/C-Media Inc)
?              spfk.sys                                                                                                            Das System kann die angegebene Datei nicht finden. !
.text          C:\WINXP\system32\DRIVERS\nv4_mini.sys                                                                              section is writeable [0xB72783A0, 0x592C35, 0xE8000020]
.text          USBPORT.SYS!DllUnload                                                                                              B72588AC 5 Bytes  JMP 8A1F41D8
.text          a8kvi53g.SYS                                                                                                        B6F43386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text          a8kvi53g.SYS                                                                                                        B6F433AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text          a8kvi53g.SYS                                                                                                        B6F433C4 3 Bytes  [00, 80, 02]
.text          a8kvi53g.SYS                                                                                                        B6F433C9 1 Byte  [30]
.text          a8kvi53g.SYS                                                                                                        B6F433C9 11 Bytes  [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text          ...                                                                                                               

---- User code sections - GMER 1.0.15 ----

.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!DialogBoxParamW                                        7E3747AB 5 Bytes  JMP 4119550D C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!CreateWindowExW                                        7E37D0A3 5 Bytes  JMP 4126DB6C C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!DialogBoxIndirectParamW                                7E382072 5 Bytes  JMP 41364CF7 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!MessageBoxIndirectA                                    7E38A082 5 Bytes  JMP 41364C29 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!DialogBoxParamA                                        7E38B144 5 Bytes  JMP 41364C94 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!MessageBoxExW                                          7E3A0838 5 Bytes  JMP 41364AFA C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!MessageBoxExA                                          7E3A085C 5 Bytes  JMP 41364B5C C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!DialogBoxIndirectParamA                                7E3A6D7D 5 Bytes  JMP 41364D5A C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] USER32.dll!MessageBoxIndirectW                                    7E3B64D5 5 Bytes  JMP 41364BBE C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!DialogBoxParamW                                        7E3747AB 5 Bytes  JMP 4119550D C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!SetWindowsHookExW                                      7E37820F 5 Bytes  JMP 41269B11 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!CallNextHookEx                                        7E37B3C6 5 Bytes  JMP 4125D135 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!CreateWindowExW                                        7E37D0A3 5 Bytes  JMP 4126DB6C C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!UnhookWindowsHookEx                                    7E37D5F3 5 Bytes  JMP 411D467E C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!DialogBoxIndirectParamW                                7E382072 5 Bytes  JMP 41364CF7 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!MessageBoxIndirectA                                    7E38A082 5 Bytes  JMP 41364C29 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!DialogBoxParamA                                        7E38B144 5 Bytes  JMP 41364C94 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!MessageBoxExW                                          7E3A0838 5 Bytes  JMP 41364AFA C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!MessageBoxExA                                          7E3A085C 5 Bytes  JMP 41364B5C C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!DialogBoxIndirectParamA                                7E3A6D7D 5 Bytes  JMP 41364D5A C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] USER32.dll!MessageBoxIndirectW                                    7E3B64D5 5 Bytes  JMP 41364BBE C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] ole32.dll!CoCreateInstance                                        774D057E 5 Bytes  JMP 4126DBC8 C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] ole32.dll!OleLoadFromStream                                      774F9C85 5 Bytes  JMP 4136505F C:\WINXP\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                  [B7EB6042] spfk.sys
IAT            atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                          [B7EB613E] spfk.sys
IAT            atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                [B7EB60C0] spfk.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                        [B7EB6800] spfk.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                [B7EB66D6] spfk.sys
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!KfAcquireSpinLock]                                                18C4830E
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!READ_PORT_UCHAR]                                                  1C959E88
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!KeGetCurrentIrql]                                                9E880000
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!KfRaiseIrql]                                                      00001CB1
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!KfLowerIrql]                                                      0E798366
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!HalGetInterruptVector]                                            74AAB000
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!HalTranslateBusAddress]                                          8986C636
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!KeStallExecutionProcessor]                                        1A00001C
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!KfReleaseSpinLock]                                                1C8B86C6
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                          C6020000
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!READ_PORT_USHORT]                                                001C9686
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                        86C60200
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                00001CB2
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[WMILIB.SYS!WmiSystemControl]                                              8800001C
IAT            \SystemRoot\System32\Drivers\a8kvi53g.SYS[WMILIB.SYS!WmiCompleteRequest]                                            001CB99E

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\Explorer.EXE [KERNEL32.dll!GetProcAddress]                                  [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]                            [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                            [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                            [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]                            [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!GetProcAddress]                            [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress]                            [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\WINXP\Explorer.EXE[1484] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress]                          [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]      [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]      [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]      [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA]      [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ws2_32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\ws2_32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[1684] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]      [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]      [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryW]        [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]      [451F1ACB] C:\Programme\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA]      [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ws2_32.dll [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\ws2_32.dll [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA]    [71609F5D] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]    [7160A16B] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW]      [7160A067] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress]    [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA]      [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA]        [71609E59] C:\WINXP\AppPatch\AcLayers.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT            C:\Programme\Internet Explorer\IEXPLORE.EXE[2240] @ C:\WINXP\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress]      [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              8A5491F8
Device          \FileSystem\Fastfat \FatCdrom                                                                                      899511F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{57895F72-2D9F-4DF8-8D43-FAC1C822AA8C}                                            89A231F8
Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    8A1F31F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    8A1F31F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                          8A54B1F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                            8A54B1F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                8A54B1F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                              8A54B1F8
Device          \Driver\PCI_PNP5804 \Device\00000045                                                                                spfk.sys
Device          \Driver\usbehci \Device\USBPDO-2                                                                                    8A1DC1F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                    8A1F31F8
Device          \Driver\usbuhci \Device\USBPDO-4                                                                                    8A1F31F8
Device          \Driver\usbuhci \Device\USBPDO-5                                                                                    8A1F31F8
Device          \Driver\usbehci \Device\USBPDO-6                                                                                    8A1DC1F8
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                              8A4D91F8
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                              8A4D91F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                        [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                  [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                  [B7E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                            89A231F8
Device          \Driver\SscRdBus \Device\00000078                                                                                  8A54A1F8
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                    89A231F8
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    8A1F31F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    8A1F31F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                  899E3380
Device          \Driver\usbehci \Device\USBFDO-2                                                                                    8A1DC1F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                        899E3380
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    8A1F31F8
Device          \Driver\sptd \Device\1779009554                                                                                    spfk.sys
Device          \Driver\usbuhci \Device\USBFDO-4                                                                                    8A1F31F8
Device          \Driver\Ftdisk \Device\FtControl                                                                                    8A4D91F8
Device          \Driver\usbuhci \Device\USBFDO-5                                                                                    8A1F31F8
Device          \Driver\usbehci \Device\USBFDO-6                                                                                    8A1DC1F8
Device          \Driver\a8kvi53g \Device\Scsi\a8kvi53g1                                                                            8A1961F8
Device          \FileSystem\Fastfat \Fat                                                                                            899511F8

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a51bda5                                       
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a51bda5@001813144102                            0x3D 0x34 0x37 0x75 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0xD4 0xC3 0x97 0x02 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x3B 0xF2 0xEE 0xCC ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0xEB 0xEA 0x69 0xEF ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0xC9 0x3E 0x3D 0x3C ...
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a51bda5 (not active ControlSet)                   
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a51bda5@001813144102                                0x3D 0x34 0x37 0x75 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0xD4 0xC3 0x97 0x02 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x3B 0xF2 0xEE 0xCC ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xEB 0xEA 0x69 0xEF ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0xC9 0x3E 0x3D 0x3C ...
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                             
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG12.00.00.01PROFESSIONAL                              263F9804E376A98A79C402733DF604734C468D8B024838AA2B98E7C7359E8110491EDE58F95CD55F93A05DA52853B05551757D9173CE6F19CBEEB014A4F2B80311A46C9FDD657A28C201705EEE4B72BE74B11736C11AC8CD99CD382449AB3A2A00681E658E32544CE8D9026C446EBE6D9AE828AC6DC5937999C1F63214914F4DDF35B2088F57C4C92FD0BB745ABEAE34ED4261FEFC5FC2E4978C464A7C6062C7B809CEB9E7DE51B18043A9ED6C300177D9155B8AF96CEDE9A0A266507DC7040B5C16FB03254521A88E3F3E25B5AE17FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D9DB7CE019D40AA5CC038D530D6EB345298921D981462615E0FFB9A2B9CF563E12DDC2A2D2B02291DE89F3EB448187B47F1C39AAC0AF1B6A8CA2B6B96CE4AC72BA1F92A623DBE79F30902CF4EA4CF8B0C71C5D956A55CA71E7B03A03B254017BD1DD2FA12977751C10BD8B2E91ED3D834FD0145F763C46A42C0CB01E2E22FF15492B1620F65D0DF9C570FC701DFBA40C8951FFCD497D127394A12893AA16D6FCB08A3D50EA2F4C8B9E75125F4EC9E0FFB48905216E8307A4BDDA4E654CAD71B27987905AA1E91A3F34D9194099B200C20B8074BC6510F76645519FEA49F4F6F0BF148CF647ED77A4AA9879364145FEDAE2

---- EOF - GMER 1.0.15 ----
--- --- ---


Mein ganzes system hat sich danach aufgehängt.. musste resetten...

das andere tool kommt sofort.

van 05.07.2010 20:10
OSAM:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:10:36 on 05.07.2010

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.6

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "O&O Software GmbH" - C:\WINXP\system32\OODBS.exe

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"CplMCDec.cpl" - "MainConcept AG" - C:\WINXP\system32\CplMCDec.cpl
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINXP\system32\DivXControlPanelApplet.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINXP\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINXP\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Cmcpls8788" - "C-Media Corporation" - C:\WINXP\System\cmicnfgp.cpl
"CplMCDec" - "MainConcept AG" - C:\WINXP\System32\CplMCDec.cpl
"CplMCDec_x86" - ? - C:\WINXP\SysWOW64\CplMCDec.cpl  (File not found)
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a8j5b1pr" (a8j5b1pr) - "Microsoft Corporation" - C:\WINXP\system32\drivers\a8j5b1pr.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Apple Mobile USB Driver" (USBAAPL) - ? - C:\WINXP\System32\Drivers\usbaapl.sys  (File not found)
"ASUS Xonar D2X Audio Interface" (cmudaxp) - "C-Media Inc" - C:\WINXP\System32\drivers\cmudaxp.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINXP\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINXP\System32\DRIVERS\avipbb.sys
"Changer" (Changer) - ? - C:\WINXP\system32\drivers\Changer.sys  (File not found)
"cpuz132" (cpuz132) - "Windows (R) Codename Longhorn DDK provider" - C:\WINXP\system32\drivers\cpuz132_x32.sys
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\WINXP\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"giveio" (giveio) - ? - C:\WINXP\System32\giveio.sys  (File found, but it contains no detailed information)
"i2omgmt" (i2omgmt) - ? - C:\WINXP\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINXP\system32\drivers\lbrtfdc.sys  (File not found)
"LibUsb-Win32 - Kernel Driver, Version 0.1.10.1" (libusb0) - "hxxp://libusb-win32.sourceforge.net" - C:\WINXP\System32\DRIVERS\libusb0.sys
"pavboot" (pavboot) - "Panda Security, S.L." - C:\WINXP\System32\drivers\pavboot.sys
"PCIDump" (PCIDump) - ? - C:\WINXP\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINXP\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINXP\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINXP\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINXP\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINXP\System32\Drivers\PxHelp20.sys
"RivaTuner32" (RivaTuner32) - ? - C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys  (File found, but it contains no detailed information)
"speedfan" (speedfan) - "Windows (R) 2000 DDK provider" - C:\WINXP\System32\speedfan.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINXP\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINXP\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\WINXP\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"TCP/IP-Protokolltreiber" (Tcpip) - "Microsoft Corporation" - C:\WINXP\System32\DRIVERS\tcpip.sys
"TechniSat Mantis BDA HID Driver" (MtsHID) - "TechniSat Provide" - C:\WINXP\System32\drivers\MtsHID.sys
"TechniSat SkyStar HD2" (MTSBDA) - "TechniSat Provide" - C:\WINXP\System32\Drivers\MtsBda.sys
"WDICA" (WDICA) - ? - C:\WINXP\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINXP\system32\Rundll32.exe c:\WINXP\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINXP\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINXP\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINXP\system32\mscoree.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINXP\system32\nvcpl.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "MCLiteShellExt Class" - ? - C:\Programme\ICQLite\ICQLiteShell.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINXP\system32\nvcpl.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll
{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451} "OODShellExtObj Class" - "O&O Software GmbH" - C:\PROGRA~1\OOSOFT~1\Defrag\oodsh.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINXP\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINXP\system32\dfshim.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "HypreCam Toolbar" - ? - C:\Programme\HypreCam Toolbar\tbcore3.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ Lite" - "ICQ Ltd." - C:\Programme\ICQLite\ICQLite.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "HypreCam Toolbar" - ? - C:\Programme\HypreCam Toolbar\tbcore3.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{FCBCCB87-9224-4B8D-B117-F56D924BEB18} "SMTTB2009 Class" - ? - C:\Programme\HypreCam Toolbar\tbcore3.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\desktop.ini
"PRT.exe" - ? - C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\PRT.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"RivaTunerStartupDaemon" - ? - "C:\Programme\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe" /S

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINXP\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Ich hoffe es ist alles ok soweit.

Und wo ist der übeltäter? :/

cosinus 05.07.2010 20:20
Ich seh dort so keine Hinweise. :dummguck:
Falls es ein Schädling ist, könnten wir mehr Glück mit einem Scanner über ein Fremdsystem haben, mach mal nen Durchgang mit der Kaspersky Rescue-CD => Kaspersky Rescue Disk: Boot-CD mit Virenscanner (ISO-Image) ... ScareWare.de

Ich denke mal Du weißt wie man Images per Imagebrennfunktion auf CD brennt...

van 05.07.2010 20:25
Keine Hinweise? Na wunderbar :( Es haben doch so viele sieses problem mit der iexplore.exe und dem verschwundenen sound gehabt.. aber ich kann nirgends eine konkrete Lösung finden!

Mit cd's brennen usw ist mir jetzt etwas zu viel... es muss doch auch so gehen.

Es kann doch nur mit dem IE zusammenhängen! Ich kann den scheiß IE ja nichtmal deinstallieren.

Mein system ist so kleinlich genau eingerichtet das eine neinstallation ziemlich aufwändig ist. Würde mir das gerne ersparen.

Wie kann ich den IE deaktivieren, dass dieser schädling den IE nicht mehr benutzen kann?

cosinus 05.07.2010 20:27
Geht so erstmal nicht. Was hast Du gegen meinen Vorschlag mit der Rescue-Disk? Das ist nur eine CD, die Du brennen musst! Kann doch nicht zuviel verlangt sein, das Image per ImgBurn oder CDBurnerXP auf eine CD zu bringen :balla:
Wenn ich mit keinem Tool Hinweise finde, gibt es keine andere Möglichkeit mehr, als über ein Fremdsystem das installierte Windows zu analysieren! :kloppen:

dermooo 05.07.2010 20:46
Hallo,
ich habe ja das gleiche Problem (http://www.trojaner-board.de/87775-i...-auf-null.html)

Ich habe nun folgendes gemachtu nd zwar den Inet explorer einfach deaktiviert

hxxp://sillydog.org/forum/sdt_2677.php

Programmpfad ggf. ändern

seitdem ich das getan habe ist mein sound nicht mehr weg und die iexplore.exen tauchen auch nicht mehr auf.

evtl. ne notlösung aber evtl. hilft es.

cosinus 05.07.2010 20:52
Zitat:
evtl. ne notlösung aber evtl. hilft es.
Genau. Das ist nichts weiter als eine Notlösung, eher nur Symptombekämpfung, oder hast Du damit die Ursache gefunden? :rolleyes:


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:21 Uhr.
Seite 1 von 8 1 23 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19