Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner möchte 40 Tans zum Sparkassen Online Banking (https://www.trojaner-board.de/88974-trojaner-moechte-40-tans-sparkassen-online-banking.html)

jqw767 01.08.2010 12:06
Trojaner möchte 40 Tans zum Sparkassen Online Banking
 
Liebes Trojaner-Board Forum,

wie im Titel beschrieben erscheint bei meinen Sparkassen Konten (Zwei verschiedene Banken, zwei verschiedene Online-Banking Portale) ein Pop-Up das von mir 40 Tans möchte
"Zur Zeit befindet sich eine neue Online Banking Anwendung in der Testphase, wodurch einige Kundendaten teilweise beschädigt wurden. Aus diesem Grund bitten wir Sie, 40 TAN's einzugeben, damit Sie Online Banking weiterhin nutzen könnten."
Habe ich natürlich nicht gemacht, sondern gleich mein online-Banking temporär sperren lassen.
Gibt's auch hier als Bild: http://img17.imageshack.us/img17/5139/trojaneru.jpg (Link mit imageshack.us)
Im Google habe ich zu diesem Wortlaut HIER **EDIT: Verlinken geht wohl nicht, oder ich bin zu blöd** (lebenscocktail.blog) ebenfalls einen Betroffenen (jedoch bei der Postbank) gefunden.

Folgende Infos kann ich Euch geben:

Windows XP SP3 mit allen Updates
Avira AntiVir Free 10 (Virendef vom 30.07.10)
Firefox 3.6.8
NoScript Add-On 2.0
Java 6.0.21

Auf eigene Faust habe ich probiert:
Spybot S&D
Hijack This

Vor diesem Eintrag natürlich:
CCleaner durchgeführt
Malwarebytes Anti-Malware (Log unten)
RSIT (Log unten)

Komisch fand ich bei RSIT, dass der Eintrag "C:\Programme\trend micro\******.exe" anstelle der ***** meinen Anmeldenamen dort stehen hat. Also sowas wie "Karl.exe" wobei ich nicht Karl als Anmeldenamen habe ^^

Das einzige das "Erfolg" hat ist mit NoScript die jeweilige Bank-Homepage nicht zuzulassen... also w*w.sparkasse-***.de blockieren. Dann kommt das Popup nicht. Allerdings haben die Phisher sicher trotzdem meinen Anmeldenamen, Pin und die jeweilig verwendete TAN , oder?

Bin um Hilfe dankbar. Bin übrigens kein Freund der "Format C:" Fraktion, wie sie so häufig in anderen Foren rumgeistert. Wenn es anders nicht geht, dann ok, aber erstmal möchte ich den Trojaner so identifizieren. Mit einer Neuinstallation bin ich ja vor einer "Neuansteckung" nicht geschützt und wer weiß wo der Trojaner schon überall sitzt. Habe viele USB Sticks, Speicherkarten und externe Festplatten und alles zu löschen ist natürlich keine Option!


Hier die Logs:
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4376

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

01.08.2010 11:26:45
mbam-log-2010-08-01 (11-26-45).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 134644
Laufzeit: 8 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
und
Code:
Logfile of random's system information tool 1.08 (written by random/random)
Run by ****** at 2010-08-01 12:41:01
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 15 GB (21%) free of 73 GB
Total RAM: 1014 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:41:21, on 01.08.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Download\RSIT.exe
C:\Programme\trend micro\******.exe

R3 - URLSearchHook: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll
O3 - Toolbar: ZoneAlarm-Sicherheit Toolbar - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Programme\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [{8E0F232B-7757-0725-9EF2-60F3DC25CD1C}] "C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Iruhi\famyf.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Easy Display Manager.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Programme\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: UI Assistant Service - Unknown owner - C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

--
End of file - 7733 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}]
ZoneAlarm Security Engine Registrar - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2010-06-15 591352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2010-07-17 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-07-17 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}]
ZoneAlarm-Sicherheit Toolbar - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll [2010-05-09 2517088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - ZoneAlarm-Sicherheit Toolbar - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll [2010-05-09 2517088]
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - ZoneAlarm Security Engine - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2010-06-15 591352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-08-26 16851456]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-20 57344]
""= []
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-02-29 166424]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-02-29 137752]
"SynTPEnh"=C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2008-08-28 1044480]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"BatteryManager"=C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe [2008-10-20 2768896]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2005-09-25 155648]
"ZoneAlarm Client"=C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe [2010-06-28 1043968]
"ISW"=C:\Programme\CheckPoint\ZAForceField\ForceField.exe [2010-06-15 738808]
"SunJavaUpdateSched"=C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2010-04-29 437584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"{8E0F232B-7757-0725-9EF2-60F3DC25CD1C}"=C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Iruhi\famyf.exe [2010-07-27 121648]
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"MSMSGS"=C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Easy Display Manager.lnk - C:\Programme\Samsung\Easy Display Manager\DMLauncher_XP.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-02-15 208896]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Internet Explorer\IEXPLORE.EXE"="C:\Programme\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe"="C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe:*:Enabled:hppniprint01.exe"
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe"="C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe:*:Enabled:hppniprint64.exe"
"C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe"="C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe:*:Enabled:hppnicifs01.exe"
"C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe"="C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe:*:Enabled:hpbtpg.exe"
"C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe"="C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe:*:Enabled:launchapp.exe"
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe"="C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-08-01 12:27:32 ----D---- C:\rsit
2010-08-01 11:16:21 ----D---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Malwarebytes
2010-08-01 11:16:11 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-08-01 11:16:06 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-08-01 11:16:06 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-08-01 11:16:06 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2010-08-01 11:05:36 ----D---- C:\Programme\CCleaner
2010-07-31 22:42:09 ----A---- C:\WINDOWS\system32\javaws.exe
2010-07-31 22:42:09 ----A---- C:\WINDOWS\system32\javaw.exe
2010-07-31 22:42:09 ----A---- C:\WINDOWS\system32\java.exe
2010-07-31 22:42:09 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-07-31 22:32:57 ----ASH---- C:\hiberfil.sys
2010-07-31 21:42:17 ----A---- C:\WINDOWS\wininit.ini
2010-07-31 19:41:58 ----D---- C:\WINDOWS\system32\NtmsData
2010-07-31 19:38:14 ----D---- C:\Programme\Spybot - Search & Destroy
2010-07-31 19:38:14 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-07-29 21:01:42 ----D---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\CheckPoint
2010-07-29 21:01:22 ----D---- C:\Programme\Trend Micro
2010-07-29 21:01:11 ----D---- C:\Programme\Conduit
2010-07-29 21:01:10 ----D---- C:\Programme\ZoneAlarm-Sicherheit
2010-07-29 21:00:55 ----D---- C:\Programme\CheckPoint
2010-07-29 21:00:42 ----A---- C:\WINDOWS\system32\vsutil_loc0407.dll
2010-07-29 21:00:40 ----A---- C:\WINDOWS\system32\vsregexp.dll
2010-07-29 21:00:36 ----A---- C:\WINDOWS\system32\zlcommdb.dll
2010-07-29 21:00:36 ----A---- C:\WINDOWS\system32\zlcomm.dll
2010-07-29 21:00:30 ----A---- C:\WINDOWS\system32\vswmi.dll
2010-07-29 21:00:28 ----A---- C:\WINDOWS\system32\zpeng25.dll
2010-07-29 21:00:28 ----A---- C:\WINDOWS\system32\vsxml.dll
2010-07-29 21:00:27 ----D---- C:\WINDOWS\system32\ZoneLabs
2010-07-29 21:00:27 ----A---- C:\WINDOWS\system32\vspubapi.dll
2010-07-29 21:00:27 ----A---- C:\WINDOWS\system32\vsmonapi.dll
2010-07-29 21:00:24 ----A---- C:\WINDOWS\system32\vsdatant.sys
2010-07-29 21:00:23 ----D---- C:\Programme\Zone Labs
2010-07-29 20:59:57 ----D---- C:\WINDOWS\Internet Logs
2010-07-29 20:59:56 ----A---- C:\WINDOWS\system32\vsutil.dll
2010-07-29 20:59:56 ----A---- C:\WINDOWS\system32\vsinit.dll
2010-07-29 20:59:56 ----A---- C:\WINDOWS\system32\vsdata.dll
2010-07-27 03:50:56 ----D---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Iruhi
2010-07-14 17:39:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$

======List of files/folders modified in the last 1 months======

2010-08-01 12:38:35 ----D---- C:\WINDOWS\Prefetch
2010-08-01 11:20:28 ----D---- C:\Download
2010-08-01 11:16:11 ----D---- C:\WINDOWS\system32\drivers
2010-08-01 11:16:06 ----RD---- C:\Programme
2010-08-01 11:11:28 ----D---- C:\WINDOWS\Temp
2010-08-01 11:11:28 ----D---- C:\WINDOWS\Debug
2010-08-01 11:11:28 ----D---- C:\WINDOWS
2010-08-01 10:59:23 ----D---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Yloc
2010-08-01 10:43:56 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-01 00:26:20 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-07-31 22:51:30 ----D---- C:\WINDOWS\system32\drivers\etc
2010-07-31 22:43:36 ----SHD---- C:\WINDOWS\Installer
2010-07-31 22:43:36 ----HD---- C:\Config.Msi
2010-07-31 22:43:35 ----D---- C:\Programme\Gemeinsame Dateien\Java
2010-07-31 22:42:09 ----D---- C:\WINDOWS\system32
2010-07-31 22:41:37 ----D---- C:\Programme\Java
2010-07-31 22:35:39 ----D---- C:\WINDOWS\Registration
2010-07-31 22:20:11 ----D---- C:\Dokumente und Einstellungen
2010-07-31 19:42:03 ----HD---- C:\WINDOWS\inf
2010-07-31 19:41:58 ----D---- C:\WINDOWS\repair
2010-07-31 19:40:30 ----SHD---- C:\System Volume Information
2010-07-31 19:40:30 ----D---- C:\WINDOWS\system32\Restore
2010-07-29 21:09:34 ----D---- C:\Programme\Mozilla Firefox
2010-07-29 21:06:18 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2010-07-26 20:59:41 ----A---- C:\WINDOWS\NeroDigital.ini
2010-07-14 17:39:45 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-14 17:39:23 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-12 20:57:21 ----D---- C:\WINDOWS\Microsoft.NET
2010-07-12 20:57:16 ----RSD---- C:\WINDOWS\assembly
2010-07-02 21:39:05 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-07-03 721904]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 tcpipBM;Bytemobile Kernel Network Provider; C:\WINDOWS\system32\drivers\tcpipBM.sys [2008-12-11 18816]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2010-05-13 532224]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R2 DOSMEMIO;MEMIO; \??\C:\WINDOWS\system32\MEMIO.SYS []
R2 ISWKL;ZoneAlarm Toolbar ISWKL; \??\C:\Programme\CheckPoint\ZAForceField\ISWKL.sys []
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2008-10-08 1334432]
R3 BTKRNL;Bluetooth-Bus-Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-07-29 879832]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-07-27 74688]
R3 DNSeFilter;DNSeFilter; C:\WINDOWS\system32\drivers\SamsungEDS.sys [2008-01-14 30208]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-02-15 5854752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-08-27 4753920]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-08-28 224736]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 VMC326;Vimicro Camera Service VMC326; C:\WINDOWS\System32\Drivers\VMC326.sys [2008-09-23 238464]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2008-11-07 291328]
S0 BMLoad;Bytemobile Boot Time Load Driver; C:\WINDOWS\system32\drivers\BMLoad.sys [2008-12-11 22528]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
S3 acjl377m;acjl377m; C:\WINDOWS\system32\drivers\acjl377m.sys []
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 massfilter;ZTE Mass Storage Filter Driver; C:\WINDOWS\system32\drivers\massfilter.sys [2008-10-29 7680]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;USB-Videogerät (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys [2009-01-04 104960]
S3 ZTEusbnmea;ZTE NMEA Port; C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys [2009-01-12 105344]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys [2009-01-04 104960]
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2010-04-20 267432]
R2 btwdins;Bluetooth Service; C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-09-17 264800]
R2 IswSvc;ZoneAlarm Toolbar IswSvc; C:\Programme\CheckPoint\ZAForceField\IswSvc.exe [2010-06-15 493048]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2010-07-17 153376]
R2 UI Assistant Service;UI Assistant Service; C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe [2009-03-30 241664]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2010-06-28 2435592]
R2 yksvc;Marvell Yukon Service; ykx32mpcoinst,serviceStartProc []
S2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Samsung Update Plus;Samsung Update Plus; C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe [2008-05-13 77480]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
PS: Ich hoffe alles richtig gemacht zu haben, habe mir die Regeln und Hinweise durchgelesen, aber man kann ja nie wissen :) Ansonsten bitte ich um Nachsicht.

Larusso 01.08.2010 12:10
:hallo:

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Downloade Dir bitte Load.exe

Das Tool benötigt eine aktive Internetverbindung, aber keinen offenen Browser
Sollte deine Firewall meckern, die Anwendung bitte zulassen.
  • Speichere die Datei am Desktop.
  • Doppelklick auf die load.exe
  • Belasse die Häckchen wie sie sind.
  • Schließe nun alle offenen Programme.
  • Klicke auf Download
  • Bitte während dem Download nicht in das Fenster klicken.
  • Folge den Anweisungen auf dem Bildschirm.
  • Wenn das Fenster Status aufpoppt klicke Start.

Nach dem Neustart findest Du einen Ordner MFTools auf dem Desktop. Darin befindet sich eine Anleitung.pdf.
Diese bitte öffnen und die darin beschriebenen Schritte abarbeiten.

jqw767 01.08.2010 21:00
Hallo Larusso und vielen Dank erstmal für die rasche Antwort.
Ich habe mich gleich nach Deiner Antwort an das Scanen gemacht, was leider etwas länger gedauert hat. Ich hatte zuerst Probleme mit dem Abspeichern des Logs von gmer.exe
Nun sollte aber alles funktioniert haben.

Hier die Logs (leider zu groß zum hochladen, da mehr als 100kb):
Ich habe meinen Benutzernamen durch USERNAME ersetzt...

OTL.txt
Code:
OTL logfile created on: 01.08.2010 21:30:37 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 580,00 Mb Available Physical Memory | 57,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 14,88 Gb Free Space | 20,95% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,93 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NCUSERNAME
Current User Name: USERNAME
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - [2010.08.01 13:22:29 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools\OTL.exe
PRC - [2010.06.15 17:49:54 | 000,493,048 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.04.20 20:35:52 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.03.30 11:34:36 | 000,241,664 | ---- | M] () -- C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe
PRC - [2008.10.20 11:32:54 | 002,768,896 | ---- | M] () -- C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe
PRC - [2008.10.06 19:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2008.05.13 09:44:00 | 000,077,480 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.02.29 00:00:10 | 000,170,520 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxext.exe
PRC - [2008.01.11 23:16:38 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.08.01 13:22:29 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools\OTL.exe
MOD - [2010.06.15 17:50:00 | 000,640,504 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2008.07.25 11:17:20 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
MOD - [2008.07.25 11:17:20 | 000,558,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
MOD - [2008.04.14 14:00:00 | 002,981,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\xpsp2res.dll
MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2006.10.23 02:32:40 | 000,311,296 | ---- | M] (Adobe Systems, Inc.) -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.06.28 13:01:30 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Stopped] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010.06.15 17:49:54 | 000,493,048 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2010.04.20 20:35:52 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.03.30 11:34:36 | 000,241,664 | ---- | M] () [Auto | Running] -- C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe -- (UI Assistant Service)
SRV - [2008.05.13 09:44:00 | 000,077,480 | ---- | M] () [Auto | Running] -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDRm.sys -- (InCDRm)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDPass.sys -- (InCDPass)
DRV - File not found [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\InCDFs.sys -- (InCDFs)
DRV - [2010.06.15 17:49:46 | 000,026,872 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2010.05.13 10:02:32 | 000,532,224 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2010.03.01 09:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.02.16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.07.03 20:52:56 | 000,721,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.12 09:12:56 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.01.04 17:29:50 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.01.04 17:29:50 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008.12.11 22:11:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008.11.07 11:04:00 | 000,291,328 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2008.10.29 16:35:32 | 000,007,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\massfilter.sys -- (massfilter)
DRV - [2008.10.08 08:35:10 | 001,334,432 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.09.23 22:23:58 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMC326.sys -- (VMC326)
DRV - [2008.08.28 20:18:14 | 000,224,736 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2008.08.27 01:35:00 | 004,753,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.07.29 17:59:08 | 000,879,832 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.07.27 01:29:54 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.02.15 22:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2008.01.14 20:01:02 | 000,030,208 | ---- | M] (Samsung Electronics,.LTD) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SamsungEDS.SYS -- (DNSeFilter)
DRV - [2005.10.27 06:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.232.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Programme\T-Mobile Internet Manager 03\addon [2009.07.28 15:33:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker [2010.07.29 21:01:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.29 21:09:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.31 22:42:09 | 000,000,000 | ---D | M]
 
[2009.06.17 21:35:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Extensions
[2010.08.01 12:49:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions
[2010.04.30 20:54:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.31 19:36:31 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.07.31 22:35:11 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Toolbar) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2010.08.01 12:49:53 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.31 22:42:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.26 16:44:23 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.26 16:44:23 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.26 16:44:23 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.26 16:44:23 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.26 16:44:23 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.07.31 22:51:30 | 000,415,663 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 14347 more lines...
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (ZoneAlarm-Sicherheit Toolbar) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - C:\Programme\ZoneAlarm-Sicherheit\tbZone.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe ()
O4 - HKLM..\Run: [ISW] C:\Programme\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [{8E0F232B-7757-0725-9EF2-60F3DC25CD1C}] C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi\famyf.exe (Zhjln Orftvii Fockjn)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Easy Display Manager.lnk = C:\Programme\Samsung\Easy Display Manager\DMLauncher_XP.exe (SAMSUNG Electronics)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.02.12 13:57:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
 
Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.08.01 18:10:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010.08.01 13:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2010.08.01 13:29:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.08.01 13:28:26 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2010.08.01 13:23:07 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2010.08.01 13:22:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
[2010.08.01 12:27:32 | 000,000,000 | ---D | C] -- C:\rsit
[2010.08.01 11:16:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
[2010.08.01 11:16:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.08.01 11:16:06 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.08.01 11:16:06 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.01 11:16:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.08.01 11:11:20 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\USERNAME\Recent
[2010.08.01 11:05:36 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.07.31 19:41:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.07.31 19:38:14 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.07.31 19:38:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.07.29 21:01:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\ForceField Shared Files
[2010.07.29 21:01:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2010.07.29 21:01:22 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\ZoneAlarm-Sicherheit
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.07.29 21:01:10 | 000,000,000 | ---D | C] -- C:\Programme\ZoneAlarm-Sicherheit
[2010.07.29 21:00:55 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2010.07.29 21:00:42 | 000,046,592 | ---- | C] (Zone Labs Inc.) -- C:\WINDOWS\System32\vsutil_loc0407.dll
[2010.07.29 21:00:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ZoneLabs
[2010.07.29 21:00:23 | 000,000,000 | ---D | C] -- C:\Programme\Zone Labs
[2010.07.29 20:59:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010.07.29 20:29:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten-Dateien
[2010.07.27 03:50:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
 
========== Files - Modified Within 90 Days ==========
 
[2010.08.01 21:25:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.01 21:25:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.01 21:25:08 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.01 13:29:16 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:24:39 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:51:30 | 000,415,663 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:02:17 | 000,427,421 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 21:00:53 | 000,000,711 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ZoneAlarm Security.lnk
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.06.30 21:22:38 | 000,018,944 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.28 13:00:12 | 000,046,592 | ---- | M] (Zone Labs Inc.) -- C:\WINDOWS\System32\vsutil_loc0407.dll
[2010.06.24 20:32:20 | 000,997,904 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010.06.24 20:32:20 | 000,448,970 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010.06.24 20:32:20 | 000,432,690 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010.06.24 20:32:20 | 000,080,488 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010.06.24 20:32:20 | 000,067,646 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010.06.13 15:25:17 | 000,139,264 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\Gutschein Nici_30. B-day.doc
[2010.06.12 17:53:59 | 000,190,592 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2010.08.01 13:39:27 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe
[2010.08.01 13:28:28 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:22:19 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:21:40 | 000,410,626 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:13 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:34 | 000,154,084 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:32:57 | 1063,702,528 | -HS- | C] () -- C:\hiberfil.sys
[2010.07.31 21:42:17 | 000,000,596 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:01:22 | 000,001,698 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 21:00:53 | 000,000,711 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ZoneAlarm Security.lnk
[2010.07.29 21:00:24 | 000,427,421 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.07.29 20:29:21 | 000,068,556 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.12 20:05:20 | 000,001,593 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Easy Display Manager.lnk
[2010.06.13 14:35:30 | 000,139,264 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\Gutschein Nici_30. B-day.doc
[2009.08.18 19:30:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.07.03 21:41:56 | 000,000,171 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2009.07.03 21:41:36 | 000,000,691 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2009.07.03 21:02:43 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.07.03 20:52:55 | 000,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009.06.06 22:56:57 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\USERNAME_KBD.ini
[2009.04.13 11:46:57 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009.02.12 21:35:38 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.02.12 14:10:08 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\MagicKBD.INI
[2009.02.12 14:10:08 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Besitzer_KBD.ini
[2009.02.12 14:10:05 | 000,003,425 | ---- | C] () -- C:\WINDOWS\System32\KBDR.INI
[2009.02.12 14:10:05 | 000,002,741 | ---- | C] () -- C:\WINDOWS\System32\KBDD.INI
[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDO.INI
[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDC.INI
[2009.02.12 14:10:05 | 000,002,606 | ---- | C] () -- C:\WINDOWS\System32\KBDB.INI
[2009.02.12 14:10:05 | 000,002,236 | ---- | C] () -- C:\WINDOWS\System32\KBDQ.INI
[2009.02.12 14:10:05 | 000,001,956 | ---- | C] () -- C:\WINDOWS\System32\KBDE.INI
[2009.02.12 14:10:05 | 000,001,885 | ---- | C] () -- C:\WINDOWS\System32\KBDP.INI
[2009.02.12 14:10:05 | 000,001,857 | ---- | C] () -- C:\WINDOWS\System32\KBDUU.INI
[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDG.INI
[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDA.INI
[2009.02.12 14:10:05 | 000,001,834 | ---- | C] () -- C:\WINDOWS\System32\KBDU.INI
[2009.02.12 14:10:05 | 000,001,819 | ---- | C] () -- C:\WINDOWS\System32\KBDN.INI
[2009.02.12 14:10:05 | 000,001,699 | ---- | C] () -- C:\WINDOWS\System32\KBDT.INI
[2009.02.12 14:10:05 | 000,001,697 | ---- | C] () -- C:\WINDOWS\System32\KBDV.INI
[2009.02.12 14:10:05 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\KBDS.INI
[2009.02.12 14:10:05 | 000,001,476 | ---- | C] () -- C:\WINDOWS\System32\KBDF.INI
[2009.02.12 14:07:50 | 000,000,135 | R--- | C] () -- C:\WINDOWS\System32\lngEng.ini
[2009.02.12 14:07:50 | 000,000,117 | ---- | C] () -- C:\WINDOWS\System32\lngKor.ini
[2009.02.12 14:04:21 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.02.12 14:01:47 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS
[2008.09.17 14:20:08 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2005.02.17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005.02.17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2001.07.07 04:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
 
========== LOP Check ==========
 
[2009.07.03 20:55:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.07.19 13:07:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DonationCoder
[2009.02.12 14:05:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLAN
[2009.07.13 20:56:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Canneverbe_Limited
[2010.07.29 21:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2009.07.03 20:58:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\DAEMON Tools Lite
[2009.07.19 13:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\DonationCoder
[2010.07.27 03:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
[2009.07.28 15:33:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Programme
[2010.04.06 21:36:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\VSO
[2010.08.01 13:09:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2009.02.12 13:57:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009.06.06 22:55:35 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2008.04.14 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2009.02.12 13:57:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010.08.01 21:25:08 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2009.02.12 13:57:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009.02.12 13:57:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2009.07.28 15:36:26 | 000,007,071 | ---- | M] () -- C:\NetworkCfg.xml
[2008.04.14 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008.04.14 14:00:00 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.08.01 21:25:07 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2009.02.12 14:07:52 | 000,000,173 | ---- | M] () -- C:\Setup.log
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.04.18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006.06.29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006.04.18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006.06.29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2009.02.12 13:57:05 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008.07.06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008.01.16 18:45:58 | 000,241,664 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5k4.DLL
[2003.06.18 17:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008.07.06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2007.02.26 17:49:10 | 001,744,896 | ---- | M] (TopThinks, INC.) -- C:\WINDOWS\imagine digital freedom.scr
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2009.02.12 14:48:24 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009.02.12 14:48:24 | 001,069,056 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009.02.12 14:48:24 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2008.04.14 14:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-14 15:39:49
< End of report >
[2010.08.01 21:34:02 | 000,001,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.dat.LOG
[2010.08.01 21:30:33 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\USERNAME\Recent
[2010.08.01 21:26:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Desktop
[2010.08.01 21:25:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.01 21:25:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.01 21:05:30 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien
[2010.08.01 13:29:16 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.01 13:28:47 | 000,000,000 | ---D | M] -- C:\Programme\ERUNT
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:26:12 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\USERNAME\Cookies
[2010.08.01 13:24:39 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 13:23:08 | 000,000,000 | ---D | M] -- C:\Programme\7-Zip
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 13:09:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc
[2010.08.01 12:41:06 | 000,000,000 | ---D | M] -- C:\Programme\Trend Micro
[2010.08.01 11:16:21 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten
[2010.08.01 11:16:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
[2010.08.01 11:16:15 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Desktop
[2010.08.01 11:16:06 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten
[2010.08.01 11:16:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:11:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.08.01 11:05:41 | 000,000,000 | ---D | M] -- C:\Programme\CCleaner
[2010.07.31 22:59:04 | 000,001,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\NTUSER.DAT.LOG
[2010.07.31 22:51:30 | 000,415,663 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.31 22:43:35 | 000,000,000 | ---D | M] -- C:\Programme\Gemeinsame Dateien\Java
[2010.07.31 22:41:37 | 000,000,000 | ---D | M] -- C:\Programme\Java
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Spybot - Search & Destroy
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:09:34 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox
[2010.07.29 21:06:18 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
[2010.07.29 21:02:17 | 000,427,421 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.07.29 21:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Programme\ZoneAlarm-Sicherheit
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\ZoneAlarm-Sicherheit
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Programme\Conduit
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.07.29 21:00:55 | 000,000,000 | ---D | M] -- C:\Programme\CheckPoint
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 21:00:53 | 000,000,711 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ZoneAlarm Security.lnk
[2010.07.29 21:00:23 | 000,000,000 | ---D | M] -- C:\Programme\Zone Labs
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.27 03:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.07.17 05:00:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.17 05:00:12 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.17 05:00:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.17 02:42:29 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010.06.30 21:22:38 | 000,018,944 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.16 21:02:12 | 000,000,000 | ---D | M] -- C:\Programme\Outlook Express
 
========== Files - Modified Within 90 Days ==========
 
[2010.08.01 21:25:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.01 21:25:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.01 21:25:08 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.01 13:29:16 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:24:39 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:51:30 | 000,415,663 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:02:17 | 000,427,421 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 21:00:53 | 000,000,711 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ZoneAlarm Security.lnk
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.07.17 05:00:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.17 05:00:12 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.17 05:00:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.17 02:42:29 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
 
========== LOP Check ==========
 
[2009.07.03 20:55:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.07.19 13:07:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DonationCoder
[2009.02.12 14:05:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLAN
[2009.07.13 20:56:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Canneverbe_Limited
[2010.07.29 21:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2009.07.03 20:58:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\DAEMON Tools Lite
[2009.07.19 13:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\DonationCoder
[2010.07.27 03:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
[2009.07.28 15:33:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Programme
[2010.04.06 21:36:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\VSO
[2010.08.01 13:09:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2009.02.12 13:57:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009.06.06 22:55:35 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2008.04.14 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2009.02.12 13:57:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010.08.01 21:25:08 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2009.02.12 13:57:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009.02.12 13:57:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2009.07.28 15:36:26 | 000,007,071 | ---- | M] () -- C:\NetworkCfg.xml
[2008.04.14 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008.04.14 14:00:00 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.08.01 21:25:07 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2009.02.12 14:07:52 | 000,000,173 | ---- | M] () -- C:\Setup.log
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.04.18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006.06.29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006.04.18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006.06.29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2009.02.12 13:57:05 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008.07.06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008.01.16 18:45:58 | 000,241,664 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5k4.DLL
[2003.06.18 17:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008.07.06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2007.02.26 17:49:10 | 001,744,896 | ---- | M] (TopThinks, INC.) -- C:\WINDOWS\imagine digital freedom.scr
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2009.02.12 14:48:24 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009.02.12 14:48:24 | 001,069,056 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009.02.12 14:48:24 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2008.04.14 14:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-14 15:39:49

< End of report >
[2010.08.01 21:34:02 | 000,001,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.dat.LOG
[2010.08.01 21:30:33 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\USERNAME\Recent
[2010.08.01 21:26:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Desktop
[2010.08.01 21:25:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.01 21:25:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.01 21:05:30 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien
[2010.08.01 13:29:16 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.01 13:28:47 | 000,000,000 | ---D | M] -- C:\Programme\ERUNT
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:26:12 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\USERNAME\Cookies
[2010.08.01 13:24:39 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 13:23:08 | 000,000,000 | ---D | M] -- C:\Programme\7-Zip
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 13:09:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc
[2010.08.01 12:41:06 | 000,000,000 | ---D | M] -- C:\Programme\Trend Micro
[2010.08.01 11:16:21 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten
[2010.08.01 11:16:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
[2010.08.01 11:16:15 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Desktop
[2010.08.01 11:16:06 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten
[2010.08.01 11:16:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:11:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.08.01 11:05:41 | 000,000,000 | ---D | M] -- C:\Programme\CCleaner
[2010.07.31 22:59:04 | 000,001,024 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\NTUSER.DAT.LOG
[2010.07.31 22:43:35 | 000,000,000 | ---D | M] -- C:\Programme\Gemeinsame Dateien\Java
[2010.07.31 22:41:37 | 000,000,000 | ---D | M] -- C:\Programme\Java
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:43:28 | 000,000,000 | ---D | M] -- C:\Programme\Spybot - Search & Destroy
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:09:34 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox
[2010.07.29 21:06:18 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
[2010.07.29 21:02:17 | 000,427,421 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.07.29 21:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Programme\ZoneAlarm-Sicherheit
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\ZoneAlarm-Sicherheit
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Programme\Conduit
[2010.07.29 21:01:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.07.29 21:00:55 | 000,000,000 | ---D | M] -- C:\Programme\CheckPoint
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 21:00:53 | 000,000,711 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ZoneAlarm Security.lnk
[2010.07.29 21:00:23 | 000,000,000 | ---D | M] -- C:\Programme\Zone Labs
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.27 03:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.06.30 21:22:38 | 000,018,944 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.16 21:02:12 | 000,000,000 | ---D | M] -- C:\Programme\Outlook Express
 
========== Files - Modified Within 90 Days ==========
 
[2010.08.01 21:25:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.01 21:25:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.01 21:25:08 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.01 13:29:16 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:24:39 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:51:30 | 000,415,663 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:02:17 | 000,427,421 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 21:00:53 | 000,000,711 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ZoneAlarm Security.lnk
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.07.17 05:00:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.17 05:00:12 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.17 05:00:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.17 02:42:29 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
 
========== LOP Check ==========
 
[2009.07.03 20:55:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.07.19 13:07:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DonationCoder
[2009.02.12 14:05:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLAN
[2009.07.13 20:56:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Canneverbe_Limited
[2010.07.29 21:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2009.07.03 20:58:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\DAEMON Tools Lite
[2009.07.19 13:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\DonationCoder
[2010.07.27 03:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
[2009.07.28 15:33:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Programme
[2010.04.06 21:36:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\VSO
[2010.08.01 13:09:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2009.02.12 13:57:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009.06.06 22:55:35 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2008.04.14 14:00:00 | 000,004,952 | RHS- | M] () -- C:\bootfont.bin
[2009.02.12 13:57:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010.08.01 21:25:08 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2009.02.12 13:57:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009.02.12 13:57:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2009.07.28 15:36:26 | 000,007,071 | ---- | M] () -- C:\NetworkCfg.xml
[2008.04.14 14:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008.04.14 14:00:00 | 000,251,712 | RHS- | M] () -- C:\ntldr
[2010.08.01 21:25:07 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2009.02.12 14:07:52 | 000,000,173 | ---- | M] () -- C:\Setup.log
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.04.18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006.06.29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006.04.18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006.06.29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2009.02.12 13:57:05 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008.07.06 14:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008.01.16 18:45:58 | 000,241,664 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5k4.DLL
[2003.06.18 17:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008.07.06 12:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2007.02.26 17:49:10 | 001,744,896 | ---- | M] (TopThinks, INC.) -- C:\WINDOWS\imagine digital freedom.scr
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2009.02.12 14:48:24 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009.02.12 14:48:24 | 001,069,056 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009.02.12 14:48:24 | 000,442,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\system32\user32.dll /md5 >
[2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.04.14 14:00:00 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=6A35E2D6F5F052C84EC2CEB296389439 -- C:\WINDOWS\system32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2008.04.14 14:00:00 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C7D8A0517CBF16B84F657DE87EBE9D4B -- C:\WINDOWS\system32\ws2help.dll
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-14 15:39:49

< End of report >
Anhang 7906

jqw767 01.08.2010 21:01
Nächster Log:
Extras.txt
Code:
OTL Extras logfile created on: 01.08.2010 21:30:37 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 580,00 Mb Available Physical Memory | 57,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 14,88 Gb Free Space | 20,95% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,93 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NCUSERNAME
Current User Name: USERNAME
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe:*:Enabled:hppniprint01.exe -- (Hewlett-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe:*:Enabled:hppniprint64.exe -- (Hewlett-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe:*:Enabled:hppnicifs01.exe -- ()
"C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe:*:Enabled:hpbtpg.exe -- (Hewlet-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe" = C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe:*:Enabled:launchapp.exe -- (Hewlett Packard)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon -- (Check Point Software Technologies LTD)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{223C0721-A6B0-4853-88C0-331029841734}" = HP Color LaserJet CP1510 Series 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.0.140
"{414C803A-6115-4DB6-BD4E-FD81EA6BC71C}" = Product_SF_Min_QFolder
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Ultra Edition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{901F0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Proofing Tools
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = T-Mobile Internet Manager 03
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"ERUNT_is1" = ERUNT 1.1j
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"ScreenshotCaptor_is1" = Screenshot Captor 2.57.01
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.08.2010 12:11:50 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 01.08.2010 14:36:50 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 01.08.2010 14:36:54 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 01.08.2010 14:36:56 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 01.08.2010 15:25:37 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 15:25:37 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 15:25:37 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte
 nicht verarbeitet werden.  .
 
Error - 01.08.2010 15:26:57 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 01.08.2010 15:27:01 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
Error - 01.08.2010 15:27:03 | Computer Name = NCUSERNAME | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung forcefield.exe, Version 1.5.232.0, fehlgeschlagenes
 Modul , Version 0.0.0.0, Fehleradresse 0x00000000.
 
[ System Events ]
Error - 01.08.2010 07:24:24 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "UI Assistant Service" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 01.08.2010 07:47:28 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst JavaQuickStarterService.
 
Error - 01.08.2010 08:58:01 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst JavaQuickStarterService.
 
Error - 01.08.2010 08:59:38 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst JavaQuickStarterService.
 
Error - 01.08.2010 09:01:03 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst JavaQuickStarterService.
 
Error - 01.08.2010 12:11:45 | Computer Name = NCUSERNAME | Source = System Error | ID = 1003
Description = Fehlercode 0000004e, 1. Parameter 00000007, 2. Parameter 0002f27b,
 3. Parameter 00000001, 4. Parameter 00000000.
 
Error - 01.08.2010 15:28:52 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 01.08.2010 15:28:53 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 01.08.2010 15:31:00 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 01.08.2010 15:31:00 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
 
< End of report >

jqw767 01.08.2010 21:03
Diesen Teil muss ich leider aufteilen, hat mehr als 100000 Zeichen!
Gmer.txt: Teil 1
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-08-01 21:04:55
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOKUME~1\USERNAME\LOKALE~1\Temp\fwriipow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwConnectPort [0xAA126534]
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwCreateFile [0xAA120782]
SSDT            F7BDA49E                                                                                                                            ZwCreateKey
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwCreatePort [0xAA126CC0]
SSDT            F7BDA494                                                                                                                            ZwCreateThread
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwCreateWaitablePort [0xAA126DF6]
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwDeleteFile [0xAA121398]
SSDT            F7BDA4A3                                                                                                                            ZwDeleteKey
SSDT            F7BDA4AD                                                                                                                            ZwDeleteValueKey
SSDT            sphj.sys                                                                                                                            ZwEnumerateKey [0xF7508CA4]
SSDT            sphj.sys                                                                                                                            ZwEnumerateValueKey [0xF7509032]
SSDT            F7BDA4B2                                                                                                                            ZwLoadKey
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwLoadKey2 [0xAA141B44]
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwOpenFile [0xAA120FAA]
SSDT            sphj.sys                                                                                                                            ZwOpenKey [0xF74EA0C0]
SSDT            F7BDA480                                                                                                                            ZwOpenProcess
SSDT            F7BDA485                                                                                                                            ZwOpenThread
SSDT            sphj.sys                                                                                                                            ZwQueryKey [0xF750910A]
SSDT            sphj.sys                                                                                                                            ZwQueryValueKey [0xF7508F8A]
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwRenameKey [0xAA1428D2]
SSDT            F7BDA4BC                                                                                                                            ZwReplaceKey
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwRequestWaitReplyPort [0xAA1260F4]
SSDT            F7BDA4B7                                                                                                                            ZwRestoreKey
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwSetInformationFile [0xAA12175C]
SSDT            \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)                              ZwSetSecurityObject [0xAA142E12]
SSDT            F7BDA4A8                                                                                                                            ZwSetValueKey

INT 0x62        ?                                                                                                                                    863D7BF8
INT 0x94        ?                                                                                                                                    861E3BF8
INT 0xA4        ?                                                                                                                                    861E3BF8

---- Kernel code sections - GMER 1.0.15 ----

?              sphj.sys                                                                                                                            Das System kann die angegebene Datei nicht finden. !
.text          USBPORT.SYS!DllUnload                                                                                                                F66D58AC 3 Bytes  JMP 861E31D8
.text          USBPORT.SYS!DllUnload + 4                                                                                                            F66D58B0 1 Byte  [8F]
.text          ak33uw7y.SYS                                                                                                                        F664E386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text          ak33uw7y.SYS                                                                                                                        F664E3AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text          ak33uw7y.SYS                                                                                                                        F664E3C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text          ak33uw7y.SYS                                                                                                                        F664E3C9 1 Byte  [30]
.text          ak33uw7y.SYS                                                                                                                        F664E3C9 11 Bytes  [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text          ...                                                                                                                                 
?              System32\Drivers\hiber_WMILIB.SYS                                                                                                    Das System kann den angegebenen Pfad nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\svchost.exe[236] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] kernel32.dll!OpenProcess                                                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] USER32.dll!FindWindowA                                                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[236] USER32.dll!FindWindowW                                                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] ntdll.dll!NtAccessCheckByType                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] ntdll.dll!NtImpersonateClientOfPort                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] ntdll.dll!NtSetInformationProcess                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] kernel32.dll!OpenProcess                                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] ADVAPI32.dll!ImpersonateNamedPipeClient                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] ADVAPI32.dll!SetThreadToken                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] USER32.dll!FindWindowA                                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] USER32.dll!FindWindowW                                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] ntdll.dll!NtAccessCheckByType                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] ntdll.dll!NtImpersonateClientOfPort                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] ntdll.dll!NtSetInformationProcess                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] kernel32.dll!OpenProcess                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] USER32.dll!FindWindowA                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] USER32.dll!FindWindowW                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] ADVAPI32.dll!ImpersonateNamedPipeClient                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] ADVAPI32.dll!SetThreadToken                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\RUNDLL32.EXE[484] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\winlogon.exe[700] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\services.exe[744] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtAccessCheckByType                                                                    7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtImpersonateClientOfPort                                                              7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] ntdll.dll!NtSetInformationProcess                                                                7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] ADVAPI32.dll!ImpersonateNamedPipeClient                                                          77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] ADVAPI32.dll!SetThreadToken                                                                      77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] USER32.dll!FindWindowA                                                                            7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\lsass.exe[764] USER32.dll!FindWindowW                                                                            7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!OpenProcess                                                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] USER32.dll!FindWindowA                                                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[952] USER32.dll!FindWindowW                                                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1020] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\svchost.exe[1060] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] ntdll.dll!NtAccessCheckByType                                          7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] ntdll.dll!NtImpersonateClientOfPort                                    7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] ntdll.dll!NtSetInformationProcess                                      7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] kernel32.dll!OpenProcess                                              7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] ADVAPI32.dll!ImpersonateNamedPipeClient                                77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] ADVAPI32.dll!SetThreadToken                                            77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] USER32.dll!FindWindowA                                                7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] USER32.dll!FindWindowW                                                7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1140] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1208] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wuauclt.exe[1452] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] ntdll.dll!NtAccessCheckByType                                                                          7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] ntdll.dll!NtCreateThread                                                                              7C91D1AE 5 Bytes  JMP 01B33544
.text          C:\WINDOWS\Explorer.EXE[1488] ntdll.dll!NtImpersonateClientOfPort                                                                    7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] ntdll.dll!NtSetInformationProcess                                                                      7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] ntdll.dll!LdrLoadDll                                                                                  7C9263C3 5 Bytes  JMP 01B33724
.text          C:\WINDOWS\Explorer.EXE[1488] kernel32.dll!GetFileAttributesExW                                                                      7C811195 5 Bytes  JMP 01B337C6
.text          C:\WINDOWS\Explorer.EXE[1488] kernel32.dll!OpenProcess                                                                              7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] ADVAPI32.dll!ImpersonateNamedPipeClient                                                                77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] ADVAPI32.dll!SetThreadToken                                                                            77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] USER32.dll!TranslateMessage                                                                            7E368BF6 5 Bytes  JMP 01B45481
.text          C:\WINDOWS\Explorer.EXE[1488] USER32.dll!FindWindowA                                                                                7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] USER32.dll!FindWindowW                                                                                7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\Explorer.EXE[1488] USER32.dll!GetClipboardData                                                                            7E380DBA 5 Bytes  JMP 01B455EE
.text          C:\WINDOWS\Explorer.EXE[1488] CRYPT32.dll!PFXImportCertStore                                                                        77ABFF8F 5 Bytes  JMP 01B42823
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!InternetCloseHandle                                                                        77194D94 5 Bytes  JMP 01B3B9DB
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!HttpSendRequestA                                                                          771960A9 5 Bytes  JMP 01B3B84F
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!HttpQueryInfoA                                                                            771979CA 5 Bytes  JMP 01B3BAD3
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!InternetReadFile                                                                          771982F2 5 Bytes  JMP 01B3BA1E
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!HttpSendRequestExW                                                                        7719EA01 5 Bytes  JMP 01B3B8A3
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!InternetQueryDataAvailable                                                                771A8A67 5 Bytes  JMP 01B3BAA7
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!InternetReadFileExA                                                                        771C934E 5 Bytes  JMP 01B3BA5D
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!HttpSendRequestW                                                                          771E3224 5 Bytes  JMP 01B3B7FB
.text          C:\WINDOWS\Explorer.EXE[1488] WININET.dll!HttpSendRequestExA                                                                        771E3329 5 Bytes  JMP 01B3B93F
.text          C:\WINDOWS\Explorer.EXE[1488] WS2_32.dll!closesocket                                                                                71A13E2B 5 Bytes  JMP 01B42CFA
.text          C:\WINDOWS\Explorer.EXE[1488] WS2_32.dll!send                                                                                        71A14C27 5 Bytes  JMP 01B42D32
.text          C:\WINDOWS\Explorer.EXE[1488] WS2_32.dll!WSASend                                                                                    71A168FA 5 Bytes  JMP 01B42D53
.text          C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[1704] kernel32.dll!OpenProcess                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\CheckPoint\ZAForceField\IswSvc.exe[1704] USER32.dll!DefDlgProcW + 56E                                                  7E3742A8 5 Bytes  JMP 20C79270 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\spoolsv.exe[1776] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\svchost.exe[1864] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] ntdll.dll!NtAccessCheckByType                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] ntdll.dll!NtImpersonateClientOfPort                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] ntdll.dll!NtSetInformationProcess                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] kernel32.dll!OpenProcess                                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] USER32.dll!FindWindowA                                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] USER32.dll!FindWindowW                                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] ADVAPI32.dll!ImpersonateNamedPipeClient                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] ADVAPI32.dll!SetThreadToken                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] ntdll.dll!NtAccessCheckByType                                                              7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] ntdll.dll!NtImpersonateClientOfPort                                                        7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] ntdll.dll!NtSetInformationProcess                                                          7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] kernel32.dll!OpenProcess                                                                    7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] ADVAPI32.dll!ImpersonateNamedPipeClient                                                    77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] ADVAPI32.dll!SetThreadToken                                                                77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] USER32.dll!FindWindowA                                                                      7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Java\jre6\bin\jqs.exe[2028] USER32.dll!FindWindowW                                                                      7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] ntdll.dll!NtAccessCheckByType                                                            7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] ntdll.dll!NtImpersonateClientOfPort                                                      7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] ntdll.dll!NtSetInformationProcess                                                        7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] kernel32.dll!OpenProcess                                                                7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] ADVAPI32.dll!ImpersonateNamedPipeClient                                                  77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] ADVAPI32.dll!SetThreadToken                                                              77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] USER32.dll!FindWindowA                                                                  7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] USER32.dll!FindWindowW                                                                  7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] ntdll.dll!NtAccessCheckByType                                                                      7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] ntdll.dll!NtImpersonateClientOfPort                                                                7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] ntdll.dll!NtSetInformationProcess                                                                  7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] kernel32.dll!OpenProcess                                                                          7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] USER32.dll!FindWindowA                                                                            7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] USER32.dll!FindWindowW                                                                            7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] ADVAPI32.dll!ImpersonateNamedPipeClient                                                            77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\System32\alg.exe[2332] ADVAPI32.dll!SetThreadToken                                                                        77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ntdll.dll!NtAccessCheckByType                                                                          7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ntdll.dll!NtCreateThread                                                                                7C91D1AE 5 Bytes  JMP 04613544
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ntdll.dll!NtImpersonateClientOfPort                                                                    7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ntdll.dll!NtSetInformationProcess                                                                      7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ntdll.dll!LdrLoadDll                                                                                    7C9263C3 5 Bytes  JMP 04613724
.text          C:\WINDOWS\RTHDCPL.EXE[2704] kernel32.dll!GetFileAttributesExW                                                                      7C811195 5 Bytes  JMP 046137C6
.text          C:\WINDOWS\RTHDCPL.EXE[2704] kernel32.dll!OpenProcess                                                                                7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ADVAPI32.dll!ImpersonateNamedPipeClient                                                                77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] ADVAPI32.dll!SetThreadToken                                                                            77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] USER32.dll!TranslateMessage                                                                            7E368BF6 5 Bytes  JMP 04625481
.text          C:\WINDOWS\RTHDCPL.EXE[2704] USER32.dll!FindWindowA                                                                                  7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] USER32.dll!FindWindowW                                                                                  7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\RTHDCPL.EXE[2704] USER32.dll!GetClipboardData                                                                            7E380DBA 5 Bytes  JMP 046255EE
.text          C:\WINDOWS\RTHDCPL.EXE[2704] CRYPT32.dll!PFXImportCertStore                                                                          77ABFF8F 5 Bytes  JMP 04622823
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WS2_32.dll!closesocket                                                                                  71A13E2B 5 Bytes  JMP 04622CFA
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WS2_32.dll!send                                                                                        71A14C27 5 Bytes  JMP 04622D32
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WS2_32.dll!WSASend                                                                                      71A168FA 5 Bytes  JMP 04622D53
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!InternetCloseHandle                                                                        77194D94 5 Bytes  JMP 0461B9DB
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!HttpSendRequestA                                                                            771960A9 5 Bytes  JMP 0461B84F
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!HttpQueryInfoA                                                                              771979CA 5 Bytes  JMP 0461BAD3
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!InternetReadFile                                                                            771982F2 5 Bytes  JMP 0461BA1E
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!HttpSendRequestExW                                                                          7719EA01 5 Bytes  JMP 0461B8A3
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!InternetQueryDataAvailable                                                                  771A8A67 5 Bytes  JMP 0461BAA7
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!InternetReadFileExA                                                                        771C934E 5 Bytes  JMP 0461BA5D
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!HttpSendRequestW                                                                            771E3224 5 Bytes  JMP 0461B7FB
.text          C:\WINDOWS\RTHDCPL.EXE[2704] WININET.dll!HttpSendRequestExA                                                                          771E3329 5 Bytes  JMP 0461B93F
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ntdll.dll!NtAccessCheckByType                                                                    7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ntdll.dll!NtCreateThread                                                                        7C91D1AE 5 Bytes  JMP 01213544
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ntdll.dll!NtImpersonateClientOfPort                                                              7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ntdll.dll!NtSetInformationProcess                                                                7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ntdll.dll!LdrLoadDll                                                                            7C9263C3 5 Bytes  JMP 01213724
.text          C:\WINDOWS\system32\hkcmd.exe[2724] kernel32.dll!GetFileAttributesExW                                                                7C811195 5 Bytes  JMP 012137C6
.text          C:\WINDOWS\system32\hkcmd.exe[2724] kernel32.dll!OpenProcess                                                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] USER32.dll!TranslateMessage                                                                      7E368BF6 5 Bytes  JMP 01225481
.text          C:\WINDOWS\system32\hkcmd.exe[2724] USER32.dll!FindWindowA                                                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] USER32.dll!FindWindowW                                                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] USER32.dll!GetClipboardData                                                                      7E380DBA 5 Bytes  JMP 012255EE
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ADVAPI32.dll!ImpersonateNamedPipeClient                                                          77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] ADVAPI32.dll!SetThreadToken                                                                      77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\hkcmd.exe[2724] CRYPT32.dll!PFXImportCertStore                                                                  77ABFF8F 5 Bytes  JMP 01222823
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WS2_32.dll!closesocket                                                                          71A13E2B 5 Bytes  JMP 01222CFA
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WS2_32.dll!send                                                                                  71A14C27 5 Bytes  JMP 01222D32
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WS2_32.dll!WSASend                                                                              71A168FA 5 Bytes  JMP 01222D53
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!InternetCloseHandle                                                                  77194D94 5 Bytes  JMP 0121B9DB
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!HttpSendRequestA                                                                    771960A9 5 Bytes  JMP 0121B84F
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!HttpQueryInfoA                                                                      771979CA 5 Bytes  JMP 0121BAD3
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!InternetReadFile                                                                    771982F2 5 Bytes  JMP 0121BA1E
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!HttpSendRequestExW                                                                  7719EA01 5 Bytes  JMP 0121B8A3
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!InternetQueryDataAvailable                                                          771A8A67 5 Bytes  JMP 0121BAA7
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!InternetReadFileExA                                                                  771C934E 5 Bytes  JMP 0121BA5D
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!HttpSendRequestW                                                                    771E3224 5 Bytes  JMP 0121B7FB
.text          C:\WINDOWS\system32\hkcmd.exe[2724] WININET.dll!HttpSendRequestExA                                                                  771E3329 5 Bytes  JMP 0121B93F
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] ntdll.dll!NtAccessCheckByType                                                    7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] ntdll.dll!NtImpersonateClientOfPort                                              7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] ntdll.dll!NtSetInformationProcess                                                7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] kernel32.dll!OpenProcess                                                          7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] USER32.dll!FindWindowA                                                            7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] USER32.dll!FindWindowW                                                            7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] ADVAPI32.dll!ImpersonateNamedPipeClient                                          77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] ADVAPI32.dll!SetThreadToken                                                      77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ntdll.dll!NtCreateThread                                                                        7C91D1AE 5 Bytes  JMP 00C53544
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ntdll.dll!LdrLoadDll                                                                            7C9263C3 5 Bytes  JMP 00C53724
.text          C:\WINDOWS\system32\ctfmon.exe[2960] kernel32.dll!GetFileAttributesExW                                                              7C811195 5 Bytes  JMP 00C537C6
.text          C:\WINDOWS\system32\ctfmon.exe[2960] kernel32.dll!OpenProcess                                                                        7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] USER32.dll!TranslateMessage                                                                    7E368BF6 5 Bytes  JMP 00C65481
.text          C:\WINDOWS\system32\ctfmon.exe[2960] USER32.dll!FindWindowA                                                                          7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] USER32.dll!FindWindowW                                                                          7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\ctfmon.exe[2960] USER32.dll!GetClipboardData                                                                    7E380DBA 5 Bytes  JMP 00C655EE
.text          C:\WINDOWS\system32\ctfmon.exe[2960] CRYPT32.dll!PFXImportCertStore                                                                  77ABFF8F 5 Bytes  JMP 00C62823
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WS2_32.dll!closesocket                                                                          71A13E2B 5 Bytes  JMP 00C62CFA
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WS2_32.dll!send                                                                                71A14C27 5 Bytes  JMP 00C62D32
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WS2_32.dll!WSASend                                                                              71A168FA 5 Bytes  JMP 00C62D53
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!InternetCloseHandle                                                                77194D94 5 Bytes  JMP 00C5B9DB
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!HttpSendRequestA                                                                    771960A9 5 Bytes  JMP 00C5B84F
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!HttpQueryInfoA                                                                      771979CA 5 Bytes  JMP 00C5BAD3
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!InternetReadFile                                                                    771982F2 5 Bytes  JMP 00C5BA1E
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!HttpSendRequestExW                                                                  7719EA01 5 Bytes  JMP 00C5B8A3
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!InternetQueryDataAvailable                                                          771A8A67 5 Bytes  JMP 00C5BAA7
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!InternetReadFileExA                                                                771C934E 5 Bytes  JMP 00C5BA5D
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!HttpSendRequestW                                                                    771E3224 5 Bytes  JMP 00C5B7FB
.text          C:\WINDOWS\system32\ctfmon.exe[2960] WININET.dll!HttpSendRequestExA                                                                  771E3329 5 Bytes  JMP 00C5B93F
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ntdll.dll!NtAccessCheckByType                                                                  7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ntdll.dll!NtCreateThread                                                                      7C91D1AE 5 Bytes  JMP 00DA3544
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ntdll.dll!NtImpersonateClientOfPort                                                            7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ntdll.dll!NtSetInformationProcess                                                              7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ntdll.dll!LdrLoadDll                                                                          7C9263C3 5 Bytes  JMP 00DA3724
.text          C:\WINDOWS\system32\wscntfy.exe[3472] kernel32.dll!GetFileAttributesExW                                                              7C811195 5 Bytes  JMP 00DA37C6
.text          C:\WINDOWS\system32\wscntfy.exe[3472] kernel32.dll!OpenProcess                                                                      7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] USER32.dll!TranslateMessage                                                                    7E368BF6 5 Bytes  JMP 00DB5481
.text          C:\WINDOWS\system32\wscntfy.exe[3472] USER32.dll!FindWindowA                                                                        7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] USER32.dll!FindWindowW                                                                        7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] USER32.dll!GetClipboardData                                                                    7E380DBA 5 Bytes  JMP 00DB55EE
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ADVAPI32.dll!ImpersonateNamedPipeClient                                                        77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] ADVAPI32.dll!SetThreadToken                                                                    77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\WINDOWS\system32\wscntfy.exe[3472] CRYPT32.dll!PFXImportCertStore                                                                77ABFF8F 5 Bytes  JMP 00DB2823
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WS2_32.dll!closesocket                                                                        71A13E2B 5 Bytes  JMP 00DB2CFA
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WS2_32.dll!send                                                                                71A14C27 5 Bytes  JMP 00DB2D32
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WS2_32.dll!WSASend                                                                            71A168FA 5 Bytes  JMP 00DB2D53
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!InternetCloseHandle                                                                77194D94 5 Bytes  JMP 00DAB9DB
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!HttpSendRequestA                                                                  771960A9 5 Bytes  JMP 00DAB84F
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!HttpQueryInfoA                                                                    771979CA 5 Bytes  JMP 00DABAD3
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!InternetReadFile                                                                  771982F2 5 Bytes  JMP 00DABA1E
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!HttpSendRequestExW                                                                7719EA01 5 Bytes  JMP 00DAB8A3
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!InternetQueryDataAvailable                                                        771A8A67 5 Bytes  JMP 00DABAA7
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!InternetReadFileExA                                                                771C934E 5 Bytes  JMP 00DABA5D
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!HttpSendRequestW                                                                  771E3224 5 Bytes  JMP 00DAB7FB
.text          C:\WINDOWS\system32\wscntfy.exe[3472] WININET.dll!HttpSendRequestExA                                                                771E3329 5 Bytes  JMP 00DAB93F
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ntdll.dll!NtAccessCheckByType                                          7C91CE8E 5 Bytes  JMP 20C78791 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ntdll.dll!NtCreateThread                                              7C91D1AE 5 Bytes  JMP 00133544
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ntdll.dll!NtImpersonateClientOfPort                                    7C91D3FE 5 Bytes  JMP 20C78D58 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ntdll.dll!NtSetInformationProcess                                      7C91DC9E 5 Bytes  JMP 20C789AB C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ntdll.dll!LdrLoadDll                                                  7C9263C3 5 Bytes  JMP 00133724
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] kernel32.dll!GetFileAttributesExW                                      7C811195 5 Bytes  JMP 001337C6
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] kernel32.dll!OpenProcess                                              7C8309E9 5 Bytes  JMP 20C7846C C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] USER32.dll!TranslateMessage                                            7E368BF6 5 Bytes  JMP 00145481
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] USER32.dll!FindWindowA                                                7E3782E1 5 Bytes  JMP 20C7828F C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] USER32.dll!FindWindowW                                                7E37C9C3 5 Bytes  JMP 20C7825A C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] USER32.dll!GetClipboardData                                            7E380DBA 5 Bytes  JMP 001455EE
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ADVAPI32.dll!ImpersonateNamedPipeClient                                77DA7426 5 Bytes  JMP 20C78E5D C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] ADVAPI32.dll!SetThreadToken                                            77DAF193 5 Bytes  JMP 20C79036 C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WS2_32.dll!closesocket                                                71A13E2B 5 Bytes  JMP 00142CFA
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WS2_32.dll!send                                                        71A14C27 5 Bytes  JMP 00142D32
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WS2_32.dll!WSASend                                                    71A168FA 5 Bytes  JMP 00142D53
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] CRYPT32.dll!PFXImportCertStore                                        77ABFF8F 5 Bytes  JMP 00142823
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!InternetCloseHandle                                        77194D94 5 Bytes  JMP 0013B9DB
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!HttpSendRequestA                                          771960A9 5 Bytes  JMP 0013B84F
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!HttpQueryInfoA                                            771979CA 5 Bytes  JMP 0013BAD3
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!InternetReadFile                                          771982F2 5 Bytes  JMP 0013BA1E
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!HttpSendRequestExW                                        7719EA01 5 Bytes  JMP 0013B8A3
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!InternetQueryDataAvailable                                771A8A67 5 Bytes  JMP 0013BAA7
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!InternetReadFileExA                                        771C934E 5 Bytes  JMP 0013BA5D
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!HttpSendRequestW                                          771E3224 5 Bytes  JMP 0013B7FB
.text          C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] WININET.dll!HttpSendRequestExA                                        771E3329 5 Bytes  JMP 0013B93F

jqw767 01.08.2010 21:04
So nun Teil 2 der Gmer.txt und MBAM Log darunter:

Gmer.txt Teil 2:
Code:
---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                  863D92D8
IAT            pci.sys[ntoskrnl.exe!IoDetachDevice]                                                                                                [F751BC4C] sphj.sys
IAT            pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                                                    [F751BCA0] sphj.sys
IAT            atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                                  [F74EB042] sphj.sys
IAT            atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                                          [F74EB13E] sphj.sys
IAT            atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                                  [F74EB0C0] sphj.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                                          [F74EB800] sphj.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                                  [F74EB6D6] sphj.sys
IAT            \SystemRoot\system32\DRIVERS\intelppm.sys[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint]                                                                861E32D8
IAT            \SystemRoot\system32\DRIVERS\CmBatt.sys[NTOSKRNL.EXE!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                                  [F74FAE9C] sphj.sys
IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\kbdclass.sys[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\mouclass.sys[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlInitUnicodeString]                                                        8800001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!swprintf]                                                                    001CB286
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeSetEvent]                                                                  C61AEB00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoCreateSymbolicLink]                                                        001C8186
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoGetConfigurationInformation]                                                86C61200
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoDeleteSymbolicLink]                                                        00001C83
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmFreeMappingAddress]                                                        8E868801
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoFreeErrorLogEntry]                                                          8800001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoDisconnectInterrupt]                                                        001CAA86
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmUnmapIoSpace]                                                              80968B00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ObReferenceObjectByPointer]                                                  8900001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IofCompleteRequest]                                                          001C9C96
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlCompareUnicodeString]                                                      C6168B00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IofCallDriver]                                                                001CB986
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmAllocateMappingAddress]                                                    428A0A00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry]                                                      BA86880C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoConnectInterrupt]                                                          8B00001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoDetachDevice]                                                              24A48DFA
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeWaitForSingleObject]                                                        00000000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeInitializeEvent]                                                            4B8BDF8B
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeCancelTimer]                                                                8D3F0304
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString]                                                CB033043
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlInitAnsiString]                                                            0673C13B
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest]                                                C13B0003
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoQueueWorkItem]                                                              8366FA72
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmMapIoSpace]                                                                75000E7B
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations]                                                  0B7D80E3
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoReportDetectedDevice]                                                      307B8D00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoReportResourceForDetection]                                                00AA840F
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize]                                                  83660000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!NlsMbCodePageTag]                                                            6A000E7A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!PoRequestPowerIrp]                                                            C6647400
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue]                                                    001CBB86
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection]                                            4F8B0200
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!sprintf]                                                                      968D5140
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache]                                                00001C90
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ObfDereferenceObject]                                                        2266E852
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference]                                                478B0000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoInvalidateDeviceState]                                                      50016A40
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ZwClose]                                                                      1CAC8E8D
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ObReferenceObjectByHandle]                                                    E8510000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ZwCreateDirectoryObject]                                                      00002254
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest]                                                6A18538B
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!PoStartNextPowerIrp]                                                          868D5200
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoCreateDevice]                                                              00001C98
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlCopyUnicodeString]                                                        2242E850
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension]                                              4B8B0000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlQueryRegistryValues]                                                      51016A18
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ZwOpenKey]                                                                    1CB4968D
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlFreeUnicodeString]                                                        E8520000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoStartTimer]                                                                00002230
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeInitializeTimer]                                                            8A05478A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoInitializeTimer]                                                            001CBB8E
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeInitializeDpc]                                                              30C48300
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeInitializeSpinLock]                                                        1CBD8688
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoInitializeIrp]                                                              80E90000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ZwCreateKey]                                                                  C6000000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString]                                              001CBB86
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString]                                                    438B0100
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ZwSetValueKey]                                                                8E8D5018
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeInsertQueueDpc]                                                            00001C90
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel]                                                2202E851
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoStartPacket]                                                                538B0000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel]                                              52016A18
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest]                                                1CAC868D
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoFreeMdl]                                                                    E8500000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmUnlockPages]                                                                000021F0
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoWriteErrorLogEntry]                                                        8A05478A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue]                                                    001CBB8E
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping]                                          18C48300
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmUnmapReservedMapping]                                                      1CBD8688
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeSynchronizeExecution]                                                      43EB0000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoStartNextPacket]                                                            320C538A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeBugCheckEx]                                                                88F93BC0
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeRemoveDeviceQueue]                                                          001CBB96
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeSetTimer]                                                                  F6317300
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!_allmul]                                                                      74070647
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmProbeAndLockPages]                                                          75C0841A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!_except_handler3]                                                            05578A0B
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!PoSetPowerState]                                                              968801B0
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey]                                                      00001CBD
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlWriteRegistryValue]                                                        57B60F66
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlDeleteRegistryValue]                                                      533B6604
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!_aulldiv]                                                                    03087408
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!strstr]                                                                      72F93B3F
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!_strupr]                                                                      8A09EBDA
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeQuerySystemTime]                                                            86880547
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoWMIRegistrationControl]                                                    00001CBD
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!KeTickCount]                                                                  88084B8A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack]                                                  001CBE8E
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoDeleteDevice]                                                              40578B00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ExAllocatePoolWithTag]                                                        8D52006A
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoAllocateWorkItem]                                                          001CC086
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoAllocateIrp]                                                                81E85000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoAllocateMdl]                                                                8B000021
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool]                                                    001CB88E
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmLockPagableDataSection]                                                    BC968B00
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoGetDriverObjectExtension]                                                  8900001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmUnlockPagableImageSection]                                                  001CC48E
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!ExFreePoolWithTag]                                                            C8968900
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoFreeIrp]                                                                    8B00001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!IoFreeWorkItem]                                                              016A4047
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!InitSafeBootMode]                                                            CCC68150
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!RtlCompareMemory]                                                            5600001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!PoCallDriver]                                                                002157E8
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!memmove]                                                                      18C48300
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[ntoskrnl.exe!MmHighestUserAddress]                                                        5D5B5E5F
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!KfAcquireSpinLock]                                                                18C4830E
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!READ_PORT_UCHAR]                                                                  1C8D9E88
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!KeGetCurrentIrql]                                                                  9E880000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!KfRaiseIrql]                                                                      00001CA9
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!KfLowerIrql]                                                                      0E798366
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!HalGetInterruptVector]                                                            74AAB000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!HalTranslateBusAddress]                                                            8186C636
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!KeStallExecutionProcessor]                                                        1A00001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!KfReleaseSpinLock]                                                                1C8386C6
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                                          C6020000
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!READ_PORT_USHORT]                                                                  001C8E86
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                          86C60200
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                                  00001CAA
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[WMILIB.SYS!WmiSystemControl]                                                              8800001C
IAT            \SystemRoot\System32\Drivers\ak33uw7y.SYS[WMILIB.SYS!WmiCompleteRequest]                                                            001CB19E
IAT            \SystemRoot\system32\DRIVERS\audstub.sys[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\ndistapi.sys[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol]                                                            [AA12B672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter]                                                                  [AA12B4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter]                                                                [AA12BCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol]                                                          [AA129C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol]                                                            [AA129C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol]                                                              [AA12B672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter]                                                                    [AA12B4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter]                                                                  [AA12BCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\msgpc.sys[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\termdd.sys[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\swenum.sys[NTOSKRNL.EXE!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\ks.sys[ntoskrnl.exe!IoCreateDevice]                                                                    [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\update.sys[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\mssmbios.sys[ntoskrnl.exe!IoCreateDevice]                                                              [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\NDProxy.SYS[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol]                                                              [AA12B672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol]                                                            [AA129C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter]                                                                  [AA12BCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter]                                                                  [AA12B4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\drivers\portcls.sys[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\usbhub.sys[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\Fs_Rec.SYS[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\Null.SYS[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\Msfs.SYS[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\System32\Drivers\Npfs.SYS[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\rasacd.sys[ntoskrnl.exe!IoCreateDevice]                                                                [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\ipsec.sys[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter]                                                                    [AA12BCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter]                                                                    [AA12B4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol]                                                                [AA12B672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice]                                                                  [F789B63E] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject]                                                              [F789BFE6] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject]                                                              [F789BFE6] BMLoad.sys (Bytemobile Kernel Driver Loader/Bytemobile, Inc.)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]                                                            [AA129C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]                                                              [AA12B672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter]                                                                    [AA12B4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter]                                                                  [AA12BCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile]                                                                      [AA1093C4] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol]                                                              [AA12B672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol]                                                            [AA129C2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter]                                                                  [AA12BCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter]                                                                  [AA12B4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile]                                                              [AA1222AA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile]                                                                      [AA12260C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile]                                                                      [AA121D40] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
IAT            \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile]                                                                        [AA12241C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\WINDOWS\system32\svchost.exe[236] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Programme\Avira\AntiVir Desktop\avshadow.exe[240] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe[368] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\RUNDLL32.EXE[484] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\winlogon.exe[700] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\services.exe[744] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\lsass.exe[764] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                    [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\svchost.exe[952] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\svchost.exe[1020] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\System32\svchost.exe[1060] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe[1088] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]        [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\svchost.exe[1140] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\svchost.exe[1208] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\wuauclt.exe[1452] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\Explorer.EXE[1488] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                        [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\spoolsv.exe[1776] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\svchost.exe[1864] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Programme\Avira\AntiVir Desktop\avguard.exe[1980] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Programme\Java\jre6\bin\jqs.exe[2028] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                              [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\wbem\wmiapsrv.exe[2164] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                          [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\System32\alg.exe[2332] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                    [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\RTHDCPL.EXE[2704] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                          [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\hkcmd.exe[2724] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2832] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                    [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\ctfmon.exe[2960] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                  [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\WINDOWS\system32\wscntfy.exe[3472] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
IAT            C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe[3652] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]        [20C7835C] C:\Programme\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                                              863D61F8
Device          \Driver\Tcpip \Device\Ip                                                                                                            vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          \Driver\usbehci \Device\USBPDO-0                                                                                                    861B51F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                                    861E21F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                                    861E21F8
Device          \Driver\sptd \Device\4140949110                                                                                                      sphj.sys
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                                    861E21F8
Device          \Driver\usbuhci \Device\USBPDO-4                                                                                                    861E21F8
Device          \Driver\Tcpip \Device\Tcp                                                                                                            vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                            tcpipBM.SYS (Bytemobile Kernel Network Provider/Bytemobile, Inc.)

Device          \Driver\PCI_PNP0360 \Device\00000049                                                                                                sphj.sys
Device          \Driver\PCI_PNP0360 \Device\00000049                                                                                                sphj.sys
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                                              863681F8
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                                              863681F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{EA7609D6-CC70-42A9-994D-F748CEFDA268}                                                            860CD500
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                                              863681F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                                          [F7463B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                                  [F7463B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                                              860CD500
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                                    860CD500
Device          \Driver\Tcpip \Device\Udp                                                                                                            vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device          \Driver\Tcpip \Device\RawIp                                                                                                          vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device          \Driver\usbuhci \Device\USBFDO-0                                                                                                    861E21F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                                    861E21F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                                    86094500
Device          \Driver\Tcpip \Device\IPMULTICAST                                                                                                    vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                                    861E21F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                                          86094500
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                                    861E21F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                                                    861B51F8
Device          \Driver\Ftdisk \Device\FtControl                                                                                                    863681F8
Device          \Driver\ak33uw7y \Device\Scsi\ak33uw7y1                                                                                              86131500

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                  C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                  0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                              0x7D 0x66 0xFA 0x65 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                           
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                      0x20 0x4A 0x03 0x98 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                0xBA 0x63 0x65 0x1D ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                               
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                      C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                      0
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                  0x7D 0x66 0xFA 0x65 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                       
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                          0x20 0x4A 0x03 0x98 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                 
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                    0xBA 0x63 0x65 0x1D ...

---- EOF - GMER 1.0.15 ----
MBAM Log:
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4376

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

01.08.2010 13:38:58
mbam-log-2010-08-01 (13-38-58).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 134699
Laufzeit: 8 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Larusso 01.08.2010 21:27
Schritt 1

Bitte schmeiß ZoneAlarm runter, die ist einfach nur Müll


Schritt 2

Teatimer abstellen

Mit laufendem TeaTimer von Spybot Search&Destroy lässt sich keine Reinigung durchführen, da er alle gelöschten Einträge wiederherstellt. Der Teatimer muss also während der Reinigungsarbeiten abgestellt werden (lasse den Teatimer so lange ausgeschaltet, bis wir mit der Reinigung fertig sind):
Starte Spybot S&D => stelle im Menü "Modus" den "Erweiterten Modus" ein => klicke dann links unten auf "Werkzeuge" => klicke auf "Resident" => das Häkchen entfernen bei Resident "TeaTimer" (Schutz aller Systemeinstellungen) => Spybot Search&Destroy schließen => Rechner neu starten. Bebilderte Anleitung.


Schritt 3

Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
    Vista User: Bitte mit Rechtsklick "als Administrator starten".
  • Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
  • Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
  • Defogger fordert nun zum Neustart auf. Bestätige dies mit OK.
  • DeFogger erstellt nun ein Logfile auf dem Desktop (defogger_disable).
Poste bitte den Inhalt der Logfile in Deiner nächsten Antwort.


Schritt 4
Code:
:OTL
[2010.08.01 13:09:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc
[2010.07.27 03:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
O4 - HKCU..\Run: [{8E0F232B-7757-0725-9EF2-60F3DC25CD1C}] C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi\famyf.exe (Zhjln Orftvii Fockjn)
O4 - HKLM..\Run: []  File not found
:services
:files
:reg
:Commands
[purity]
[emptytemp]
[reboot]
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Schritt 5

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.


Bitte poste in Deiner nächsten Antwort
Defogger_disable.txt
OTLFix Log
OTL.txt
Extras.txt
Berichte wie der Rechner läuft

jqw767 01.08.2010 22:24
Hallo Larusso,

also ich fange mit der guten Nachricht zuerst an:
Nachdem ich Deine letzten Anweisungen befolgt habe kommt das Phishing Pop-Up in meinen Sparkassenkonten NICHT MEHR!
Ob das nun heißt, dass mein PC CLEAN ist, überlasse ich der Expertenmeinung, aber ich bin erstmal sehr erfreut!

Hier die zugehörigen Log Dateien:
Defogger_disable.txt
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:56 on 01/08/2010 (USERNAME)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-
OTLFix Log
Code:
All processes killed
========== OTL ==========
C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Yloc folder moved successfully.
C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi folder moved successfully.
C:\Programme\Conduit\Community Alerts folder moved successfully.
C:\Programme\Conduit folder moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{8E0F232B-7757-0725-9EF2-60F3DC25CD1C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8E0F232B-7757-0725-9EF2-60F3DC25CD1C}\ not found.
File C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi\famyf.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
========== SERVICES/DRIVERS ==========
========== FILES ==========
========== REGISTRY ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: USERNAME
->Temp folder emptied: 3071464 bytes
->Temporary Internet Files folder emptied: 195338 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 31357223 bytes
->Flash cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 2134328 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 2127032 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 44828 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 37,00 mb
 
 
OTL by OldTimer - Version 3.2.9.1 log created on 08012010_230654

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
OTL.txt
Code:
OTL logfile created on: 01.08.2010 23:11:38 - Run 2
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 548,00 Mb Available Physical Memory | 54,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 14,96 Gb Free Space | 21,06% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,93 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NCUSERNAME
Current User Name: USERNAME
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Processes (SafeList) ==========
 
PRC - [2010.08.01 13:22:29 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools\OTL.exe
PRC - [2010.07.29 21:09:22 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.04.20 20:35:52 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.03.30 11:34:36 | 000,241,664 | ---- | M] () -- C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe
PRC - [2008.10.20 11:32:54 | 002,768,896 | ---- | M] () -- C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe
PRC - [2008.10.06 19:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2008.05.13 09:44:00 | 000,077,480 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.02.29 00:00:10 | 000,170,520 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxext.exe
PRC - [2008.01.11 23:16:38 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.08.01 13:22:29 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools\OTL.exe
MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.04.20 20:35:52 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.03.30 11:34:36 | 000,241,664 | ---- | M] () [Auto | Running] -- C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe -- (UI Assistant Service)
SRV - [2008.05.13 09:44:00 | 000,077,480 | ---- | M] () [Auto | Running] -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDRm.sys -- (InCDRm)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDPass.sys -- (InCDPass)
DRV - File not found [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\InCDFs.sys -- (InCDFs)
DRV - [2010.03.01 09:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.02.16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.07.03 20:52:56 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.12 09:12:56 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.01.04 17:29:50 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.01.04 17:29:50 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008.12.11 22:11:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008.11.07 11:04:00 | 000,291,328 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2008.10.29 16:35:32 | 000,007,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\massfilter.sys -- (massfilter)
DRV - [2008.10.08 08:35:10 | 001,334,432 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.09.23 22:23:58 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMC326.sys -- (VMC326)
DRV - [2008.08.28 20:18:14 | 000,224,736 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2008.08.27 01:35:00 | 004,753,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.07.29 17:59:08 | 000,879,832 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.07.27 01:29:54 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.02.15 22:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2008.01.14 20:01:02 | 000,030,208 | ---- | M] (Samsung Electronics,.LTD) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SamsungEDS.SYS -- (DNSeFilter)
DRV - [2005.10.27 06:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Programme\T-Mobile Internet Manager 03\addon [2009.07.28 15:33:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.29 21:09:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.31 22:42:09 | 000,000,000 | ---D | M]
 
[2009.06.17 21:35:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Extensions
[2010.08.01 22:44:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions
[2010.04.30 20:54:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.31 19:36:31 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.08.01 22:05:21 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.31 22:42:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.26 16:44:23 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.26 16:44:23 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.26 16:44:23 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.26 16:44:23 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.26 16:44:23 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.07.31 22:51:30 | 000,415,663 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 14347 more lines...
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - No CLSID value found.
O2 - BHO: (no name) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe ()
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [{8E0F232B-7757-0725-9EF2-60F3DC25CD1C}] C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Iruhi\famyf.exe File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Easy Display Manager.lnk = C:\Programme\Samsung\Easy Display Manager\DMLauncher_XP.exe (SAMSUNG Electronics)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.0.43.97 217.0.43.113
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.02.12 13:57:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.01 23:06:54 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.08.01 22:40:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010.08.01 22:37:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Application Data
[2010.08.01 18:10:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010.08.01 13:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2010.08.01 13:29:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.08.01 13:28:26 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2010.08.01 13:23:07 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2010.08.01 13:22:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
[2010.08.01 12:27:32 | 000,000,000 | ---D | C] -- C:\rsit
[2010.08.01 11:16:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
[2010.08.01 11:16:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.08.01 11:16:06 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.08.01 11:16:06 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.01 11:16:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.08.01 11:11:20 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\USERNAME\Recent
[2010.08.01 11:05:36 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.07.31 22:42:09 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.31 22:42:09 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.31 22:42:09 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.31 22:42:09 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.31 19:41:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.07.31 19:38:14 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.07.31 19:38:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.07.29 21:01:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\ForceField Shared Files
[2010.07.29 21:01:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2010.07.29 21:01:22 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.07.29 21:00:55 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2010.07.29 21:00:42 | 000,046,592 | ---- | C] (Zone Labs Inc.) -- C:\WINDOWS\System32\vsutil_loc0407.dll
[2010.07.29 20:29:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten-Dateien
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.01 23:08:10 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.01 23:08:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.01 23:08:05 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.01 23:07:20 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.01 23:07:20 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 22:57:01 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\defogger_reenable
[2010.08.01 22:55:47 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Defogger.exe
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:51:30 | 000,415,663 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.07.17 05:00:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.17 05:00:12 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.17 05:00:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.17 02:42:29 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
 
========== Files Created - No Company Name ==========
 
[2010.08.01 22:56:48 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\defogger_reenable
[2010.08.01 22:55:46 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Defogger.exe
[2010.08.01 13:39:27 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe
[2010.08.01 13:28:28 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:22:19 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:21:40 | 000,410,626 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:13 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:34 | 000,154,084 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:32:57 | 1063,702,528 | -HS- | C] () -- C:\hiberfil.sys
[2010.07.31 21:42:17 | 000,000,596 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:01:22 | 000,001,698 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 20:29:21 | 000,068,556 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.12 20:05:20 | 000,001,593 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Easy Display Manager.lnk
[2009.08.18 19:30:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.07.03 21:41:56 | 000,000,171 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2009.07.03 21:41:36 | 000,000,691 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2009.07.03 21:02:43 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.06.06 22:56:57 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\USERNAME_KBD.ini
[2009.04.13 11:46:57 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009.02.12 21:35:38 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.02.12 14:10:08 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\MagicKBD.INI
[2009.02.12 14:10:08 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Besitzer_KBD.ini
[2009.02.12 14:10:05 | 000,003,425 | ---- | C] () -- C:\WINDOWS\System32\KBDR.INI
[2009.02.12 14:10:05 | 000,002,741 | ---- | C] () -- C:\WINDOWS\System32\KBDD.INI
[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDO.INI
[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDC.INI
[2009.02.12 14:10:05 | 000,002,606 | ---- | C] () -- C:\WINDOWS\System32\KBDB.INI
[2009.02.12 14:10:05 | 000,002,236 | ---- | C] () -- C:\WINDOWS\System32\KBDQ.INI
[2009.02.12 14:10:05 | 000,001,956 | ---- | C] () -- C:\WINDOWS\System32\KBDE.INI
[2009.02.12 14:10:05 | 000,001,885 | ---- | C] () -- C:\WINDOWS\System32\KBDP.INI
[2009.02.12 14:10:05 | 000,001,857 | ---- | C] () -- C:\WINDOWS\System32\KBDUU.INI
[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDG.INI
[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDA.INI
[2009.02.12 14:10:05 | 000,001,834 | ---- | C] () -- C:\WINDOWS\System32\KBDU.INI
[2009.02.12 14:10:05 | 000,001,819 | ---- | C] () -- C:\WINDOWS\System32\KBDN.INI
[2009.02.12 14:10:05 | 000,001,699 | ---- | C] () -- C:\WINDOWS\System32\KBDT.INI
[2009.02.12 14:10:05 | 000,001,697 | ---- | C] () -- C:\WINDOWS\System32\KBDV.INI
[2009.02.12 14:10:05 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\KBDS.INI
[2009.02.12 14:10:05 | 000,001,476 | ---- | C] () -- C:\WINDOWS\System32\KBDF.INI
[2009.02.12 14:07:50 | 000,000,135 | R--- | C] () -- C:\WINDOWS\System32\lngEng.ini
[2009.02.12 14:07:50 | 000,000,117 | ---- | C] () -- C:\WINDOWS\System32\lngKor.ini
[2009.02.12 14:04:21 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.02.12 14:01:47 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS
[2008.09.17 14:20:08 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2005.02.17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005.02.17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2001.07.07 04:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
< End of report >
Extras.txt
Code:
OTL Extras logfile created on: 01.08.2010 23:11:38 - Run 2
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 548,00 Mb Available Physical Memory | 54,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 85,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 14,96 Gb Free Space | 21,06% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,93 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NCUSERNAME
Current User Name: USERNAME
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe:*:Enabled:hppniprint01.exe -- (Hewlett-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe:*:Enabled:hppniprint64.exe -- (Hewlett-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe:*:Enabled:hppnicifs01.exe -- ()
"C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe:*:Enabled:hpbtpg.exe -- (Hewlet-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe" = C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe:*:Enabled:launchapp.exe -- (Hewlett Packard)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{223C0721-A6B0-4853-88C0-331029841734}" = HP Color LaserJet CP1510 Series 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.0.140
"{414C803A-6115-4DB6-BD4E-FD81EA6BC71C}" = Product_SF_Min_QFolder
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Ultra Edition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{901F0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Proofing Tools
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = T-Mobile Internet Manager 03
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"ERUNT_is1" = ERUNT 1.1j
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"ScreenshotCaptor_is1" = Screenshot Captor 2.57.01
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.08.2010 16:40:31 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:40:46 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 01.08.2010 16:54:50 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:54:50 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:55:05 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 01.08.2010 16:59:33 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:59:33 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:59:48 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 01.08.2010 17:08:54 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 17:08:54 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
[ System Events ]
Error - 01.08.2010 16:39:48 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 01.08.2010 16:54:10 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 01.08.2010 16:54:14 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 01.08.2010 16:58:52 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 01.08.2010 16:58:56 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 01.08.2010 17:06:55 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Bluetooth Service" wurde unerwartet beendet. Dies ist
bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 01.08.2010 17:06:55 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "UI Assistant Service" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 01.08.2010 17:06:55 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 01.08.2010 17:08:15 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 01.08.2010 17:08:19 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
 
< End of report >

Larusso 02.08.2010 10:19
Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**

http://i266.photobucket.com/albums/i...ownload_FF.gif

http://i94.photobucket.com/albums/l8...x-Download.png
  • Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
  • Doppel-klicke auf ComboFix.exe und folge den Aufforderungen.
    • Wenn ComboFix fertig ist, wird es ein Log für dich erstellen.
    • Bitte poste mir den Inhalt von C:\ComboFix.txt hier in de Thread.
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

jqw767 02.08.2010 17:16
Hallo Larusso,

Combo-Fix ausgeführt und folgende Logdatei erhalten:

Code:
ComboFix 10-08-01.02 - USERNAME 02.08.2010  18:07:08.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1014.439 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\USERNAME\Desktop\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Iruhi\famyf.exe
c:\windows\SEC
c:\windows\SEC\DelMt.cmd
c:\windows\SEC\JRE150.exe
c:\windows\SEC\Marker.exe
c:\windows\SEC\MEMIO.sys
c:\windows\SEC\MEMIO.vxd
c:\windows\SEC\MP10GER.exe
c:\windows\SEC\SECINSTALL.EXE
c:\windows\SEC\SECINSTALL.INI
c:\windows\SEC\StartMem.exe

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-02 bis 2010-08-02  ))))))))))))))))))))))))))))))
.

2010-08-01 11:28 . 2010-08-01 11:28        --------        d-----w-        c:\programme\ERUNT
2010-08-01 11:23 . 2010-08-01 11:23        --------        d-----w-        c:\programme\7-Zip
2010-08-01 10:27 . 2010-08-01 10:38        --------        d-----w-        C:\rsit
2010-08-01 09:16 . 2010-08-01 09:16        --------        d-----w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
2010-08-01 09:16 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-01 09:16 . 2010-08-01 09:16        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-08-01 09:16 . 2010-08-01 09:16        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-08-01 09:16 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-01 09:05 . 2010-08-01 09:05        --------        d-----w-        c:\programme\CCleaner
2010-07-31 20:43 . 2010-07-31 20:43        503808        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-56b124f3-n\msvcp71.dll
2010-07-31 20:43 . 2010-07-31 20:43        499712        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-56b124f3-n\jmc.dll
2010-07-31 20:43 . 2010-07-31 20:43        348160        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-56b124f3-n\msvcr71.dll
2010-07-31 20:43 . 2010-07-31 20:43        61440        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5b539a7d-n\decora-sse.dll
2010-07-31 20:43 . 2010-07-31 20:43        12800        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5b539a7d-n\decora-d3d.dll
2010-07-31 20:42 . 2010-07-17 03:00        423656        ----a-w-        c:\windows\system32\deployJava1.dll
2010-07-31 20:21 . 2010-07-31 20:21        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Avira
2010-07-31 17:41 . 2010-07-31 17:42        --------        d-----w-        c:\windows\system32\NtmsData
2010-07-31 17:38 . 2010-08-01 20:49        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-07-31 17:38 . 2010-07-31 17:43        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2010-07-29 19:01 . 2010-07-29 19:01        --------        d-----w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\CheckPoint
2010-07-29 19:01 . 2010-08-01 10:41        --------        d-----w-        c:\programme\Trend Micro
2010-07-29 19:01 . 2010-07-29 19:01        --------        d-----w-        c:\dokumente und einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
2010-07-29 19:00 . 2010-07-29 19:00        --------        d-----w-        c:\programme\CheckPoint
2010-07-29 19:00 . 2010-07-29 19:00        4212        ---ha-w-        c:\windows\system32\zllictbl.dat
2010-07-29 19:00 . 2010-06-28 11:00        46592        ----a-w-        c:\windows\system32\vsutil_loc0407.dll

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-31 20:43 . 2009-02-12 12:01        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java
2010-07-31 20:41 . 2009-02-12 12:01        --------        d-----w-        c:\programme\Java
2010-06-24 18:32 . 2009-02-12 19:35        80488        ----a-w-        c:\windows\system32\perfc007.dat
2010-06-24 18:32 . 2009-02-12 19:35        448970        ----a-w-        c:\windows\system32\perfh007.dat
2010-06-14 14:31 . 2009-02-12 11:55        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"BatteryManager"="c:\programme\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-10-20 2768896]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Easy Display Manager.lnk - c:\programme\Samsung\Easy Display Manager\DMLauncher_XP.exe [2009-2-12 466944]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hppniprint01.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hppniprint64.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hppnicifs01.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hpbtpg.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\LaunchApp.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [17.06.2009 21:42 135336]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [12.02.2009 14:01 4300]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [14.01.2008 20:01 30208]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [12.02.2009 14:05 238464]
S2 UI Assistant Service;UI Assistant Service;c:\programme\T-Mobile Internet Manager 03\AssistantServices.exe [28.07.2009 15:33 241664]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [28.07.2009 15:33 7680]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03.07.2009 20:52 721904]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - BMLoad

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - (no file)
HKCU-Run-{8E0F232B-7757-0725-9EF2-60F3DC25CD1C} - c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Iruhi\famyf.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-08-02 18:11
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2010-08-02  18:13:31
ComboFix-quarantined-files.txt  2010-08-02 16:13

Vor Suchlauf: 11 Verzeichnis(se), 15.922.417.664 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 15.859.605.504 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - E6CE4D0341C21EC0C4109949DD5FC660

Larusso 02.08.2010 17:49
Schritt 1

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von einem der folgenden Download-Spiegel neu herunter:
BleepingComputer.com - ForoSpyware.com
und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

USERNAME editieren
Code:
Folder::
c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Iruhi
Speichere dies als CFScript.txt auf Deinem Desktop.

Wichtig:
  • Stelle deine Anti Viren Software temprär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein.
    Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Schließe alle laufenden Programme. Gehe sicher das ComboFix ungehindert arbeiten kann.
  • Mache nichts am PC solange ComboFix läuft.

http://i266.photobucket.com/albums/i.../CFScriptB.gif
  • In Bezug auf obiges Bild, ziehe CFScript.txt in die ComboFix.exe
  • Wenn ComboFix fertig ist, wird es ein Log erstellen, C:\ComboFix.txt. Bitte füge es hier als Antwort ein.

Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.

Hinweis für Mitleser:
Obiges Combofix-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!


Schritt 2

Bitte Update Malwarebytes und lass einen Quickscan laufen


Schritt 3

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.


Bitte poste in Deiner nächsten Antwort
COmbofix.txt
MBAM Log
OTL.txt
Extras.txt
Berichte wie der Rechner läuft

jqw767 02.08.2010 19:06
Hier die gewünschten Logs:

COmbofix.txt
Code:
ComboFix 10-08-02.01 - USERNAME 02.08.2010  19:11:58.2.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1014.544 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\USERNAME\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\USERNAME\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((  Dateien erstellt von 2010-07-02 bis 2010-08-02  ))))))))))))))))))))))))))))))
.

2010-08-01 21:06 . 2010-08-01 21:06        --------        d-----w-        C:\_OTL
2010-08-01 20:40 . 2010-08-01 20:40        --------        d-----w-        c:\windows\Internet Logs
2010-08-01 11:39 . 2010-08-01 11:39        --------        d-----w-        c:\windows\system32\LogFiles
2010-08-01 11:28 . 2010-08-01 11:28        --------        d-----w-        c:\programme\ERUNT
2010-08-01 11:23 . 2010-08-01 11:23        --------        d-----w-        c:\programme\7-Zip
2010-08-01 10:27 . 2010-08-01 10:38        --------        d-----w-        C:\rsit
2010-08-01 09:16 . 2010-08-01 09:16        --------        d-----w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
2010-08-01 09:16 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-01 09:16 . 2010-08-01 09:16        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-08-01 09:16 . 2010-08-01 09:16        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-08-01 09:16 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-01 09:05 . 2010-08-01 09:05        --------        d-----w-        c:\programme\CCleaner
2010-07-31 20:43 . 2010-07-31 20:43        503808        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-56b124f3-n\msvcp71.dll
2010-07-31 20:43 . 2010-07-31 20:43        499712        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-56b124f3-n\jmc.dll
2010-07-31 20:43 . 2010-07-31 20:43        348160        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-56b124f3-n\msvcr71.dll
2010-07-31 20:43 . 2010-07-31 20:43        61440        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5b539a7d-n\decora-sse.dll
2010-07-31 20:43 . 2010-07-31 20:43        12800        ----a-w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5b539a7d-n\decora-d3d.dll
2010-07-31 20:42 . 2010-07-17 03:00        423656        ----a-w-        c:\windows\system32\deployJava1.dll
2010-07-31 20:21 . 2010-07-31 20:21        --------        d-----w-        c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Avira
2010-07-31 17:41 . 2010-07-31 17:42        --------        d-----w-        c:\windows\system32\NtmsData
2010-07-31 17:38 . 2010-08-01 20:49        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-07-31 17:38 . 2010-07-31 17:43        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2010-07-29 19:01 . 2010-07-29 19:01        --------        d-----w-        c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\CheckPoint
2010-07-29 19:01 . 2010-08-01 10:41        --------        d-----w-        c:\programme\Trend Micro
2010-07-29 19:01 . 2010-07-29 19:01        --------        d-----w-        c:\dokumente und einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
2010-07-29 19:00 . 2010-07-29 19:00        --------        d-----w-        c:\programme\CheckPoint
2010-07-29 19:00 . 2010-07-29 19:00        4212        ---ha-w-        c:\windows\system32\zllictbl.dat
2010-07-29 19:00 . 2010-06-28 11:00        46592        ----a-w-        c:\windows\system32\vsutil_loc0407.dll

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-31 20:43 . 2009-02-12 12:01        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java
2010-07-31 20:41 . 2009-02-12 12:01        --------        d-----w-        c:\programme\Java
2010-06-24 18:32 . 2009-02-12 19:35        80488        ----a-w-        c:\windows\system32\perfc007.dat
2010-06-24 18:32 . 2009-02-12 19:35        448970        ----a-w-        c:\windows\system32\perfh007.dat
2010-06-14 14:31 . 2009-02-12 11:55        744448        ----a-w-        c:\windows\pchealth\helpctr\binaries\helpsvc.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"BatteryManager"="c:\programme\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-10-20 2768896]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Easy Display Manager.lnk - c:\programme\Samsung\Easy Display Manager\DMLauncher_XP.exe [2009-2-12 466944]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hppniprint01.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hppniprint64.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hppnicifs01.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\hpbtpg.exe"=
"c:\\HP_CP1510_Default_Install_4.0\\setup\\LaunchApp.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [17.06.2009 21:42 135336]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [12.02.2009 14:01 4300]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [14.01.2008 20:01 30208]
R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [12.02.2009 14:05 238464]
S2 UI Assistant Service;UI Assistant Service;c:\programme\T-Mobile Internet Manager 03\AssistantServices.exe [28.07.2009 15:33 241664]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [28.07.2009 15:33 7680]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03.07.2009 20:52 721904]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - BMLoad

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\dokumente und einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-08-02 19:15
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2010-08-02  19:18:19
ComboFix-quarantined-files.txt  2010-08-02 17:18
ComboFix2.txt  2010-08-02 16:13

Vor Suchlauf: 12 Verzeichnis(se), 15.860.924.416 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 15.850.340.352 Bytes frei

- - End Of File - - D3FD713FC1EE44D87E52BDAFC5E04B03
MBAM Log
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4381

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

02.08.2010 19:49:46
mbam-log-2010-08-02 (19-49-46).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 136498
Laufzeit: 9 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
OTL.txt
Code:
OTL logfile created on: 02.08.2010 19:51:56 - Run 3
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 559,00 Mb Available Physical Memory | 55,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 14,78 Gb Free Space | 20,80% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,93 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NCUSERNAME
Current User Name: USERNAME
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Processes (SafeList) ==========
 
PRC - [2010.08.01 13:22:29 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools\OTL.exe
PRC - [2010.07.29 21:09:22 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.05.14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.04.20 20:35:52 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.03.02 10:28:23 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.08.01 13:22:29 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools\OTL.exe
MOD - [2008.04.14 14:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010.04.20 20:35:52 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.02.24 09:28:01 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.03.30 11:34:36 | 000,241,664 | ---- | M] () [Auto | Stopped] -- C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe -- (UI Assistant Service)
SRV - [2008.05.13 09:44:00 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDRm.sys -- (InCDRm)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\InCDPass.sys -- (InCDPass)
DRV - File not found [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\InCDFs.sys -- (InCDFs)
DRV - [2010.03.01 09:05:19 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.02.16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.07.03 20:52:56 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.12 09:12:56 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.01.04 17:29:50 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.01.04 17:29:50 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008.12.11 22:11:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008.11.07 11:04:00 | 000,291,328 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2008.10.29 16:35:32 | 000,007,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\massfilter.sys -- (massfilter)
DRV - [2008.10.08 08:35:10 | 001,334,432 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.09.23 22:23:58 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMC326.sys -- (VMC326)
DRV - [2008.08.28 20:18:14 | 000,224,736 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2008.08.27 01:35:00 | 004,753,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.07.29 17:59:08 | 000,879,832 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2008.07.27 01:29:54 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2008.04.14 14:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008.02.15 22:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2008.01.14 20:01:02 | 000,030,208 | ---- | M] (Samsung Electronics,.LTD) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SamsungEDS.SYS -- (DNSeFilter)
DRV - [2005.10.27 06:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Programme\T-Mobile Internet Manager 03\addon [2009.07.28 15:33:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.29 21:09:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.31 22:42:09 | 000,000,000 | ---D | M]
 
[2009.06.17 21:35:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Extensions
[2010.08.01 22:44:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions
[2010.04.30 20:54:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.31 19:36:31 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Mozilla\Firefox\Profiles\xyri22re.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.08.01 22:05:21 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.07.31 22:42:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.26 16:44:23 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.26 16:44:23 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.26 16:44:23 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.26 16:44:23 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.26 16:44:23 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.08.02 18:10:52 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Easy Display Manager.lnk = C:\Programme\Samsung\Easy Display Manager\DMLauncher_XP.exe (SAMSUNG Electronics)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.0.43.97 217.0.43.113
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.02.12 13:57:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.02 18:06:12 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010.08.02 18:04:23 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010.08.02 18:04:23 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010.08.02 18:04:23 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010.08.02 18:04:23 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010.08.02 18:03:47 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.08.01 23:06:54 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.08.01 22:40:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs
[2010.08.01 22:37:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Application Data
[2010.08.01 18:10:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010.08.01 13:39:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2010.08.01 13:29:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010.08.01 13:28:26 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2010.08.01 13:23:07 | 000,000,000 | ---D | C] -- C:\Programme\7-Zip
[2010.08.01 13:22:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
[2010.08.01 12:27:32 | 000,000,000 | ---D | C] -- C:\rsit
[2010.08.01 11:16:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\Malwarebytes
[2010.08.01 11:16:11 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.08.01 11:16:06 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.08.01 11:16:06 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.08.01 11:16:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.08.01 11:11:20 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\USERNAME\Recent
[2010.08.01 11:05:36 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.07.31 22:42:09 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.31 22:42:09 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.31 22:42:09 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.31 22:42:09 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.31 19:41:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010.07.31 19:38:14 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.07.31 19:38:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.07.29 21:01:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\ForceField Shared Files
[2010.07.29 21:01:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Anwendungsdaten\CheckPoint
[2010.07.29 21:01:22 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
[2010.07.29 21:00:55 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2010.07.29 21:00:42 | 000,046,592 | ---- | C] (Zone Labs Inc.) -- C:\WINDOWS\System32\vsutil_loc0407.dll
[2010.07.29 20:29:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten-Dateien
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.02 19:18:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.02 19:16:00 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.08.02 19:09:22 | 003,749,250 | R--- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ComboFix.exe
[2010.08.02 18:10:52 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.08.02 18:06:16 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010.08.02 17:58:51 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.02 17:58:49 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.02 00:31:23 | 007,340,032 | -H-- | M] () -- C:\Dokumente und Einstellungen\USERNAME\NTUSER.DAT
[2010.08.02 00:31:23 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\USERNAME\ntuser.ini
[2010.08.01 22:57:01 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\defogger_reenable
[2010.08.01 22:55:47 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Defogger.exe
[2010.08.01 13:28:28 | 000,000,591 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:22:20 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:20:40 | 000,410,626 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:14 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:47 | 000,154,084 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 21:42:46 | 000,000,596 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:01:22 | 000,001,698 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 20:29:23 | 000,068,556 | ---- | M] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.29 20:18:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.07.26 20:59:41 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010.07.17 05:00:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010.07.17 05:00:12 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010.07.17 05:00:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010.07.17 02:42:29 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
 
========== Files Created - No Company Name ==========
 
[2010.08.02 19:09:09 | 003,749,250 | R--- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ComboFix.exe
[2010.08.02 18:06:16 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010.08.02 18:06:13 | 000,262,448 | ---- | C] () -- C:\cmldr
[2010.08.02 18:04:23 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010.08.02 18:04:23 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010.08.02 18:04:23 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010.08.02 18:04:23 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010.08.02 18:04:23 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010.08.01 22:56:48 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\defogger_reenable
[2010.08.01 22:55:46 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Defogger.exe
[2010.08.01 13:39:27 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\gmer.exe
[2010.08.01 13:28:28 | 000,000,591 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\NTREGOPT.lnk
[2010.08.01 13:28:28 | 000,000,572 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\ERUNT.lnk
[2010.08.01 13:22:19 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Gmer.zip
[2010.08.01 13:21:40 | 000,410,626 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Load.exe
[2010.08.01 11:16:13 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.01 11:12:34 | 000,154,084 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Eigene Dateien\cc_20100801_111231.reg
[2010.08.01 11:05:41 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\CCleaner.lnk
[2010.07.31 22:32:57 | 1063,702,528 | -HS- | C] () -- C:\hiberfil.sys
[2010.07.31 21:42:17 | 000,000,596 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010.07.31 19:38:29 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Spybot - Search & Destroy.lnk
[2010.07.29 21:01:22 | 000,001,698 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\HijackThis.lnk
[2010.07.29 21:00:53 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2010.07.29 20:29:21 | 000,068,556 | ---- | C] () -- C:\Dokumente und Einstellungen\USERNAME\Desktop\Starten.htm
[2010.07.12 20:05:20 | 000,001,593 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Easy Display Manager.lnk
[2009.08.18 19:30:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009.07.03 21:41:56 | 000,000,171 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2009.07.03 21:41:36 | 000,000,691 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2009.07.03 21:02:43 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.06.06 22:56:57 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\USERNAME_KBD.ini
[2009.04.13 11:46:57 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009.02.12 21:35:38 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.02.12 14:10:08 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\MagicKBD.INI
[2009.02.12 14:10:08 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Besitzer_KBD.ini
[2009.02.12 14:10:05 | 000,003,425 | ---- | C] () -- C:\WINDOWS\System32\KBDR.INI
[2009.02.12 14:10:05 | 000,002,741 | ---- | C] () -- C:\WINDOWS\System32\KBDD.INI
[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDO.INI
[2009.02.12 14:10:05 | 000,002,699 | ---- | C] () -- C:\WINDOWS\System32\KBDC.INI
[2009.02.12 14:10:05 | 000,002,606 | ---- | C] () -- C:\WINDOWS\System32\KBDB.INI
[2009.02.12 14:10:05 | 000,002,236 | ---- | C] () -- C:\WINDOWS\System32\KBDQ.INI
[2009.02.12 14:10:05 | 000,001,956 | ---- | C] () -- C:\WINDOWS\System32\KBDE.INI
[2009.02.12 14:10:05 | 000,001,885 | ---- | C] () -- C:\WINDOWS\System32\KBDP.INI
[2009.02.12 14:10:05 | 000,001,857 | ---- | C] () -- C:\WINDOWS\System32\KBDUU.INI
[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDG.INI
[2009.02.12 14:10:05 | 000,001,835 | ---- | C] () -- C:\WINDOWS\System32\KBDA.INI
[2009.02.12 14:10:05 | 000,001,834 | ---- | C] () -- C:\WINDOWS\System32\KBDU.INI
[2009.02.12 14:10:05 | 000,001,819 | ---- | C] () -- C:\WINDOWS\System32\KBDN.INI
[2009.02.12 14:10:05 | 000,001,699 | ---- | C] () -- C:\WINDOWS\System32\KBDT.INI
[2009.02.12 14:10:05 | 000,001,697 | ---- | C] () -- C:\WINDOWS\System32\KBDV.INI
[2009.02.12 14:10:05 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\KBDS.INI
[2009.02.12 14:10:05 | 000,001,476 | ---- | C] () -- C:\WINDOWS\System32\KBDF.INI
[2009.02.12 14:07:50 | 000,000,135 | R--- | C] () -- C:\WINDOWS\System32\lngEng.ini
[2009.02.12 14:07:50 | 000,000,117 | ---- | C] () -- C:\WINDOWS\System32\lngKor.ini
[2009.02.12 14:04:21 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.02.12 14:01:47 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS
[2008.09.17 14:20:08 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2005.02.17 12:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005.02.17 12:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2001.07.07 04:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
< End of report >
Extras.txt
Code:
OTL Extras logfile created on: 02.08.2010 19:51:56 - Run 3
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Dokumente und Einstellungen\USERNAME\Desktop\MFTools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.014,00 Mb Total Physical Memory | 559,00 Mb Available Physical Memory | 55,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 14,78 Gb Free Space | 20,80% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,93 Gb Free Space | 99,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: NCUSERNAME
Current User Name: USERNAME
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppniprint01.exe:*:Enabled:hppniprint01.exe -- (Hewlett-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppniprint64.exe:*:Enabled:hppniprint64.exe -- (Hewlett-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hppnicifs01.exe:*:Enabled:hppnicifs01.exe -- ()
"C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe" = C:\HP_CP1510_Default_Install_4.0\setup\hpbtpg.exe:*:Enabled:hpbtpg.exe -- (Hewlet-Packard)
"C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe" = C:\HP_CP1510_Default_Install_4.0\setup\LaunchApp.exe:*:Enabled:launchapp.exe -- (Hewlett Packard)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{223C0721-A6B0-4853-88C0-331029841734}" = HP Color LaserJet CP1510 Series 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.0.140
"{414C803A-6115-4DB6-BD4E-FD81EA6BC71C}" = Product_SF_Min_QFolder
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Ultra Edition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{901F0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Proofing Tools
"{995F2783-8311-49BF-833E-DB659774B4F6}" = hppFonts
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = T-Mobile Internet Manager 03
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"ERUNT_is1" = ERUNT 1.1j
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"ScreenshotCaptor_is1" = Screenshot Captor 2.57.01
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.08.2010 16:55:05 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 01.08.2010 16:59:33 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:59:33 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 16:59:48 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 01.08.2010 17:08:54 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 17:08:54 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 01.08.2010 17:09:09 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
Error - 02.08.2010 11:59:38 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 02.08.2010 11:59:38 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 02.08.2010 11:59:53 | Computer Name = NCUSERNAME | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
 zurückgegeben.  .
 
[ System Events ]
Error - 01.08.2010 16:58:56 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 01.08.2010 17:06:55 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Bluetooth Service" wurde unerwartet beendet. Dies ist
bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 01.08.2010 17:06:55 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "UI Assistant Service" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 01.08.2010 17:06:55 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 01.08.2010 17:08:15 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 01.08.2010 17:08:19 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 02.08.2010 11:58:59 | Computer Name = NCUSERNAME | Source = SRService | ID = 104
Description = Die Initialisierung der Systemwiederherstellung ist fehlgeschlagen.
 
Error - 02.08.2010 11:59:02 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Systemwiederherstellungsdienst" wurde mit folgendem Fehler
 beendet:  %%2
 
Error - 02.08.2010 12:07:01 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "UI Assistant Service" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 02.08.2010 12:10:27 | Computer Name = NCUSERNAME | Source = Service Control Manager | ID = 7034
Description = Dienst "Marvell Yukon Service" wurde unerwartet beendet. Dies ist
bereits 1 Mal passiert.
 
 
< End of report >
Berichte wie der Rechner läuft:
Soweit ich beurteilen kann "normal". Keine Popup Nachfrage im Online-Banking

Larusso 02.08.2010 20:07
Schritt 1
Code:
:OTL
[2010.07.29 21:01:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O2 - BHO: (no name) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - No CLSID value found.

:services
:files
:reg
:Commands
[purity]
[emptytemp]
[reboot]
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Schritt 2

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
  • Dein Anti-Virus-Programm während des Scans deaktivieren.
  • Button http://img695.imageshack.us/img695/1599/eset1l.jpg drücken.
    • Firefox-User: Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User: müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Hacken bei Yes, i accept the Terms of Use.
  • Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Remove found threads" und "Scan archives".
  • http://img707.imageshack.us/img707/687/starteg.jpg drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.

Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.


Bitte poste in Deiner nächsten Antwort
OTL FIx Log
ESET Log

jqw767 02.08.2010 21:47
So, vielen Dank, dass Du Dir so viel Zeit nimmst für mein Problem.

Hier die Logdateien:

OTL FIx Log
Code:
All processes killed
========== OTL ==========
C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\Log folder moved successfully.
C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts\LanguagePacks folder moved successfully.
C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit\Community Alerts folder moved successfully.
C:\Dokumente und Einstellungen\USERNAME\Lokale Einstellungen\Anwendungsdaten\Conduit folder moved successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}\ not found.
========== SERVICES/DRIVERS ==========
========== FILES ==========
========== REGISTRY ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: USERNAME
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41697529 bytes
->Flash cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 40,00 mb
 
 
OTL by OldTimer - Version 3.2.9.1 log created on 08022010_211900

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
ESET Log
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=f5b01f84e97521428cfe94296450ea66
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-08-02 08:31:03
# local_time=2010-08-02 10:31:03 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 118068 118068 0 0
# compatibility_mode=1797 16775141 100 100 170066 55673898 161606 0
# compatibility_mode=8192 67108863 100 0 240 240 0 0
# scanned=64199
# found=0
# cleaned=0
# scan_time=3731

Larusso 02.08.2010 22:21
Logfile ist sauber :daumenhoc

Hier noch die letzten paar Schritte zur Säuberung Deines Rechners.

Schritt 1

Combofix deinstallieren

Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Start => Ausführen (bei Vista (Windows-Taste + R) => dort reinschreiben ComboFix /uninstall => Enter drücken - damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch auch dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.


Schritt 2

Tool CleanUp

Starte bitte die OTL.exe.
Klicke nun auf den Bereinigung Button. Dies wird die meisten Tools und Logfiles entfernen.
Sollte denoch etwas bestehen bleiben, bitte manuell entfernen sowie den Papierkorb leeren.


Schritt 3

Automatische Updates

Sehen wir nach ob die Updates für Windows sich automatisch downloaden. Das ist der beste Weg um all die Sicherheits- Patches und Fixes zu erhalten.

Windows + R Taste drücken. Kopiere nun folgenden Text in die Kommandozeile

RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

und klicke auf OK.
Stelle sicher das die automatischen Updates aktiviert sind.


Schritt 4

Um Dich für die Zukunft vor weiteren Infizierungen zu schützen empfehle ich Dir noch ein paar Programme.
  • SpywareBlaster
    Ein Tutorial zur Verwendung findest Du Hier

  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
    Hinweis: MBAM ersetzt keine Anti- Viren- Software.

  • Temp File Cleaner
    TFC ist ein wirklich starkes Tool zum entfernen von Temp Dateien vom IE und WIndows, leert den Papierkorb und noch viel mehr.
    Ausserdem hilft es Deinen Computer zu beschleunigen.
    Du kannst Dir TFC ( by OldTimer ) hier downloaden.

  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.

  • Halte Dein System aktuell
    Ich kann gar nicht oft genug betonen, wie wichtig es ist, dass der PC auf dem aktuellsten Stand der Dinge ist.
    Es werden oft genug Sicherheitslücken in Windows eigenen Anwendungen gefunden. Diese "Löcher" gehören entfernt, weil Angreifer diese womöglich nutzen um unauthorisiert auf Dein System zu zugreifen.
    Jeden zweiten Dienstag im Monat ist Update Tag. Besuche bitte dazu die Microsoft Update Seite.

  • Halte Deine Software aktuell
    Der einfachste Weg dafür ist der Secunia Online Software.


Schritt 5

Tipps für sicheres Surfen

Das sind meine Vorschläge.
Verwende einen alternativen Browser statt den IE.
Ich empfehle Mozilla Firefox.

Für Firefox gibt es verschiedenste AddOns um sicher durch das WWW zu kommen.
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.

  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:14 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131