Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   png777fh.dll' enthielt TR/Spy.585728.35[trojan] (https://www.trojaner-board.de/89298-png777fh-dll-enthielt-tr-spy-585728-35-trojan.html)

Julius35 09.08.2010 14:05
png777fh.dll' enthielt TR/Spy.585728.35[trojan]
 
Hallo,

Antivir meldet bei mir folgendes:

Die Datei 'C:\Windows\System32\png777fh.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.585728.35' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48405267.qua' verschoben!

Für die laufende Sitzung ist er dann weg und wird auch nicht von Malwarebytes gefunden. Nach Neustart (Windows Vista) ist er wieder da.

Habe schon die Registry mit ccleaner gesäubert und mit Malwarebytes den Rechner durchsucht. Kein Fund, weil das Ding sicherlich von Antivir in die Quarantäne verschoben wurde.

Der Online-Scanner von F-Prot finded nichts und der Luke Filewalker von Antivir hat ein paar alte Trojaner irgendwo im Browser-Cache beseitigt.

Kann mir jemand helfen, das Ding wieder loszuwerden?

Grüße
Julius

markusg 09.08.2010 17:29
ootl:
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
poste beide

Julius35 09.08.2010 18:27
Die OTL.txt:

Code:
OTL logfile created on: 09.08.2010 18:35:47 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\......\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 34,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173,99 Gb Total Space | 71,62 Gb Free Space | 41,16% Space Free | Partition Type: NTFS
Drive D: | 45,22 Gb Total Space | 11,65 Gb Free Space | 25,75% Space Free | Partition Type: NTFS
Drive E: | 406,52 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 465,64 Gb Total Space | 172,32 Gb Free Space | 37,01% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: XXXXX
Current User Name: yyyyyy
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\......\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Opera\opera.exe (Opera Software)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\Programme\FAST Gigabank\Gigabank.exe (FAST LTA AG)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Mail\WinMail.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)
PRC - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Programme\HybridTM_IR(A)\RC620_A.exe ()
PRC - C:\Programme\freenetMail Dateimanager\DBDDsktDrvTrayApp.exe (freenet.de)
PRC - C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\......\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Akamai) -- c:\Programme\Common Files\Akamai\rswin_3725.dll ()
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (Application Updater) -- C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (HauppaugeTVServer) -- C:\Programme\WinTV\HCWTVServer.exe (Hauppauge Computer Works)
SRV - (TestHandler) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (hcw95rc) -- C:\Windows\System32\drivers\hcw95rc.sys (Hauppauge Computer Works, Inc.)
DRV - (hcw95bda) -- C:\Windows\System32\drivers\hcw95bda.sys (Hauppauge Computer Works, Inc.)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (slabser) -- C:\Windows\System32\drivers\slabser.sys (MCCI Corporation)
DRV - (slabbus) CP210x USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\slabbus.sys (MCCI Corporation)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (nvraid) NVIDIA nForce(tm) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvatabus) -- C:\Windows\system32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (iaStor) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (JGOGO) -- C:\Windows\system32\drivers\jgogo.sys (JMicron )
DRV - (ECS_Loader_220) -- C:\Windows\System32\drivers\ECS_Loader_220.sys (WideView Technology Inc.)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 62 D3 C9 F2 DE 03 CA 01  [binary data]
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 62 D3 C9 F2 DE 03 CA 01  [binary data]
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.1.1:80
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=302398"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13"
FF - prefs.js..extensions.enabledItems: de-AT@dictionaries.addons.mozilla.org:2.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:1.1.2
FF - prefs.js..extensions.enabledItems: searchsettings@spigot.com:1.2.3
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.06.30 08:25:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.06.30 08:25:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.06.05 18:42:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2008.06.23 14:52:52 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\mozilla\Extensions
[2010.08.07 16:06:09 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\mozilla\Firefox\Profiles\puxr1l9h.default\extensions
[2010.08.07 15:56:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\yyyyyy\AppData\Roaming\mozilla\Firefox\Profiles\puxr1l9h.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.03.22 12:53:04 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\mozilla\Firefox\Profiles\puxr1l9h.default\extensions\de-AT@dictionaries.addons.mozilla.org
[2010.02.04 16:45:40 | 000,002,254 | ---- | M] () -- C:\Users\yyyyyy\AppData\Roaming\Mozilla\FireFox\Profiles\puxr1l9h.default\searchplugins\askcom.xml
[2010.04.23 21:30:21 | 000,001,819 | ---- | M] () -- C:\Users\yyyyyy\AppData\Roaming\Mozilla\FireFox\Profiles\puxr1l9h.default\searchplugins\bing.xml
[2010.04.23 21:30:22 | 000,000,873 | ---- | M] () -- C:\Users\yyyyyy\AppData\Roaming\Mozilla\FireFox\Profiles\puxr1l9h.default\searchplugins\conduit.xml
[2010.08.09 13:52:51 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.21 08:35:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.09 13:52:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.06.26 10:03:55 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.06.26 10:03:55 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.06.26 10:03:55 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.06.26 10:03:55 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.06.26 10:03:55 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (IE Developer Toolbar BHO) - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Programme\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O3 - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O3 - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\..\Toolbar\WebBrowser: (no name) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [freenetMail Dateimanager Taskleistensymbol] C:\Program Files\freenetMail Dateimanager\DBDDsktDrvTrayApp.exe (freenet.de)
O4 - HKLM..\Run: [HybridTM_A] C:\Programme\HybridTM_IR(A)\RC620_A.exe ()
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Programme\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-732255811-3183488341-2812780789-1000..\Run: [ISUSPM Startup] C:\Programme\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKU\S-1-5-21-732255811-3183488341-2812780789-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\......\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gigabank.lnk = C:\Programme\FAST Gigabank\Gigabank.exe (FAST LTA AG)
O4 - Startup: C:\Users\yyyyyy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2010.05.07 12:58:09 | 000,000,000 | -H-D | M]
O7 - HKU\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube Download - C:\Users\yyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\yyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Programme\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Encarta Suchleiste - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Common Files\microsoft shared\Encarta Search Bar\ENCSBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img9.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img9.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4379aa64-a0d0-11dc-9a06-001a92c20a66}\Shell\AutoRun\command - "" = F:\wubi.exe -- File not found
O33 - MountPoints2\{9c158345-62e5-11dc-ab4e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{9c158345-62e5-11dc-ab4e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Welcome.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - State: "services" - 0
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {9BCCB97E-BE3F-320E-2908-96C386E0CC2B} - DirectX
ActiveX: {9FCF2F9A-30A1-AB17-9572-2D5B148719FF} - Adobe Shockwave Director 11.0
ActiveX: {B165C5D8-B86C-A884-940A-801DBD566E89} - Microsoft VM
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.mjpg - C:\Windows\System32\pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.09 16:31:58 | 000,000,000 | ---D | C] -- C:\Users\yyyyyy\AppData\Roaming\Malwarebytes
[2010.08.09 13:52:48 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.08.09 13:52:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.08.09 13:52:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.08.09 13:49:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.08.07 13:04:20 | 000,000,000 | ---D | C] -- C:\ProgramData\F-Secure
[2010.08.06 18:03:04 | 000,000,000 | ---D | C] -- C:\Users\yyyyyy\AppData\Roaming\Avira
[2010.08.06 17:46:37 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.08.06 16:13:44 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[3 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.09 18:39:59 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C23C680E-AFD6-499B-8D62-7D4BDAABD7B3}.job
[2010.08.09 18:33:06 | 002,097,152 | -HS- | M] () -- C:\Users\yyyyyy\NTUSER.DAT
[2010.08.09 18:26:01 | 000,001,130 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-732255811-3183488341-2812780789-1001UA.job
[2010.08.09 18:26:01 | 000,001,078 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-732255811-3183488341-2812780789-1001Core.job
[2010.08.09 18:15:24 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{31D36847-25B7-4967-9ACD-59A7E1914681}.job
[2010.08.09 18:09:14 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.09 18:09:14 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.09 16:31:57 | 000,524,288 | -HS- | M] () -- C:\Users\yyyyyy\NTUSER.DAT{289c2424-a335-11dd-82aa-bd311c3965c7}.TMContainer00000000000000000001.regtrans-ms
[2010.08.09 16:31:57 | 000,065,536 | -HS- | M] () -- C:\Users\yyyyyy\NTUSER.DAT{289c2424-a335-11dd-82aa-bd311c3965c7}.TM.blf
[2010.08.09 14:17:53 | 000,052,917 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.08.09 14:17:28 | 005,125,592 | -H-- | M] () -- C:\Users\yyyyyy\AppData\Local\IconCache.db
[2010.08.09 14:09:42 | 000,052,917 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.08.09 14:09:14 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.09 14:09:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.09 14:09:07 | 3217,633,280 | -HS- | M] () -- C:\hiberfil.sys
[2010.08.09 09:21:13 | 000,000,332 | ---- | M] () -- C:\Users\yyyyyy\Documents\cc_20100809_092109.reg
[2010.08.09 09:20:16 | 000,030,050 | ---- | M] () -- C:\Users\yyyyyy\Documents\cc_20100809_092005.reg
[2010.08.09 09:12:23 | 000,000,810 | ---- | M] () -- C:\Users\yyyyyy\Desktop\CCleaner.lnk
[2010.08.07 13:19:06 | 001,438,864 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.08.07 13:19:06 | 000,633,360 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.08.07 13:19:06 | 000,586,980 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.08.07 13:19:06 | 000,127,170 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.08.07 13:19:06 | 000,101,052 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.08.06 18:02:13 | 000,159,296 | ---- | M] () -- C:\Users\yyyyyy\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.08.06 17:46:37 | 000,001,880 | ---- | M] () -- C:\Users\yyyyyy\Desktop\HijackThis.lnk
[2010.08.06 17:19:04 | 004,092,304 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.08.02 09:14:57 | 000,000,989 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.2.lnk
[2010.07.17 05:00:12 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.07.17 05:00:12 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.07.17 05:00:10 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[3 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.09 09:21:11 | 000,000,332 | ---- | C] () -- C:\Users\yyyyyy\Documents\cc_20100809_092109.reg
[2010.08.09 09:20:13 | 000,030,050 | ---- | C] () -- C:\Users\yyyyyy\Documents\cc_20100809_092005.reg
[2010.08.09 09:12:23 | 000,000,810 | ---- | C] () -- C:\Users\yyyyyy\Desktop\CCleaner.lnk
[2010.08.06 17:46:37 | 000,001,880 | ---- | C] () -- C:\Users\yyyyyy\Desktop\HijackThis.lnk
[2010.08.02 09:14:57 | 000,000,989 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.2.lnk
[2010.06.24 12:25:58 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.05.04 08:46:36 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.03.22 18:29:54 | 000,000,012 | ---- | C] () -- C:\Windows\Ulead32.ini
[2009.07.14 15:21:08 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2009.04.08 15:25:44 | 000,364,544 | ---- | C] () -- C:\Windows\System32\BH_DATA120VC8.dll
[2009.04.08 07:17:48 | 000,057,344 | ---- | C] () -- C:\Windows\System32\FKStampPainter20.dll
[2009.02.02 20:11:40 | 000,208,896 | ---- | C] () -- C:\Windows\System32\LXPrnUtil10.dll
[2009.02.02 20:10:14 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll
[2009.02.02 20:08:36 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll
[2009.02.02 20:08:22 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll
[2009.01.11 17:42:49 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2009.01.11 17:42:49 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2009.01.11 17:31:44 | 000,000,988 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2009.01.11 17:31:44 | 000,000,163 | ---- | C] () -- C:\Windows\brpcfx.ini
[2009.01.11 17:26:06 | 000,031,664 | ---- | C] () -- C:\Windows\maxlink.ini
[2008.09.11 16:33:12 | 000,090,112 | ---- | C] () -- C:\Windows\System32\LxUtl10.dll
[2008.09.11 16:33:11 | 000,131,072 | ---- | C] () -- C:\Windows\System32\BH_DATA100VC7.dll
[2008.08.07 14:18:09 | 000,106,496 | ---- | C] () -- C:\Windows\System32\IO_PORT.DLL
[2008.08.07 14:18:09 | 000,102,400 | ---- | C] () -- C:\Windows\System32\FVC.DLL
[2008.08.07 14:18:09 | 000,032,768 | ---- | C] () -- C:\Windows\System32\SQ1394.DLL
[2008.08.07 14:18:09 | 000,010,624 | ---- | C] () -- C:\Windows\System32\GENEUSB.SYS
[2008.08.07 14:18:09 | 000,010,624 | ---- | C] () -- C:\Windows\System32\drivers\GENEUSB.SYS
[2008.03.11 18:33:37 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.03.11 18:33:37 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.02.04 19:26:39 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.02.04 19:24:52 | 000,598,016 | ---- | C] () -- C:\Windows\System32\viscomqtde.dll
[2008.02.04 19:24:52 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007.11.13 23:39:34 | 000,344,064 | ---- | C] () -- C:\Windows\System32\BH_DATA110VC8.dll
[2007.11.08 21:21:08 | 000,000,399 | ---- | C] () -- C:\Windows\vtplus32.ini
[2007.11.08 21:21:02 | 000,032,133 | ---- | C] () -- C:\Windows\Irremote.ini
[2007.11.08 21:20:55 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2007.11.08 21:20:26 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2007.11.08 21:19:52 | 000,006,538 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2007.10.11 12:38:45 | 000,373,248 | ---- | C] () -- C:\Windows\EyeCand3.INI
[2007.09.18 11:50:29 | 000,039,955 | ---- | C] () -- C:\Windows\php.ini
[2007.09.17 11:59:02 | 000,000,507 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.05.30 13:23:18 | 000,135,168 | ---- | C] () -- C:\Windows\System32\property.dll
[2007.01.26 01:04:12 | 000,138,752 | ---- | C] () -- C:\Windows\System32\mase32.dll
[2007.01.26 01:04:12 | 000,027,648 | ---- | C] () -- C:\Windows\System32\ma32.dll
[2006.12.10 15:52:04 | 000,409,600 | ---- | C] () -- C:\Windows\System32\BH_DATA100VC8.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.09.21 13:53:28 | 000,282,679 | ---- | C] () -- C:\Windows\System32\dnt27.dll
[2006.09.21 13:52:24 | 000,077,882 | ---- | C] () -- C:\Windows\System32\dntvmc27.dll
[2006.09.21 13:52:14 | 000,077,881 | ---- | C] () -- C:\Windows\System32\dntvm27.dll
[2006.08.11 09:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2006.04.21 10:08:22 | 000,253,952 | ---- | C] () -- C:\Windows\System32\HtmlHelp.dll
[2005.11.09 12:13:48 | 000,282,624 | ---- | C] () -- C:\Windows\System32\dnt27VC7.dll
[2005.11.09 12:11:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvmc27VC7.dll
[2005.11.09 12:11:30 | 000,077,824 | ---- | C] () -- C:\Windows\System32\dntvm27VC7.dll
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2001.10.10 08:57:58 | 000,073,786 | ---- | C] () -- C:\Windows\System32\dntvmc23.dll
[2001.10.10 08:57:58 | 000,061,497 | ---- | C] () -- C:\Windows\System32\dntvm23.dll
[2001.03.07 08:02:30 | 000,229,431 | ---- | C] () -- C:\Windows\System32\dnt23.dll
 
========== LOP Check ==========
 
[2010.02.07 10:03:14 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\CoSoSys
[2010.06.11 16:44:57 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Duden
[2008.04.05 08:14:00 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\FAST LTA
[2007.11.28 17:32:31 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\GHISLER
[2009.09.28 13:48:38 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Haufe
[2010.05.31 09:16:03 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\JAlbum
[2008.09.11 23:16:34 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Lexware
[2010.08.03 18:20:43 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\LPC
[2007.09.18 11:51:40 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Maguma Studio
[2008.08.06 18:27:57 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Nikon
[2008.06.03 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Notepad++
[2008.12.22 13:52:31 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\OpenOffice.org
[2008.04.09 07:55:52 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Opera
[2009.10.13 12:26:38 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\PC-FAX TX
[2008.09.07 11:47:11 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\phonostar-Player
[2008.08.28 06:47:15 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\PIE
[2008.07.09 08:05:03 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\scriptforest
[2008.05.24 10:48:42 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\SteelBytes
[2008.10.30 09:25:49 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Subversion
[2010.06.05 18:42:35 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Thunderbird
[2010.03.22 18:40:08 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Ulead Systems
[2007.11.26 18:55:29 | 000,000,000 | ---D | M] -- C:\Users\......\AppData\Roaming\Weaverslave
[2008.08.24 13:30:31 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\AD ON Multimedia
[2010.06.11 18:03:11 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Duden
[2010.04.23 21:30:01 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers
[2008.04.03 09:54:46 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\FAST LTA
[2007.11.28 17:30:26 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\GHISLER
[2008.01.19 09:09:08 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\IBP
[2010.05.03 12:52:49 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\IrfanView
[2007.09.28 14:08:26 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Lexware
[2007.12.21 15:59:54 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\LPC
[2010.05.16 15:27:39 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Nikon
[2008.06.03 09:06:53 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Notepad++
[2009.05.08 19:06:53 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\OpenOffice.org
[2007.12.21 16:03:36 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Opera
[2008.09.17 14:23:19 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\phonostar-Player
[2008.08.07 14:23:30 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\PIE
[2010.02.17 15:56:32 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\ScanSoft
[2008.04.22 10:34:11 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\scriptforest
[2007.09.26 12:51:09 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Thunderbird
[2007.11.25 11:49:54 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Weaverslave
[2010.08.09 14:04:43 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.08.09 18:15:24 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{31D36847-25B7-4967-9ACD-59A7E1914681}.job
[2010.08.09 18:39:59 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C23C680E-AFD6-499B-8D62-7D4BDAABD7B3}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.08.24 13:30:31 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\AD ON Multimedia
[2010.08.06 15:55:41 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Adobe
[2007.12.15 18:02:20 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Ahead
[2008.03.03 09:09:42 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Apple Computer
[2010.08.06 18:03:04 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Avira
[2008.08.07 14:40:29 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Corel
[2010.05.07 12:12:58 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\DivX
[2010.06.11 18:03:11 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Duden
[2010.04.23 21:30:01 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers
[2008.04.03 09:54:46 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\FAST LTA
[2007.11.28 17:30:26 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\GHISLER
[2008.01.19 09:09:08 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\IBP
[2007.09.14 19:25:28 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Identities
[2007.09.28 14:05:42 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\InstallShield
[2010.05.03 12:52:49 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\IrfanView
[2007.09.28 14:08:26 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Lexware
[2007.12.21 15:59:54 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\LPC
[2007.09.18 12:04:58 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Macromedia
[2010.08.09 16:31:58 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Media Center Programs
[2010.06.01 14:00:22 | 000,000,000 | --SD | M] -- C:\Users\yyyyyy\AppData\Roaming\Microsoft
[2008.06.23 14:52:52 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Mozilla
[2010.05.16 15:27:39 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Nikon
[2008.06.03 09:06:53 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Notepad++
[2009.05.08 19:06:53 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\OpenOffice.org
[2008.07.14 09:33:58 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\OpenOffice.org2
[2007.12.21 16:03:36 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Opera
[2008.09.17 14:23:19 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\phonostar-Player
[2008.08.07 14:23:30 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\PIE
[2010.02.17 15:56:32 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\ScanSoft
[2008.04.22 10:34:11 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\scriptforest
[2008.04.03 10:18:13 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Talkback
[2007.09.26 12:51:09 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Thunderbird
[2007.11.25 11:49:54 | 000,000,000 | ---D | M] -- C:\Usersyyyyyy\AppData\Roaming\Weaverslave
[2008.11.25 15:12:03 | 000,000,000 | ---D | M] -- C:\Users\yyyyyy\AppData\Roaming\Winamp
 
< %APPDATA%\*.exe /s >
[2010.05.16 15:23:22 | 000,335,872 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
[2010.05.03 15:05:33 | 000,086,016 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{56FDB311-6511-11DE-832F-0050560400B1}\ARPPRODUCTICON.exe
[2010.05.16 15:22:38 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
[2010.06.11 18:04:59 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{8AEBFD30-B94F-4A49-8106-03039708BDD4}\ARPPRODUCTICON.exe
[2008.09.11 16:26:30 | 000,086,016 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{A4E86B6A-6EEC-41FD-8960-26947F0E3353}\ARPPRODUCTICON.exe
[2010.05.16 15:24:12 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
[2009.09.28 13:16:27 | 000,086,016 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{D5C8E140-6E6F-11DD-9AA9-0050560400B1}\ARPPRODUCTICON.exe
[2010.05.03 15:05:05 | 000,086,016 | R--- | M] (InstallShield Software Corp.) -- C:\Users\yyyyyy\AppData\Roaming\Microsoft\Installer\{EB5AE940-8E5D-11DE-992A-005056B12123}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007.05.30 13:50:24 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007.05.30 13:50:24 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007.05.30 13:50:24 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2007.05.30 14:02:06 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=3E39E69F31F95D056703212E94320899 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_e6b2949c\atapi.sys
[2007.05.30 14:02:06 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=3E39E69F31F95D056703212E94320899 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20544_none_dbb443eb3d9db847\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.01.19 07:06:48 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.01.19 06:33:23 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008.01.19 06:33:23 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\drivers\iaStor.sys
[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6c3369af\iaStor.sys
[2006.05.11 11:30:52 | 000,247,808 | ---- | M] (Intel Corporation) MD5=294110966CEDD127629C5BE48367C8CF -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0d20ce62\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
 
< MD5 for: NVATABUS.SYS  >
[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows\System32\drivers\nvatabus.sys
[2006.07.14 14:55:34 | 000,105,088 | ---- | M] (NVIDIA Corporation) MD5=7D960340BE5B0E008BB94E4C3B991339 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_27229839\nvatabus.sys
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.05.30 13:48:53 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2007.05.30 13:48:53 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows\System32\drivers\viamraid.sys
[2006.03.31 02:18:30 | 000,100,992 | ---- | M] (VIA Technologies inc,.ltd) MD5=9F3F276C7300ED211129757A411B605F -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_2d6a7e3a\viamraid.sys
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2007.05.30 13:24:11 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007.05.30 13:24:08 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007.05.30 13:24:11 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007.05.30 13:24:27 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007.05.30 13:24:30 | 006,021,120 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 13:31:42 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2009.03.08 13:31:37 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 857 bytes -> C:\Users\Public\Documents\meeting at the ITB.eml:OECustomProperty
@Alternate Data Stream - 769 bytes -> C:\Users\Public\Documents\avast! Registration.eml:OECustomProperty
@Alternate Data Stream - 733 bytes -> C:\Users\Public\Documents\Aw  Jugendweihe.eml:OECustomProperty
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:0A8E2C33
< End of report >

Julius35 09.08.2010 18:29
und die Extras.txt

Code:
OTL Extras logfile created on: 09.08.2010 18:35:47 - Run 1
OTL by OldTimer - Version 3.2.9.1    Folder = C:\Users\.....\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 34,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173,99 Gb Total Space | 71,62 Gb Free Space | 41,16% Space Free | Partition Type: NTFS
Drive D: | 45,22 Gb Total Space | 11,65 Gb Free Space | 25,75% Space Free | Partition Type: NTFS
Drive E: | 406,52 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 465,64 Gb Total Space | 172,32 Gb Free Space | 37,01% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: XXXXX
Current User Name: yyyyyy
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-732255811-3183488341-2812780789-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_USERS\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\Müller Foto\Müller Foto\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Müller Foto] -- "C:\Program Files\Müller Foto\Müller Foto\Müller Foto.exe" "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{096EA8C2-ACB4-47A3-946C-BACD1A5870C5}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{22AD1CA3-F4B3-48F6-89AA-9986AEEFC620}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{26902C56-C1B9-48A2-B28E-2F4DB46A4CBD}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{2871B6B1-3EE3-4B69-AA39-5077B9E32640}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2899BEDB-C0DF-41E5-8C9C-D5FE43BAFA97}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{484D7858-F3E7-490A-89EC-50A89F438827}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{4890BB27-973B-4B08-8135-4662E8ABED07}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{4B24FC87-DC75-4C85-9D6C-834D82941394}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{4E4105E4-5B24-4554-8ED0-AF12FAB7F7AA}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{57DE4E9A-E271-4FB8-AE6F-3BC178C38774}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{603768E3-EFA5-471C-9EB9-C00CF841B72C}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{64621655-2EE6-4756-AAB7-45F184A5F6C2}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{69834FC8-70EE-420E-AB8A-57B2FF9DEFFF}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{70B331A4-41F0-4887-BE5C-DB83EBB52E1B}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{7343D576-6912-426A-A0E1-7FD83DCCAAB4}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{756C0A82-1DC9-41C0-A51C-94C347A71FB7}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{7903D7D9-4A69-45FC-951D-4E8B1F778A6E}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{866128BE-96A0-4EE0-80FF-755C8F23E9FB}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{873D4F60-017C-4B42-B227-F9DC94A8F881}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8C8A588C-2E9D-4089-A69F-3D7116A70D25}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{90312AFD-6994-4AB3-977A-46C9BE0729F6}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{91D3F917-E1DD-48F4-9649-5E197464E6C5}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{9213A05E-64B9-42E7-AE87-871D12DEF74F}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{9D33F8A8-5D16-4E0B-B8FC-534445AB678B}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A10F6CE8-547A-457F-BC10-2EEF8BE21AA6}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{B5304E8B-4005-4F6E-9C8C-FDD2010878FA}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{BBFED4B3-84F9-4975-B872-6E80079221EB}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{BFE35559-6B7A-428B-ABC6-5EB19BCC8E72}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{C9CCBF60-CCA7-416F-8F48-84CD54931667}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{CFC7785A-E931-448B-98B2-905A33D02D32}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{D3C634F0-027D-41FE-B9E6-FCF4412EC7E1}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D5956D5C-1837-497B-9640-D309798324F6}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{D605BAF0-AB32-4A31-9658-BD6F6FBE1237}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D6ED6AAA-762E-41BD-8B65-614000548AFA}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DB33BC0A-51C0-4806-882E-5B1CFFA51450}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{DDD1ECB4-642A-40E2-A876-F5830BF4ED25}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{F38AAD7E-6908-4D59-86C9-60408B4A0D37}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FAF28432-3FF0-4B80-9C09-4BF97427B475}" = lport=2869 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0446E164-BD84-4785-8DA2-D832200B4AF7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{07C8A331-41BB-4921-820E-9307E6F306CC}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\rm.exe |
"{0AD82127-12D6-41E0-9EF7-12D6A7C72A40}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{13E6453E-E563-4F3D-B975-08C56CC96EF8}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{16C21883-71A1-487B-B171-83408F9E2EB0}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{252DAF14-0963-405F-BAC7-3332C89D8C02}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{2F2DBF32-71A6-4CEF-B67D-2EF61E27E4EC}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{32A6FED1-3263-4B96-B8B5-49078273DE7F}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{37F69904-0A13-4BF7-8179-4B0962D15019}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3C3F44F0-2529-4AC9-853E-F40B26256640}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3D3A0C1A-F8DE-428F-BB67-D14BF5111CEE}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{3DF955E1-4FEB-4D89-8011-9D541878A029}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{482BDF49-C754-4152-A8A3-7F8018ECD82C}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4CA454E4-E683-48BD-9111-86396C528A42}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{4E867877-E5E5-4DA9-8658-857A07C9062E}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{543B7829-74DA-4E4D-9426-0700A1D1A15C}" = protocol=6 | dir=in | app=c:\program files\mozilla thunderbird\thunderbird.exe |
"{5493976A-C4D7-441C-BC78-064C72E8B786}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{558C608E-E326-4BEF-A809-33860A7D6BFE}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5D8C2D55-C24E-4EBE-8D14-3D64245F65E5}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{6414C7E0-FD35-45B7-81CF-D54AB7177710}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{66DD0686-2ABD-446C-92D8-76C969C46240}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{695BC91F-4936-4C25-814B-B3FF07D1DE1A}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{6A0909AE-C3FF-4C65-93A2-244E8A92A389}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{6F760E5B-2D0D-42C1-97C6-EDC099D933C3}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\umi.exe |
"{794FB1BF-95E5-4A60-B81A-89C32C04CC20}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\rm.exe |
"{79DE93E5-0F21-40CF-9ACA-E82665AB8C30}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{814E6FBD-A31E-4590-BAE6-1DA957E782F6}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{8DCF8DA0-26E4-48EF-8E3E-C7A3CDF9B891}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8DE3BFF3-207D-4323-AD31-521CE666AC1E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{8E4F1A92-D1BC-4C61-832F-9D770F1BF8E1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{982BC60E-8305-447A-8108-EBCBDA582C09}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{98E69402-0E08-4139-A1F4-467D2753CA51}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9A892AC6-ECE7-4838-9ACF-8922C00B7AAA}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9D5D4F68-F08A-4BF7-91C2-803B5E162CE4}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A3382E72-1A5B-4F7B-9858-DFD1B06626B5}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{A3FD77E8-909A-4951-A4AB-CEF0254822FF}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A63A98A2-3A9C-4421-A937-9C0FD7C6E0FA}" = protocol=17 | dir=in | app=c:\program files\mozilla thunderbird\thunderbird.exe |
"{AEB2E8D1-6978-48E1-A5F3-6F10B3B6A0D2}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{B00C147F-96BD-4AD7-AFDF-A4CC2CA460DC}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{BC8B5889-395D-4AA9-B721-21CE49615081}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{BDA25CA9-E49D-40D1-8A2E-5790F6DBADA4}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BDF36F4F-83B3-4121-8382-7233B76A089D}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{C1EA167F-0860-42A1-B6B0-5FB09484FA98}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D06E88F9-F131-4574-9832-3C484E78A3EC}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{DC9AC09B-DA4C-480C-A97F-518CAFD5D264}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E94C1C01-5379-46E9-913E-8C9102234AA7}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\videospin.exe |
"{EA204CC2-67BF-4745-BE36-3BBB708344F8}" = protocol=6 | dir=in | app=c:\program files\pinnacle\videospin\programs\videospin.exe |
"{F7306DF6-4B41-4621-8424-85C9AFAD5B48}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{FB35FC2C-2799-4262-9D25-33DF7BA82178}" = protocol=17 | dir=in | app=c:\program files\pinnacle\videospin\programs\umi.exe |
"TCP Query User{1C20DC42-ADD3-4480-AB0B-299C3B139B85}C:\program files\eclipse\eclipse.exe" = protocol=6 | dir=in | app=c:\program files\eclipse\eclipse.exe |
"TCP Query User{3A014371-D35E-4070-A7BF-30C38F1B93C0}D:\wos\apache2\bin\httpd.exe" = protocol=6 | dir=in | app=d:\wos\apache2\bin\httpd.exe |
"TCP Query User{4D7E7A6B-FAD4-4BC7-A54F-EF3A7D2E4020}D:\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe |
"TCP Query User{5B20681B-85BC-452F-B994-C433BD5CEA41}D:\wosportable\mysql\bin\mysqld-nt.exe" = protocol=6 | dir=in | app=d:\wosportable\mysql\bin\mysqld-nt.exe |
"TCP Query User{6C909552-5AE9-4239-92F0-44344E92F6E5}C:\program files\jalbum7.3\jalbumwin.exe" = protocol=6 | dir=in | app=c:\program files\jalbum7.3\jalbumwin.exe |
"TCP Query User{7D058A56-6435-42B6-ADEF-5FC9DFA7B84A}D:\wosportable\apache2\bin\httpd.exe" = protocol=6 | dir=in | app=d:\wosportable\apache2\bin\httpd.exe |
"TCP Query User{946D8909-EE27-4BDF-B64D-3D38CB1B78F1}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{95AF5831-98B0-4783-8548-584859CA8AE7}C:\users\yyyyy\appdata\local\temp\nero web\setupxu.exe" = protocol=6 | dir=in | app=c:\users\yyyyy\appdata\local\temp\nero web\setupxu.exe |
"TCP Query User{B245A280-22C3-4057-94E1-079290E8321D}D:\xampp\apache\bin\apache.exe" = protocol=6 | dir=in | app=d:\xampp\apache\bin\apache.exe |
"TCP Query User{C4CD0A70-D1B5-4064-98E2-1571516992C2}C:\program files\common files\ahead\nero web\setupx.exe" = protocol=6 | dir=in | app=c:\program files\common files\ahead\nero web\setupx.exe |
"TCP Query User{CA706283-E550-48E2-9A2D-18831AC00DCD}D:\wos\mysql\bin\mysqld-nt.exe" = protocol=6 | dir=in | app=d:\wos\mysql\bin\mysqld-nt.exe |
"TCP Query User{DBA94E61-519C-428C-8041-4C785727B782}C:\program files\maguma\tools\dbglistener.exe" = protocol=6 | dir=in | app=c:\program files\maguma\tools\dbglistener.exe |
"TCP Query User{E6B1A6BB-8D8B-4C0E-8B98-DF8B1B7A3FE5}C:\program files\totalcmd\totalcmd.exe" = protocol=6 | dir=in | app=c:\program files\totalcmd\totalcmd.exe |
"TCP Query User{E81EB868-7376-4F6E-A709-9FAE37ED4C48}C:\program files\phonostar\ps_olect.exe" = protocol=6 | dir=in | app=c:\program files\phonostar\ps_olect.exe |
"UDP Query User{0BB06ACB-78A8-4F61-838F-FADFA10BC496}D:\wos\mysql\bin\mysqld-nt.exe" = protocol=17 | dir=in | app=d:\wos\mysql\bin\mysqld-nt.exe |
"UDP Query User{1732B4D4-5487-4FBE-9453-01423623096D}C:\program files\common files\ahead\nero web\setupx.exe" = protocol=17 | dir=in | app=c:\program files\common files\ahead\nero web\setupx.exe |
"UDP Query User{322B4FA1-BC6A-466F-8B63-9F583F76C672}D:\wos\apache2\bin\httpd.exe" = protocol=17 | dir=in | app=d:\wos\apache2\bin\httpd.exe |
"UDP Query User{3D5C4A9B-A863-4232-AACB-49B575BC45BD}C:\program files\totalcmd\totalcmd.exe" = protocol=17 | dir=in | app=c:\program files\totalcmd\totalcmd.exe |
"UDP Query User{3D907062-B7FF-40CD-B1FE-92B6CE133B16}D:\wosportable\apache2\bin\httpd.exe" = protocol=17 | dir=in | app=d:\wosportable\apache2\bin\httpd.exe |
"UDP Query User{6A2A0F82-C89C-47A1-9CC4-DBD88BA0D7E5}C:\users\yyyyy\appdata\local\temp\nero web\setupxu.exe" = protocol=17 | dir=in | app=c:\users\yyyyy\appdata\local\temp\nero web\setupxu.exe |
"UDP Query User{6BB03D6E-22F7-4B09-ABF8-22E2DB344651}C:\program files\jalbum7.3\jalbumwin.exe" = protocol=17 | dir=in | app=c:\program files\jalbum7.3\jalbumwin.exe |
"UDP Query User{6CF8CD22-4111-454D-A646-288E70050B10}C:\program files\maguma\tools\dbglistener.exe" = protocol=17 | dir=in | app=c:\program files\maguma\tools\dbglistener.exe |
"UDP Query User{ABD12246-B40B-4234-B58C-07DC8561A6F9}D:\wosportable\mysql\bin\mysqld-nt.exe" = protocol=17 | dir=in | app=d:\wosportable\mysql\bin\mysqld-nt.exe |
"UDP Query User{C029AC9E-7E67-447B-8730-4F35A52FEA77}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{D5A9A63E-B9AC-4A90-95F4-808A27E240B2}C:\program files\phonostar\ps_olect.exe" = protocol=17 | dir=in | app=c:\program files\phonostar\ps_olect.exe |
"UDP Query User{E62EB242-B1D0-4C6E-871D-9C12CAC1F66B}C:\program files\eclipse\eclipse.exe" = protocol=17 | dir=in | app=c:\program files\eclipse\eclipse.exe |
"UDP Query User{F3DB7C15-4494-4C8A-B014-5CF605899CF4}D:\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=d:\xampp\mysql\bin\mysqld.exe |
"UDP Query User{F69060B4-CF30-4826-8E7C-647433A44721}D:\xampp\apache\bin\apache.exe" = protocol=17 | dir=in | app=d:\xampp\apache\bin\apache.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05F6DF5C-2BB1-4FA1-8537-E47F8CAB14EB}" = TAXMAN 2007 spezial
"{07100140-E9B4-4DF6-A845-CAAFD093E477}" = Microsoft Encarta 2007 - Standard
"{08C0729E-3E50-11DF-9D81-005056806466}" = Google Earth
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}" = HP USB Disk Storage Format Tool
"{0F022A2E-7022-497D-90A5-0F46746D8275}" = Macromedia Extension Manager
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID-Anmelde-Assistent
"{115C6DA4-A8B1-4DA2-B675-302576FD04FB}" = LUMIX RAW Codec 1.0
"{138DAD46-BF86-4840-8FE4-6730F469A806}" = TAXMAN 2008 spezial
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1716D952-F601-4A07-8988-7FCFAEDE6FDC}" = TAXMAN Bibliothek 2008
"{17A50383-2F75-4F6D-BAF9-8E22662E3797}" = TAXMAN 2009 spezial
"{19B822A6-372A-43E2-9230-0AFA4EC84F8C}" = Lexware buchhalter 2009
"{1B856EF3-BC27-487E-92B9-9699994F0131}" = TAXMAN 2007 spezial
"{1C63DD23-6554-4A1F-8D0D-B5A6B49D8015}" = Corel Graphics Suite 11
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2227E1FA-01F5-483C-AB0E-2A308E900B3D}" = InterVideo FilterSDK for Hauppauge
"{225C12AE-BB37-4EE3-8935-583E2F0E6644}" = Lexware reisekosten 2009
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{236BB7C4-4419-42FD-0407-2E257A25E34D}" = Adobe Photoshop CS2
"{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8
"{2FA2CDE4-ABE2-461D-A2FF-33EA4A3BBB49}" = TAXMAN 2010 spezial
"{318AB667-3230-41B5-A617-CB3BF748D371}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3A7E8601-F0C9-49A0-855A-EEDEEFE11F7E}" = Lexware buchhalter 2007
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3EAE4683-E5EE-4835-AAAF-9F2A3014E04B}" = Lexware reisekosten 2007
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{44046312-696F-4E29-82C8-3F29F81DD11F}" = Lexware Elster
"{48E341CA-D2DC-4458-8E84-FA4D72BDCF7A}" = TAXMAN 2007 spezial
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C93C363-414E-11D4-9756-00C04F8EEB39}" = Macromedia Flash 5
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56FDB311-6511-11DE-832F-0050560400B1}" = Haufe iDesk-Browser
"{57456DD2-4CDD-4245-A5E6-D865CD8E0238}" = Lexware reisekosten 2009
"{5791B7D3-8B34-4218-9750-6A8E45D0AD32}" = pdfforge Toolbar v1.1.2
"{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}" = Adobe Flash Player 9 ActiveX
"{59624372-3B85-47f4-9B04-4911E551DF1E}" = Lexware Info Service
"{5C81B189-5456-40C4-9313-7FE6FA6DD64C}" = Office-Bibliothek
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{62B7C52C-CAB6-48B1-8245-52356C141C92}" = RENESIS® Player Browser Plugins
"{62DAFF65-4204-486A-8CD8-2D80D4BDB205}" = Jalbum
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A92FDF6-3E24-4D82-A1B4-51FBDD4A0493}" = TAXMAN 2008 spezial
"{700C61BE-9424-4B20-9153-7A0C59722AF4}" = TAXMAN Bibliothek 2009
"{70788C1F-9CFB-41A8-807F-E79AE0F9C6FD}" = Lexware reisekosten 2007
"{713E5AB1-2389-43A6-8313-CB4D3C44C4FA}" = Samsung USB Driver
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75D3FF08-4838-4E47-BAE2-DF1BD866B630}" = DataLogV2.4
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-0C40-4930-9AFE-113BCE553101}" = Adobe Stock Photos 1.0
"{7E81E513-27E6-4EC2-BA25-ECF1023A070D}" = Lexware reisekosten 2007
"{81CD6232-10F5-4832-B3DA-1B88B1571031}" = Nero 7 Essentials
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AEBFD30-B94F-4A49-8106-03039708BDD4}" = Duden Korrektor Patch 012009
"{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{924EB80F-C2BB-4B9F-8412-88BBA937393F}" = MobileMe Control Panel
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95264530-5A22-8E7E-FE9D-D63A927BCAEA}" = Adobe Media Player
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A4E86B6A-6EEC-41FD-8960-26947F0E3353}" = Haufe iDesk-Service
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A8E97458-4089-48D2-9BEB-6FD62D4FBB33}" = TAXMAN Bibliothek 2007
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABA6B4BD-FB8D-4397-9B52-DC5DA85E0696}" = TAXMAN 2007 spezial
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.4 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Samsung Master
"{AF33C368-670C-4048-8EA4-4353A89C9417}" = Steuer Update 14.01
"{B26CEFDF-DD0A-4145-ADE6-EE3440DB6711}" = Lexware reisekosten 2007
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{B877EB7B-DE53-46F7-AF2A-AF5E3677B625}" = Lexware buchhalter 2007
"{BEC1F5F9-501B-43EF-834D-86CF63F64722}" = TAXMAN Bibliothek 2010
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C595649D-4C16-42D0-B606-2D1EF9D18C64}" = Duden Korrektor
"{C8616041-2802-4DE2-B3BD-6285AAD65C2A}" = Nikon RAW Codec
"{CB4B1827-6433-4C08-8E51-DB49A7C309AE}" = CyberView X - MF v1.18a
"{CBC544C4-EBFC-4471-8FE3-BF3DDCEE3840}" = Lexware buchhalter 2007
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2F5287E-5F0E-447B-9157-B08AA4E2AC76}" = Opera 9.60
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D5C8E140-6E6F-11DD-9AA9-0050560400B1}" = Haufe iDesk-Service
"{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}" = Safari
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E2500C71-5D43-4BA0-B044-9BA9A3A11CAD}" = Lexware buchhalter 2007
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{E7081891-BC7F-43F9-9CE6-B5DD2F497156}" = Internet Explorer Developer Toolbar
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{E9787678-119F-4D52-B551-6739B2B22101}" = Adobe Help Center 1.0
"{E98371BD-6C0D-463E-B004-E6303F9A34A7}" = Lexware buchhalter 2008
"{EB05C755-BE12-42CF-817D-20D8E5C33AC8}" = Phase 5 HTML-Editor
"{EB5AE940-8E5D-11DE-992A-005056B12123}" = Haufe iDesk-Service
"{EC4455AB-F155-4CC1-A4C5-88F3777F9886}" = Apple Mobile Device Support
"{EC4D5610-F99A-41C8-BA00-9801F81A46CD}" = Lexware buchhalter 2007
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4E16EDA-D4CA-48C3-94C8-4D5F0B4351C1}" = TAXMAN 2009 spezial
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime
"{FE688026-1C8C-4E50-889D-4B6607CADC24}" = Lexware buchhalter 2008
"{FEB15887-0932-4D2D-BB85-6AC03FBF1AA8}" = Pinnacle VideoSpin
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 4.60 beta
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-2E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Akamai" = Akamai NetSession Interface
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DivX Setup.divx.com" = DivX-Setup
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16
"freenetMail Dateimanager" = freenetMail Dateimanager
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"IBP9_is1" = IBP & ARELIS 9.7.1
"InstallShield_{1C63DD23-6554-4A1F-8D0D-B5A6B49D8015}" = Corel Graphics Suite 11
"IrfanView" = IrfanView (remove only)
"JAlbum_0" = JAlbum 7.3
"Jalbum_1" = Jalbum 8.0
"Lynx Web Browser_is1" = Lynx 2.8.5rel.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Media Converter SA Edition" = Media Converter SA Edition 0.8
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)
"Müller Foto" = Müller Foto
"Notepad++" = Notepad++
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"phase5" = phase5
"Picasa 3" = Picasa 3
"PSPad editor_is1" = PSPad editor
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"TheLastRipper" = TheLastRipper 1.4
"Totalcmd" = Total Commander (Remove or Repair)
"Uninstall_is1" = Uninstall 1.0.0.1
"VTPlus32 für WinTV (German)" = VTPlus32 für WinTV (German)
"Winamp" = Winamp
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinMerge_is1" = WinMerge 2.12.2
"Wubi" = Ubuntu
"xampp" = XAMPP 1.6.7
"Xvid_is1" = Xvid 1.1.2 final uninstall
"Zero Assumption Digital Image Recovery_is1" = Zero Assumption Digital Image Recovery 1.2
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-732255811-3183488341-2812780789-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

markusg 09.08.2010 18:59
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Julius35 09.08.2010 20:31
Der Combofix-Log:

Code:
ComboFix 10-08-08.03 - yyyyyy 09.08.2010  20:53:55.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3070.1150 [GMT 2:00]
ausgeführt von:: c:\users\........\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\........\AcroPro90_efg.exe.part
c:\users\yyyyyy\AppData\Roaming\AD ON Multimedia
c:\users\yyyyyy\AppData\Roaming\AD ON Multimedia\eBay Shortcuts\config.ini
F:\install.exe

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-09 bis 2010-08-09  ))))))))))))))))))))))))))))))
.

2010-08-09 19:09 . 2010-08-09 19:09        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-08-09 19:09 . 2010-08-09 19:11        --------        d-----w-        c:\users\yyyyyy\AppData\Local\temp
2010-08-09 14:31 . 2010-08-09 14:31        --------        d-----w-        c:\users\yyyyyy\AppData\Roaming\Malwarebytes
2010-08-07 11:04 . 2010-08-07 11:04        --------        d-----w-        c:\programdata\F-Secure
2010-08-06 16:03 . 2010-08-06 16:03        --------        d-----w-        c:\users\yyyyyy\AppData\Roaming\Avira
2010-08-06 15:46 . 2010-08-06 15:46        --------        d-----w-        c:\program files\Trend Micro
2010-08-06 15:44 . 2010-08-06 15:44        --------        d-----w-        c:\users\........\AppData\Roaming\Malwarebytes
2010-08-06 14:13 . 2010-08-06 14:13        --------        d-----w-        c:\programdata\regid.1986-12.com.adobe
2010-08-06 11:50 . 2010-08-06 11:50        --------        d-----w-        c:\users\........\Neuer Ordner
2010-08-02 07:02 . 2010-07-23 15:22        43008        ----a-w-        c:\users\........\AppData\Roaming\Mozilla\Firefox\Profiles\xoobc2n6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-08-02 07:02 . 2010-07-23 15:22        1496064        ----a-w-        c:\users\........\AppData\Roaming\Mozilla\Firefox\Profiles\xoobc2n6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-08-02 07:02 . 2010-07-23 15:22        338944        ----a-w-        c:\users\........\AppData\Roaming\Mozilla\Firefox\Profiles\xoobc2n6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-08-02 07:02 . 2010-07-23 15:22        346112        ----a-w-        c:\users\........\AppData\Roaming\Mozilla\Firefox\Profiles\xoobc2n6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-09 19:09 . 2010-02-16 16:26        --------        d-----w-        c:\program files\Common Files\Akamai
2010-08-09 16:29 . 2010-04-26 06:35        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-09 12:09 . 2010-03-14 07:19        52917        ----a-w-        c:\programdata\nvModes.dat
2010-08-09 11:51 . 2007-09-28 12:04        --------        d-----w-        c:\program files\Java
2010-08-09 07:12 . 2010-05-07 09:14        --------        d-----w-        c:\program files\CCleaner
2010-08-07 11:19 . 2006-11-02 15:33        633360        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-07 11:19 . 2006-11-02 15:33        127170        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-06 16:02 . 2007-09-14 17:25        159296        ----a-w-        c:\users\yyyyyy\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-06 15:54 . 2010-06-24 10:26        --------        d-----w-        c:\program files\pdfforge Toolbar
2010-08-06 14:20 . 2007-09-16 08:56        159296        ----a-w-        c:\users\........\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-06 13:53 . 2007-05-30 12:13        --------        d-----w-        c:\program files\Common Files\Adobe
2010-08-03 16:20 . 2007-12-27 08:57        --------        d-----w-        c:\users\........\AppData\Roaming\LPC
2010-08-02 10:38 . 2008-12-22 11:53        1        ----a-w-        c:\users\........\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-02 07:16 . 2008-12-22 11:45        --------        d-----w-        c:\program files\OpenOffice.org 3
2010-07-17 03:00 . 2010-05-21 06:35        423656        ----a-w-        c:\windows\system32\deployJava1.dll
2010-07-01 14:48 . 2007-12-21 14:00        --------        d-----w-        c:\program files\Opera
2010-06-24 10:53 . 2010-01-21 08:20        --------        d-----w-        c:\program files\PDFCreator
2010-06-24 10:26 . 2010-06-24 10:26        --------        d-----w-        c:\program files\Application Updater
2010-06-16 09:12 . 2010-06-16 09:10        --------        d-----w-        c:\program files\ElsterFormular
2010-06-16 09:11 . 2010-06-16 09:11        --------        d-----w-        c:\programdata\elsterformular
2010-06-15 18:25 . 2010-06-15 18:25        1079048        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-06-11 16:04 . 2010-06-11 16:04        49152        ----a-r-        c:\users\yyyyyy\AppData\Roaming\Microsoft\Installer\{8AEBFD30-B94F-4A49-8106-03039708BDD4}\ARPPRODUCTICON.exe
2010-06-11 16:03 . 2010-06-11 16:03        --------        d-----w-        c:\users\yyyyyy\AppData\Roaming\Duden
2010-06-11 14:44 . 2010-06-11 14:44        --------        d-----w-        c:\users\........\AppData\Roaming\Duden
2010-06-11 14:43 . 2010-06-11 14:43        --------        d-----w-        c:\program files\Duden
2010-06-11 14:42 . 2010-06-11 14:42        --------        d-----w-        c:\programdata\BIFAB
2010-06-11 14:42 . 2010-06-11 14:40        --------        d-----w-        c:\program files\Office-Bibliothek
2010-06-07 13:56 . 2009-05-08 17:07        1        ----a-w-        c:\users\yyyyyy\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-03 02:41 . 2010-06-03 02:41        3600384        ----a-w-        c:\windows\system32\GPhotos.scr
2010-05-30 16:37 . 2009-10-05 09:45        1432240        ----a-w-        c:\programdata\hps\3018\setup_Mueller_Fotowelt.exe
2010-05-26 17:06 . 2010-06-09 16:26        34304        ----a-w-        c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-09 16:26        289792        ----a-w-        c:\windows\system32\atmfd.dll
2010-05-23 15:50 . 2010-06-02 13:53        73216        ----a-w-        c:\users\........\AppData\Roaming\Mozilla\Firefox\Profiles\xoobc2n6.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
2010-05-21 12:14 . 2009-10-03 08:33        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-21 09:22 . 2010-05-21 09:22        7168        ----a-w-        c:\programdata\Lexware\Taxman spezial\2010\versionSteuerHtml.dll
2010-05-21 09:22 . 2010-05-21 09:22        7168        ----a-w-        c:\programdata\Lexware\Taxman spezial\2010\versionTaxAppData.dll
2010-05-21 09:22 . 2010-05-21 09:22        7168        ----a-w-        c:\programdata\Lexware\Taxman spezial\2010\Daten\versionTaxDB.dll
2010-05-21 08:37 . 2010-05-21 08:37        716800        ----a-w-        c:\windows\system32\lxter20VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        69632        ----a-w-        c:\windows\system32\PXTTool80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        557056        ----a-w-        c:\windows\system32\zvkonline80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        4661248        ----a-w-        c:\windows\system32\LxXtreme70VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        27648        ----a-w-        c:\windows\system32\LXTPSW20VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        1347584        ----a-w-        c:\windows\system32\LXTool80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        110592        ----a-w-        c:\windows\system32\LxUISettings20Native.dll
2010-05-21 08:37 . 2010-05-21 08:37        323584        ----a-w-        c:\windows\system32\LxImport80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        299008        ----a-w-        c:\windows\system32\LXBtr80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        225280        ----a-w-        c:\windows\system32\LxBasics80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        192512        ----a-w-        c:\windows\system32\LXDasi80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        135168        ----a-w-        c:\windows\system32\LxMail30VC8.dll
2010-05-16 14:28 . 2008-08-06 11:09        20        ---h--w-        c:\programdata\PKP_DLdw.DAT
2010-05-16 13:24 . 2010-05-16 13:24        49152        ----a-r-        c:\users\yyyyyy\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2010-05-16 13:23 . 2010-05-16 13:23        335872        ----a-r-        c:\users\yyyyyy\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-05-16 13:22 . 2008-08-06 11:11        57344        ----a-r-        c:\users\yyyyyy\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2010-05-16 13:18 . 2010-05-16 13:18        20        ---h--w-        c:\programdata\PKP_DLdu.DAT
2010-05-16 13:17 . 2003-03-18 19:05        106496        ----a-w-        c:\windows\system32\ATL71.DLL
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01FotoBank]
@="{489d8d66-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d66-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02FotoBank]
@="{489d8d67-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d67-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03FotoBank]
@="{489d8d68-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d68-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04FotoBank]
@="{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\05FotoBank]
@="{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\06FotoBank]
@="{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\07FotoBank]
@="{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\08FotoBank]
@="{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-25 68856]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-08-09 221184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 4423680]
"HybridTM_A"="c:\program files\HybridTM_IR(A)\RC620_A.exe" [2006-05-30 118784]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"freenetMail Dateimanager Taskleistensymbol"="c:\program files\freenetMail Dateimanager\DBDDsktDrvTrayApp.exe" [2005-08-16 142336]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"Skytel"="Skytel.exe" [2007-03-16 1822720]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-12-16 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

c:\users\yyyyyy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-11 110592]

c:\users\........\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Gigabank.lnk - c:\program files\FAST Gigabank\Gigabank.exe [2008-6-4 1666648]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-11 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):fc,c5,54,84,b9,ed,ca,01

R3 ECS_Loader_220;Digital TV Receiver Firmware Loader 5.10.31.0;c:\windows\system32\Drivers\ECS_Loader_220.sys [2005-10-31 15616]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-07 380928]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-18 21504]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2007-06-04 467456]
S3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-06-04 15488]


--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - hide3tp9

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
bthsvcs        REG_MULTI_SZ          BthServ
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners

2010-05-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-25 18:39]

2010-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 14:45]

2010-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 14:45]

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-732255811-3183488341-2812780789-1001Core.job
- c:\users\........\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 15:50]

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-732255811-3183488341-2812780789-1001UA.job
- c:\users\........\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 15:50]

2010-08-09 c:\windows\Tasks\User_Feed_Synchronization-{31D36847-25B7-4967-9ACD-59A7E1914681}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]

2010-08-09 c:\windows\Tasks\User_Feed_Synchronization-{C23C680E-AFD6-499B-8D62-7D4BDAABD7B3}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube Download - c:\users\yyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\yyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\yyyyyy\AppData\Roaming\Mozilla\Firefox\Profiles\puxr1l9h.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13
FF - component: c:\program files\pdfforge Toolbar\FF\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\pdfforge Toolbar\SSFF\components\SearchSettingsFF.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1698.5652\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Toolbar-{B922D405-6D13-4A2B-AE89-08A030DA4402} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-08-09 21:10
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2010-08-09  21:15:57
ComboFix-quarantined-files.txt  2010-08-09 19:15

Vor Suchlauf: 20 Verzeichnis(se), 75.210.657.792 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 83.167.748.096 Bytes frei

- - End Of File - - 68D16AB2808DE8667789350AE3F064F6

markusg 09.08.2010 20:41
avira

avira 10 so instalieren bzw. dann konfigurieren. wenn du die konfiguration übernommen hast, update das programm.
klicke dann auf "lokaler schutz" "lokale laufwerke" eventuelle funde in quarantäne, log posten.

Julius35 10.08.2010 13:16
Hm, soweit ich sehe, sind die Funde alle zip-dateien:

Code:

Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Dienstag, 10. August 2010  06:45

Es wird nach 2690356 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - FREE Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows Vista
Windowsversion : (Service Pack 2)  [6.0.6002]
Boot Modus    : Normal gebootet
Benutzername  : yyyyy
Computername  : XXXXXX

Versionsinformationen:
BUILD.DAT      : 10.0.0.567    32097 Bytes  19.04.2010 15:50:00
AVSCAN.EXE    : 10.0.3.0      433832 Bytes  29.04.2010 09:04:25
AVSCAN.DLL    : 10.0.3.0      56168 Bytes  29.04.2010 09:04:25
LUKE.DLL      : 10.0.2.3      104296 Bytes  07.03.2010 17:33:04
LUKERES.DLL    : 10.0.0.0      13672 Bytes  14.01.2010 09:59:47
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 06:35:52
VBASE001.VDF  : 7.10.1.0    1372672 Bytes  19.11.2009 12:43:47
VBASE002.VDF  : 7.10.3.1    3143680 Bytes  20.01.2010 12:44:00
VBASE003.VDF  : 7.10.3.75    996864 Bytes  26.01.2010 12:44:04
VBASE004.VDF  : 7.10.4.203  1579008 Bytes  05.03.2010 12:44:11
VBASE005.VDF  : 7.10.6.82    2494464 Bytes  15.04.2010 09:04:25
VBASE006.VDF  : 7.10.7.218  2294784 Bytes  02.06.2010 13:21:18
VBASE007.VDF  : 7.10.9.165  4840960 Bytes  23.07.2010 17:31:37
VBASE008.VDF  : 7.10.9.166      2048 Bytes  23.07.2010 17:31:37
VBASE009.VDF  : 7.10.9.167      2048 Bytes  23.07.2010 17:31:37
VBASE010.VDF  : 7.10.9.168      2048 Bytes  23.07.2010 17:31:37
VBASE011.VDF  : 7.10.9.169      2048 Bytes  23.07.2010 17:31:37
VBASE012.VDF  : 7.10.9.170      2048 Bytes  23.07.2010 17:31:37
VBASE013.VDF  : 7.10.9.198    157696 Bytes  26.07.2010 17:31:38
VBASE014.VDF  : 7.10.9.255    997888 Bytes  29.07.2010 07:18:29
VBASE015.VDF  : 7.10.10.28    139264 Bytes  02.08.2010 15:03:06
VBASE016.VDF  : 7.10.10.52    127488 Bytes  03.08.2010 15:03:06
VBASE017.VDF  : 7.10.10.84    137728 Bytes  06.08.2010 15:26:52
VBASE018.VDF  : 7.10.10.85      1536 Bytes  06.08.2010 15:26:52
VBASE019.VDF  : 7.10.10.86      1536 Bytes  06.08.2010 15:26:52
VBASE020.VDF  : 7.10.10.87      1536 Bytes  06.08.2010 15:26:52
VBASE021.VDF  : 7.10.10.88      1536 Bytes  06.08.2010 15:26:52
VBASE022.VDF  : 7.10.10.89      1536 Bytes  06.08.2010 15:26:53
VBASE023.VDF  : 7.10.10.90      1536 Bytes  06.08.2010 15:26:53
VBASE024.VDF  : 7.10.10.91      1536 Bytes  06.08.2010 15:26:53
VBASE025.VDF  : 7.10.10.92      1536 Bytes  06.08.2010 15:26:53
VBASE026.VDF  : 7.10.10.93      1536 Bytes  06.08.2010 15:26:53
VBASE027.VDF  : 7.10.10.94      1536 Bytes  06.08.2010 15:26:53
VBASE028.VDF  : 7.10.10.95      1536 Bytes  06.08.2010 15:26:53
VBASE029.VDF  : 7.10.10.96      1536 Bytes  06.08.2010 15:26:53
VBASE030.VDF  : 7.10.10.97      1536 Bytes  06.08.2010 15:26:53
VBASE031.VDF  : 7.10.10.105  119296 Bytes  08.08.2010 06:48:29
Engineversion  : 8.2.4.34 
AEVDF.DLL      : 8.1.2.1      106868 Bytes  02.08.2010 07:18:40
AESCRIPT.DLL  : 8.1.3.42    1364347 Bytes  02.08.2010 07:18:40
AESCN.DLL      : 8.1.6.1      127347 Bytes  16.05.2010 10:33:42
AESBX.DLL      : 8.1.3.1      254324 Bytes  29.04.2010 09:04:25
AERDL.DLL      : 8.1.8.2      614772 Bytes  23.07.2010 04:48:04
AEPACK.DLL    : 8.2.3.5      471412 Bytes  07.08.2010 09:01:00
AEOFFICE.DLL  : 8.1.1.8      201081 Bytes  23.07.2010 04:48:01
AEHEUR.DLL    : 8.1.2.11    2834805 Bytes  07.08.2010 09:00:59
AEHELP.DLL    : 8.1.13.2      242039 Bytes  23.07.2010 04:47:51
AEGEN.DLL      : 8.1.3.19      393587 Bytes  07.08.2010 09:00:54
AEEMU.DLL      : 8.1.2.0      393588 Bytes  29.04.2010 09:04:25
AECORE.DLL    : 8.1.16.2      192887 Bytes  23.07.2010 04:47:49
AEBB.DLL      : 8.1.1.0        53618 Bytes  29.04.2010 09:04:25
AVWINLL.DLL    : 10.0.0.0      19304 Bytes  14.01.2010 09:59:10
AVPREF.DLL    : 10.0.0.0      44904 Bytes  14.01.2010 09:59:07
AVREP.DLL      : 10.0.0.8      62209 Bytes  18.02.2010 15:47:40
AVREG.DLL      : 10.0.3.0      53096 Bytes  29.04.2010 09:04:25
AVSCPLR.DLL    : 10.0.3.0      83816 Bytes  29.04.2010 09:04:25
AVARKT.DLL    : 10.0.0.14    227176 Bytes  29.04.2010 09:04:25
AVEVTLOG.DLL  : 10.0.0.8      203112 Bytes  26.01.2010 07:53:25
SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 11:57:58
AVSMTP.DLL    : 10.0.0.17      63848 Bytes  16.03.2010 14:38:56
NETNT.DLL      : 10.0.0.0      11624 Bytes  19.02.2010 13:41:00
RCIMAGE.DLL    : 10.0.0.26    2550120 Bytes  28.01.2010 11:10:08
RCTEXT.DLL    : 10.0.53.0      98152 Bytes  29.04.2010 09:04:25

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldrives.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, F:, G:, H:, I:, J:, K:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 10
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: hoch
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Dienstag, 10. August 2010  06:45

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WinMail.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'thunderbird.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mobsync.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Gigabank.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'NkMonitor.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcWnd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TestHandler.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MDM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleUpdaterService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'pptd40nt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DBDDsktDrvTrayApp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmdc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RC620_A.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSASCui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Die Systemdateien wurden durchsucht ('21' Dateien)

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
Masterbootsektor HD1
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'D:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'F:\'
    [INFO]      Es wurde kein Virus gefunden!
Bootsektor 'G:\'
    [INFO]      Im  Laufwerk 'G:\' ist kein Datenträger eingelegt!
Bootsektor 'H:\'
    [INFO]      Im  Laufwerk 'H:\' ist kein Datenträger eingelegt!
Bootsektor 'I:\'
    [INFO]      Im  Laufwerk 'I:\' ist kein Datenträger eingelegt!
Bootsektor 'J:\'
    [INFO]      Im  Laufwerk 'J:\' ist kein Datenträger eingelegt!
Bootsektor 'K:\'
    [INFO]      Im  Laufwerk 'K:\' ist kein Datenträger eingelegt!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1822' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <SYSTEM>
Beginne mit der Suche in 'D:\' <DATA>
Beginne mit der Suche in 'F:\' <second>
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-05-09 102002\Backup files 203.zip
[0] Archivtyp: ZIP
  [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen
  --> C/Users/......./Downloads/1.zip
    [1] Archivtyp: ZIP
--> 1/codec.txt
  [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-05-09 102002\Backup files 209.zip
[0] Archivtyp: ZIP
--> D/install/flash/ADBEFLPRCS4_LS4.7z.dlm
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
    [WARNUNG]  Die Datei konnte nicht gelesen werden!
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-05-09 102002\Backup files 259.zip
[0] Archivtyp: ZIP
--> C/Users/......./Documents/ADBEFLPRCS4_LS4.7z
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
    [WARNUNG]  Die Datei konnte nicht gelesen werden!
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-08-31 100002\Backup files 2.zip
[0] Archivtyp: ZIP
  [FUND]      Ist das Trojanische Pferd TR/Drop.Agent.var
  --> C/Users/......./AppData/Local/Microsoft/Windows Mail/Local Folders (1)/Inbox/58EE31DF-0000125F.eml
    [1] Archivtyp: MIME
    --> D0e283045.zip
      [2] Archivtyp: ZIP
--> D0e283045.exe
  [FUND]      Ist das Trojanische Pferd TR/Drop.Agent.var
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-09-12 170852\Backup files 1.zip
[0] Archivtyp: ZIP
  [FUND]      Ist das Trojanische Pferd TR/Dldr.Agent.tpi.7
  --> C/Users/......./AppData/Local/Microsoft/Windows Mail/Local Folders (1)/Inbox/74786C77-0000129F.eml
    [1] Archivtyp: MIME
    --> Mdca072ce.zip
      [2] Archivtyp: ZIP
--> Mdca072ce.exe
  [FUND]      Ist das Trojanische Pferd TR/Dldr.Agent.tpi.7
    [WARNUNG]  Bei dieser Datei handelt es sich um eine Mailbox. Um Ihre Emails nicht zu beeinträchtigen wird diese Datei nicht repariert oder gelöscht.
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-11-02 100007\Backup files 2.zip
[0] Archivtyp: ZIP
  [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Bredolab.aue.41
  --> C/Users/......./AppData/Local/Microsoft/Windows Mail/Local Folders (1)/Inbox/4DFC79EA-00001591.eml
    [1] Archivtyp: MIME
    --> DHL_print_label_72dc0.zip
      [2] Archivtyp: ZIP
--> DHL_print_label_72dc0.exe
  [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Bredolab.aue.41
    [WARNUNG]  Bei dieser Datei handelt es sich um eine Mailbox. Um Ihre Emails nicht zu beeinträchtigen wird diese Datei nicht repariert oder gelöscht.
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-11-16 100008\Backup files 5.zip
[0] Archivtyp: ZIP
  [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen
  --> C/Users/......./Downloads/1.zip
    [1] Archivtyp: ZIP
--> 1/codec.txt
  [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2010-03-29 100008\Backup files 22.zip
[0] Archivtyp: ZIP
--> C/Users/......./Documents/ADBEFLPRCS4_LS4.7z
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
    [WARNUNG]  Die Datei konnte nicht gelesen werden!
F:\XXXXXX\Backup Set 2010-05-05 141022\Backup Files 2010-05-16 124358\Backup files 10.zip
[0] Archivtyp: ZIP
--> D/install/flash/ADBEFLPRCS4_LS4.7z.dlm
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
    [WARNUNG]  Die Datei konnte nicht gelesen werden!
F:\XXXXXX\Backup Set 2010-05-05 141022\Backup Files 2010-05-16 124358\Backup files 66.zip
[0] Archivtyp: ZIP
--> C/Users/......./Documents/ADBEFLPRCS4_LS4.7z
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
    [WARNUNG]  Die Datei konnte nicht gelesen werden!
F:\XXXXXX\Backup Set 2010-05-05 141022\Backup Files 2010-08-09 100506\Backup files 4.zip
[0] Archivtyp: ZIP
--> D/install/adobe/Photoshop_12_LS4.7z
  [WARNUNG]  Die Datei konnte nicht gelesen werden!
    [WARNUNG]  Die Datei konnte nicht gelesen werden!
Beginne mit der Suche in 'G:\'
Der zu durchsuchende Pfad G:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'H:\'
Der zu durchsuchende Pfad H:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'I:\'
Der zu durchsuchende Pfad I:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'J:\'
Der zu durchsuchende Pfad J:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'K:\'
Der zu durchsuchende Pfad K:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'E:\' <Kregeline>

Beginne mit der Desinfektion:
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-11-16 100008\Backup files 5.zip
    [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen
    [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4822e561.qua' verschoben!
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-11-02 100007\Backup files 2.zip
    [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Bredolab.aue.41
    [WARNUNG]  Die Datei wurde ignoriert.
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-09-12 170852\Backup files 1.zip
    [FUND]      Ist das Trojanische Pferd TR/Dldr.Agent.tpi.7
    [WARNUNG]  Die Datei wurde ignoriert.
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-08-31 100002\Backup files 2.zip
    [FUND]      Ist das Trojanische Pferd TR/Drop.Agent.var
    [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50b5cac1.qua' verschoben!
F:\XXXXXX\Backup Set 2009-05-09 102002\Backup Files 2009-05-09 102002\Backup files 203.zip
    [FUND]      Ist das Trojanische Pferd TR/Dropper.Gen
    [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '02ea902b.qua' verschoben!


Ende des Suchlaufs: Dienstag, 10. August 2010  14:09
Benötigte Zeit:  7:23:18 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

 121302 Verzeichnisse wurden überprüft
 4919144 Dateien wurden geprüft
      5 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      3 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 4919139 Dateien ohne Befall
  99718 Archive wurden durchsucht
    14 Warnungen
      3 Hinweise
 134185 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

markusg 10.08.2010 14:01
sieht gut aus, noch irgendwelche probleme?

Julius35 10.08.2010 14:36
Also diesmal hat er deutlich länger gebraucht. Ich dachte, der Trojaner ist beseitigt. Aber so nach einer Viertelstunde kam wieder die alte Meldung:


In der Datei 'C:\Windows\System32\png777fh.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Spy.585728.35' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

Ich habe schon überlegt, ob es ein Fehlalarm ist. Aber dann würde sich das Ding ja nicht nach jedem Hochfahren wieder installieren.

Grüße
Julius

markusg 10.08.2010 16:06
start programme zubehör, editor, kopiere rein:
Killall::
File::
C:\Windows\System32\png777fh.dll

datei speichern unter, dateityp alle dateien, name cfscript.txt
speicherort, dort wo sich combofix.exe befindet, ziehe cfscript auf combofix, programm startet, log posten.

Julius35 11.08.2010 09:06
Also das habe ich alles gemacht. Dann hat Combofix den Rechner heruntergefahren. Beim Neustart habe ich mich als User angemeldet. Da kamen dann viele Aufforderungen nach Administratorrechten. Nach der 20. Aufforderung habe ich abgelehnt und dann hat combofix die Sache abgebrochen. Die Trojaner-Meldung ist in alter Schönheit da.

Soll ich nochmal das gleiche machen und mich dann als Admin anmelden?

Grüße
Julius

Julius35 12.08.2010 09:02
okay, habs nochmal als Admin nach dem Neustart gemacht. Hat soweit alles geklappt. Aber Antivir meldet immer noch den Trojaner.

Code:
ComboFix 10-08-11.04 - yyyyyyy 12.08.2010  9:28.3.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3070.1981 [GMT 2:00]
ausgeführt von:: c:\users\........\Downloads\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\........\Downloads\cfscript.txt
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\System32\png777fh.dll"
.

(((((((((((((((((((((((  Dateien erstellt von 2010-07-12 bis 2010-08-12  ))))))))))))))))))))))))))))))
.

2010-08-12 07:35 . 2010-08-12 07:37        --------        d-----w-        c:\users\yyyyyyy\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\TEMP\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\TEMP.diavolo\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\TEMP.diavolo.001\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\TEMP.diavolo.000\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\........\AppData\Local\temp
2010-08-12 07:35 . 2010-08-12 07:35        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-08-11 11:34 . 2010-08-11 11:34        --------        d-----w-        c:\users\........\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2010-08-11 08:59 . 2010-08-11 08:59        --------        d-----w-        c:\users\........\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2010-08-11 08:59 . 2010-08-11 08:59        --------        d-----w-        c:\users\........\AppData\Roaming\Adobe Mini Bridge CS5
2010-08-09 14:31 . 2010-08-09 14:31        --------        d-----w-        c:\users\yyyyyyy\AppData\Roaming\Malwarebytes
2010-08-07 11:04 . 2010-08-07 11:04        --------        d-----w-        c:\programdata\F-Secure
2010-08-06 16:03 . 2010-08-06 16:03        --------        d-----w-        c:\users\yyyyyyy\AppData\Roaming\Avira
2010-08-06 15:46 . 2010-08-06 15:46        --------        d-----w-        c:\program files\Trend Micro
2010-08-06 15:44 . 2010-08-06 15:44        --------        d-----w-        c:\users\........\AppData\Roaming\Malwarebytes
2010-08-06 14:13 . 2010-08-06 14:13        --------        d-----w-        c:\programdata\regid.1986-12.com.adobe
2010-08-06 11:50 . 2010-08-06 11:50        --------        d-----w-        c:\users\........\Neuer Ordner

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-12 07:38 . 2010-03-14 07:19        52789        ----a-w-        c:\programdata\nvModes.dat
2010-08-12 07:36 . 2010-02-16 16:26        --------        d-----w-        c:\program files\Common Files\Akamai
2010-08-11 13:08 . 2006-11-02 15:33        633360        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-11 13:08 . 2006-11-02 15:33        127170        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-11 11:35 . 2009-11-04 12:51        --------        d-----w-        c:\program files\Common Files\Adobe AIR
2010-08-09 16:29 . 2010-04-26 06:35        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-09 11:51 . 2007-09-28 12:04        --------        d-----w-        c:\program files\Java
2010-08-09 07:12 . 2010-05-07 09:14        --------        d-----w-        c:\program files\CCleaner
2010-08-06 16:02 . 2007-09-14 17:25        159296        ----a-w-        c:\users\yyyyyyy\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-06 15:54 . 2010-06-24 10:26        --------        d-----w-        c:\program files\pdfforge Toolbar
2010-08-06 14:20 . 2007-09-16 08:56        159296        ----a-w-        c:\users\........\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-06 13:53 . 2007-05-30 12:13        --------        d-----w-        c:\program files\Common Files\Adobe
2010-08-03 16:20 . 2007-12-27 08:57        --------        d-----w-        c:\users\........\AppData\Roaming\LPC
2010-08-02 07:16 . 2008-12-22 11:45        --------        d-----w-        c:\program files\OpenOffice.org 3
2010-07-17 03:00 . 2010-05-21 06:35        423656        ----a-w-        c:\windows\system32\deployJava1.dll
2010-07-01 14:48 . 2007-12-21 14:00        --------        d-----w-        c:\program files\Opera
2010-06-24 10:53 . 2010-01-21 08:20        --------        d-----w-        c:\program files\PDFCreator
2010-06-24 10:26 . 2010-06-24 10:26        --------        d-----w-        c:\program files\Application Updater
2010-06-16 09:12 . 2010-06-16 09:10        --------        d-----w-        c:\program files\ElsterFormular
2010-06-16 09:11 . 2010-06-16 09:11        --------        d-----w-        c:\programdata\elsterformular
2010-06-03 02:41 . 2010-06-03 02:41        3600384        ----a-w-        c:\windows\system32\GPhotos.scr
2010-05-26 17:06 . 2010-06-09 16:26        34304        ----a-w-        c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-09 16:26        289792        ----a-w-        c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2009-10-03 08:33        221568        ------w-        c:\windows\system32\MpSigStub.exe
2010-05-21 08:37 . 2010-05-21 08:37        716800        ----a-w-        c:\windows\system32\lxter20VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        69632        ----a-w-        c:\windows\system32\PXTTool80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        557056        ----a-w-        c:\windows\system32\zvkonline80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        4661248        ----a-w-        c:\windows\system32\LxXtreme70VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        27648        ----a-w-        c:\windows\system32\LXTPSW20VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        1347584        ----a-w-        c:\windows\system32\LXTool80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        110592        ----a-w-        c:\windows\system32\LxUISettings20Native.dll
2010-05-21 08:37 . 2010-05-21 08:37        323584        ----a-w-        c:\windows\system32\LxImport80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        299008        ----a-w-        c:\windows\system32\LXBtr80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        225280        ----a-w-        c:\windows\system32\LxBasics80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        192512        ----a-w-        c:\windows\system32\LXDasi80VC8.dll
2010-05-21 08:37 . 2010-05-21 08:37        135168        ----a-w-        c:\windows\system32\LxMail30VC8.dll
2010-05-16 14:28 . 2008-08-06 11:09        20        ---h--w-        c:\programdata\PKP_DLdw.DAT
2010-05-16 13:18 . 2010-05-16 13:18        20        ---h--w-        c:\programdata\PKP_DLdu.DAT
2010-05-16 13:17 . 2003-03-18 19:05        106496        ----a-w-        c:\windows\system32\ATL71.DLL
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01FotoBank]
@="{489d8d66-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d66-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02FotoBank]
@="{489d8d67-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d67-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03FotoBank]
@="{489d8d68-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d68-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04FotoBank]
@="{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\05FotoBank]
@="{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\06FotoBank]
@="{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\07FotoBank]
@="{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\08FotoBank]
@="{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}"
[HKEY_CLASSES_ROOT\CLSID\{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}]
2008-06-04 20:40        1461848        ----a-w-        c:\program files\FAST Gigabank\FotoBanker.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-25 68856]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-08-09 221184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 4423680]
"HybridTM_A"="c:\program files\HybridTM_IR(A)\RC620_A.exe" [2006-05-30 118784]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"freenetMail Dateimanager Taskleistensymbol"="c:\program files\freenetMail Dateimanager\DBDDsktDrvTrayApp.exe" [2005-08-16 142336]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"Skytel"="Skytel.exe" [2007-03-16 1822720]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-12-16 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

c:\users\yyyyyyy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-11 110592]

c:\users\........\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Gigabank.lnk - c:\program files\FAST Gigabank\Gigabank.exe [2008-6-4 1666648]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-11 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):fc,c5,54,84,b9,ed,ca,01

R3 ECS_Loader_220;Digital TV Receiver Firmware Loader 5.10.31.0;c:\windows\system32\Drivers\ECS_Loader_220.sys [2005-10-31 15616]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-07 380928]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-18 21504]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2007-06-04 467456]
S3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-06-04 15488]


--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - hide3tp9

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
bthsvcs        REG_MULTI_SZ          BthServ
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners

2010-05-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-25 18:39]

2010-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 14:45]

2010-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 14:45]

2010-08-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-732255811-3183488341-2812780789-1001Core.job
- c:\users\........\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 15:50]

2010-08-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-732255811-3183488341-2812780789-1001UA.job
- c:\users\........\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 15:50]

2010-08-11 c:\windows\Tasks\User_Feed_Synchronization-{31D36847-25B7-4967-9ACD-59A7E1914681}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{C23C680E-AFD6-499B-8D62-7D4BDAABD7B3}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube Download - c:\users\yyyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\yyyyyyy\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type",                  5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size",  4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-08-12 09:38
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(256)
c:\program files\FAST Gigabank\FotoBanker.dll
c:\program files\FAST Gigabank\Ltkrn15u.dll
c:\program files\FAST Gigabank\Ltfil15u.dll
c:\program files\FAST Gigabank\Ltdis15u.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-12  09:49:06 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-08-12 07:49
ComboFix2.txt  2010-08-09 19:16

Vor Suchlauf: 23 Verzeichnis(se), 80.245.137.408 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 80.119.603.200 Bytes frei

- - End Of File - - DAED5C72EEB19975ABF8B2C4E1A611B7

Julius35 12.08.2010 09:43
Ansonsten habe ich mal die png777fh.dll mit Malwarebytes gescannt, bevor Antivir sie entdeckt und beseitigt hat. Das Ergebnis:


Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

12.08.2010 10:22:15
mbam-log-2010-08-12 (10-22-15).txt

Scan type: Quick scan
Objects scanned: 1
Time elapsed: 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

markusg 12.08.2010 10:07
kannst du die dll mal bei
VirusTotal - Free Online Virus, Malware and URL Scanner
prüfen und das ergebniss posten?


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:57 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19