Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Infiziert mit TR/Crypt.Xpack.Gen! Was nun tun? (https://www.trojaner-board.de/94705-infiziert-tr-crypt-xpack-gen-tun.html)

2Dope2Cope 13.01.2011 12:50
Infiziert mit TR/Crypt.Xpack.Gen! Was nun tun?
 
Tach Post!

Mein laptop is infiziert mit nem Trojaner! Und Antivir kriegt dat ding ma wieder nich weg! Kann mir jemand helfen?

Hier die Antivir logfile, malwarebytes lass ich grad noch drüberlaufen, poste dann auch die file:



Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Donnerstag, 13. Januar 2011 12:05

Es wird nach 2362511 Virenstämmen gesucht.

Lizenznehmer : Avira AntiVir Personal - FREE Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows XP
Windowsversion : (Service Pack 2) [5.1.2600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : SCHLEPPTOP

Versionsinformationen:
BUILD.DAT : 9.0.0.429 21701 Bytes 2010/10/06 09:59:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 2009/12/15 12:08:26
AVSCAN.DLL : 9.0.3.0 49409 Bytes 2009/02/13 10:04:10
LUKE.DLL : 9.0.3.2 209665 Bytes 2009/02/20 09:35:44
LUKERES.DLL : 9.0.2.0 13569 Bytes 2009/01/26 08:41:59
VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009/11/06 12:08:23
VBASE001.VDF : 7.11.0.0 13342208 Bytes 2010/12/14 20:16:44
VBASE002.VDF : 7.11.0.1 2048 Bytes 2010/12/14 20:16:44
VBASE003.VDF : 7.11.0.2 2048 Bytes 2010/12/14 20:16:44
VBASE004.VDF : 7.11.0.3 2048 Bytes 2010/12/14 20:16:44
VBASE005.VDF : 7.11.0.4 2048 Bytes 2010/12/14 20:16:44
VBASE006.VDF : 7.11.0.5 2048 Bytes 2010/12/14 20:16:44
VBASE007.VDF : 7.11.0.6 2048 Bytes 2010/12/14 20:16:44
VBASE008.VDF : 7.11.0.7 2048 Bytes 2010/12/14 20:16:44
VBASE009.VDF : 7.11.0.8 2048 Bytes 2010/12/14 20:16:44
VBASE010.VDF : 7.11.0.9 2048 Bytes 2010/12/14 20:16:44
VBASE011.VDF : 7.11.0.10 2048 Bytes 2010/12/14 20:16:44
VBASE012.VDF : 7.11.0.11 2048 Bytes 2010/12/14 20:16:44
VBASE013.VDF : 7.11.0.52 128000 Bytes 2010/12/16 20:16:45
VBASE014.VDF : 7.11.0.91 226816 Bytes 2010/12/20 20:16:46
VBASE015.VDF : 7.11.0.122 136192 Bytes 2010/12/21 20:16:46
VBASE016.VDF : 7.11.0.156 122880 Bytes 2010/12/24 20:16:47
VBASE017.VDF : 7.11.0.185 146944 Bytes 2010/12/27 20:16:48
VBASE018.VDF : 7.11.0.228 132608 Bytes 2010/12/30 20:16:48
VBASE019.VDF : 7.11.1.5 148480 Bytes 2011/01/03 20:16:49
VBASE020.VDF : 7.11.1.37 156672 Bytes 2011/01/07 20:16:50
VBASE021.VDF : 7.11.1.65 140800 Bytes 2011/01/10 20:16:50
VBASE022.VDF : 7.11.1.87 225280 Bytes 2011/01/11 20:16:51
VBASE023.VDF : 7.11.1.88 2048 Bytes 2011/01/11 20:16:51
VBASE024.VDF : 7.11.1.89 2048 Bytes 2011/01/11 20:16:51
VBASE025.VDF : 7.11.1.90 2048 Bytes 2011/01/11 20:16:51
VBASE026.VDF : 7.11.1.91 2048 Bytes 2011/01/11 20:16:51
VBASE027.VDF : 7.11.1.92 2048 Bytes 2011/01/11 20:16:51
VBASE028.VDF : 7.11.1.93 2048 Bytes 2011/01/11 20:16:51
VBASE029.VDF : 7.11.1.94 2048 Bytes 2011/01/11 20:16:51
VBASE030.VDF : 7.11.1.95 2048 Bytes 2011/01/11 20:16:52
VBASE031.VDF : 7.11.1.110 60416 Bytes 2011/01/12 20:16:52
Engineversion : 8.2.4.140
AEVDF.DLL : 8.1.2.1 106868 Bytes 2010/09/18 18:38:14
AESCRIPT.DLL : 8.1.3.52 1282426 Bytes 2011/01/12 20:17:03
AESCN.DLL : 8.1.7.2 127349 Bytes 2010/11/22 14:44:55
AESBX.DLL : 8.1.3.2 254324 Bytes 2010/11/22 14:45:05
AERDL.DLL : 8.1.9.2 635252 Bytes 2010/09/22 09:42:08
AEPACK.DLL : 8.2.4.7 512375 Bytes 2011/01/12 20:17:02
AEOFFICE.DLL : 8.1.1.10 201084 Bytes 2010/11/22 14:44:54
AEHEUR.DLL : 8.1.2.64 3154294 Bytes 2011/01/12 20:17:00
AEHELP.DLL : 8.1.16.0 246136 Bytes 2011/01/12 20:16:54
AEGEN.DLL : 8.1.5.1 397683 Bytes 2011/01/12 20:16:54
AEEMU.DLL : 8.1.3.0 393589 Bytes 2010/11/22 14:44:24
AECORE.DLL : 8.1.19.0 196984 Bytes 2011/01/12 20:16:52
AEBB.DLL : 8.1.1.0 53618 Bytes 2010/05/11 16:51:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008/12/12 06:47:56
AVPREF.DLL : 9.0.3.0 44289 Bytes 2009/12/15 12:08:25
AVREP.DLL : 8.0.0.7 159784 Bytes 2010/03/14 16:30:46
AVREG.DLL : 9.0.0.0 36609 Bytes 2008/11/07 13:25:04
AVARKT.DLL : 9.0.0.3 292609 Bytes 2009/05/25 08:46:54
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009/01/30 08:37:04
SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009/01/28 13:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009/02/02 06:21:28
NETNT.DLL : 9.0.0.0 11521 Bytes 2008/11/07 13:41:21
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 2009/06/10 08:00:54
RCTEXT.DLL : 9.0.73.0 87297 Bytes 2009/12/15 12:08:23

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: c:\programme\avira\antivir desktop\sysscan.avp
Protokollierung.......................: niedrig
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: mittel
Abweichende Gefahrenkategorien........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Donnerstag, 13. Januar 2011 12:05

Der Suchlauf nach versteckten Objekten wird begonnen.
Es wurden '30734' Objekte überprüft, '0' versteckte Objekte wurden gefunden.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpybotSD.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ctfmon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'explorer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TuneUpUtilitiesApp32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'alg.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqwmiex.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'wdfmgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TuneUpUtilitiesService32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'McciCMService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'S24EvMon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WinStylerThemeSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
Es wurden '33' Prozesse mit '33' Modulen durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '55' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\pagefile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
[HINWEIS] Bei dieser Datei handelt es sich um eine Windows Systemdatei.
[HINWEIS] Es ist in Ordnung, dass diese Datei für die Suche nicht geöffnet werden kann.
C:\System Volume Information\_restore{5BF9F71D-2C57-4B2B-84A1-A00BEF199656}\RP58\A0014060.dll
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
C:\System Volume Information\_restore{5BF9F71D-2C57-4B2B-84A1-A00BEF199656}\RP59\A0014113.exe
[FUND] Ist das Trojanische Pferd TR/FakeAV.vtv
C:\System Volume Information\_restore{5BF9F71D-2C57-4B2B-84A1-A00BEF199656}\RP59\A0014114.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen

Beginne mit der Desinfektion:
C:\System Volume Information\_restore{5BF9F71D-2C57-4B2B-84A1-A00BEF199656}\RP58\A0014060.dll
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4d5ee2c4.qua' verschoben!
C:\System Volume Information\_restore{5BF9F71D-2C57-4B2B-84A1-A00BEF199656}\RP59\A0014113.exe
[FUND] Ist das Trojanische Pferd TR/FakeAV.vtv
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4d5ee2c5.qua' verschoben!
C:\System Volume Information\_restore{5BF9F71D-2C57-4B2B-84A1-A00BEF199656}\RP59\A0014114.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4cc87706.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 13. Januar 2011 12:31
Benötigte Zeit: 25:47 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

5876 Verzeichnisse wurden überprüft
215019 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
215015 Dateien ohne Befall
2172 Archive wurden durchsucht
1 Warnungen
4 Hinweise
30734 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden

cosinus 13.01.2011 13:40
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

2Dope2Cope 13.01.2011 16:03
Hi Arne!

Ok, hier die Malwarebytes logdatei:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5511

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2011/01/13 03:45:52 PM
mbam-log-2011-01-13 (15-45-52).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 184989
Laufzeit: 23 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\dokumente und einstellungen\sebastian\anwendungsdaten\Adobe\plugs\kb8834875.exe (Trojan.Agent) -> Quarantined and deleted successfully.



Und hier die OTL Logfiles:OTL Logfile:
Code:
OTL logfile created on: 2011/01/13 03:55:08 PM - Run 2
OTL by OldTimer - Version 3.2.20.1    Folder = C:\Dokumente und Einstellungen\Sebastian\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00001C09 | Country: Südafrika | Language: ENS | Date Format: yyyy/MM/dd
 
1,015.00 Mb Total Physical Memory | 527.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74.52 Gb Total Space | 64.22 Gb Free Space | 86.18% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SCHLEPPTOP | User Name: Sebastian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Sebastian\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe (Motive Communications, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe (TuneUp Software GmbH)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Sebastian\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\Programme\TuneUp Utilities 2006\WinStylerThemeHelper.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (McciCMService) -- C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe (Motive Communications, Inc.)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (S24EventMonitor) Intel(R) -- C:\Programme\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel(R) -- C:\Programme\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (TUWinStylerThemeSvc) -- C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe (TuneUp Software GmbH)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (MRESP50a64) -- C:\PROGRA~1\GEMEIN~1\Motive\MRESP50a64.SYS File not found
DRV - (MRENDIS5) -- C:\PROGRA~1\GEMEIN~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) -- C:\PROGRA~1\GEMEIN~1\Motive\MREMPR5.SYS File not found
DRV - (MREMP50a64) -- C:\PROGRA~1\GEMEIN~1\Motive\MREMP50a64.SYS File not found
DRV - (catchme) -- C:\ComboFix\catchme.sys File not found
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (pxrts) -- C:\WINDOWS\system32\drivers\pxrts.sys (Prevx)
DRV - (pxscan) -- C:\WINDOWS\System32\drivers\pxscan.sys (Prevx)
DRV - (pxkbf) -- C:\WINDOWS\system32\drivers\pxkbf.sys (Prevx)
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (MREMP50) -- C:\Programme\Gemeinsame Dateien\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Programme\Gemeinsame Dateien\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ADIHdAudAddService) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (HpqKbFiltr) -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (NETw4x32) Intel(R) -- C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (s24trans) -- C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (HBtnKey) -- C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.4
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.1
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010/11/03 21:40:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010/10/18 17:16:39 | 000,000,000 | ---D | M]
 
[2008/09/10 08:43:26 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\Mozilla\Extensions
[2011/01/13 12:32:55 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\Mozilla\Firefox\Profiles\y6054xfg.default\extensions
[2010/10/22 07:16:52 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\Mozilla\Firefox\Profiles\y6054xfg.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/10/06 22:08:10 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\Mozilla\Firefox\Profiles\y6054xfg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/10/26 06:48:07 | 000,000,000 | ---D | M] (Personas) -- C:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\Mozilla\Firefox\Profiles\y6054xfg.default\extensions\personas@christopher.beard
[2011/01/12 21:25:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010/11/05 10:53:21 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/24 18:59:46 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010/09/24 18:59:46 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010/09/24 18:59:46 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010/09/24 18:59:46 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010/09/24 18:59:46 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010/07/28 01:39:30 | 000,413,985 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 14321 more lines...
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [Qbubiwareheguri] C:\WINDOWS\spsphet.DLL File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download with Xilisoft Download YouTube Video - C:\Programme\Xilisoft\Download YouTube Video\upod_link.HTM ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (ICQ, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5)
O16 - DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} hxxp://download.tvants.com/pub/tvants/tvants1/win32/cab/tvants.cab (TVAnts ActiveX Control)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1217956634 (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.dll - C:\Programme\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/05/10 08:53:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{01b7d100-cc09-11df-9e17-001b771b4875}\Shell\AutoRun\command - "" = TranscendService(JF).exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/01/13 15:54:08 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Sebastian\Desktop\OTL.exe
[2011/01/10 15:13:13 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Sebastian\Eigene Dateien\Eigene Musik
 
========== Files - Modified Within 30 Days ==========
 
[2011/01/13 15:54:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Sebastian\Desktop\OTL.exe
[2011/01/13 15:53:29 | 000,320,708 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011/01/13 15:53:29 | 000,315,758 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/01/13 15:53:29 | 000,049,852 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011/01/13 15:53:29 | 000,041,692 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/01/13 15:49:29 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/01/13 15:49:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2010/04/10 11:50:36 | 000,000,306 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/05/13 13:05:19 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\FnF4.txt
[2009/05/07 09:50:23 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\QSwitch.txt
[2009/05/07 09:50:23 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\DSwitch.txt
[2009/05/07 09:50:23 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\AtStart.txt
[2008/09/13 15:26:00 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS61.DLL
[2008/05/17 18:41:51 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/05/10 11:44:50 | 000,098,816 | ---- | C] () -- C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/05/10 10:15:41 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/05/10 10:15:41 | 000,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini
[2008/05/10 10:15:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NSREX.INI
[2008/05/10 09:44:32 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4864.dll
[2008/05/10 09:38:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[1999/01/22 19:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/03/18 10:12:02 | 000,003,806 | ---- | C] () -- C:\WINDOWS\System32\mmc.ini

< End of report >
--- --- ---















OTL Logfile:
Code:
OTL Extras logfile created on: 2011/01/13 03:55:08 PM - Run 2
OTL by OldTimer - Version 3.2.20.1    Folder = C:\Dokumente und Einstellungen\Sebastian\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00001C09 | Country: Südafrika | Language: ENS | Date Format: yyyy/MM/dd
 
1,015.00 Mb Total Physical Memory | 527.00 Mb Available Physical Memory | 52.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74.52 Gb Total Space | 64.22 Gb Free Space | 86.18% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SCHLEPPTOP | User Name: Sebastian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft Office Communicator\communicator.exe" = C:\Programme\Microsoft Office Communicator\communicator.exe:*:Enabled:Microsoft Office Communicator 2007 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)
"C:\Programme\Microsoft Office Communicator\communicator.exe" = C:\Programme\Microsoft Office Communicator\communicator.exe:*:Enabled:Microsoft Office Communicator 2007 -- (Microsoft Corporation)
"C:\Programme\BitLord\BitLord.exe" = C:\Programme\BitLord\BitLord.exe:*:Enabled:BitLord -- (www.BitLord.com)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 J1
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg
"{868D7896-99D4-4513-BC62-2B3AD3E24926}" = TuneUp Utilities 2006
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUSR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9D0F85-5658-4A5E-95A9-65F7DB2916EE}" = Broadcom 440x 10/100 Integrated Controller
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E5BA0430-919F-46DD-B656-0796F8A5ADFF}" = Microsoft Office Communicator 2007
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BitLord" = BitLord 1.1
"Broadcom 802.11b Network Adapter" = Broadcom 802.11-WLAN-Adapter
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NeroVision!UninstallKey" = Nero Digital
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"ProInst" = Intel(R) PROSet/Wireless Software
"PROPLUSR" = Microsoft Office Professional Plus 2007
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuneUp Utilities" = TuneUp Utilities
"TVAnts ActiveX Control 1.0" = TVAnts ActiveX Control 1.0
"VLC media player" = VideoLAN VLC media player 0.8.4a
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinRAR archiver" = WinRAR
"Xilisoft Download YouTube Video" = Xilisoft Download YouTube Video
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 2010/11/24 01:01:06 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 2010/11/24 01:01:06 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1969
 
Error - 2010/11/24 01:01:06 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1969
 
Error - 2010/11/24 01:01:08 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 2010/11/24 01:01:08 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4078
 
Error - 2010/11/24 01:01:08 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4078
 
Error - 2010/11/29 03:35:37 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 2010/11/29 03:35:37 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2078
 
Error - 2010/11/29 03:35:37 PM | Computer Name = SCHLEPPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2078
 
Error - 2011/01/08 08:30:12 AM | Computer Name = SCHLEPPTOP | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung SpybotSD.exe, Version 1.6.2.46, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ System Events ]
Error - 2011/01/08 08:00:51 AM | Computer Name = SCHLEPPTOP | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  AFD  avgio  avipbb  Fips  intelppm  IPSec  MRxSmb  NetBIOS  NetBT  RasAcd  Rdbss  SASDIFSV  SASKUTIL  ssmdrv
Tcpip
 
Error - 2011/01/10 10:12:46 AM | Computer Name = SCHLEPPTOP | Source = Windows Update Agent | ID = 16
Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst
 "Automatische Updates" hergestellt werden, daher können Updates nicht nach dem
angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht,
 eine Verbindung herzustellen.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/10 10:13:51 AM | Computer Name = SCHLEPPTOP | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 2011/01/12 01:00:46 PM | Computer Name = SCHLEPPTOP | Source = Windows Update Agent | ID = 16
Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst
 "Automatische Updates" hergestellt werden, daher können Updates nicht nach dem
angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht,
 eine Verbindung herzustellen.
 
 
< End of report >
--- --- ---






Gruß,
Sebi

cosinus 13.01.2011 16:16
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

2Dope2Cope 13.01.2011 20:20
hallo!

ja gibt noch weitere, aber die sind noch von letztem jahr!!
ok, hier sind sie:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4359

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2010/07/28 02:08:25 AM
mbam-log-2010-07-28 (02-08-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 237930
Laufzeit: 1 Stunde(n), 11 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)













Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4110

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2010/06/20 06:12:54 PM
mbam-log-2010-06-20 (18-12-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 226451
Laufzeit: 59 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)











Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4110

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2010/06/19 11:47:13 PM
mbam-log-2010-06-19 (23-47-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 226688
Laufzeit: 1 Stunde(n), 23 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)











Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4110

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2010/05/18 12:35:02 AM
mbam-log-2010-05-18 (00-35-02).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 222499
Laufzeit: 55 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)











Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4110

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2010/05/17 11:30:19 PM
mbam-log-2010-05-17 (23-30-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 222455
Laufzeit: 1 Stunde(n), 4 Minute(n), 20 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)










Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4110

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2010/05/17 10:22:34 PM
mbam-log-2010-05-17 (22-22-34).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 123768
Laufzeit: 4 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 14.01.2011 09:26
Zitat:
C:\ComboFix
Wann hast du CF ausgeführt und warum postest du das Log nicht?

2Dope2Cope 15.01.2011 10:57
hi arne!

combofix hab ich vor nem jahr ma ausgeführt...oder noch länger her als ich schonma nen virus draufhatte...

2Dope2Cope 15.01.2011 10:58
oh is doch noch nich so lange her nur nen halbes jahr. hier dat combofix log:

Combofix Logfile:
Code:
ComboFix 10-05-12.01 - Sebastian 2010/05/18  21:38:41.4.2 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.27.1031.18.1015.614 [GMT 2:00]
Running from: c:\dokumente und einstellungen\Sebastian\Eigene Dateien\Symbolleiste Royal TS\System Care\ComboFix.exe
Command switches used :: c:\dokumente und einstellungen\Sebastian\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\dokume~1\SEBAST~1\LOKALE~1\Temp\iqqhyrczavdcmwd.sys"
"c:\dokume~1\SEBAST~1\LOKALE~1\Temp\kdlkyxaiq.sys"
"c:\programme\Analog Devices\Core\smax4pnp .exe"
"c:\programme\Analog Devices\SoundMAX\smax4 .exe"
"c:\programme\Hewlett-Packard\HP Quick Launch Buttons\qlbctrl .exe"
"c:\programme\Intel\Wireless\Bin\ifrmewrk .exe"
"c:\programme\Intel\Wireless\Bin\zcfgsvc .exe"
"c:\programme\internet explorer\wmpscfgs.exe"
"c:\programme\iTunes\ituneshelper .exe"
"c:\programme\Java\jre1.6.0_07\bin\jusched .exe"
"c:\programme\QuickTime\qttask  .exe"
"c:\programme\Synaptics\SynTP\syntpstart .exe"
"c:\windows\system32\commoupucyz.exe"
"c:\windows\TEMP\mc21.tmp"
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\83e2ada7cfcab60d50489686
c:\83e2ada7cfcab60d50489686\MRT.exe
c:\programme\Analog Devices\Core\smax4pnp .exe
c:\programme\Analog Devices\SoundMAX\smax4 .exe
c:\programme\Hewlett-Packard\HP Quick Launch Buttons\qlbctrl .exe
c:\programme\Intel\Wireless\Bin\ifrmewrk .exe
c:\programme\Intel\Wireless\Bin\zcfgsvc .exe
c:\programme\iTunes\ituneshelper .exe
c:\programme\Java\jre1.6.0_07\bin\jusched .exe
c:\programme\QuickTime\qttask  .exe
c:\programme\Synaptics\SynTP\syntpstart .exe

.
(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RIVLMMRVH
-------\Legacy_VJLWANPMMBPQZPQ
-------\Service_rivlmmrvh
-------\Service_vjlwanpmmbpqzpq


(((((((((((((((((((((((((  Files Created from 2010-04-18 to 2010-05-18  )))))))))))))))))))))))))))))))
.

2010-05-18 16:40 . 2010-05-18 16:40        --------        d-----w-        C:\_OTL
2010-05-17 20:17 . 2010-05-17 20:17        --------        d-----w-        c:\dokumente und einstellungen\Sebastian\Anwendungsdaten\Malwarebytes
2010-05-17 20:17 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-17 20:17 . 2010-05-17 20:17        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-05-17 20:17 . 2010-05-17 20:17        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-05-17 20:17 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-05-12 11:11 . 2010-05-12 11:11        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\PTBSync
2010-05-12 11:11 . 2010-05-12 11:11        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Eigene Dateien
2010-05-12 11:11 . 2010-05-13 11:10        --------        d-s---w-        c:\programme\PTBSync

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-18 19:41 . 2009-03-23 15:21        --------        d-----w-        c:\programme\iTunes
2010-05-18 19:41 . 2009-03-23 15:20        --------        d-----w-        c:\programme\QuickTime
2010-05-18 19:37 . 2008-06-10 12:10        71264        -c--a-w-        c:\dokumente und einstellungen\Sebastian\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-05-18 18:23 . 2010-04-09 17:27        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-05-18 16:48 . 2007-10-29 12:00        49852        ----a-w-        c:\windows\system32\perfc007.dat
2010-05-18 16:48 . 2007-10-29 12:00        320708        ----a-w-        c:\windows\system32\perfh007.dat
2010-05-13 11:05 . 2008-11-04 13:16        --------        d-----w-        c:\programme\IncrediMail
2010-05-13 07:53 . 2008-09-24 10:20        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
2010-05-12 22:35 . 2009-03-20 18:36        --------        d-----w-        c:\programme\Imgares
2010-04-11 22:00 . 2010-04-11 22:00        515072        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2010-04-11 21:57 . 2008-08-14 00:09        2278400        -c--a-w-        c:\windows\system32\TUKernel.exe
2010-04-11 13:42 . 2010-04-11 13:42        205279        ----a-w-        C:\quarantine.zip
2010-04-10 14:46 . 2010-04-10 10:50        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\PrevxCSI
2010-04-10 10:51 . 2010-04-10 10:51        53160        ----a-w-        c:\windows\system32\PxSecure.dll
2010-04-10 10:51 . 2010-04-10 10:51        53088        ----a-w-        c:\windows\system32\drivers\pxrts.sys
2010-04-10 10:51 . 2010-04-10 10:51        30280        ----a-w-        c:\windows\system32\drivers\pxscan.sys
2010-04-10 10:50 . 2010-04-10 10:50        24368        ----a-w-        c:\windows\system32\drivers\pxkbf.sys
2010-04-10 08:46 . 2010-04-10 08:46        --------        d-----w-        c:\programme\CCleaner
2010-04-09 23:00 . 2010-04-09 22:59        --------        d-----w-        c:\programme\TuneUp Utilities 2010
2010-04-09 22:59 . 2008-08-13 03:52        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software
2010-04-09 22:59 . 2010-04-09 22:59        --------        d-sh--w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-09 17:28 . 2010-04-09 17:27        --------        d-----w-        c:\programme\Spybot - Search & Destroy
2010-04-01 13:17 . 2010-04-09 23:00        30536        ----a-w-        c:\windows\system32\TURegOpt.exe
2010-04-01 13:11 . 2010-04-09 23:00        30024        ----a-w-        c:\windows\system32\uxtuneup.dll
2010-03-11 12:31 . 2007-10-29 12:00        832512        ----a-w-        c:\windows\system32\wininet.dll
2010-03-11 12:31 . 2007-10-29 12:00        78336        ----a-w-        c:\windows\system32\ieencode.dll
2010-03-11 12:31 . 2007-10-29 12:00        17408        ------w-        c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2007-10-29 12:00        430080        ----a-w-        c:\windows\system32\vbscript.dll
2010-02-24 12:31 . 2007-10-29 12:00        454016        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
.

(((((((((((((((((((((((((((((  SnapShot@2010-05-13_08.02.14  )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-29 12:00 . 2010-05-13 07:54        41692              c:\windows\system32\perfc009.dat
+ 2007-10-29 12:00 . 2010-05-18 16:48        41692              c:\windows\system32\perfc009.dat
+ 2007-10-29 12:00 . 2010-05-18 16:48        315758              c:\windows\system32\perfh009.dat
- 2007-10-29 12:00 . 2010-05-13 07:54        315758              c:\windows\system32\perfh009.dat
+ 2008-05-10 08:37 . 2010-05-18 19:43        269392              c:\windows\system32\FNTCACHE.DAT
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-10-29 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50        155648        -c--a-w-        c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\ICQ6\\ICQ.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office Communicator\\communicator.exe"=
"c:\\Programme\\BitLord\\BitLord.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2010/04/10 12:51 PM 30280]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [2009/05/25 09:31 AM 108289]
R2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2010/04/10 12:51 PM 53088]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010/04/01 03:14 PM 1050440]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2010/04/10 12:50 PM 24368]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010/02/24 02:41 PM 10064]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-04-09 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2006\SystemOptimizer.exe [2005-08-17 20:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Download with Xilisoft Download YouTube Video - c:\programme\Xilisoft\Download YouTube Video\upod_link.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://download.tvants.com/pub/tvants/tvants1/win32/cab/tvants.cab
FF - ProfilePath - c:\dokumente und einstellungen\Sebastian\Anwendungsdaten\Mozilla\Firefox\Profiles\y6054xfg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-IncrediMail - c:\progra~1\INCRED~1\bin\IncMail.exe
MSConfigStartUp-PTBSync - c:\programme\PTBSync\PTBSync.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-05-18 21:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1356)
c:\programme\TuneUp Utilities 2006\WinStylerThemeHelper.dll

- - - - - - - > 'lsass.exe'(1428)
c:\programme\TuneUp Utilities 2006\WinStylerThemeHelper.dll

- - - - - - - > 'explorer.exe'(2348)
c:\programme\TuneUp Utilities 2006\WinStylerThemeHelper.dll
.
------------------------ Other Running Processes ------------------------
.
c:\programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
c:\programme\Intel\Wireless\Bin\S24EvMon.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Intel\Wireless\Bin\EvtEng.exe
c:\programme\Gemeinsame Dateien\Motive\McciCMService.exe
c:\programme\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\programme\Hewlett-Packard\Shared\hpqwmiex.exe
c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\\?\c:\windows\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2010-05-18  21:47:45 - machine was rebooted
ComboFix-quarantined-files.txt  2010-05-18 19:47
ComboFix2.txt  2010-05-18 18:32
ComboFix3.txt  2010-05-13 08:03

Pre-Run: 9,132,404,736 Bytes frei
Post-Run: 9,011,118,080 Bytes frei

- - End Of File - - 7CB69CA55791295661814A9604A33280
--- --- ---

cosinus 17.01.2011 09:30
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O4 - HKCU..\Run: [Qbubiwareheguri] C:\WINDOWS\spsphet.DLL File not found
DRV - (MRESP50a64) -- C:\PROGRA~1\GEMEIN~1\Motive\MRESP50a64.SYS File not found
DRV - (MRENDIS5) -- C:\PROGRA~1\GEMEIN~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) -- C:\PROGRA~1\GEMEIN~1\Motive\MREMPR5.SYS File not found
DRV - (MREMP50a64) -- C:\PROGRA~1\GEMEIN~1\Motive\MREMP50a64.SYS File not found
O33 - MountPoints2\{01b7d100-cc09-11df-9e17-001b771b4875}\Shell\AutoRun\command - "" = TranscendService(JF).exe
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

2Dope2Cope 17.01.2011 11:49
moin!
ja habe OTL grad gestartet, hier das log:




All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Qbubiwareheguri deleted successfully.
Service MRESP50a64 stopped successfully!
Service MRESP50a64 deleted successfully!
File C:\PROGRA~1\GEMEIN~1\Motive\MRESP50a64.SYS File not found not found.
Service MRENDIS5 stopped successfully!
Service MRENDIS5 deleted successfully!
File C:\PROGRA~1\GEMEIN~1\Motive\MRENDIS5.SYS File not found not found.
Service MREMPR5 stopped successfully!
Service MREMPR5 deleted successfully!
File C:\PROGRA~1\GEMEIN~1\Motive\MREMPR5.SYS File not found not found.
Service MREMP50a64 stopped successfully!
Service MREMP50a64 deleted successfully!
File C:\PROGRA~1\GEMEIN~1\Motive\MREMP50a64.SYS File not found not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01b7d100-cc09-11df-9e17-001b771b4875}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01b7d100-cc09-11df-9e17-001b771b4875}\ not found.
File TranscendService(JF).exe not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67591 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Sebastian
->Temp folder emptied: 152834 bytes
->Temporary Internet Files folder emptied: 3236258 bytes
->Java cache emptied: 443831 bytes
->FireFox cache emptied: 106874042 bytes
->Flash cache emptied: 2798681 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 113890 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 108.00 mb


OTL by OldTimer - Version 3.2.20.1 log created on 01172011_114351

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 17.01.2011 12:31
Dann bitte jetzt CF ausführen, die cofi.exe neu runterladen!!!

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

2Dope2Cope 17.01.2011 14:25
ok, hier das cofi blog:


Combofix Logfile:
Code:
ComboFix 11-01-16.04 - Sebastian 2011/01/17  14:14:25.5.2 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.27.1031.18.1015.651 [GMT 1:00]
Running from: c:\dokumente und einstellungen\Sebastian\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\Sebastian\Anwendungsdaten\Adobe\AdobeUpdate .exe
c:\dokumente und einstellungen\Sebastian\Anwendungsdaten\Adobe\plugs

.
(((((((((((((((((((((((((  Files Created from 2010-12-17 to 2011-01-17  )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 17:09 . 2010-05-17 20:17        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-05-17 20:17        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
.

(((((((((((((((((((((((((((((  SnapShot@2010-05-13_08.02.14  )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 12:20 . 2010-01-23 08:11        46080              c:\windows\system32\tzchange.exe
+ 2008-06-10 12:20 . 2010-04-21 13:28        46080              c:\windows\system32\tzchange.exe
+ 2005-05-27 16:34 . 2008-11-07 09:49        61440              c:\windows\system32\spool\drivers\w32x86\3\trackid.dll
- 2005-05-27 16:34 . 2007-02-21 01:13        61440              c:\windows\system32\spool\drivers\w32x86\3\TrackID.DLL
+ 2009-10-02 16:37 . 2010-04-15 10:22        68608              c:\windows\system32\spool\drivers\w32x86\3\ricaz0pl.dll
+ 2008-11-07 09:49 . 2008-11-07 09:49        67044              c:\windows\system32\spool\drivers\w32x86\3\ricaz0lg.dat
+ 2008-11-07 09:49 . 2008-11-07 09:49        65536              c:\windows\system32\spool\drivers\w32x86\3\ricaz0hp.exe
+ 2009-12-11 08:24 . 2009-01-20 10:45        20480              c:\windows\system32\spool\drivers\w32x86\3\cioum.dll
+ 2010-10-18 16:11 . 2009-03-05 22:59        36864              c:\windows\system32\ReinstallBackups\0003\DriverFiles\usbaapl.sys
- 2007-10-29 12:00 . 2010-03-11 12:31        44544              c:\windows\system32\pngfilt.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        44544              c:\windows\system32\pngfilt.dll
+ 2007-10-29 12:00 . 2011-01-17 10:49        41692              c:\windows\system32\perfc009.dat
- 2007-10-29 12:00 . 2010-05-13 07:54        41692              c:\windows\system32\perfc009.dat
+ 2007-10-29 12:00 . 2011-01-17 10:49        49852              c:\windows\system32\perfc007.dat
- 2007-10-29 12:00 . 2010-05-13 07:54        49852              c:\windows\system32\perfc007.dat
- 2007-08-13 17:54 . 2010-03-11 12:31        52224              c:\windows\system32\msfeedsbs.dll
+ 2007-08-13 17:54 . 2010-05-04 17:14        52224              c:\windows\system32\msfeedsbs.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        27648              c:\windows\system32\jsproxy.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        27648              c:\windows\system32\jsproxy.dll
+ 2007-08-13 17:39 . 2010-05-04 12:39        13824              c:\windows\system32\ieudinit.exe
- 2007-08-13 17:39 . 2010-03-10 13:17        13824              c:\windows\system32\ieudinit.exe
+ 2007-10-29 12:00 . 2010-05-04 17:14        44544              c:\windows\system32\iernonce.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        44544              c:\windows\system32\iernonce.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        78336              c:\windows\system32\ieencode.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        78336              c:\windows\system32\ieencode.dll
+ 2007-10-29 12:00 . 2010-05-04 12:39        70656              c:\windows\system32\ie4uinit.exe
- 2007-10-29 12:00 . 2010-03-10 13:17        70656              c:\windows\system32\ie4uinit.exe
+ 2007-08-13 17:36 . 2010-05-04 17:14        63488              c:\windows\system32\icardie.dll
- 2007-08-13 17:36 . 2010-03-11 12:31        63488              c:\windows\system32\icardie.dll
+ 2010-10-18 16:11 . 2010-04-19 18:47        41984              c:\windows\system32\DRVSTORE\usbaapl_5BE1FFC476B2D9925B428CF102B47444B9A16508\usbaapl.sys
+ 2010-10-18 16:11 . 2010-04-19 18:29        18432              c:\windows\system32\DRVSTORE\netaapl_3A00C5601D92D37DDCB0AE45518D6B42BE1588E6\netaapl.sys
+ 2010-10-18 16:20 . 2009-05-18 11:17        26600              c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspiWDM.sys
+ 2010-10-18 16:01 . 2004-08-03 20:58        15104              c:\windows\system32\drivers\usbscan.sys
+ 2009-03-23 15:20 . 2010-04-19 18:47        41984              c:\windows\system32\drivers\usbaapl.sys
+ 2009-03-23 15:22 . 2009-05-18 11:17        26600              c:\windows\system32\drivers\GEARAspiWDM.sys
+ 2010-07-27 16:44 . 2010-07-27 16:44        91424              c:\windows\system32\dnssd.dll
+ 2010-10-18 16:01 . 2004-08-03 20:58        15104              c:\windows\system32\dllcache\usbscan.sys
+ 2007-10-29 12:00 . 2010-05-04 17:14        44544              c:\windows\system32\dllcache\pngfilt.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        44544              c:\windows\system32\dllcache\pngfilt.dll
+ 2009-12-15 12:20 . 2010-05-04 17:14        52224              c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-12-15 12:20 . 2010-03-11 12:31        52224              c:\windows\system32\dllcache\msfeedsbs.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        27648              c:\windows\system32\dllcache\jsproxy.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        27648              c:\windows\system32\dllcache\jsproxy.dll
+ 2009-12-15 12:20 . 2010-05-04 12:39        13824              c:\windows\system32\dllcache\ieudinit.exe
- 2009-12-15 12:20 . 2010-03-10 13:17        13824              c:\windows\system32\dllcache\ieudinit.exe
+ 2007-10-29 12:00 . 2010-05-04 17:14        44544              c:\windows\system32\dllcache\iernonce.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        44544              c:\windows\system32\dllcache\iernonce.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        78336              c:\windows\system32\dllcache\ieencode.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        78336              c:\windows\system32\dllcache\ieencode.dll
+ 2007-10-29 12:00 . 2010-05-04 12:39        70656              c:\windows\system32\dllcache\ie4uinit.exe
- 2007-10-29 12:00 . 2010-03-10 13:17        70656              c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-12-15 12:20 . 2010-05-04 17:14        63488              c:\windows\system32\dllcache\icardie.dll
- 2009-12-15 12:20 . 2010-03-11 12:31        63488              c:\windows\system32\dllcache\icardie.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        17408              c:\windows\system32\dllcache\corpol.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        17408              c:\windows\system32\dllcache\corpol.dll
+ 2007-10-29 12:00 . 2010-03-05 14:54        65536              c:\windows\system32\dllcache\asycfilt.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        17408              c:\windows\system32\corpol.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        17408              c:\windows\system32\corpol.dll
+ 2007-10-29 12:00 . 2010-03-05 14:54        65536              c:\windows\system32\asycfilt.dll
+ 2010-05-18 20:53 . 2010-05-18 20:53        65024              c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2010-05-18 20:53 . 2010-05-18 20:53        18944              c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        35088              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        35088              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        18704              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        18704              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        20240              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        20240              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-06-19 19:56 . 2010-03-11 12:31        44544              c:\windows\ie7updates\KB982381-IE7\pngfilt.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        52224              c:\windows\ie7updates\KB982381-IE7\msfeedsbs.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        27648              c:\windows\ie7updates\KB982381-IE7\jsproxy.dll
+ 2010-06-19 19:56 . 2010-03-10 13:17        13824              c:\windows\ie7updates\KB982381-IE7\ieudinit.exe
+ 2010-06-19 19:56 . 2010-03-11 12:31        44544              c:\windows\ie7updates\KB982381-IE7\iernonce.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        78336              c:\windows\ie7updates\KB982381-IE7\ieencode.dll
+ 2010-06-19 19:56 . 2010-03-10 13:17        70656              c:\windows\ie7updates\KB982381-IE7\ie4uinit.exe
+ 2010-06-19 19:56 . 2010-03-11 12:31        63488              c:\windows\ie7updates\KB982381-IE7\icardie.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        17408              c:\windows\ie7updates\KB982381-IE7\corpol.dll
+ 2010-06-19 19:56 . 2008-07-08 13:00        26488              c:\windows\$hf_mig$\KB982381-IE7\update\spcustom.dll
+ 2010-06-19 19:56 . 2008-07-08 13:00        18808              c:\windows\$hf_mig$\KB982381-IE7\spmsg.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        44544              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\pngfilt.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        52224              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\msfeedsbs.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        27648              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\jsproxy.dll
+ 2010-05-04 13:19 . 2010-05-04 13:19        13824              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieudinit.exe
+ 2010-05-04 16:48 . 2010-05-04 16:48        44544              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iernonce.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        78336              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieencode.dll
+ 2010-05-04 13:19 . 2010-05-04 13:19        70656              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ie4uinit.exe
+ 2010-05-04 16:48 . 2010-05-04 16:48        63488              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\icardie.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        17408              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\corpol.dll
+ 2010-06-19 20:04 . 2009-05-26 11:40        26488              c:\windows\$hf_mig$\KB980218\update\spcustom.dll
+ 2010-06-19 20:04 . 2009-05-26 11:40        18808              c:\windows\$hf_mig$\KB980218\spmsg.dll
+ 2010-06-19 20:04 . 2008-07-08 13:00        26488              c:\windows\$hf_mig$\KB980195\update\spcustom.dll
+ 2010-06-19 20:04 . 2008-07-08 13:00        18808              c:\windows\$hf_mig$\KB980195\spmsg.dll
+ 2010-06-19 20:02 . 2009-05-26 09:01        26488              c:\windows\$hf_mig$\KB979559\update\spcustom.dll
+ 2010-06-19 20:02 . 2009-05-26 09:01        18808              c:\windows\$hf_mig$\KB979559\spmsg.dll
+ 2010-06-19 19:59 . 2009-05-26 11:40        26488              c:\windows\$hf_mig$\KB979482\update\spcustom.dll
+ 2010-06-19 19:59 . 2009-05-26 11:40        18808              c:\windows\$hf_mig$\KB979482\spmsg.dll
+ 2010-03-05 14:50 . 2010-03-05 14:50        65536              c:\windows\$hf_mig$\KB979482\SP3QFE\asycfilt.dll
+ 2010-03-05 14:37 . 2010-03-05 14:37        65536              c:\windows\$hf_mig$\KB979482\SP3GDR\asycfilt.dll
+ 2010-03-05 14:49 . 2010-03-05 14:49        65536              c:\windows\$hf_mig$\KB979482\SP2QFE\asycfilt.dll
+ 2010-06-19 19:59 . 2008-07-08 13:00        26488              c:\windows\$hf_mig$\KB975562\update\spcustom.dll
+ 2010-06-19 19:59 . 2008-07-08 13:00        18808              c:\windows\$hf_mig$\KB975562\spmsg.dll
+ 2010-07-27 10:03 . 2009-05-26 11:40        26488              c:\windows\$hf_mig$\KB2229593\update\spcustom.dll
+ 2010-07-27 10:03 . 2009-05-26 11:40        18808              c:\windows\$hf_mig$\KB2229593\spmsg.dll
+ 2010-10-18 16:02 . 2001-08-18 02:54        5632              c:\windows\system32\ptpusb.dll
+ 2010-05-18 20:53 . 2010-05-18 20:53        5120              c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF16.exe
+ 2009-07-11 23:12 . 2009-07-11 23:12        632656              c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
+ 2009-07-11 23:09 . 2009-07-11 23:09        554832              c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll
+ 2009-07-11 23:08 . 2009-07-11 23:08        479232              c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        832512              c:\windows\system32\wininet.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        832512              c:\windows\system32\wininet.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        233472              c:\windows\system32\webcheck.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        233472              c:\windows\system32\webcheck.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        105984              c:\windows\system32\url.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        105984              c:\windows\system32\url.dll
+ 2006-06-06 03:16 . 2008-06-10 22:11        221184              c:\windows\system32\spool\drivers\w32x86\3\ricjc32.dll
- 2006-06-06 03:16 . 2007-04-05 08:44        221184              c:\windows\system32\spool\drivers\w32x86\3\RICJC32.dll
+ 2008-11-07 09:49 . 2008-11-07 09:49        962560              c:\windows\system32\spool\drivers\w32x86\3\ricipp.dll
+ 2009-10-02 16:37 . 2010-04-15 10:22        287744              c:\windows\system32\spool\drivers\w32x86\3\ricaz0gu.dll
+ 2009-10-02 16:37 . 2010-04-15 10:22        218624              c:\windows\system32\spool\drivers\w32x86\3\ricaz0gs.dll
+ 2009-10-02 16:37 . 2010-04-15 10:22        832512              c:\windows\system32\spool\drivers\w32x86\3\ricaz0gc.dll
+ 2009-01-27 20:04 . 2009-01-27 20:04        229376              c:\windows\system32\spool\drivers\w32x86\3\ricaz0cb.dll
+ 2010-04-14 10:46 . 2009-10-05 11:54        542208              c:\windows\system32\spool\drivers\w32x86\3\PSCRIPT5.DLL
+ 2010-04-14 10:46 . 2009-10-05 11:54        726016              c:\windows\system32\spool\drivers\w32x86\3\PS5UI.DLL
+ 2010-07-07 07:56 . 2010-04-15 19:12        672256              c:\windows\system32\spool\drivers\w32x86\3\hpiss7sm.dll
+ 2010-07-07 07:56 . 2010-04-15 19:13        625152              c:\windows\system32\spool\drivers\w32x86\3\hpisr7sm.dll
+ 2010-07-07 07:30 . 2010-04-15 19:14        112640              c:\windows\system32\spool\drivers\w32x86\3\hpipn7sm.dll
+ 2009-12-11 08:24 . 2009-02-25 19:08        671816              c:\windows\system32\spool\drivers\w32x86\3\hpcdmc32.dll
+ 2009-12-11 08:24 . 2009-12-17 09:26        313856              c:\windows\system32\spool\drivers\w32x86\3\CIOUM32.msi
+ 2010-10-18 16:02 . 2004-08-03 22:57        159232              c:\windows\system32\ptpusd.dll
- 2007-10-29 12:00 . 2010-05-13 07:54        315758              c:\windows\system32\perfh009.dat
+ 2007-10-29 12:00 . 2011-01-17 10:49        315758              c:\windows\system32\perfh009.dat
+ 2007-10-29 12:00 . 2011-01-17 10:49        320708              c:\windows\system32\perfh007.dat
- 2007-10-29 12:00 . 2010-05-13 07:54        320708              c:\windows\system32\perfh007.dat
- 2007-10-29 12:00 . 2010-03-11 12:31        102912              c:\windows\system32\occache.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        102912              c:\windows\system32\occache.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        671232              c:\windows\system32\mstime.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        671232              c:\windows\system32\mstime.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        193024              c:\windows\system32\msrating.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        193024              c:\windows\system32\msrating.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        477696              c:\windows\system32\mshtmled.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        477696              c:\windows\system32\mshtmled.dll
+ 2007-08-13 17:54 . 2010-05-04 17:14        459264              c:\windows\system32\msfeeds.dll
- 2007-08-13 17:54 . 2010-03-11 12:31        459264              c:\windows\system32\msfeeds.dll
+ 2007-08-13 17:34 . 2010-05-04 17:14        268288              c:\windows\system32\iertutil.dll
- 2007-08-13 17:34 . 2010-03-11 12:31        268288              c:\windows\system32\iertutil.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        192512              c:\windows\system32\iepeers.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        192512              c:\windows\system32\iepeers.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        385024              c:\windows\system32\iedkcs32.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        385024              c:\windows\system32\iedkcs32.dll
+ 2007-07-11 11:27 . 2010-05-04 17:14        380928              c:\windows\system32\ieapfltr.dll
- 2007-07-11 11:27 . 2010-03-11 12:31        380928              c:\windows\system32\ieapfltr.dll
+ 2007-10-29 12:00 . 2010-04-16 11:43        161792              c:\windows\system32\ieakui.dll
- 2007-10-29 12:00 . 2010-02-23 05:18        161792              c:\windows\system32\ieakui.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        230400              c:\windows\system32\ieaksie.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        230400              c:\windows\system32\ieaksie.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        153088              c:\windows\system32\ieakeng.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        153088              c:\windows\system32\ieakeng.dll
+ 2009-03-23 15:22 . 2008-04-17 10:12        107368              c:\windows\system32\GEARAspi.dll
- 2009-03-23 15:22 . 2008-04-17 11:12        107368              c:\windows\system32\GEARAspi.dll
+ 2008-05-10 08:37 . 2010-06-19 20:21        269392              c:\windows\system32\FNTCACHE.DAT
+ 2007-10-29 12:00 . 2010-05-04 17:14        133120              c:\windows\system32\extmgr.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        133120              c:\windows\system32\extmgr.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        214528              c:\windows\system32\dxtrans.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        214528              c:\windows\system32\dxtrans.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        347136              c:\windows\system32\dxtmsft.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        347136              c:\windows\system32\dxtmsft.dll
+ 2010-10-18 16:20 . 2008-04-17 10:12        107368              c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspi.dll
+ 2010-07-27 16:44 . 2010-07-27 16:44        197920              c:\windows\system32\dnssdX.dll
+ 2010-07-27 16:44 . 2010-07-27 16:44        107808              c:\windows\system32\dns-sd.exe
+ 2007-10-29 12:00 . 2010-05-04 17:14        832512              c:\windows\system32\dllcache\wininet.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        832512              c:\windows\system32\dllcache\wininet.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        233472              c:\windows\system32\dllcache\webcheck.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        233472              c:\windows\system32\dllcache\webcheck.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        105984              c:\windows\system32\dllcache\url.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        105984              c:\windows\system32\dllcache\url.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        102912              c:\windows\system32\dllcache\occache.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        102912              c:\windows\system32\dllcache\occache.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        671232              c:\windows\system32\dllcache\mstime.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        671232              c:\windows\system32\dllcache\mstime.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        193024              c:\windows\system32\dllcache\msrating.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        193024              c:\windows\system32\dllcache\msrating.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        477696              c:\windows\system32\dllcache\mshtmled.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        477696              c:\windows\system32\dllcache\mshtmled.dll
- 2009-12-15 12:20 . 2010-03-11 12:31        459264              c:\windows\system32\dllcache\msfeeds.dll
+ 2009-12-15 12:20 . 2010-05-04 17:14        459264              c:\windows\system32\dllcache\msfeeds.dll
+ 2008-05-10 07:51 . 2010-04-16 11:43        634656              c:\windows\system32\dllcache\iexplore.exe
+ 2009-12-15 12:20 . 2010-05-04 17:14        268288              c:\windows\system32\dllcache\iertutil.dll
- 2009-12-15 12:20 . 2010-03-11 12:31        268288              c:\windows\system32\dllcache\iertutil.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        192512              c:\windows\system32\dllcache\iepeers.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        192512              c:\windows\system32\dllcache\iepeers.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        385024              c:\windows\system32\dllcache\iedkcs32.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        385024              c:\windows\system32\dllcache\iedkcs32.dll
- 2009-12-15 12:20 . 2010-03-11 12:31        380928              c:\windows\system32\dllcache\ieapfltr.dll
+ 2009-12-15 12:20 . 2010-05-04 17:14        380928              c:\windows\system32\dllcache\ieapfltr.dll
- 2007-10-29 12:00 . 2010-02-23 05:18        161792              c:\windows\system32\dllcache\ieakui.dll
+ 2007-10-29 12:00 . 2010-04-16 11:43        161792              c:\windows\system32\dllcache\ieakui.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        230400              c:\windows\system32\dllcache\ieaksie.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        230400              c:\windows\system32\dllcache\ieaksie.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        153088              c:\windows\system32\dllcache\ieakeng.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        153088              c:\windows\system32\dllcache\ieakeng.dll
+ 2008-05-10 07:51 . 2010-06-14 14:30        743936              c:\windows\system32\dllcache\helpsvc.exe
- 2008-05-10 07:51 . 2007-10-29 12:00        743936              c:\windows\system32\dllcache\helpsvc.exe
+ 2007-10-29 12:00 . 2010-05-04 17:14        133120              c:\windows\system32\dllcache\extmgr.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        133120              c:\windows\system32\dllcache\extmgr.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        214528              c:\windows\system32\dllcache\dxtrans.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        214528              c:\windows\system32\dllcache\dxtrans.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        347136              c:\windows\system32\dllcache\dxtmsft.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        347136              c:\windows\system32\dllcache\dxtmsft.dll
- 2007-10-29 12:00 . 2007-10-29 12:00        285696              c:\windows\system32\dllcache\atmfd.dll
+ 2007-10-29 12:00 . 2010-04-20 05:46        285696              c:\windows\system32\dllcache\atmfd.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        124928              c:\windows\system32\dllcache\advpack.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        124928              c:\windows\system32\dllcache\advpack.dll
+ 2007-10-29 12:00 . 2010-04-20 05:46        285696              c:\windows\system32\atmfd.dll
- 2007-10-29 12:00 . 2007-10-29 12:00        285696              c:\windows\system32\atmfd.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        124928              c:\windows\system32\advpack.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        124928              c:\windows\system32\advpack.dll
+ 2008-05-10 07:51 . 2010-06-14 14:30        743936              c:\windows\pchealth\helpctr\binaries\helpsvc.exe
- 2008-05-10 07:51 . 2007-10-29 12:00        743936              c:\windows\pchealth\helpctr\binaries\HelpSvc.exe
+ 2010-10-18 16:10 . 2010-10-18 16:10        807936              c:\windows\Installer\9fc328.msi
+ 2010-07-23 00:03 . 2010-07-23 00:03        338432              c:\windows\Installer\2e6fd.msp
+ 2010-08-04 13:13 . 2010-08-04 13:13        686080              c:\windows\Installer\2b72b.msp
+ 2010-11-05 09:53 . 2010-11-05 09:53        689152              c:\windows\Installer\27b764.msi
+ 2010-11-05 09:53 . 2010-11-05 09:53        371272              c:\windows\Installer\{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}\SkypeIcon.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        888080              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        888080              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        272648              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\pubs.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        272648              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\pubs.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        922384              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        922384              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        845584              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\outicon.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        845584              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\outicon.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        217864              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\misc.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        217864              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\misc.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        159504              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\inficon.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        159504              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\inficon.exe
+ 2010-10-18 16:20 . 2010-10-18 16:20        380928              c:\windows\Installer\{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}\iTunesIco.exe
+ 2009-03-06 01:37 . 2009-03-06 01:37        501640              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\SOA.DLL
+ 2009-03-06 03:26 . 2009-03-06 03:26        770464              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\REGFORM.EXE
+ 2008-11-04 03:13 . 2008-11-04 03:13        118128              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\MSCONV97.DLL
+ 2008-10-25 08:27 . 2008-10-25 08:27        177040              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\IPOLK.DLL
+ 2008-10-26 05:26 . 2008-10-26 05:26        162680              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\ACCWIZ.DLL
+ 2010-06-19 19:56 . 2010-03-11 12:31        832512              c:\windows\ie7updates\KB982381-IE7\wininet.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        233472              c:\windows\ie7updates\KB982381-IE7\webcheck.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        105984              c:\windows\ie7updates\KB982381-IE7\url.dll
+ 2010-06-19 19:56 . 2009-05-26 11:40        388984              c:\windows\ie7updates\KB982381-IE7\spuninst\updspapi.dll
+ 2010-06-19 19:56 . 2008-07-08 13:00        234872              c:\windows\ie7updates\KB982381-IE7\spuninst\spuninst.exe
+ 2010-06-19 19:56 . 2010-03-11 12:31        102912              c:\windows\ie7updates\KB982381-IE7\occache.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        671232              c:\windows\ie7updates\KB982381-IE7\mstime.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        193024              c:\windows\ie7updates\KB982381-IE7\msrating.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        477696              c:\windows\ie7updates\KB982381-IE7\mshtmled.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        459264              c:\windows\ie7updates\KB982381-IE7\msfeeds.dll
+ 2010-06-19 19:56 . 2010-02-23 05:20        634648              c:\windows\ie7updates\KB982381-IE7\iexplore.exe
+ 2010-06-19 19:56 . 2010-03-11 12:31        268288              c:\windows\ie7updates\KB982381-IE7\iertutil.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        192512              c:\windows\ie7updates\KB982381-IE7\iepeers.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        385024              c:\windows\ie7updates\KB982381-IE7\iedkcs32.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        380928              c:\windows\ie7updates\KB982381-IE7\ieapfltr.dll
+ 2010-06-19 19:56 . 2010-02-23 05:18        161792              c:\windows\ie7updates\KB982381-IE7\ieakui.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        230400              c:\windows\ie7updates\KB982381-IE7\ieaksie.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        153088              c:\windows\ie7updates\KB982381-IE7\ieakeng.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        133120              c:\windows\ie7updates\KB982381-IE7\extmgr.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        214528              c:\windows\ie7updates\KB982381-IE7\dxtrans.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        347136              c:\windows\ie7updates\KB982381-IE7\dxtmsft.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        124928              c:\windows\ie7updates\KB982381-IE7\advpack.dll
+ 2010-06-19 19:56 . 2009-05-26 11:40        388984              c:\windows\$hf_mig$\KB982381-IE7\update\updspapi.dll
+ 2010-06-19 19:56 . 2009-05-26 11:40        765304              c:\windows\$hf_mig$\KB982381-IE7\update\update.exe
+ 2010-06-19 19:56 . 2008-07-08 13:00        234872              c:\windows\$hf_mig$\KB982381-IE7\spuninst.exe
+ 2010-05-04 16:48 . 2010-05-04 16:48        841216              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\wininet.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        233472              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\webcheck.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        105984              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\url.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        102912              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\occache.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        671232              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\mstime.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        193024              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\msrating.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        477696              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\mshtmled.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        459264              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\msfeeds.dll
+ 2010-04-16 11:08 . 2010-04-16 11:08        634648              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
+ 2010-05-04 16:48 . 2010-05-04 16:48        268288              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iertutil.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        193024              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iepeers.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        388608              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iedkcs32.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        380928              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieapfltr.dll
+ 2010-04-16 11:06 . 2010-04-16 11:06        161792              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieakui.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        230400              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieaksie.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        153088              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieakeng.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        132608              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\extmgr.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        214528              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\dxtrans.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        347136              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\dxtmsft.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        124928              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\advpack.dll
+ 2010-06-19 20:04 . 2009-05-26 11:40        388984              c:\windows\$hf_mig$\KB980218\update\updspapi.dll
+ 2010-06-19 20:04 . 2009-05-26 11:40        765304              c:\windows\$hf_mig$\KB980218\update\update.exe
+ 2010-06-19 20:04 . 2009-05-26 11:40        234872              c:\windows\$hf_mig$\KB980218\spuninst.exe
+ 2010-04-20 05:37 . 2010-04-20 05:37        285824              c:\windows\$hf_mig$\KB980218\SP3QFE\atmfd.dll
+ 2010-04-20 05:29 . 2010-04-20 05:29        285696              c:\windows\$hf_mig$\KB980218\SP3GDR\atmfd.dll
+ 2010-04-20 05:42 . 2010-04-20 05:42        285824              c:\windows\$hf_mig$\KB980218\SP2QFE\atmfd.dll
+ 2010-06-19 20:04 . 2008-07-08 13:00        388984              c:\windows\$hf_mig$\KB980195\update\updspapi.dll
+ 2010-06-19 20:04 . 2008-07-08 13:00        765304              c:\windows\$hf_mig$\KB980195\update\update.exe
+ 2010-06-19 20:04 . 2008-07-08 13:00        234872              c:\windows\$hf_mig$\KB980195\spuninst.exe
+ 2010-06-19 20:02 . 2009-05-26 11:40        388984              c:\windows\$hf_mig$\KB979559\update\updspapi.dll
+ 2010-06-19 20:02 . 2009-05-26 11:40        765304              c:\windows\$hf_mig$\KB979559\update\update.exe
+ 2010-06-19 20:02 . 2009-05-26 09:01        234872              c:\windows\$hf_mig$\KB979559\spuninst.exe
+ 2010-06-19 19:59 . 2009-05-26 11:40        388984              c:\windows\$hf_mig$\KB979482\update\updspapi.dll
+ 2010-06-19 19:59 . 2009-05-26 11:40        765304              c:\windows\$hf_mig$\KB979482\update\update.exe
+ 2010-06-19 19:59 . 2009-05-26 11:40        234872              c:\windows\$hf_mig$\KB979482\spuninst.exe
+ 2010-06-19 19:59 . 2009-05-26 11:40        388984              c:\windows\$hf_mig$\KB975562\update\updspapi.dll
+ 2010-06-19 19:59 . 2009-05-26 11:40        765304              c:\windows\$hf_mig$\KB975562\update\update.exe
+ 2010-06-19 19:59 . 2008-07-08 13:00        234872              c:\windows\$hf_mig$\KB975562\spuninst.exe
+ 2010-07-27 10:03 . 2010-02-22 17:52        388984              c:\windows\$hf_mig$\KB2229593\update\updspapi.dll
+ 2010-07-27 10:03 . 2010-02-22 14:21        765304              c:\windows\$hf_mig$\KB2229593\update\update.exe
+ 2010-07-27 10:03 . 2009-05-26 11:40        234872              c:\windows\$hf_mig$\KB2229593\spuninst.exe
+ 2010-07-23 20:44 . 2010-06-14 14:38        744448              c:\windows\$hf_mig$\KB2229593\SP3QFE\helpsvc.exe
+ 2010-07-23 20:44 . 2010-06-14 14:31        744448              c:\windows\$hf_mig$\KB2229593\SP3GDR\helpsvc.exe
+ 2010-07-23 20:44 . 2010-06-14 15:13        744448              c:\windows\$hf_mig$\KB2229593\SP2QFE\helpsvc.exe
+ 2007-10-29 12:00 . 2010-04-03 04:39        2377576              c:\windows\system32\WMVCore.dll
+ 2007-10-29 12:00 . 2010-05-02 08:24        1851008              c:\windows\system32\win32k.sys
+ 2009-03-23 15:20 . 2010-04-19 18:47        3062048              c:\windows\system32\usbaaplrc.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        1168384              c:\windows\system32\urlmon.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        1168384              c:\windows\system32\urlmon.dll
+ 2009-10-02 16:37 . 2010-04-15 10:22        2717696              c:\windows\system32\spool\drivers\w32x86\3\ricaz0us.dll
+ 2009-10-02 16:37 . 2010-04-15 10:22        1856512              c:\windows\system32\spool\drivers\w32x86\3\ricaz0ur.dll
+ 2009-10-02 16:37 . 2010-04-15 10:22        1046016              c:\windows\system32\spool\drivers\w32x86\3\ricaz0cd.dll
+ 2010-07-07 07:56 . 2010-04-15 19:13        3499008              c:\windows\system32\spool\drivers\w32x86\3\hpiur7sm.dll
+ 2010-07-07 07:56 . 2010-04-15 19:13        3588608              c:\windows\system32\spool\drivers\w32x86\3\hpiui7sm.dll
+ 2010-07-07 07:56 . 2010-04-15 19:12        2657280              c:\windows\system32\spool\drivers\w32x86\3\hpist7sm.dll
+ 2010-07-07 07:56 . 2010-04-15 19:13        1666560              c:\windows\system32\spool\drivers\w32x86\3\hpils7sm.dll
+ 2010-07-07 07:56 . 2010-04-15 19:13        1723392              c:\windows\system32\spool\drivers\w32x86\3\hpi3a7sm.dll
+ 2009-09-01 23:37 . 2009-09-01 23:37        3189760              c:\windows\system32\spool\drivers\w32x86\3\hpbcfgre.dll
+ 2010-10-18 16:11 . 2009-03-05 22:59        1900544              c:\windows\system32\ReinstallBackups\0003\DriverFiles\usbaaplrc.dll
+ 2007-10-29 12:00 . 2010-02-05 18:38        1296896              c:\windows\system32\quartz.dll
- 2007-10-29 12:00 . 2009-11-27 17:33        1296896              c:\windows\system32\quartz.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        3600384              c:\windows\system32\mshtml.dll
- 2007-08-13 17:54 . 2010-03-11 12:31        6067200              c:\windows\system32\ieframe.dll
+ 2007-08-13 17:54 . 2010-05-04 17:14        6067200              c:\windows\system32\ieframe.dll
+ 2010-10-18 16:11 . 2010-04-19 18:47        3062048              c:\windows\system32\DRVSTORE\usbaapl_5BE1FFC476B2D9925B428CF102B47444B9A16508\usbaaplrc.dll
+ 2010-10-18 16:11 . 2010-04-19 18:29        1461992              c:\windows\system32\DRVSTORE\netaapl_3A00C5601D92D37DDCB0AE45518D6B42BE1588E6\wdfcoinstaller01009.dll
+ 2007-10-29 12:00 . 2010-04-03 04:39        2377576              c:\windows\system32\dllcache\WMVCore.dll
+ 2007-10-29 12:00 . 2010-05-02 08:24        1851008              c:\windows\system32\dllcache\win32k.sys
+ 2007-10-29 12:00 . 2010-05-04 17:14        1168384              c:\windows\system32\dllcache\urlmon.dll
- 2007-10-29 12:00 . 2010-03-11 12:31        1168384              c:\windows\system32\dllcache\urlmon.dll
+ 2007-10-29 12:00 . 2010-02-05 18:38        1296896              c:\windows\system32\dllcache\quartz.dll
- 2007-10-29 12:00 . 2009-11-27 17:33        1296896              c:\windows\system32\dllcache\quartz.dll
+ 2007-10-29 12:00 . 2010-05-04 17:14        3600384              c:\windows\system32\dllcache\mshtml.dll
+ 2009-12-15 12:20 . 2010-05-04 17:14        6067200              c:\windows\system32\dllcache\ieframe.dll
- 2009-12-15 12:20 . 2010-03-11 12:31        6067200              c:\windows\system32\dllcache\ieframe.dll
+ 2010-10-18 16:20 . 2010-10-18 16:20        6333440              c:\windows\Installer\9fcddf.msi
+ 2010-10-18 16:16 . 2010-10-18 16:16        9472000              c:\windows\Installer\9fcaac.msi
+ 2010-10-18 16:11 . 2010-10-18 16:11        3084800              c:\windows\Installer\9fc375.msi
+ 2010-10-18 16:11 . 2010-10-18 16:11        1984000              c:\windows\Installer\9fc335.msi
+ 2010-04-24 15:08 . 2010-04-24 15:08        9129984              c:\windows\Installer\5df9f.msp
+ 2010-03-24 16:54 . 2010-03-24 16:54        3126272              c:\windows\Installer\5df8a.msp
+ 2010-03-24 16:54 . 2010-03-24 16:54        2516992              c:\windows\Installer\5df89.msp
+ 2010-04-24 15:07 . 2010-04-24 15:07        4667392              c:\windows\Installer\5df70.msp
+ 2010-04-24 15:05 . 2010-04-24 15:05        4199424              c:\windows\Installer\5df5c.msp
+ 2010-05-18 21:35 . 2010-05-18 21:35        5023744              c:\windows\Installer\5df48.msp
+ 2010-04-24 15:10 . 2010-04-24 15:10        8486400              c:\windows\Installer\5df1f.msp
+ 2010-08-13 16:01 . 2010-08-13 16:01        8993280              c:\windows\Installer\473da.msp
+ 2010-08-13 15:59 . 2010-08-13 15:59        8182272              c:\windows\Installer\473c6.msp
+ 2010-08-13 16:02 . 2010-08-13 16:02        2545664              c:\windows\Installer\473b2.msp
+ 2010-08-13 16:00 . 2010-08-13 16:00        9404928              c:\windows\Installer\4739e.msp
+ 2010-09-17 04:06 . 2010-09-17 04:06        3355648              c:\windows\Installer\47389.msp
+ 2010-05-18 20:53 . 2010-05-18 20:53        1583616              c:\windows\Installer\3b1f82.msi
+ 2010-09-17 05:04 . 2010-09-17 05:04        9401856              c:\windows\Installer\35ef5.msp
+ 2010-10-21 17:12 . 2010-10-21 17:12        3359744              c:\windows\Installer\35ee1.msp
+ 2010-10-07 17:43 . 2010-10-07 17:43        1980416              c:\windows\Installer\35ecd.msp
+ 2010-10-21 17:10 . 2010-10-21 17:10        3995136              c:\windows\Installer\2e749.msp
+ 2010-12-16 23:17 . 2010-12-16 23:17        3362304              c:\windows\Installer\2e731.msp
+ 2010-08-19 15:57 . 2010-08-19 15:57        3395584              c:\windows\Installer\2b717.msp
+ 2010-07-10 18:14 . 2010-07-10 18:14        2850816              c:\windows\Installer\2b703.msp
+ 2010-11-05 09:52 . 2010-11-05 09:52        1580544              c:\windows\Installer\27b75f.msi
+ 2010-05-20 17:57 . 2010-05-20 17:57        4989952              c:\windows\Installer\232db.msp
+ 2010-05-20 17:57 . 2010-05-20 17:57        5907456              c:\windows\Installer\232da.msp
+ 2010-06-11 09:03 . 2010-06-11 09:03        5021184              c:\windows\Installer\232bd.msp
- 2008-09-24 10:27 . 2010-05-13 07:53        1172240              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        1172240              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
- 2008-09-24 10:27 . 2010-05-13 07:53        1165584              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-09-24 10:27 . 2011-01-13 10:55        1165584              c:\windows\Installer\{91120000-0011-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-11-10 01:41 . 2008-11-10 01:41        2014584              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\PPTVIEW.EXE
+ 2009-03-06 03:26 . 2009-03-06 03:26        5466488              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\IPDESIGN.DLL
+ 2008-11-03 23:40 . 2008-11-03 23:40        1442160              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\INFOPATH.EXE
+ 2010-06-19 19:56 . 2010-03-11 12:31        1168384              c:\windows\ie7updates\KB982381-IE7\urlmon.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        3599872              c:\windows\ie7updates\KB982381-IE7\mshtml.dll
+ 2010-06-19 19:56 . 2010-03-11 12:31        6067200              c:\windows\ie7updates\KB982381-IE7\ieframe.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        1171968              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\urlmon.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        3603456              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\mshtml.dll
+ 2010-05-04 16:48 . 2010-05-04 16:48        6071296              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieframe.dll
+ 2010-06-18 14:47 . 2009-06-29 08:33        2452872              c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\ieapfltr.dat
+ 2010-05-02 08:00 . 2010-05-02 08:00        1860480              c:\windows\$hf_mig$\KB979559\SP3QFE\win32k.sys
+ 2010-05-02 08:05 . 2010-05-02 08:05        1851392              c:\windows\$hf_mig$\KB979559\SP3GDR\win32k.sys
+ 2010-05-02 07:54 . 2010-05-02 07:54        1860096              c:\windows\$hf_mig$\KB979559\SP2QFE\win32k.sys
+ 2010-02-05 18:28 . 2010-02-05 18:28        1297408              c:\windows\$hf_mig$\KB975562\SP3QFE\quartz.dll
+ 2010-02-05 18:25 . 2010-02-05 18:25        1297408              c:\windows\$hf_mig$\KB975562\SP3GDR\quartz.dll
+ 2010-02-05 18:19 . 2010-02-05 18:19        1297408              c:\windows\$hf_mig$\KB975562\SP2QFE\quartz.dll
+ 2009-04-05 12:29 . 2011-01-04 16:20        37403080              c:\windows\system32\MRT.exe
+ 2010-04-24 15:09 . 2010-04-24 15:09        11750912              c:\windows\Installer\5dfb3.msp
+ 2010-04-24 15:07 . 2010-04-24 15:07        10118144              c:\windows\Installer\5df34.msp
+ 2010-12-21 12:06 . 2010-12-21 12:06        11570688              c:\windows\Installer\2e71d.msp
+ 2010-07-22 23:04 . 2010-07-22 23:04        11395072              c:\windows\Installer\2b6ef.msp
+ 2010-07-10 18:06 . 2010-07-10 18:06        10120192              c:\windows\Installer\2b6d6.msp
+ 2010-05-20 17:58 . 2010-05-20 17:58        12114432              c:\windows\Installer\232a9.msp
+ 2009-03-06 01:37 . 2009-03-06 01:37        10222432              c:\windows\Installer\$PatchCache$\Managed\00002119110000000000000000F01FEC\12.0.6425\MSACCESS.EXE
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-10-29 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21        548352        ----a-w-        c:\programme\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50        155648        -c--a-w-        c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\ICQ6\\ICQ.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office Communicator\\communicator.exe"=
"c:\\Programme\\BitLord\\BitLord.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=

R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2010/04/10 11:51 AM 30280]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [2010/02/17 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [2010/05/06 04:10 PM 67656]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [2009/05/25 08:31 AM 108289]
R2 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2010/04/10 11:51 AM 53088]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010/04/01 02:14 PM 1050440]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2010/04/10 11:50 AM 24368]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010/02/24 01:41 PM 10064]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-11-26 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2006\SystemOptimizer.exe [2005-08-17 20:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Download with Xilisoft Download YouTube Video - c:\programme\Xilisoft\Download YouTube Video\upod_link.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4C833081-D026-4FF8-968F-7EAB660D2FBA} - hxxp://download.tvants.com/pub/tvants/tvants1/win32/cab/tvants.cab
FF - ProfilePath - c:\dokumente und einstellungen\Sebastian\Anwendungsdaten\Mozilla\Firefox\Profiles\y6054xfg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: ColorfulTabs: {0545b830-f0aa-4d7e-8820-50a4629a56fe} - %profile%\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-01-17 14:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\windows\TEMP\mc21.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1252)
c:\programme\TuneUp Utilities 2006\WinStylerThemeHelper.dll
c:\programme\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\igfxdev.dll

- - - - - - - > 'lsass.exe'(1328)
c:\programme\TuneUp Utilities 2006\WinStylerThemeHelper.dll
.
Completion time: 2011-01-17  14:19:06
ComboFix-quarantined-files.txt  2011-01-17 13:19
ComboFix2.txt  2010-05-18 19:47
ComboFix3.txt  2010-05-18 18:32
ComboFix4.txt  2010-05-13 08:03

Pre-Run: 9 Verzeichnis(se), 69,503,574,016 Bytes frei
Post-Run: 11 Verzeichnis(se), 69,482,278,912 Bytes frei

- - End Of File - - 474582C95590D0EE886E8423F54D456B
--- --- ---

cosinus 17.01.2011 14:53
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

2Dope2Cope 18.01.2011 19:01
tach post!

also hier die logs:

GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-17 15:53:24
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HTS541680J9SA00 rev.SB2OC7BP
Running: 3dkf3ig7[1].exe; Driver: C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\uxdoikob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwAssignProcessToJobObject [0xAA33B464]
SSDT            F7CCADB6                                                                                                                                                        ZwCreateKey
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwCreateThread [0xAA33B49E]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwDeleteKey [0xAA33B290]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwDeleteValueKey [0xAA33B302]
SSDT            F7CCADCA                                                                                                                                                        ZwLoadKey
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwOpenProcess [0xAA33B7B2]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwOpenThread [0xAA33B68E]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwProtectVirtualMemory [0xAA33B52A]
SSDT            F7CCADD4                                                                                                                                                        ZwReplaceKey
SSDT            F7CCADCF                                                                                                                                                        ZwRestoreKey
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwSetContextThread [0xAA33B426]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwSetValueKey [0xAA33B38E]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwTerminateProcess [0xAA33B8E6]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwTerminateThread [0xAA33B5AE]
SSDT            \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx)                                                                                          ZwWriteVirtualMemory [0xAA33B5E6]

Code            \??\C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\catchme.sys                                                                                                              pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

?              C:\WINDOWS\TEMP\mc21.tmp                                                                                                                                        Das System kann die angegebene Datei nicht finden. !
?              C:\WINDOWS\system32\Drivers\PROCEXP113.SYS                                                                                                                      Das System kann die angegebene Datei nicht finden. !
?              C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\catchme.sys                                                                                                                  Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\wdfmgr.exe[168] kernel32.dll!LoadLibraryExW                                                                                                  7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\wdfmgr.exe[168] kernel32.dll!FreeLibrary + 15                                                                                                7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\wdfmgr.exe[168] kernel32.dll!CreateFileW                                                                                                    7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe[280] kernel32.dll!LoadLibraryExW                                                                        7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe[280] kernel32.dll!FreeLibrary + 15                                                                      7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe[280] kernel32.dll!CreateFileW                                                                          7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe[336] kernel32.dll!LoadLibraryExW                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe[336] kernel32.dll!FreeLibrary + 15                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe[336] kernel32.dll!CreateFileW                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[376] kernel32.dll!LoadLibraryExW                                        7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[376] kernel32.dll!FreeLibrary + 15                                      7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[376] kernel32.dll!CreateFileW                                          7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\spoolsv.exe[464] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\spoolsv.exe[464] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\spoolsv.exe[464] kernel32.dll!CreateFileW                                                                                                    7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Avira\AntiVir Desktop\sched.exe[560] kernel32.dll!LoadLibraryExW                                                                                    7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Avira\AntiVir Desktop\sched.exe[560] kernel32.dll!FreeLibrary + 15                                                                                  7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Avira\AntiVir Desktop\sched.exe[560] kernel32.dll!CreateFileW                                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[608] kernel32.dll!LoadLibraryExW                                                                                  7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[608] kernel32.dll!FreeLibrary + 15                                                                                7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Avira\AntiVir Desktop\avguard.exe[608] kernel32.dll!CreateFileW                                                                                    7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Bonjour\mDNSResponder.exe[856] kernel32.dll!LoadLibraryExW                                                                                          7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Bonjour\mDNSResponder.exe[856] kernel32.dll!FreeLibrary + 15                                                                                        7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Bonjour\mDNSResponder.exe[856] kernel32.dll!CreateFileW                                                                                            7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Intel\Wireless\Bin\EvtEng.exe[904] kernel32.dll!LoadLibraryExW                                                                                      7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Intel\Wireless\Bin\EvtEng.exe[904] kernel32.dll!FreeLibrary + 15                                                                                    7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Intel\Wireless\Bin\EvtEng.exe[904] kernel32.dll!CreateFileW                                                                                        7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\csrss.exe[1180] KERNEL32.dll!LoadLibraryExW                                                                                                  7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\csrss.exe[1180] KERNEL32.dll!CreateFileW                                                                                                    7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[1204] kernel32.dll!LoadLibraryExW                                                                                    7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[1204] kernel32.dll!FreeLibrary + 15                                                                                  7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Intel\Wireless\Bin\RegSrvc.exe[1204] kernel32.dll!CreateFileW                                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\winlogon.exe[1252] kernel32.dll!LoadLibraryExW                                                                                              7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\winlogon.exe[1252] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\services.exe[1316] kernel32.dll!LoadLibraryExW                                                                                              7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\services.exe[1316] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\lsass.exe[1328] kernel32.dll!LoadLibraryExW                                                                                                  7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\lsass.exe[1328] kernel32.dll!CreateFileW                                                                                                    7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\svchost.exe[1540] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\notepad.exe[1572] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\notepad.exe[1572] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\notepad.exe[1572] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\svchost.exe[1624] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe[1636] kernel32.dll!LoadLibraryExW                                                                      7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe[1636] kernel32.dll!CreateFileW                                                                          7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\System32\svchost.exe[1732] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\System32\svchost.exe[1732] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\System32\svchost.exe[1732] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\svchost.exe[1764] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\svchost.exe[1764] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\svchost.exe[1764] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1844] kernel32.dll!LoadLibraryExW                                                                                  7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1844] kernel32.dll!FreeLibrary + 15                                                                                7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Intel\Wireless\Bin\S24EvMon.exe[1844] kernel32.dll!CreateFileW                                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\svchost.exe[1904] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\svchost.exe[1904] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\svchost.exe[1904] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[1924] kernel32.dll!LoadLibraryExW                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[1924] kernel32.dll!FreeLibrary + 15                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[1924] kernel32.dll!CreateFileW                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\svchost.exe[1952] kernel32.dll!CreateFileW                                                                                                  7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe[2296] kernel32.dll!LoadLibraryExW                                                                    7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe[2296] kernel32.dll!FreeLibrary + 15                                                                  7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe[2296] kernel32.dll!CreateFileW                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!LoadLibraryExW                                                                                                    7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!FreeLibrary + 15                                                                                                  7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\System32\alg.exe[2320] kernel32.dll!CreateFileW                                                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2448] kernel32.dll!LoadLibraryExW                                                                                  7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2448] kernel32.dll!FreeLibrary + 15                                                                                7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Avira\AntiVir Desktop\avgnt.exe[2448] kernel32.dll!CreateFileW                                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\iTunes\iTunesHelper.exe[2504] kernel32.dll!LoadLibraryExW                                                                                          7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\iTunes\iTunesHelper.exe[2504] kernel32.dll!FreeLibrary + 15                                                                                        7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\iTunes\iTunesHelper.exe[2504] kernel32.dll!CreateFileW                                                                                              7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\system32\ctfmon.exe[2520] kernel32.dll!LoadLibraryExW                                                                                                7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\system32\ctfmon.exe[2520] kernel32.dll!FreeLibrary + 15                                                                                              7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\system32\ctfmon.exe[2520] kernel32.dll!CreateFileW                                                                                                    7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\iPod\bin\iPodService.exe[2772] kernel32.dll!LoadLibraryExW                                                                                          7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\iPod\bin\iPodService.exe[2772] kernel32.dll!FreeLibrary + 15                                                                                        7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\iPod\bin\iPodService.exe[2772] kernel32.dll!CreateFileW                                                                                            7C810770 6 Bytes  JMP 5F040F5A
.text          C:\WINDOWS\explorer.exe[3172] kernel32.dll!LoadLibraryExW                                                                                                        7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\WINDOWS\explorer.exe[3172] kernel32.dll!FreeLibrary + 15                                                                                                      7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\WINDOWS\explorer.exe[3172] kernel32.dll!CreateFileW                                                                                                          7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] kernel32.dll!LoadLibraryExW                                                                                    7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] kernel32.dll!FreeLibrary + 15                                                                                  7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] kernel32.dll!CreateFileW                                                                                      7C810770 6 Bytes  JMP 5F040F5A
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxParamW                                                                                    7E37555F 5 Bytes  JMP 4115F4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxIndirectParamW                                                                            7E382032 5 Bytes  JMP 412D203E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxIndirectA                                                                                7E38A04A 5 Bytes  JMP 412D1FBF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxParamA                                                                                    7E38B10C 5 Bytes  JMP 412D2003 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxExW                                                                                      7E3A05D8 5 Bytes  JMP 412D1F4B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxExA                                                                                      7E3A05FC 5 Bytes  JMP 412D1F85 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxIndirectParamA                                                                            7E3A6B50 5 Bytes  JMP 412D2079 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxIndirectW                                                                                7E3B62AB 5 Bytes  JMP 4118176A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Programme\Internet Explorer\iexplore.exe[3492] ole32.dll!OleLoadFromStream                                                                                    774FA257 5 Bytes  JMP 412D223B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text          C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z3QG6YMM\3dkf3ig7[1].exe[3576] kernel32.dll!LoadLibraryExW    7C801AF1 6 Bytes  JMP 5F070F5A
.text          C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z3QG6YMM\3dkf3ig7[1].exe[3576] kernel32.dll!FreeLibrary + 15  7C80AC03 4 Bytes  CALL 5F00003D
.text          C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z3QG6YMM\3dkf3ig7[1].exe[3576] kernel32.dll!CreateFileW      7C810770 6 Bytes  JMP 5F040F5A

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                                          SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                                        pxrts.sys (Prevx Realtime Security/Prevx)

---- EOF - GMER 1.0.15 ----
--- --- ---





OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 15:58:34 on 17.01.2011

OS: Windows XP Professional Service Pack 2 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.17055

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Programme\TuneUp Utilities 2006\SystemOptimizer.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir Personal – Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"QlbConfig" - " Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbConfg.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
"SMAX4CP" - "Analog Devices, Inc." - C:\Programme\Analog Devices\SoundMAX\SMax4.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"mbr" (mbr) - ? - C:\cofi\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"mchInjDrv" (mchInjDrv) - ? - C:\WINDOWS\TEMP\mc21.tmp  (File not found)
"MREMP50 NDIS Protocol Driver" (MREMP50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\PROGRA~1\GEMEIN~1\Motive\MREMP50.SYS
"MRESP50 NDIS Protocol Driver" (MRESP50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\PROGRA~1\GEMEIN~1\Motive\MRESP50.SYS
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"pxkbf" (pxkbf) - "Prevx" - C:\WINDOWS\System32\drivers\pxkbf.sys
"pxrts" (pxrts) - "Prevx" - C:\WINDOWS\System32\drivers\pxrts.sys
"pxscan" (pxscan) - "Prevx" - C:\WINDOWS\System32\drivers\pxscan.sys
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys
"uxdoikob" (uxdoikob) - ? - C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\uxdoikob.sys  (Hidden registry entry, rootkit activity | File not found)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"WLAN-Transport" (s24trans) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\s24trans.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{59850401-6664-101B-B21C-00AA004BA90B} "Microsoft Office Binder Unbind" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2010\DseShExt-x86.dll
{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0} "TuneUp Shredder Shell Context Menu Extension" - "TuneUp Software GmbH" - C:\Programme\TuneUp Utilities 2006\sdshelex.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2010\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Yahoo! Toolbar" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{0CCA191D-13A6-4E29-B746-314DEE697D83} "Facebook Photo Uploader 5" - "Facebook, Inc." - C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx / hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? -  (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{4C833081-D026-4FF8-968F-7EAB660D2FBA} "TVAnts ActiveX Control" - "Zhejiang University" - C:\PROGRA~1\TVAntsX\TvantsX.ocx / hxxp://download.tvants.com/pub/tvants/tvants1/win32/cab/tvants.cab
{5D637FAD-E202-48D1-8F18-5B9C459BD1E3} "{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}" - ? -  (File not found | COM-object registry key not found) / hxxp://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1217956634
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll
"ICQ6" - "ICQ, Inc." - C:\Programme\ICQ6\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - ? - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Sebastian\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Canon BJ Language Monitor PIXMA iP3000" - "CANON INC." - C:\WINDOWS\system32\CNMLM61.DLL

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Bonjour Service" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
"iPod Service" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"McciCMService" (McciCMService) - "Motive Communications, Inc." - C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll
"TuneUp Drive Defrag-Dienst" (TuneUp.Defrag) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe
"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
"TuneUp WinStyler Theme Service" (TUWinStylerThemeSvc) - "TuneUp Software GmbH" - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----
"UIHost" - "Microsoft Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.dll
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru






MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 142):
0x804D7000 \WINDOWS\system32\TUKERNEL.EXE
0x80720000 \WINDOWS\system32\hal.dll
0xF7AD6000 \WINDOWS\system32\KDCOM.DLL
0xF79E6000 \WINDOWS\system32\BOOTVID.dll
0xF7586000 ACPI.sys
0xF7AD8000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7575000 pci.sys
0xF75D6000 isapnp.sys
0xF75E6000 ohci1394.sys
0xF75F6000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF79EA000 compbatt.sys
0xF79EE000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7B9E000 pciide.sys
0xF7856000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7557000 pcmcia.sys
0xF7606000 MountMgr.sys
0xF7538000 ftdisk.sys
0xF7ADA000 dmload.sys
0xF7512000 dmio.sys
0xF79F2000 ACPIEC.sys
0xF7B9F000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF785E000 PartMgr.sys
0xF7866000 pxscan.sys
0xF7616000 VolSnap.sys
0xF74FA000 atapi.sys
0xF7626000 disk.sys
0xF7636000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF74DA000 fltMgr.sys
0xF74C8000 sr.sys
0xF7646000 PxHelp20.sys
0xF74B1000 KSecDD.sys
0xF7424000 Ntfs.sys
0xF73F7000 NDIS.sys
0xF73DC000 Mup.sys
0xF7816000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6197000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xF6183000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF615E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF5F43000 \SystemRoot\system32\DRIVERS\NETw4x32.sys
0xF78E6000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF5F20000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78EE000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7826000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF7836000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0xF5F0C000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7846000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78F6000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0xF7676000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xF5E91000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xF78FE000 \SystemRoot\System32\drivers\pxkbf.sys
0xF7906000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF5E5C000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7AFA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF790E000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF6CC7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF6CB7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF6CA7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF5E39000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7916000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF7AA2000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0xF6C97000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF791E000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7AA6000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7AAA000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7BA8000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF6C87000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7AAE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF5E22000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF6C77000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF6C67000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7926000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5E11000 \SystemRoot\system32\DRIVERS\psched.sys
0xF6C57000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF792E000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7936000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF5DE0000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF6C47000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7AFC000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5D87000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AC6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7ACA000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF6C37000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xAA766000 \SystemRoot\system32\drivers\ADIHdAud.sys
0xAA744000 \SystemRoot\system32\drivers\portcls.sys
0xF76A6000 \SystemRoot\system32\drivers\drmk.sys
0xAA72C000 \SystemRoot\system32\drivers\AEAudio.sys
0xAA610000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xF794E000 \SystemRoot\System32\Drivers\Modem.SYS
0xF76E6000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B08000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C32000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B0A000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7976000 \SystemRoot\System32\drivers\vga.sys
0xF7B0C000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B0E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF797E000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7986000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF6736000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA9812000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA97BA000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xA9771000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xA9749000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA9727000 \SystemRoot\System32\drivers\afd.sys
0xF7706000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF798E000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xA9705000 \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
0xF7996000 \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
0xA96DA000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA966B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF7716000 \SystemRoot\System32\Drivers\Fips.SYS
0xA9635000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7736000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7746000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xF7B16000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xF77C6000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA961D000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B1A000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF5D5F000 \SystemRoot\System32\drivers\Dxapi.sys
0xF79DE000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BE6000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04E000 \SystemRoot\System32\igxpdv32.DLL
0xBF1D9000 \SystemRoot\System32\igxpdx32.DLL
0xA94C9000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xAA33A000 \SystemRoot\System32\drivers\pxrts.sys
0xF7C1F000 \??\C:\WINDOWS\TEMP\mc21.tmp
0xF78D6000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xA94BD000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA94A9000 \SystemRoot\system32\DRIVERS\s24trans.sys
0xA916C000 \SystemRoot\system32\drivers\wdmaud.sys
0xA9301000 \SystemRoot\system32\drivers\sysaudio.sys
0xF7AE2000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xA8EBF000 \SystemRoot\system32\DRIVERS\srv.sys
0xF7CAC000 \??\C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys
0xA895D000 \SystemRoot\System32\Drivers\HTTP.sys
0xF7B86000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
0xF7956000 \??\C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\catchme.sys
0xA864D000 \??\C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp\uxdoikob.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 38):
0 System Idle Process
4 System
1068 C:\WINDOWS\system32\smss.exe
1180 C:\WINDOWS\system32\csrss.exe
1252 C:\WINDOWS\system32\winlogon.exe
1316 C:\WINDOWS\system32\services.exe
1328 C:\WINDOWS\system32\lsass.exe
1540 C:\WINDOWS\system32\svchost.exe
1624 C:\WINDOWS\system32\svchost.exe
1636 C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
1732 C:\WINDOWS\system32\svchost.exe
1844 C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
1904 C:\WINDOWS\system32\svchost.exe
1952 C:\WINDOWS\system32\svchost.exe
464 C:\WINDOWS\system32\spoolsv.exe
560 C:\Programme\Avira\AntiVir Desktop\sched.exe
608 C:\Programme\Avira\AntiVir Desktop\avguard.exe
376 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
856 C:\Programme\Bonjour\mDNSResponder.exe
904 C:\Programme\Intel\Wireless\Bin\EvtEng.exe
280 C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe
1204 C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
1764 C:\WINDOWS\system32\svchost.exe
1924 C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
168 C:\WINDOWS\system32\wdfmgr.exe
336 C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
2296 C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
2320 C:\WINDOWS\system32\alg.exe
2448 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
2504 C:\Programme\iTunes\iTunesHelper.exe
2520 C:\WINDOWS\system32\ctfmon.exe
2772 C:\Programme\iPod\bin\iPodService.exe
1572 C:\WINDOWS\system32\notepad.exe
3172 C:\WINDOWS\explorer.exe
3492 C:\Programme\Internet Explorer\iexplore.exe
548 C:\WINDOWS\system32\msiexec.exe
3308 C:\WINDOWS\system32\wbem\wmiprvse.exe
3072 C:\Dokumente und Einstellungen\Sebastian\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541680J9SA00, Rev: SB2OC7BP

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!











Schönen Abend!

Gruß!

cosinus 18.01.2011 19:40
Zitat:
"mchInjDrv" (mchInjDrv) - ? - C:\WINDOWS\TEMP\mc21.tmp (File not found)
hattest du mal den Spyware Doctor installiert? :wtf:


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:23 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131