Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Virus versteckt Dateien - Windows Recovery Wurm (https://www.trojaner-board.de/97990-virus-versteckt-dateien-windows-recovery-wurm.html)

Bin 23.04.2011 12:50
Virus versteckt Dateien - Windows Recovery Wurm
 
Hi,

ich habe seit gestern leider das gleiche Problem!

Hier sind die Logs von OTL:

OTL Logfile:
Code:
OTL Extras logfile created on: 23.04.2011 13:40:18 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Dokumente und Einstellungen\USER\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 432,00 Mb Available Physical Memory | 42,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 71,35 Gb Free Space | 47,87% Space Free | Partition Type: NTFS
Drive D: | 149,05 Gb Total Space | 80,72 Gb Free Space | 54,16% Space Free | Partition Type: NTFS
Drive K: | 627,10 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: BINS-ATHLON64 | User Name: USER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Pinnacle\Shared Files\Programs\MediaManager\PMSManager.exe" = C:\Programme\Pinnacle\Shared Files\Programs\MediaManager\PMSManager.exe:LocalSubNet:Enabled:PMSManager.exe -- (Pinnacle Systems)
"C:\Programme\Pinnacle\MediaCenter\EpgSpoolerSrv.exe" = C:\Programme\Pinnacle\MediaCenter\EpgSpoolerSrv.exe:LocalSubNet:Enabled:EpgSpoolerSrv.exe -- ( )
"C:\Programme\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe" = C:\Programme\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe:LocalSubNet:Enabled:PMC.Service.Main.exe -- (Pinnacle Systems)
"C:\Programme\Pinnacle\MediaCenter\tvtvWizard.exe" = C:\Programme\Pinnacle\MediaCenter\tvtvWizard.exe:LocalSubNet:Enabled:tvtvWizard.exe -- (Pinnacle Systems)
"C:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSInstallInit.exe" = C:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe -- ( )
"C:\Games\Sierra\FEAR\FEAR.exe" = C:\Games\Sierra\FEAR\FEAR.exe:*:Enabled:FEAR -- ()
"C:\Programme\ICQ\ICQLite\ICQLite.exe" = C:\Programme\ICQ\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite -- (ICQ Ltd.)
"C:\Games\Firefly Studios\Stronghold 2\Stronghold2.exe" = C:\Games\Firefly Studios\Stronghold 2\Stronghold2.exe:*:Enabled:Stronghold 2 -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00EB0426-D2D7-4E92-B6F1-B28983E2BC0B}" = OEL Screensaver Studio
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{16D2C649-CBA8-44EE-B730-12584667D487}" = Stronghold 2
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1E728246-95D5-4E72-8A9A-AC62602F39D8}_is1" = ANSTOSS 3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{2B653229-9854-4989-B780-D978F5F13EAB}" = FEAR
"{2F173C40-563E-11D4-89C5-0010ADDAAC33}" = EA.com Matchup
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32F720F5-2D0D-4245-A2B0-9EB3CECF8101}" = Norton Ghost 10.0
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{460CE8B9-6EC2-458A-90D4-691631ECE9D9}" = Pinnacle MediaServer
"{6411B38F-7704-484B-A93B-FD900BC8E8EB}" = PIF DESIGNER2.0
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6E5BC38E-F22B-4197-00A2-CD8E58EF139D}" = FUSSBALL MANAGER 2005
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.5.3.139
"{782DCB70-3DF4-4366-00BF-E3767BCD173B}" = UEFA EURO 2004
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7BA1FB62-A363-4D24-8870-45131F0D0137}" = EPSON PRINT Image Framer Tool2.0
"{7C22BE34-6E56-4169-8DE3-16B2938621E4}" = Application Suite
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8A793FC6-6DF5-11DD-BB6A-00018021113F}" = EPSON PhotoQuicker3.4
"{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Security Suite CBE 09
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AB97F52-512B-43EF-AAEC-4825C17B32ED}" = EA.com Update
"{9FE3F0EA-3122-47F9-BA98-3132C12D3D33}" = SEGA Rally Revo Demo
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A433AE09-2126-4dad-9CBD-C1B05DC42787}" = Windows Messenger 5.1
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A70000000000}" = Adobe Reader 7.0 - Deutsch
"{ADBBED4F-720B-460D-AA14-D85EBC4AEF97}" = TextPad
"{AFA9D219-A7FD-4240-8793-E5C7C9D715F4}" = IKEA Home Planner
"{B208806F-A231-4FA0-AB3F-5C1B8979223E}" = Microsoft ActiveSync 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B73B4A99-4173-4747-BBEC-0F05E966F9D2}" = Battlefield 1942: Secret Weapons of WWII
"{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1" = Eraser 5.8.7
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C64121E9-B741-4177-00BD-7B228D3F6723}" = F1 2002
"{CA0A1E54-CE0F-4366-B09C-A87B61DC5633}" = Symantec Network Drivers Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}" = Battlefield 1942: The Road To Rome
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D474A0E8-4421-43C0-BE8E-F454F91E2E2A}" = Race Driver 2
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (PINNACLESYS)
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E875BE90-42E6-4539-94CC-99922FA5764B}" = pac-it MOS 2003 Test
"{E8FC7C35-F467-453D-9077-246C2178EF77}_is1" = Anstoss action A3 Integration
"{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" =           
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle MediaCenter
"{FA031DA5-05D0-4937-BD2B-DCEC47A2506B}_is1" = ANSTOSS 2007
"{FEBC7B8D-BC69-46F7-A872-7698D03127C8}" = DiRT Demo
"0852D05415AB9A4F1EF451E342267F76C776ED2F" = Windows-Treiberpaket - Nokia Modem  (11/03/2006 6.82.0.1)
"0C5EDC3653FED5B121F464339EAC12534D253B25" = Windows Driver Package - Nokia Modem  (02/15/2007 3.1)
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 4.5)
"3D Haus Design Studio_is1" = 3D Haus Design Studio - Standard Edition -
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2004
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"aEton CommunicaEor" = aEton CommunicaEor
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"AnalogX CookieWall" = AnalogX CookieWall
"AnalogX Proxy" = AnalogX Proxy
"AnyDVD" = AnyDVD
"ATITool" = ATITool Overclocking Utility
"AVMWLANCLI" = AVM FRITZ!WLAN
"Back4Win_is1" = Back4Win
"BC2_is1" = Beyond Compare Version 2.5
"Canon PhotoStitch 3.1" = Canon Utilities PhotoStitch 3.1
"CCleaner" = CCleaner
"CloneDVD2" = CloneDVD2
"Cultures - Die Entdeckung Vinlands" = Cultures - Die Entdeckung Vinlands
"DCXtended .9" = DCXtended .9
"DesertCombat" = DesertCombat  0.7
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDFab Platinum 4_is1" = DVDFab Platinum 4.0.5.0
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows-Treiberpaket - Nokia Modem  (06/09/2010 7.01.0.7)
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"Family Fun RC Racers" = Big Fun Funk-Flitzer
"FarmingSimulator2008_is1" = Landwirtschafts Simulator 2008
"FLV Player" = FLV Player 2.0 (build 25)
"fotokasten Comfort_is1" = fotokasten Comfort
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free DVD Video Burner_is1" = Free DVD Video Burner version 1.2
"Free DVD Video Converter_is1" = Free DVD Video Converter version 1.1
"Free Video to DVD Converter_is1" = Free Video to DVD Converter version 1.2
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16
"Free YouTube Download_is1" = Free YouTube Download version 2.10.33.324
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9
"Google Updater" = Google Updater
"GreenBox_is1" = GreenBox 1.0
"ICQ" = ICQ
"ICQLite" = ICQ 5.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{9FE3F0EA-3122-47F9-BA98-3132C12D3D33}" = SEGA Rally Revo Demo
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{D474A0E8-4421-43C0-BE8E-F454F91E2E2A}" = Race Driver 2
"InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Security Suite CBE 09
"Links 2001 1.0" = Microsoft Links 2001
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 2.6 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NeroVision!UninstallKey" = NeroVision Express 2
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"Odometer" = Odometer
"PhotoRecord" = Canon PhotoRecord
"Pizza Syndicate" = Pizza Syndicate deinstallieren
"QuickPar" = QuickPar 0.9
"ratDVD" = ratDVD 0.78.1444
"RemoteCapture" = Canon Utilities RemoteCapture 1.1
"Uninstall_is1" = Uninstall 1.0.0.1
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.21-2c
"WinRAR archiver" = WinRAR Archivierer
"xp-AntiSpy" = xp-AntiSpy 3.95
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZoomBrowserEXDeInstall" = Canon Utilities ZoomBrowser EX
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.04.2011 14:51:56 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
 
Error - 12.04.2011 06:07:08 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
 
Error - 12.04.2011 06:07:08 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
 
Error - 12.04.2011 06:07:08 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
 
Error - 12.04.2011 08:24:52 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: The server name or address could not be resolved
.
 
Error - 12.04.2011 08:24:52 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
 
Error - 12.04.2011 08:24:52 | Computer Name = BINS-ATHLON64 | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.
.
 
Error - 23.04.2011 04:49:29 | Computer Name = BINS-ATHLON64 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x743b2222.
 
Error - 23.04.2011 04:49:35 | Computer Name = BINS-ATHLON64 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
 Modul ntdll.dll, Version 5.1.2600.2180, Fehleradresse 0x00043345.
 
Error - 23.04.2011 05:07:23 | Computer Name = BINS-ATHLON64 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung chrome.exe, Version 0.0.0.0, fehlgeschlagenes
 Modul unknown, Version 0.0.0.0, Fehleradresse 0x31344342.
 
[ System Events ]
Error - 23.04.2011 04:23:51 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 23.04.2011 04:23:55 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7034
Description = Dienst "Symantec Event Manager" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 23.04.2011 04:24:01 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7034
Description = Dienst "MSSQL$PINNACLESYS" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 23.04.2011 04:24:03 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7034
Description = Dienst "Symantec Network Drivers Service" wurde unerwartet beendet.
 Dies ist bereits 1 Mal passiert.
 
Error - 23.04.2011 04:24:06 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7034
Description = Dienst "Symantec Settings Manager" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
 
Error - 23.04.2011 04:45:13 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "adfs" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%2
 
Error - 23.04.2011 04:46:47 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Pinnacle Systems Media Service" wurde nicht ordnungsgemäß
 gestartet.
 
Error - 23.04.2011 04:58:47 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "adfs" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%2
 
Error - 23.04.2011 05:00:21 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Pinnacle Systems Media Service" wurde nicht ordnungsgemäß
 gestartet.
 
Error - 23.04.2011 07:35:58 | Computer Name = BINS-ATHLON64 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "adfs" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%2
 
 
< End of report >
--- --- ---




OTL Logfile:
Code:
OTL logfile created on: 23.04.2011 13:40:18 - Run 1
OTL by OldTimer - Version 3.2.22.3    Folder = C:\Dokumente und Einstellungen\USER\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 432,00 Mb Available Physical Memory | 42,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 81,00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 71,35 Gb Free Space | 47,87% Space Free | Partition Type: NTFS
Drive D: | 149,05 Gb Total Space | 80,72 Gb Free Space | 54,16% Space Free | Partition Type: NTFS
Drive K: | 627,10 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: BINS-ATHLON64 | User Name: USER | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\USER\Eigene Dateien\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Programme\Eraser\Eraser.exe (The Eraser Project)
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCSETMGR.EXE (Symantec Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCEVTMGR.EXE (Symantec Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
PRC - C:\Programme\Norton\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\gearsec.exe (GEAR Software)
PRC - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
PRC - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (Rocket Division Software)
PRC - c:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe (Pinnacle Systems)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\MDM.EXE (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe (SEIKO EPSON CORPORATION)
PRC - C:\WINDOWS\system32\Crypserv.exe (Kenonic Controls Ltd.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\USER\Eigene Dateien\Downloads\OTL (1).exe (OldTimer Tools)
MOD - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\kloehk.dll (Kaspersky Lab)
MOD - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\adialhk.dll (Kaspersky Lab)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2527_x-ww_aa415c8a\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AppMgmt) --  File not found
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AVP) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe (Kaspersky Lab)
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (ccSetMgr) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (Symantec Core LC) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (Norton Ghost) -- C:\Programme\Norton\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
SRV - (GEARSecurity) -- C:\WINDOWS\system32\gearsec.exe (GEAR Software)
SRV - (SNDSrvc) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (StarWindService) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (Rocket Division Software)
SRV - (PinnacleSys.MediaServer) -- c:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe (Pinnacle Systems)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
SRV - (EPSONStatusAgent2) -- C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe (SEIKO EPSON CORPORATION)
SRV - (Crypkey License) -- C:\WINDOWS\System32\Crypserv.exe (Kenonic Controls Ltd.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (FWLANUSB) -- C:\WINDOWS\system32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (avmeject) -- C:\WINDOWS\system32\drivers\avmeject.sys (AVM Berlin)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (KLFLTDEV) -- C:\WINDOWS\system32\drivers\klfltdev.sys (Kaspersky Lab)
DRV - (klbg) -- C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (ATITool) -- C:\WINDOWS\system32\drivers\ATITool.sys ()
DRV - (SYMIDSCO) -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SymcData\ids-diskless\20061113.031\SymIDSCo.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\Programme\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (dtscsi) -- C:\WINDOWS\System32\Drivers\dtscsi.sys ()
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (symlcbrd) -- C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (SymSnap) -- C:\WINDOWS\System32\drivers\SymSnap.sys (StorageCraft)
DRV - (V2IMount) -- C:\WINDOWS\System32\drivers\V2iMount.sys (Symantec Corporation)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (Vax347b) -- C:\WINDOWS\system32\DRIVERS\Vax347b.sys ( )
DRV - (ElbyDelay) -- C:\WINDOWS\system32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMIDS) -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMNDIS) -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMFW) -- C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMDNS) -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvcchflt) -- C:\WINDOWS\system32\DRIVERS\nvcchflt.sys (NVIDIA Corporation)
DRV - (nvatabus) -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (3xHybrid) -- C:\WINDOWS\system32\drivers\3xHybrid.sys (Philips Semiconductors GmbH)
DRV - (nvcap) nVidia WDM Video Capture (universal) -- C:\WINDOWS\system32\drivers\nvcap.sys (NVIDIA Corporation)
DRV - (NVXBAR) -- C:\WINDOWS\system32\drivers\nvxbar.sys (NVIDIA Corporation)
DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (Changer) -- C:\WINDOWS\System32\drivers\Changer.sys (Microsoft Corporation)
DRV - (lbrtfdc) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys (Toshiba Corp.)
DRV - (MPE) -- C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (Vax347s) -- C:\WINDOWS\System32\Drivers\Vax347s.sys ( )
DRV - (prohlp02) -- C:\WINDOWS\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) -- C:\WINDOWS\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (Aspi32) -- C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
DRV - (sfhlp01) -- C:\WINDOWS\System32\drivers\sfhlp01.sys (Protection Technology)
DRV - (ASAPIW2k) -- C:\WINDOWS\system32\drivers\asapiW2k.sys (Pinnacle Systems GmbH)
DRV - (prosync1) -- C:\WINDOWS\System32\drivers\prosync1.sys (Protection Technology)
DRV - (NetworkX) -- C:\WINDOWS\system32\ckldrv.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: MapShare-status@tomtom.com:1.6
FF - prefs.js..extensions.enabledItems: baseTheme@tomtom.com:1.0.1
 
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\THBExt [2010.03.03 10:26:50 | 000,000,000 | ---D | M]
 
[2009.03.29 16:05:44 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\Mozilla\Extensions
[2009.03.29 16:05:44 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
File not found (No name found) -- C:\PROGRAMME\TOMTOM HOME 2\XUL\EXTENSIONS\MAPSHARE-STATUS@TOMTOM.COM
 
O1 HOSTS File: ([2009.01.22 19:26:28 | 000,000,853 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1                                activate.adobe.com
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [Eraser] C:\Programme\Eraser\Eraser.exe (The Eraser Project)
O4 - HKCU..\Run: [GoWNKtoBbTfMqRQ]  File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Odometer.lnk = C:\Programme\Odometer\Odometer.exe (Introspect Software)
O4 - Startup: C:\Dokumente und Einstellungen\USER\Startmenü\Programme\Autostart\CookieWall.lnk = C:\Programme\AnalogX\CookieWall\cookie.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\USER\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\USER\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\ie_banner_deny.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} hxxp://s1.teamlearn.de/qp2.cab (QuickPlace Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1279637737812 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1279637718640 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\adialhk.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.10.28 14:48:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.03.05 14:43:04 | 000,000,000 | -H-D | M] - D:\Autos -- [ NTFS ]
O32 - AutoRun File - [2003.07.05 23:33:08 | 000,892,975 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2003.07.14 21:52:34 | 000,000,091 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{7d6c6d24-1c6a-11de-b7fd-001f3f005b34}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.23 13:39:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USER\Eigene Dateien\Downloads
[2011.04.23 11:12:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\Malwarebytes
[2011.04.23 11:12:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.04.23 11:12:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2011.04.23 11:12:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.04.23 11:12:36 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.04.23 11:12:02 | 007,734,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\USER\Desktop\mbam-setup-1.50.1.1100.exe
[2011.04.23 10:19:03 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\USER\Recent
[2011.04.22 21:09:05 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spybot - Search & Destroy
[2011.04.22 21:08:59 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2011.04.12 23:42:59 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DVDVideoSoft
[2011.03.27 21:36:35 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\USER\Startmenü\Programme\Google Chrome
[2008.03.12 17:34:45 | 000,047,360 | -H-- | C] (VSO Software) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\pcouffin.sys
[2006.10.05 17:40:04 | 001,772,544 | ---- | C] (CommunicaEtor) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Updater.exe
[2006.10.05 17:40:03 | 005,511,168 | ---- | C] (aEton Usenet LTD) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CommunicaEtor.exe
[2005.12.08 22:42:33 | 000,159,616 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347b.sys
[2005.12.08 22:42:33 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347s.sys
[2004.01.09 15:29:32 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\TAR32.DLL
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.23 13:38:06 | 000,001,240 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005UA.job
[2011.04.23 13:35:49 | 000,045,056 | ---- | M] ( ) -- C:\WINDOWS\System32\CompiledAdapter
[2011.04.23 13:35:11 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011.04.23 13:34:53 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.23 13:34:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.23 13:32:18 | 012,210,720 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2011.04.23 13:32:18 | 001,466,400 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2011.04.23 13:32:18 | 000,097,524 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2011.04.23 13:32:18 | 000,007,140 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx
[2011.04.23 13:08:01 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.23 12:33:01 | 000,000,364 | ---- | M] () -- C:\WINDOWS\tasks\Symantec NetDetect.job
[2011.04.23 11:12:42 | 000,000,805 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.23 11:12:14 | 007,734,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\USER\Desktop\mbam-setup-1.50.1.1100.exe
[2011.04.22 21:09:05 | 000,000,954 | -H-- | M] () -- C:\Dokumente und Einstellungen\USER\Desktop\Spybot - Search & Destroy.lnk
[2011.04.22 17:15:00 | 000,000,412 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011.04.22 13:04:35 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.04.21 19:29:17 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.17 21:38:02 | 000,001,188 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005Core.job
[2011.04.12 23:43:00 | 000,000,986 | -H-- | M] () -- C:\Dokumente und Einstellungen\USER\Desktop\Free YouTube Download.lnk
[2011.04.05 19:50:29 | 000,558,802 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.04.05 19:50:29 | 000,514,876 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.04.05 19:50:29 | 000,130,890 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.04.05 19:50:29 | 000,109,780 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.03.27 21:37:05 | 000,002,473 | -H-- | M] () -- C:\Dokumente und Einstellungen\USER\Desktop\Google Chrome.lnk
[9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.04.23 11:12:41 | 000,000,805 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.22 21:09:05 | 000,000,954 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Desktop\Spybot - Search & Destroy.lnk
[2011.04.12 23:43:00 | 000,000,986 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Desktop\Free YouTube Download.lnk
[2011.03.27 21:37:05 | 000,002,473 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Desktop\Google Chrome.lnk
[2011.03.27 21:33:39 | 000,001,240 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005UA.job
[2011.03.27 21:33:39 | 000,001,188 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005Core.job
[2010.09.26 18:34:32 | 000,190,656 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010.03.03 10:27:18 | 000,113,933 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2010.03.03 10:27:18 | 000,097,549 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2010.03.03 10:26:27 | 012,210,720 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2010.03.03 10:26:27 | 001,466,400 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox2.dat
[2010.02.02 18:39:00 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\anvkgp.dat
[2010.02.02 18:03:57 | 000,000,020 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\anvkgp.dat
[2009.08.09 18:12:18 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2009.06.12 22:30:12 | 000,000,668 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\vso_ts_preview.xml
[2009.04.30 13:54:14 | 000,026,577 | ---- | C] () -- C:\WINDOWS\System32\drivers\klopp.dat
[2009.04.27 16:36:02 | 000,314,053 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\libssl32.dll
[2009.04.27 16:35:55 | 000,180,124 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\libpq.dll
[2009.04.27 16:35:51 | 000,331,742 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ssleay32.dll
[2009.04.27 16:35:43 | 001,560,983 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\libeay32.dll
[2009.01.30 14:55:58 | 000,001,451 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\NMM-MetaData.db
[2009.01.13 18:58:33 | 000,162,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Uninstall.exe
[2008.12.07 15:22:12 | 000,097,360 | R--- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin
[2008.03.12 17:34:45 | 000,087,608 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\inst.exe
[2008.03.12 17:34:45 | 000,007,887 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\pcouffin.cat
[2008.03.12 17:34:45 | 000,001,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\pcouffin.inf
[2007.12.23 21:58:53 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007.11.11 13:44:49 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2007.06.30 13:50:07 | 000,000,106 | ---- | C] () -- C:\WINDOWS\entpack.ini
[2007.05.12 23:41:32 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2007.01.01 22:37:06 | 000,000,210 | ---- | C] () -- C:\WINDOWS\Sierra.ini
[2006.12.26 20:05:43 | 000,000,632 | ---- | C] () -- C:\WINDOWS\Thps3.INI
[2006.12.17 01:13:09 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006.11.10 15:08:50 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATITool.sys
[2006.08.05 17:59:07 | 000,000,228 | ---- | C] () -- C:\WINDOWS\basscad.ini
[2006.01.29 20:43:31 | 000,197,120 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2006.01.24 14:01:50 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\MASD321.DLL
[2006.01.22 14:35:15 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2005.12.29 01:46:58 | 000,000,121 | ---- | C] () -- C:\WINDOWS\Winchat.ini
[2005.12.26 22:34:09 | 000,001,545 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2005.12.24 21:52:12 | 000,002,528 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\$_hpcst$.hpc
[2005.12.10 04:06:00 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2005.12.10 04:06:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005.12.09 16:37:39 | 000,223,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\dtscsi.sys
[2005.12.09 16:19:25 | 000,096,256 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd0669.sys
[2005.12.08 21:03:57 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT
[2005.11.21 21:56:57 | 000,000,272 | ---- | C] () -- C:\WINDOWS\game.ini
[2005.11.06 23:10:24 | 000,000,059 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2005.11.06 23:10:21 | 000,027,648 | R--- | C] () -- C:\WINDOWS\Setup_ck.exe
[2005.11.06 23:10:21 | 000,024,608 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2005.11.06 23:10:21 | 000,018,432 | ---- | C] () -- C:\WINDOWS\Setup_ck.dll
[2005.11.06 23:10:21 | 000,011,776 | ---- | C] () -- C:\WINDOWS\Ckrfresh.exe
[2005.11.06 17:55:01 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005.10.29 16:55:55 | 000,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005.10.29 15:15:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OPPRIN~1.INI
[2005.10.29 10:42:09 | 000,406,016 | ---- | C] () -- C:\WINDOWS\System32\PSDrvCheck.exe
[2005.10.29 10:40:25 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\MACD32.DLL
[2005.10.29 10:40:25 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\MASE32.DLL
[2005.10.29 10:40:25 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\MAMC32.DLL
[2005.10.29 10:40:25 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\MASD32.DLL
[2005.10.29 10:40:25 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\MA32.DLL
[2005.10.28 22:59:23 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2005.10.28 22:59:23 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2005.10.28 22:59:23 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2005.10.28 22:59:23 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2005.10.28 22:59:23 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2005.10.28 22:59:23 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2005.10.28 22:50:14 | 000,003,072 | R--- | C] () -- C:\WINDOWS\System32\34CoInstaller.dll
[2005.10.28 22:50:04 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2005.10.28 22:49:31 | 000,061,440 | R--- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2005.10.28 22:48:54 | 000,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005.10.28 22:37:03 | 000,000,146 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005.10.28 22:35:32 | 000,015,360 | -H-- | C] () -- C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005.10.28 15:40:35 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005.10.28 15:39:43 | 002,189,528 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005.10.28 14:51:44 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005.10.28 14:50:11 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005.10.28 14:46:20 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.09.20 15:09:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2004.09.20 15:09:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2004.09.20 15:09:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2004.09.20 15:09:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2004.09.20 15:09:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2004.09.20 15:09:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2004.09.20 15:09:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2004.09.20 15:09:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2004.08.04 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 14:00:00 | 000,558,802 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.04 14:00:00 | 000,514,876 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.04 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 14:00:00 | 000,130,890 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.04 14:00:00 | 000,109,780 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.04 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 14:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 14:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004.08.04 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.01.29 18:08:44 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\Lkdlib.dll
[2004.01.29 17:02:48 | 000,001,900 | ---- | C] () -- C:\WINDOWS\System32\grl.dat
[2004.01.09 15:28:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\LK_FDEC.dll
[2003.07.30 11:48:28 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003.07.30 10:49:22 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002.03.26 21:18:27 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\mp4fil32.dll
[2001.03.09 18:00:00 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
[2001.03.09 18:00:00 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll
[1997.06.14 11:11:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll

< End of report >
--- --- ---



Schon mal vielen Dank für eure super Hilfe!!!!

cosinus 25.04.2011 15:00
Zitat:
Art des Suchlaufs: Quick-Scan
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Bin 27.04.2011 18:41
Hi,

anbei die Logdatei von Malwarebytes:

Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6457

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

27.04.2011 19:05:36
mbam-log-2011-04-27 (19-05-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 457357
Laufzeit: 2 Stunde(n), 36 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Was noch wichtig ist zu sagen, mein komplettes Startmenu (Programme) ist leer. Nur das Malwarebytes sowie SuperAntispy ist drin. (Habe ich jetzt nachträglich erst installiert).

Desweiteren ist mein Desktopbild weg, sowie auch einige Icons versteckt.

Ach ja hier ist noch ein älterer Log:

Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6424

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

23.04.2011 13:31:35
mbam-log-2011-04-23 (13-31-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 463097
Laufzeit: 2 Stunde(n), 10 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 3
Infizierte Dateien: 10

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\dokumente und einstellungen\USER\startmenü\programme\windows recovery (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\anwendungsdaten\93190628 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programme\winupdates (Worm.P2P) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\system volume information\_restore{6fc9a147-6942-4227-bf6d-74279ddda8b4}\RP625\A0276040.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{6fc9a147-6942-4227-bf6d-74279ddda8b4}\RP625\A0276006.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\USER\startmenü\programme\windows recovery\uninstall windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\USER\startmenü\programme\windows recovery\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\USER\anwendungsdaten\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\cmd.com (Worm.Alcra) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ping.com (Worm.Alcra) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\tasklist.com (Worm.Alcra) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\tracert.com (Worm.Alcra) -> Quarantined and deleted successfully.
c:\programme\winupdates\a.zip (Worm.P2P) -> Quarantined and deleted successfully.

cosinus 27.04.2011 19:16
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.10.28 14:48:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.03.05 14:43:04 | 000,000,000 | -H-D | M] - D:\Autos -- [ NTFS ]
O32 - AutoRun File - [2003.07.05 23:33:08 | 000,892,975 | R--- | M] () - K:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2003.07.14 21:52:34 | 000,000,091 | R--- | M] () - K:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{7d6c6d24-1c6a-11de-b7fd-001f3f005b34}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exe
O4 - HKCU..\Run: [GoWNKtoBbTfMqRQ]  File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Bin 27.04.2011 20:11
Ok hab ich gemacht!

Hier der Log:

Zitat:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
File not found.
File move failed. K:\Autorun.exe scheduled to be moved on reboot.
File move failed. K:\Autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d6c6d24-1c6a-11de-b7fd-001f3f005b34}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7d6c6d24-1c6a-11de-b7fd-001f3f005b34}\ not found.
File F:\InstallTomTomHOME.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoWNKtoBbTfMqRQ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temporary Internet Files folder emptied: 32768 bytes

User: Administrator.BINS-ATHLON64
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: USER
->Temp folder emptied: 15554044 bytes
->Temporary Internet Files folder emptied: 88725890 bytes
->Java cache emptied: 17385 bytes
->Google Chrome cache emptied: 15925171 bytes
->Flash cache emptied: 1537808 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2175612 bytes
%systemroot%\System32 .tmp files removed: 593799 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 943616 bytes
RecycleBin emptied: 46033614 bytes

Total Files Cleaned = 164,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 04272011_210236

Files\Folders moved on Reboot...
File move failed. K:\Autorun.exe scheduled to be moved on reboot.
File move failed. K:\Autorun.inf scheduled to be moved on reboot.
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\6vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIdsA sString%3D%26lang%3Dde%26id%3D34796248%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=02;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=18;s =13;s=20;s=19;s=06;s=14;s=08;intid=0;advid=0;t[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=0600[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=03;km=05;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s =09;intid=;advid=539916;tsn=756;hsn=600;a=02;o[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s =09;s=06;intid=;advid=563435;tsn=756;hsn=600;a[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=04;km=07;fuel=02;gear=02;ac=02;restr=03;s=01;s=13;s =07;s=20;s=09;s=06;s=14;s=08;intid=0;advid=0;t[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=600;[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=0600[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=05;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=02;s=01;s=13;s =07;s=20;s=09;s=06;s=08;intid=05110430;advid=1[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=0;typ=01;ccm=0;cap=0;reg=0;km=0;fuel=01;gear=01;ac=01;restr=0;s=0;intid=0;advi d=0;tsn=0;hsn=0;a=01;ord=DUh9XTm0HEYLg418tNaYY[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=0;typ=01;ccm=0;cap=0;reg=0;km=0;fuel=01;gear=01;ac=01;restr=0;s=0;intid=0;advi d=0;tsn=0;hsn=0;a=01;ord=EtbeQShqrj1XF8y8FfqLS[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=120x600,160x600,200x600,2x2;price=0;typ=01;ccm=0;cap=0;reg=0;km=0;fuel=01;gear=01;ac=01;restr=0;s=0;intid=0;advi d=0;tsn=0;hsn=0;a=01;ord=LafpH9fCYPRVlyPlEYP8P[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;s=08;i ntid=0;advid=0;tsn=905;hsn=600;a=02;ord=Re23xo[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;intid= 0;advid=0;tsn=905;hsn=600;a=02;ord=GR4y8yYgI3q[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s =06;s=08;intid=0;advid=0;tsn=905;hsn=600;a=02;[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s=09;s=06;i ntid=;advid=563435;tsn=756;hsn=600;a=02;ord=G0[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s =06;intid=0;advid=0;tsn=905;hsn=0600;a=02;ord=[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[3] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[4] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\YJ67O725\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[5] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\26vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIds AsString%3D%26lang%3Dde%26id%3D2047946%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=03;km=05;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s =09;intid=;advid=539916;tsn=756;hsn=600;a=02;o[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s =09;s=06;intid=;advid=563435;tsn=756;hsn=600;a[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;sz=120x600,160x600,200x600,2x2;price=05;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=02;s=01;s=13;s =07;s=20;s=09;s=06;s=08;intid=05110430;advid=1[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;sz=120x600,160x600,200x600,2x2;price=0;typ=01;ccm=0;cap=09;reg=0;km=0;fuel=01;gear=01;ac=01;restr=0;s=0;intid=0;adv id=0;tsn=0;hsn=0;a=01;ord=dqpNcIQu1HFUflNj61W9[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;sz=300x150;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;intid= 0;advid=0;tsn=905;hsn=0600;a=02;ord=Uim2gnB8vV[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;intid= 0;advid=0;tsn=905;hsn=0600;a=02;ord=kfp16PX4Mz[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;intid= 0;advid=0;tsn=905;hsn=0600;a=02;ord=TDqKj7oMnI[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s =06;s=08;intid=0;advid=0;tsn=905;hsn=600;a=02;[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WX2PIDOP\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\6vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIdsA sString%3D%26lang%3Dde%26id%3D28061729%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\6vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIdsA sString%3D%26lang%3Dde%26id%3D30866266%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;s=08;intid=0;advid=0;tsn=905;hsn[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=05;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=02;s=01;s=13;s =07;s=20;s=09;s=06;s=08;intid=05110430;advid=1[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=120x600,160x600,200x600,2x2;price=02;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=18;s =13;s=20;s=19;s=06;s=14;s=08;intid=0;advid=0;t[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;s=08;intid=0;advid=0;tsn=905;hsn[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;s=08;intid=0;advid=0;tsn=905;hsn[3] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s =09;s=06;intid=;advid=563435;tsn=756;hsn=600;a[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=0600[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;s=08;i ntid=0;advid=0;tsn=905;hsn=600;a=02;ord=Nv3D2i[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=300x250;price=05;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=02;s=01;s=13;s=07;s=20;s=09;s=06;s =08;intid=05110430;advid=16815;tsn=0;hsn=0;a=0[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s =06;intid=0;advid=0;tsn=905;hsn=600;a=02;ord=l[3] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s =06;intid=0;advid=0;tsn=905;hsn=0600;a=02;ord=[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\homepage;dcopt=ist;sz=468x60,728x90,1x1;price=0;typ=0;ccm=0;cap=0;reg=0;km=0;fuel=01;gear=01;ac=01;restr=0;s=0;intid=0;advi d=0;tsn=0;hsn=0;a=0;ord=pJPm114wo7M0P4NFBWdShW[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\WF05MB8L\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[3] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\S5I7KLQR\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\S5I7KLQR\keywords;kw=schroth+gurte;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\L14DZ1LZ\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\L14DZ1LZ\keywords;kw=sabelt+gurte;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\L14DZ1LZ\keywords;kw=schroth+gurte;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\L14DZ1LZ\music;sz=300x250;kl=N;klg=de;kt=K;kga=-1;kr=F;kw=falco+out+of+the+dark;kgg=-1;kcr=de;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=3360930089795684[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\L14DZ1LZ\music;sz=300x250;kl=N;klg=de;kt=K;kga=-1;kr=F;kw=falco+rock+me+amadeus+live;kgg=-1;kcr=de;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=5221578704981350[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\H4HU79HZ\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\H4HU79HZ\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[2].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\H4HU79HZ\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[3].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\H4HU79HZ\keywords;kw=golf+1+diesel;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\H4HU79HZ\keywords;kw=golf+1+dieselschild;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\H4HU79HZ\__schroth-gurte_W0QQQ5ftrkparmsZ72Q253A1229Q257C66Q253A2Q257C65Q253A12Q257C39Q253A1QQ_dmptZAutoteileQ5fQ5AubehQc3Qb6rQQ_fromfsbZQQ_trksidZp3286Q2ec0Q2em14QQ_sop Z1QQ_scZ1[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\EJTK4VOF\keywords;kw=dieselschild+golf+1;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\EJTK4VOF\keywords;kw=dieselschild+golf1;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;s[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\EJTK4VOF\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\EJTK4VOF\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[2].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\EJTK4VOF\keywords;kw=golf+1+chrom;dcopt=ist;seg=DE_Top_30pct_Buyers;seg=OM_BHV-BSV_Computer_Meta_07110;seg=OM_BHV-BSV_Handy_Meta_071101;seg=OM_BHV-BSV_Kleidung_Meta_07110;seg=GL_[3].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\EJTK4VOF\__golf-1-chrom_W0QQQ5ftrkparmsZ72Q253A1229Q257C66Q253A2Q257C65Q253A12Q257C39Q253A1QQ_dmptZAutoteileQ5fQ5AubehQc3Qb6rQQ_fromfsbZQQ_trksidZp3286Q2ec0Q2em14QQ_sop Z1QQ_scZ1[1].htm not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\6vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIdsA sString%3D%26lang%3Dde%26id%3D24381777%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\6vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIdsA sString%3D%26lang%3Dde%26id%3D27179665%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\6vehicleCategory%3DCar%26segment%3DCar%26negativeFeatures%3DEXPORT%26damageUnrepaired%3DNO_DAMAGE_UNREPAIRED%26customerIdsA sString%3D%26lang%3Dde%26id%3D32975360%26tabNumber%3D6 not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=08;reg=04;km=07;fuel=02;gear=02;ac=02;restr=03;s=01;s=13;s =07;s=20;s=09;s=06;s=14;s=08;intid=0;advid=0;t[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;dcopt=ist;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=600;[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;dcopt=ist;sz=728x90,2x2;price=0;typ=01;ccm=0;cap=0;reg=0;km=0;fuel=01;gear=01;ac=01;restr=0;s=0;intid=0;advid=0;tsn =0;hsn=0;a=01;ord=U9lohYtVabbVuV0EjxkY3JDfqtv;[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=08;reg=03;km=06;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;s=08;intid=0;advid=0;tsn=905;hsn[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=600;[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=600;[3] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=120x600,160x600,200x600,2x2;price=04;typ=07;ccm=0;cap=09;reg=04;km=07;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s =20;s=09;s=06;intid=0;advid=0;tsn=905;hsn=0600[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=08;reg=03;km=08;fuel=02;gear=02;ac=04;restr=02;s=01;s=13;s=09;s=06;intid=;advi d=563435;tsn=756;hsn=600;a=02;ord=KVyHM4Gcl0SU[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=300x250;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s=06;intid= 0;advid=0;tsn=905;hsn=600;a=02;ord=Hqu7vtK0JPN[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=468x60,728x90,1x1;price=04;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=03;s=01;s=13;s=20;s=09;s =06;intid=0;advid=0;tsn=905;hsn=600;a=02;ord=W[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\corrado;sz=468x60,728x90,1x1;price=05;typ=07;ccm=0;cap=09;reg=03;km=08;fuel=02;gear=02;ac=01;restr=02;s=01;s=13;s=07;s=20;s =09;s=06;s=08;intid=05110430;advid=16815;tsn=0[2] not found!
File\Folder C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5\6PITOL65\UsedCars_List;acc=N;acc=U;ad=0;art=0;equi=0;fuel=0;gear=0;sales=0;make=74;model=2083;zip1=D;zip2=D;price=0;price=1;price=2; price=3;hp=0;fr=0;miles=0;msent=;hsn=;tsn=;cos[2] not found!
C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Temp\WCESLog.log moved successfully.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_5cc.dat not found!

Registry entries deleted on Reboot...

cosinus 28.04.2011 09:21
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Bin 28.04.2011 20:07
tdsskiller habe ich runtergeladen und auf dem Desktop gespeichert. Es startet allerdings nicht...

cosinus 28.04.2011 20:44
Dann bitte jetzt CF ausführen, tdsskiller danach nochmal probieren.

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Bin 29.04.2011 19:52
Ok, habe ich alles gemacht.

Hier ist das Log von Combofix:

Combofix Logfile:
Code:
ComboFix 11-04-29.01 - USER 29.04.2011  20:15:16.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.49.1031.18.1023.583 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\USER\Desktop\cofi.exe
AV: Kaspersky Security Suite CBE 09 *Disabled/Outdated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE 09 *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\dll
c:\dokumente und einstellungen\All Users\Anwendungsdaten\libeay32.dll
c:\dokumente und einstellungen\All Users\Anwendungsdaten\libssl32.dll
c:\dokumente und einstellungen\All Users\Anwendungsdaten\ssleay32.dll
c:\dokumente und einstellungen\All Users\Anwendungsdaten\Uninstall.exe
c:\dokumente und einstellungen\All Users\Anwendungsdaten\updater.exe
c:\dokumente und einstellungen\USER\Anwendungsdaten\inst.exe
c:\dokumente und einstellungen\USER\WINDOWS
.
Infizierte Kopie von c:\windows\system32\drivers\volsnap.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
(((((((((((((((((((((((  Dateien erstellt von 2011-03-28 bis 2011-04-29  ))))))))))))))))))))))))))))))
.
.
2011-04-27 19:02 . 2011-04-27 19:02        --------        d-----w-        C:\_OTL
2011-04-24 18:16 . 2011-04-24 18:16        --------        d-----w-        c:\dokumente und einstellungen\USER\Anwendungsdaten\SUPERAntiSpyware.com
2011-04-24 18:16 . 2011-04-24 18:16        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2011-04-24 18:16 . 2011-04-24 18:16        --------        d-----w-        c:\programme\SUPERAntiSpyware
2011-04-23 09:12 . 2011-04-23 09:12        --------        d-----w-        c:\dokumente und einstellungen\USER\Anwendungsdaten\Malwarebytes
2011-04-23 09:12 . 2011-04-23 09:12        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-04-23 09:12 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-23 09:12 . 2011-04-23 09:12        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2011-04-22 19:08 . 2011-04-22 19:38        --------        d-----w-        c:\programme\Spybot - Search & Destroy
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-29 18:22 . 2005-10-29 08:42        45056        ----a-w-        c:\windows\system32\CompiledAdapter
2011-04-28 19:25 . 2005-12-09 14:19        96256        ----a-w-        c:\windows\system32\drivers\sptd0669.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\programme\Eraser\Eraser.exe" [2009-06-10 334224]
"SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-04-20 2423752]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe" [2010-03-03 208616]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
c:\dokumente und einstellungen\USER\Startmen\Programme\Autostart\
CookieWall.lnk - c:\programme\AnalogX\CookieWall\cookie.exe [2005-10-29 97796]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Odometer.lnk - c:\programme\Odometer\Odometer.exe [2007-4-20 1326592]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21        548352        ----a-w-        c:\programme\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinFlip.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\WinFlip.lnk
backup=c:\windows\pss\WinFlip.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^DOKUME~1^ALLUSE~1^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk]
path=c:\dokume~1\ALLUSE~1\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
2007-02-26 00:09        983040        ----a-r-        c:\programme\SlySoft\AnyDVD\AnyDVD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMWlanClient]
2008-09-05 00:01        1794048        ----a-r-        c:\programme\avmwlanstick\WLanGUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
2006-03-08 13:21        59040        ----a-w-        c:\programme\Gemeinsame Dateien\Symantec Shared\CCAPP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
2005-11-08 22:00        128920        ----a-w-        c:\programme\DAEMON Tools\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-06-26 20:09        1211176        ----a-w-        c:\programme\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
2006-07-11 10:15        3144800        ----a-w-        c:\programme\ICQ\ICQLite\ICQLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]
2003-06-18 12:25        49152        ----a-w-        c:\programme\Pinnacle\MediaCenter\LaunchList.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]
2000-04-17 14:58        49152        ----a-w-        c:\programme\ICQ\NDetect.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50        155648        ----a-w-        c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]
2005-09-09 18:09        1537648        ----a-w-        c:\programme\Norton\Norton Ghost\Agent\GhostTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2007-09-17 00:07        8491008        ----a-w-        c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2007-09-17 00:07        81920        ----a-w-        c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2007-09-17 00:07        1626112        ----a-w-        c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-05-14 09:32        1479680        ----a-w-        c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
2003-11-10 14:06        406016        ------w-        c:\windows\system32\PSDrvCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCRemote]
2004-12-06 07:30        57344        ----a-w-        c:\programme\Pinnacle\Shared Files\Programs\Remote\remoterm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMCS]
2004-11-08 12:01        57344        ----a-w-        c:\programme\Pinnacle\Shared Files\Programs\MediaCenterService\PMC.Service.Main.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-03-24 20:20        77824        ----a-r-        c:\windows\SOUNDMAN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-10-28 12:49        36972        ----a-w-        c:\programme\Java\jre1.5.0\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-05-11 14:47        39408        ----a-w-        c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2005-10-29 14:05        100056        ----a-w-        c:\progra~1\SYMNET~1\SNDMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Games\\Sierra\\FEAR\\FEAR.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programme\\ICQ\\ICQLite\\ICQLite.exe"=
"c:\\Games\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29.01.2008 19:29 32784]
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [28.10.2005 22:48 16640]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [09.12.2005 16:19 664064]
R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [08.12.2005 22:42 159616]
R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [08.12.2005 22:42 5248]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [17.02.2010 20:25 12872]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [10.05.2010 20:41 67656]
R3 3xHybrid;Pinnacle PCTV 300i Stereo DVB-T;c:\windows\system32\drivers\3xHybrid.sys [28.10.2005 22:50 969728]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [07.12.2008 15:22 265088]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13.03.2008 20:02 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30.04.2008 19:06 24592]
S2 gupdate1c9d247ad93fc3c;Google Update Service (gupdate1c9d247ad93fc3c);c:\programme\Google\Update\GoogleUpdate.exe [11.05.2009 16:49 133104]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [07.12.2008 15:22 4352]
S3 pnicml;pnicml;\??\c:\dokume~1\BENJAM~1\LOKALE~1\Temp\pnicml.sys --> c:\dokume~1\BENJAM~1\LOKALE~1\Temp\pnicml.sys [?]
.
Inhalt des "geplante Tasks" Ordners
.
2011-04-29 c:\windows\Tasks\Google Software Updater.job
- c:\programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-11 14:47]
.
2011-04-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-11 14:49]
.
2011-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-11 14:49]
.
2011-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005Core.job
- c:\dokumente und einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2011-03-27 13:02]
.
2011-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005UA.job
- c:\dokumente und einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2011-03-27 13:02]
.
2011-04-27 c:\windows\Tasks\Symantec NetDetect.job
- c:\programme\Symantec\LiveUpdate\NDETECT.EXE [2005-10-29 14:39]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://www.fujitsu-siemens.com/support/homepc/misc.html
IE: Free YouTube Download - c:\dokumente und einstellungen\USER\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\USER\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\ie_banner_deny.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: {62D35BF6-4623-435D-A679-08F114526CB3} = 192.168.0.1
TCP: {72CB7531-F436-4411-8386-A30C1139AA88} = 192.168.0.1
TCP: {B90230D8-4B1D-4F94-8205-08274C2AAD65} = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKU-Default-Run-Nokia.PCSync - c:\programme\Nokia\Nokia PC Suite 6\PcSync2.exe
MSConfigStartUp-MSMSGS - c:\programme\Messenger\msmsgs.exe
MSConfigStartUp-PCSuiteTrayApplication - c:\programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
MSConfigStartUp-SSC_UserPrompt - c:\programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
MSConfigStartUp-winupdates - c:\programme\winupdates\winupdates.exe
AddRemove-aEton CommunicaEor - c:\dokumente und einstellungen\All Users\Anwendungsdaten\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-04-29 20:24
Windows 5.1.2600 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(288)
c:\programme\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'explorer.exe'(468)
c:\windows\system32\webcheck.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
c:\programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
c:\programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
c:\programme\avmwlanstick\WlanNetService.exe
c:\windows\system32\crypserv.exe
c:\programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
c:\windows\System32\GEARSec.exe
c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\programme\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\programme\Norton\Norton Ghost\Agent\VProSvc.exe
c:\windows\system32\nvsvc32.exe
c:\programme\pinnacle\shared files\programs\mediaserver\pmshost.exe
c:\programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-04-29  20:29:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-04-29 18:29
.
Vor Suchlauf: 9 Verzeichnis(se), 76.184.596.480 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 76.059.308.032 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - DAD53EB814D00C1C988DE26F98B7784B
--- --- ---



Hier ist der Log von TDSSKiller:

Zitat:
2011/04/29 20:49:18.0437 1612 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/29 20:49:18.0921 1612 ================================================================================
2011/04/29 20:49:18.0921 1612 SystemInfo:
2011/04/29 20:49:18.0921 1612
2011/04/29 20:49:18.0921 1612 OS Version: 5.1.2600 ServicePack: 2.0
2011/04/29 20:49:18.0921 1612 Product type: Workstation
2011/04/29 20:49:18.0921 1612 ComputerName: BINS-ATHLON64
2011/04/29 20:49:18.0921 1612 UserName: USER
2011/04/29 20:49:18.0921 1612 Windows directory: C:\WINDOWS
2011/04/29 20:49:18.0921 1612 System windows directory: C:\WINDOWS
2011/04/29 20:49:18.0921 1612 Processor architecture: Intel x86
2011/04/29 20:49:18.0921 1612 Number of processors: 1
2011/04/29 20:49:18.0921 1612 Page size: 0x1000
2011/04/29 20:49:18.0921 1612 Boot type: Normal boot
2011/04/29 20:49:18.0921 1612 ================================================================================
2011/04/29 20:49:19.0515 1612 Initialize success
2011/04/29 20:50:11.0609 2012 ================================================================================
2011/04/29 20:50:11.0609 2012 Scan started
2011/04/29 20:50:11.0609 2012 Mode: Manual;
2011/04/29 20:50:11.0609 2012 ================================================================================
2011/04/29 20:50:12.0125 2012 3xHybrid (b985bd6230ac8cc7526d89ef92ce05be) C:\WINDOWS\system32\DRIVERS\3xHybrid.sys
2011/04/29 20:50:12.0265 2012 ACPI (94b4741d2cf9ed38140b831293d1601a) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/29 20:50:12.0312 2012 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/29 20:50:12.0390 2012 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
2011/04/29 20:50:12.0437 2012 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
2011/04/29 20:50:12.0625 2012 ALCXWDM (bea942ff21154fee4f71ddd477621c70) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2011/04/29 20:50:12.0781 2012 AmdK8 (a2d5f093f9cb160c183c77015704f156) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
2011/04/29 20:50:12.0828 2012 AnyDVD (d90fa12a6eceb522f2fc58dd7fdd1480) C:\WINDOWS\system32\Drivers\AnyDVD.sys
2011/04/29 20:50:12.0859 2012 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/29 20:50:12.0890 2012 ASAPIW2k (4f9cbbf95e8f7a0d4c0edcfe3b78102e) C:\WINDOWS\system32\drivers\ASAPIW2k.sys
2011/04/29 20:50:13.0000 2012 Aspi32 (ed8cee58c1e4c5893f5b2fd686a272bf) C:\WINDOWS\system32\drivers\Aspi32.sys
2011/04/29 20:50:13.0015 2012 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/29 20:50:13.0062 2012 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\drivers\atapi.sys
2011/04/29 20:50:13.0109 2012 ATITool (0e4bb35c5305099ac82053ac992e3e0e) C:\WINDOWS\system32\DRIVERS\ATITool.sys
2011/04/29 20:50:13.0140 2012 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/29 20:50:13.0171 2012 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/29 20:50:13.0203 2012 avmeject (263cf9d248fd5e020a1333ed4f7eaa88) C:\WINDOWS\system32\drivers\avmeject.sys
2011/04/29 20:50:13.0250 2012 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/29 20:50:13.0437 2012 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/29 20:50:13.0500 2012 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/04/29 20:50:13.0531 2012 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/29 20:50:13.0578 2012 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/29 20:50:13.0625 2012 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/29 20:50:13.0640 2012 Changer (daf1a8193b6caf0fb858cadcc5c4af4a) C:\WINDOWS\system32\drivers\Changer.sys
2011/04/29 20:50:13.0734 2012 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/29 20:50:13.0781 2012 dmboot (5789b83ba87fc84c3568cf86cacef8ce) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/29 20:50:13.0843 2012 dmio (084eb0a50a4f7b4705c8a57f234e5291) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/29 20:50:13.0859 2012 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/29 20:50:13.0875 2012 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/29 20:50:13.0906 2012 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/29 20:50:13.0968 2012 dtscsi (6461e57bb51a848aae26f52427b7cf9e) C:\WINDOWS\System32\Drivers\dtscsi.sys
2011/04/29 20:50:13.0968 2012 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\dtscsi.sys. md5: 6461e57bb51a848aae26f52427b7cf9e
2011/04/29 20:50:13.0984 2012 dtscsi - detected Locked file (1)
2011/04/29 20:50:14.0015 2012 ElbyCDIO (a74f2d7f4a265916736a90fea5a34fe9) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
2011/04/29 20:50:14.0031 2012 ElbyDelay (df9957db3bfe5136aad3c2c101806c98) C:\WINDOWS\system32\Drivers\ElbyDelay.sys
2011/04/29 20:50:14.0046 2012 ENTECH (fd9fc82f134b1c91004ffc76a5ae494b) C:\WINDOWS\system32\DRIVERS\ENTECH.sys
2011/04/29 20:50:14.0078 2012 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/29 20:50:14.0187 2012 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/04/29 20:50:14.0218 2012 FETND5BV (7d53d569892b46738e87f39c9aa8488a) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys
2011/04/29 20:50:14.0296 2012 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
2011/04/29 20:50:14.0312 2012 Fips (9e9af89f9b14aa6249065c309ce73bd8) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/29 20:50:14.0328 2012 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/04/29 20:50:14.0390 2012 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/04/29 20:50:14.0421 2012 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/29 20:50:14.0437 2012 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/29 20:50:14.0468 2012 FWLANUSB (ff12fa487265da2ac7de4be53f72ff1a) C:\WINDOWS\system32\DRIVERS\fwlanusb.sys
2011/04/29 20:50:14.0515 2012 GearAspiWDM (32a73a8952580b284a47290adb62032a) C:\WINDOWS\system32\drivers\GearAspiWDM.sys
2011/04/29 20:50:14.0546 2012 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/29 20:50:14.0578 2012 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/29 20:50:14.0656 2012 HTTP (bfb7b73c942e816c4fb4a5a7bae87136) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/29 20:50:14.0687 2012 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/04/29 20:50:14.0734 2012 i8042prt (7c575018d0413440d75432a78b88c899) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/29 20:50:14.0750 2012 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/29 20:50:14.0812 2012 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/04/29 20:50:14.0828 2012 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/29 20:50:14.0843 2012 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/29 20:50:14.0859 2012 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/29 20:50:14.0875 2012 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/29 20:50:14.0921 2012 isapnp (ce9b7afdf0a3d7dd8d1487262316b959) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/29 20:50:14.0953 2012 Kbdclass (b128fc0a5cd83f669d5de4b58f77c7d6) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/29 20:50:14.0984 2012 kbdhid (7ec877aa899323b92874fe62c7ddcde7) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/29 20:50:15.0000 2012 kl1 (cd6a8fa9395460ffe7fd8881a6c67254) C:\WINDOWS\system32\drivers\kl1.sys
2011/04/29 20:50:15.0015 2012 klbg (1fdd35aa7efaeb283198a3b14800f37e) C:\WINDOWS\system32\drivers\klbg.sys
2011/04/29 20:50:15.0031 2012 KLFLTDEV (73eb94ad1c85b4a3c5a8b4d879f668b9) C:\WINDOWS\system32\DRIVERS\klfltdev.sys
2011/04/29 20:50:15.0078 2012 KLIF (204b4f4355097bab0c2de8b097d947dd) C:\WINDOWS\system32\DRIVERS\klif.sys
2011/04/29 20:50:15.0109 2012 klim5 (cd16a39c6f61c2ae0272e1f431353bf7) C:\WINDOWS\system32\DRIVERS\klim5.sys
2011/04/29 20:50:15.0140 2012 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/29 20:50:15.0156 2012 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/29 20:50:15.0218 2012 lbrtfdc (cc50a66548c2f285bc8a7b0b8aa578e3) C:\WINDOWS\system32\drivers\lbrtfdc.sys
2011/04/29 20:50:15.0281 2012 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/29 20:50:15.0312 2012 Modem (91a3da4b12f6f1d760463a7f7857f748) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/29 20:50:15.0390 2012 Mouclass (71e15ca47fd947552054afb28536268f) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/29 20:50:15.0421 2012 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/29 20:50:15.0437 2012 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/29 20:50:15.0468 2012 MPE (55a9a7e6bb297bf0f5b144029dcb79cc) C:\WINDOWS\system32\DRIVERS\MPE.sys
2011/04/29 20:50:15.0500 2012 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/29 20:50:15.0562 2012 MRxSmb (5ddc9a1b2eb5a4bf010ce8c019a18c1f) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/29 20:50:15.0625 2012 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/29 20:50:15.0656 2012 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/29 20:50:15.0671 2012 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/29 20:50:15.0703 2012 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/29 20:50:15.0718 2012 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/29 20:50:15.0750 2012 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/04/29 20:50:15.0781 2012 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/29 20:50:15.0796 2012 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/04/29 20:50:15.0843 2012 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/29 20:50:15.0859 2012 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/04/29 20:50:15.0890 2012 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/29 20:50:15.0906 2012 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/29 20:50:15.0937 2012 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/29 20:50:15.0968 2012 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/29 20:50:15.0984 2012 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/29 20:50:16.0000 2012 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/29 20:50:16.0062 2012 NetworkX (36b660b966a30065c43a409548758df1) C:\WINDOWS\system32\ckldrv.sys
2011/04/29 20:50:16.0093 2012 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/29 20:50:16.0140 2012 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
2011/04/29 20:50:16.0171 2012 nmwcd (c3963d85b721a7f80d8a55f4e2867a3a) C:\WINDOWS\system32\drivers\ccdcmb.sys
2011/04/29 20:50:16.0203 2012 nmwcdc (3859c69a77793180548802dac9f34a38) C:\WINDOWS\system32\drivers\ccdcmbo.sys
2011/04/29 20:50:16.0218 2012 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/29 20:50:16.0281 2012 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/29 20:50:16.0312 2012 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/29 20:50:16.0640 2012 nv (5950e6cc9fb3fabb61604d395dbc8550) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/29 20:50:16.0968 2012 nvatabus (83f0275a21d9772b51cef57e35afae61) C:\WINDOWS\system32\DRIVERS\nvatabus.sys
2011/04/29 20:50:17.0000 2012 nvcap (d39a77296f39ae50c0d01dff46d4b594) C:\WINDOWS\system32\DRIVERS\nvcap.sys
2011/04/29 20:50:17.0031 2012 nvcchflt (fb7213bc5279c1af5e4e9ca05d944f2c) C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
2011/04/29 20:50:17.0062 2012 NVENETFD (468e839f0f7aff5c9baa4717b82cdd11) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2011/04/29 20:50:17.0078 2012 nvnetbus (7a6444c5f0d53c7e6e7f500bc4c930f7) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2011/04/29 20:50:17.0109 2012 NVXBAR (2c6c9c82505f5d4f89bb73c3f7feeb99) C:\WINDOWS\system32\DRIVERS\NVxbar.sys
2011/04/29 20:50:17.0140 2012 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/29 20:50:17.0156 2012 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/29 20:50:17.0187 2012 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
2011/04/29 20:50:17.0203 2012 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
2011/04/29 20:50:17.0234 2012 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
2011/04/29 20:50:17.0265 2012 ohci1394 (c91f4ab66638a255660137a36e729fc4) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/29 20:50:17.0312 2012 Parport (b2f17a2edb5450e61973a037f63a595b) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/04/29 20:50:17.0343 2012 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/29 20:50:17.0390 2012 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/29 20:50:17.0421 2012 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys
2011/04/29 20:50:17.0468 2012 PCI (6fb463e5b243fbd6f3d3c83f914d94fb) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/29 20:50:17.0531 2012 Pcmcia (e2363f4c1daff89abee5f593e13d8a05) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/04/29 20:50:17.0562 2012 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
2011/04/29 20:50:18.0015 2012 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/29 20:50:18.0062 2012 Processor (f04317fb351b75233979dc65d4cead54) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/04/29 20:50:18.0093 2012 prodrv06 (6d3b2fc5dec2f59b28fe5fa17250a7b0) C:\WINDOWS\System32\drivers\prodrv06.sys
2011/04/29 20:50:18.0140 2012 prohlp02 (c5f47b7ec2ec906847d5f80ba779a5bd) C:\WINDOWS\system32\drivers\prohlp02.sys
2011/04/29 20:50:18.0156 2012 prosync1 (f3471e7971ee62420451d958da635064) C:\WINDOWS\system32\drivers\prosync1.sys
2011/04/29 20:50:18.0250 2012 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/29 20:50:18.0312 2012 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/29 20:50:18.0578 2012 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/29 20:50:18.0593 2012 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/29 20:50:18.0609 2012 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/29 20:50:18.0625 2012 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/29 20:50:18.0671 2012 Rdbss (809ca45caa9072b3176ad44579d7f688) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/29 20:50:18.0687 2012 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/29 20:50:18.0750 2012 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/29 20:50:18.0781 2012 redbook (aa56702e230860565cb8d43680f57f33) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/29 20:50:18.0875 2012 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
2011/04/29 20:50:18.0921 2012 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
2011/04/29 20:50:18.0953 2012 Secdrv (72dffa33f8ed1c847075eee2c1e790ee) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/29 20:50:18.0984 2012 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/29 20:50:19.0000 2012 Serial (cd5b9995afcdb466c9efc048d167e3be) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/29 20:50:19.0093 2012 sfdrv01 (4c0d673281178cb496011a2e28571fc8) C:\WINDOWS\system32\drivers\sfdrv01.sys
2011/04/29 20:50:19.0125 2012 sfhlp01 (462aee0ea0481ea8bd45cac876a4ccc4) C:\WINDOWS\system32\drivers\sfhlp01.sys
2011/04/29 20:50:19.0140 2012 sfhlp02 (15be2b5e4dc5b8623cf167720682abc9) C:\WINDOWS\system32\drivers\sfhlp02.sys
2011/04/29 20:50:19.0171 2012 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/29 20:50:19.0250 2012 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/04/29 20:50:19.0296 2012 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/29 20:50:19.0390 2012 sptd (32dea2a16cc0171a54dd9b386231f559) C:\WINDOWS\system32\Drivers\sptd.sys
2011/04/29 20:50:19.0390 2012 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 32dea2a16cc0171a54dd9b386231f559
2011/04/29 20:50:19.0406 2012 sptd - detected Locked file (1)
2011/04/29 20:50:19.0453 2012 sr (e4200cb2f418d8fc4acdd7e38c419d6a) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/29 20:50:19.0515 2012 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/29 20:50:19.0562 2012 ssmdrv (71d609c5dff067906d930bde031c4cfe) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/04/29 20:50:19.0609 2012 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/04/29 20:50:19.0625 2012 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/29 20:50:19.0656 2012 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/29 20:50:19.0718 2012 SYMDNS (1f0a3f93fecba6e873e75ac34538708b) C:\WINDOWS\System32\Drivers\SYMDNS.SYS
2011/04/29 20:50:19.0812 2012 SymEvent (9351e17b2c6055cb0df442e54e5c1961) C:\Programme\Symantec\SYMEVENT.SYS
2011/04/29 20:50:19.0843 2012 SYMFW (ca212638c07f7a1736667319589f416e) C:\WINDOWS\System32\Drivers\SYMFW.SYS
2011/04/29 20:50:19.0859 2012 SYMIDS (83a0415ab669afe9f2b7fccc52f23153) C:\WINDOWS\System32\Drivers\SYMIDS.SYS
2011/04/29 20:50:19.0890 2012 SYMIDSCO (1f86a0426fe9c70575e808556e659904) C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20061113.031\symidsco.sys
2011/04/29 20:50:19.0937 2012 symlcbrd (5220576ee29bea7c18dff9ecabf18bbc) C:\WINDOWS\system32\drivers\symlcbrd.sys
2011/04/29 20:50:19.0953 2012 SYMNDIS (2a8ebb694d702d91d8046b31c3da2220) C:\WINDOWS\System32\Drivers\SYMNDIS.SYS
2011/04/29 20:50:19.0968 2012 SYMREDRV (7c73b65f1bdfab9052a5076c0ca622de) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
2011/04/29 20:50:20.0031 2012 SymSnap (fea2d66aeb341e11fad6ff2d50b8ca40) C:\WINDOWS\system32\drivers\SymSnap.sys
2011/04/29 20:50:20.0046 2012 SYMTDI (b4562798891dca27ed67ca07acbadbd9) C:\WINDOWS\System32\Drivers\SYMTDI.SYS
2011/04/29 20:50:20.0140 2012 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/29 20:50:20.0187 2012 Tcpip (6129e70f3d2f1e60860c930ebeaf92c2) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/29 20:50:20.0234 2012 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/29 20:50:20.0265 2012 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/29 20:50:20.0296 2012 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/29 20:50:20.0390 2012 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/29 20:50:20.0437 2012 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/29 20:50:20.0484 2012 upperdev (0ccadc7391021376edbb8aa649d04e68) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys
2011/04/29 20:50:20.0515 2012 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/29 20:50:20.0546 2012 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/29 20:50:20.0578 2012 usbhub (d31e07bf822c7f2bd32714e9ddca8be2) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/29 20:50:20.0593 2012 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/04/29 20:50:20.0625 2012 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/04/29 20:50:20.0656 2012 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/04/29 20:50:20.0718 2012 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\drivers\usbser.sys
2011/04/29 20:50:20.0734 2012 UsbserFilt (68b4f83cccf70a2ff32ee142c234332a) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys
2011/04/29 20:50:20.0765 2012 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/29 20:50:20.0812 2012 usb_rndisx (51df49cfd69ab3094b05bdab4cccc129) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
2011/04/29 20:50:20.0875 2012 V2IMount (deea641cc5f87867759856a52cbc0999) C:\WINDOWS\system32\drivers\V2IMount.sys
2011/04/29 20:50:20.0937 2012 Vax347b (cb3400d696bee266c38cae330c2b4337) C:\WINDOWS\system32\DRIVERS\Vax347b.sys
2011/04/29 20:50:20.0953 2012 Vax347s (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\Vax347s.sys
2011/04/29 20:50:20.0984 2012 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2011/04/29 20:50:21.0031 2012 VolSnap (d6888520ff56d72a50437e371ca25fc9) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/29 20:50:21.0078 2012 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/29 20:50:21.0109 2012 wceusbsh (4a954a20a4c73d6db13c0fe25f3f1b0c) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2011/04/29 20:50:21.0187 2012 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/04/29 20:50:21.0265 2012 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/29 20:50:21.0359 2012 WpdUsb (1385e5aa9c9821790d33a9563b8d2dd0) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/04/29 20:50:21.0421 2012 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/04/29 20:50:21.0656 2012 ================================================================================
2011/04/29 20:50:21.0656 2012 Scan finished
2011/04/29 20:50:21.0656 2012 ================================================================================
2011/04/29 20:50:21.0656 3784 Detected object count: 2
2011/04/29 20:50:40.0281 3784 Locked file(dtscsi) - User select action: Skip
2011/04/29 20:50:40.0281 3784 Locked file(sptd) - User select action: Skip

cosinus 29.04.2011 21:08
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Bin 01.05.2011 18:41
Hier der Log von GMER:


GMER Logfile:
Code:
GMER 1.0.15.15572 - hxxp://www.gmer.net
Rootkit scan 2011-05-01 19:33:23
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\00000091 ST3160023AS rev.3.00
Running: um6ldp5f.exe; Driver: C:\DOKUME~1\BENJAM~1\LOKALE~1\Temp\uwloypod.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwAdjustPrivilegesToken [0xEDE00224]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwClose [0xEDE007F8]
SSDT            860146C8                                                                                                            ZwConnectPort
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwCreateFile [0xEDE01BE6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwCreateKey [0xEDDFF99A]
SSDT            Vax347b.sys (Plug and Play BIOS Extension/ )                                                                        ZwCreatePagingFile [0xF72ABC70]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwCreateSymbolicLinkObject [0xEDE03BC6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwCreateThread [0xEDE005F8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwDeleteKey [0xEDDFFDDC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwDeleteValueKey [0xEDDFFFDC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwDeviceIoControlFile [0xEDE01EF6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwDuplicateObject [0xEDE040CE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwEnumerateKey [0xEDE000F2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwEnumerateValueKey [0xEDE0015A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwFsControlFile [0xEDE01DA8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwLoadDriver [0xEDE0366A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwOpenFile [0xEDE01A42]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwOpenKey [0xEDDFFAFC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwOpenProcess [0xEDE003FC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwOpenSection [0xEDE03BF0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwOpenThread [0xEDE00348]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwQueryKey [0xEDE001C2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwQueryMultipleValueKey [0xEDDFFEC6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwQueryValueKey [0xEDDFFCA4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwQueueApcThread [0xEDE038D2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwReplaceKey [0xEDDFF61C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwRequestWaitReplyPort [0xEDE02ABE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwRestoreKey [0xEDDFF77E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwResumeThread [0xEDE03FA0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSaveKey [0xEDDFF41A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSecureConnectPort [0xEDE020D6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSetContextThread [0xEDE006F6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSetSecurityObject [0xEDE03764]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSetSystemInformation [0xEDE03C1A]
SSDT            Vax347b.sys (Plug and Play BIOS Extension/ )                                                                        ZwSetSystemPowerState [0xF72B74F0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSetValueKey [0xEDDFFB52]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSuspendProcess [0xEDE03CFE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSuspendThread [0xEDE03E2A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwSystemDebugControl [0xEDE03596]
SSDT            \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com)            ZwTerminateProcess [0xEDA02620]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  ZwWriteVirtualMemory [0xEDE0053A]

Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  FsRtlCheckLockForReadAccess
Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                                  IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!FsRtlCheckLockForReadAccess                                                                            804E9E28 5 Bytes  JMP EDE17874 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text          ntkrnlpa.exe!IoIsOperationSynchronous                                                                                804EE562 5 Bytes  JMP EDE17C2E \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text          ntkrnlpa.exe!ZwCallbackReturn + 2720                                                                                80501438 12 Bytes  [FE, 3C, E0, ED, 2A, 3E, E0, ...]
?              C:\WINDOWS\system32\drivers\sptd.sys                                                                                Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
?              C:\WINDOWS\System32\Drivers\SPTD0669.SYS                                                                            Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
.text          C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                            section is writeable [0xF034F360, 0x307AC7, 0xE8000020]
.text          dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7                                                                          F02F24F0 16 Bytes  [3D, C7, 8A, 0F, 44, C7, 85, ...]
.text          dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11                                                                    F02F2501 7 Bytes  [10, 2F, F0, AB, C7, EE, FA]
.text          dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 19                                                                    F02F2509 23 Bytes  [65, DA, 86, 95, 37, 8C, CA, ...]
?              C:\WINDOWS\System32\Drivers\dtscsi.sys                                                                              Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                  [F730D056] sptd.sys
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject]                                              [F6BF4D50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT            \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject]                                              [F6BF4D50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT            \SystemRoot\system32\DRIVERS\nwlnkipx.sys[TDI.SYS!TdiRegisterDeviceObject]                                          [F6BF4D50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT            \SystemRoot\system32\DRIVERS\nwlnknb.sys[TDI.SYS!TdiRegisterDeviceObject]                                            [F6BF4D50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT            \SystemRoot\system32\DRIVERS\nwlnkspx.sys[TDI.SYS!TdiRegisterDeviceObject]                                          [F6BF4D50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              86DA10E8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device          \FileSystem\Fastfat \FatCdrom                                                                                        862008A0
Device          \FileSystem\Fastfat \FatCdrom                                                                                        86386670
Device          \Driver\usbstor \Device\0000009b                                                                                    869877D0
Device          \Driver\usbstor \Device\0000009c                                                                                    869877D0
Device          \Driver\nvatabus \Device\0000008f                                                                                    8685F140

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                            SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                            kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

Device          \Driver\usbstor \Device\0000009d                                                                                    869877D0
Device          \Driver\usbstor \Device\0000009e                                                                                    869877D0
Device          \Driver\usbstor \Device\0000009f                                                                                    869877D0

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                            kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                            SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\prodrv06 \Device\ProDrv06                                                                                    E1E00C30
Device          \Driver\00000039 \Device\00000070                                                                                    sptd.sys
Device          \Driver\00000039 \Device\00000070                                                                                    sptd.sys
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                              86DA2C78

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                              SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                              fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device          \Driver\Cdrom \Device\CdRom0                                                                                        86A39138
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                              86DA2C78

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                              SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                              fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device          \FileSystem\Rdbss \Device\FsWrap                                                                                    860887F8
Device          \FileSystem\Rdbss \Device\FsWrap                                                                                    86325658
Device          \Driver\Cdrom \Device\CdRom1                                                                                        86A39138
Device          \Driver\Cdrom \Device\CdRom2                                                                                        86A39138
Device          \Driver\prohlp02 \Device\ProHlp02                                                                                    E15AC008
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                              860757F8
Device          \Driver\nvatabus \Device\00000091                                                                                    8685F140
Device          \Driver\NetBT \Device\NetBT_Tcpip_{72CB7531-F436-4411-8386-A30C1139AA88}                                            860757F8
Device          \Driver\nvatabus \Device\00000092                                                                                    8685F140
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                    860757F8
Device          \FileSystem\Srv \Device\LanmanServer                                                                                868701F0

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                            kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                            SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\Disk \Device\Harddisk0\DR0                                                                                  86DA2450

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                          kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                          SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\Disk \Device\Harddisk1\DR1                                                                                  86DA2450
Device          \Driver\Disk \Device\Harddisk2\DR4                                                                                  86DA2450
Device          \Driver\Disk \Device\Harddisk2\DP(1)0-0+9                                                                            86DA2450
Device          \Driver\usbstor \Device\00000099                                                                                    869877D0
Device          \Driver\Disk \Device\Harddisk3\DP(1)0-0+a                                                                            86DA2450
Device          \Driver\Disk \Device\Harddisk3\DR5                                                                                  86DA2450
Device          \Driver\nvatabus \Device\NvAta0                                                                                      8685F140
Device          \Driver\Disk \Device\Harddisk4\DP(1)0-0+b                                                                            86DA2450
Device          \Driver\Disk \Device\Harddisk4\DR6                                                                                  86DA2450
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    85FE57F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    85D84B80
Device          \Driver\nvatabus \Device\NvAta1                                                                                      8685F140
Device          \Driver\Disk \Device\Harddisk5\DP(1)0-0+c                                                                            86DA2450
Device          \Driver\Disk \Device\Harddisk5\DR7                                                                                  86DA2450
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          85FE57F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          85D84B80
Device          \Driver\nvatabus \Device\NvAta2                                                                                      8685F140
Device          \FileSystem\Npfs \Device\NamedPipe                                                                                  862CF8A0
Device          \Driver\Disk \Device\Harddisk6\DP(1)0-0+d                                                                            86DA2450
Device          \Driver\Disk \Device\Harddisk6\DR8                                                                                  86DA2450
Device          \Driver\Ftdisk \Device\FtControl                                                                                    86DA2C78
Device          \FileSystem\Msfs \Device\Mailslot                                                                                    862F38A0
Device          \FileSystem\Msfs \Device\Mailslot                                                                                    86305648
Device          \Driver\NetBT \Device\NetBT_Tcpip_{62D35BF6-4623-435D-A679-08F114526CB3}                                            860757F8
Device          \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target1Lun0                                                            86B35130
Device          \Driver\Vax347s \Device\Scsi\Vax347s1                                                                                86DA2708
Device          \Driver\dtscsi \Device\Scsi\dtscsi1Port4Path0Target0Lun0                                                            86B35130
Device          \Driver\dtscsi \Device\Scsi\dtscsi1                                                                                  86B35130
Device          \FileSystem\Fastfat \Fat                                                                                            862008A0
Device          \FileSystem\Fastfat \Fat                                                                                            86386670

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device          \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer                                                                  869171E8
Device          \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer                                                                    869171E8
Device          \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer                                                                        869171E8
Device          \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer                                                                    869171E8
Device          \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer                                                                    869171E8
Device          \FileSystem\Cdfs \Cdfs                                                                                              862358A0
Device          \FileSystem\Cdfs \Cdfs                                                                                              869F6348

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0                                                                  -768473934
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  -1057639245
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  394784288
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                              0x92 0x25 0x8C 0xCB ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                           
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x76 0x77 0xA9 0xC8 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0xBE 0x4E 0xBB 0x68 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                0x86 0x3A 0x68 0xA5 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                  0x92 0x25 0x8C 0xCB ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools\
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)       
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x76 0x77 0xA9 0xC8 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xBE 0x4E 0xBB 0x68 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                    0x86 0x3A 0x68 0xA5 ...
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}@DisplayName          Alcohol 120%
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xE2 0x63 0x26 0xF1 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x71 0x3B 0x04 0x66 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0x25 0xDA 0xEC 0x7E ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x3E 0x1E 0x9E 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xCD 0x44 0xCD 0xB9 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xDF 0x20 0x58 0x62 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0x31 0x77 0xE1 0xBA ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x83 0x6C 0x56 0x8B ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0x51 0xFA 0x6E 0x91 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0x3D 0xCE 0xEA 0x26 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0x2A 0xB7 0xCC 0xB5 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0x6C 0x43 0x2D 0x1E ...
Reg            HKLM\SOFTWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6@ProductName                                Alcohol 120%

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 02.05.2011 10:21
Und die anderen Logs?

Bin 04.05.2011 16:19
Hier das Log von OSAM:

Hat leider ein bisschen gedauert...

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:17:55 on 04.05.2011

OS: Windows XP Home Edition Service Pack 2 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005Core.job" - "Google Inc." - C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1957994488-1606980848-839522115-1005UA.job" - "Google Inc." - C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Symantec NetDetect.job" - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\NDETECT.EXE

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File signed by Microsoft | File found, but it contains no detailed information)
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"jpicpl32.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\jpicpl32.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir PersonalEdition Classic" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl  (File not found)
"Avira AntiVir PersonalEdition Classic " - ? - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl  (File not found)
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"SYMLIVE" - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\S32LUCP1.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"adfs" (adfs) - ? - C:\WINDOWS\system32\drivers\adfs.sys  (File not found)
"AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\AnyDVD.sys
"ASAPIW2K" (ASAPIW2k) - "Pinnacle Systems GmbH" - C:\WINDOWS\System32\drivers\ASAPIW2k.sys
"Aspi32" (Aspi32) - "Adaptec" - C:\WINDOWS\system32\drivers\Aspi32.sys
"ATITool Overclocking Utility" (ATITool) - ? - C:\WINDOWS\System32\DRIVERS\ATITool.sys
"AVM Eject" (avmeject) - "AVM Berlin" - C:\WINDOWS\System32\drivers\avmeject.sys
"catchme" (catchme) - ? - C:\cofi\catchme.sys  (File not found)
"dtscsi" (dtscsi) - "DT Soft Ltd." - C:\WINDOWS\System32\Drivers\dtscsi.sys  (File is exclusively opened, access blocked)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys
"ElbyDelay" (ElbyDelay) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyDelay.sys
"ENTECH" (ENTECH) - "EnTech Taiwan" - C:\WINDOWS\system32\DRIVERS\ENTECH.sys
"GearAspiWDM" (GearAspiWDM) - "GEAR Software Inc." - C:\WINDOWS\system32\drivers\GearAspiWDM.sys
"Kl1" (kl1) - "Kaspersky Lab" - C:\WINDOWS\System32\drivers\kl1.sys
"NetworkX" (NetworkX) - ? - C:\WINDOWS\system32\ckldrv.sys  (File found, but it contains no detailed information)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"pnicml" (pnicml) - ? - C:\DOKUME~1\BENJAM~1\LOKALE~1\Temp\pnicml.sys  (File not found)
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
"Secdrv" (Secdrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\WINDOWS\System32\DRIVERS\secdrv.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "AVIRA GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfdrv01.sys
"StarForce Protection Environment Driver v6" (prodrv06) - "Protection Technology" - C:\WINDOWS\System32\drivers\prodrv06.sys
"StarForce Protection Helper Driver" (sfhlp01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp01.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp02.sys
"StarForce Protection Helper Driver v2" (prohlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\prohlp02.sys
"StarForce Protection Synchronization Driver v1" (prosync1) - "Protection Technology" - C:\WINDOWS\System32\drivers\prosync1.sys
"SYMDNS" (SYMDNS) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\SYMDNS.SYS
"SymEvent" (SymEvent) - "Symantec Corporation" - C:\Programme\Symantec\SYMEVENT.SYS
"SYMFW" (SYMFW) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\SYMFW.SYS
"SYMIDS" (SYMIDS) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\SYMIDS.SYS
"SYMIDSCO" (SYMIDSCO) - "Symantec Corporation" - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20061113.031\symidsco.sys
"symlcbrd" (symlcbrd) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\symlcbrd.sys
"SYMNDIS" (SYMNDIS) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\SYMNDIS.SYS
"SYMREDRV" (SYMREDRV) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\SYMREDRV.SYS
"SymSnap" (SymSnap) - "StorageCraft" - C:\WINDOWS\system32\drivers\SymSnap.sys
"SYMTDI" (SYMTDI) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\SYMTDI.SYS
"V2IMount" (V2IMount) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\V2IMount.sys
"Vax347b" (Vax347b) - " " - C:\WINDOWS\System32\DRIVERS\Vax347b.sys
"Vax347s" (Vax347s) - " " - C:\WINDOWS\System32\Drivers\Vax347s.sys
"VSO Software pcouffin" (pcouffin) - "VSO Software" - C:\WINDOWS\System32\Drivers\pcouffin.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{32020A01-506E-484D-A2A8-BE3CF17601C3} "AlcoholShellEx" - "Alcohol Soft Development Team" - C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll
{B22A40F0-BD69-11D3-8D28-006097C82E57} "BCShellEx" - "Scooter Software" - C:\Programme\Beyond Compare 2\BCShellEx.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{8BE13461-936F-11D1-A87D-444553540000} "Eraser Shell Extension" - "-" - C:\WINDOWS\System32\erasext.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{f802f260-519b-11d1-bb5d-0060974c6013} "ICQ Shell Extension" - ? - C:\Programme\ICQ\ICQShell.dll  (File found, but it contains no detailed information)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "MCLiteShellExt Class" - ? - C:\Programme\ICQ\ICQLite\ICQLiteShell.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\Wcesview.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -  (File not found | COM-object registry key not found)
{c2c1d8a0-016a-11d1-a7fa-444553540000} "Shell Extension Sample" - ? -  (File not found | COM-object registry key not found)
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{85E0B171-04FA-11D1-B7DA-00A0C90348D6} "Statistik für den Schutz des Web-Datenverkehrs" - "Kaspersky Lab" - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\SCIEPlgn.dll
{2F25CF20-C569-11D1-B94C-00608CB45480} "TextPad" - "Helios Software Solutions" - C:\Programme\Textpad\TextPad 4\System\shellext.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
<binary data> "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.5.0" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.5.0" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} "MUWebControl Class" - "Microsoft Corporation" - C:\WINDOWS\system32\muweb.dll / hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1279637718640
{05D96F71-87C6-11D3-9BE4-00902742D6E0} "QuickPlace Class" - ? - C:\WINDOWS\Downloaded Program Files\qp2.dll / hxxp://s1.teamlearn.de/qp2.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
"ICQ Lite" - "ICQ Ltd." - C:\Programme\ICQ\ICQLite\ICQLite.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
{85E0B171-04FA-11D1-B7DA-00A0C90348D6} "Statistik für den Schutz des Web-Datenverkehrs" - "Kaspersky Lab" - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\SCIEPlgn.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} "IEVkbdBHO Class" - "Kaspersky Lab" - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\ievkbd.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Programme\Spybot - Search & Destroy\SDHelper.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Odometer.lnk" - "Introspect Software" - C:\Programme\Odometer\Odometer.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"CookieWall.lnk" - ? - C:\Programme\AnalogX\CookieWall\cookie.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\USER\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Eraser" - "The Eraser Project" - C:\Programme\Eraser\Eraser.exe -hide
"H/PC Connection Agent" - "Microsoft Corporation" - "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AVP" - "Kaspersky Lab" - "C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"AVM WLAN Connection Service" (AVM WLAN Connection Service) - "AVM Berlin" - C:\Programme\avmwlanstick\WlanNetService.exe
"Crypkey License" (Crypkey License) - "Kenonic Controls Ltd." - C:\WINDOWS\system32\crypserv.exe
"EPSON Printer Status Agent2" (EPSONStatusAgent2) - "SEIKO EPSON CORPORATION" - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
"GEARSecurity" (GEARSecurity) - "GEAR Software" - C:\WINDOWS\System32\GEARSec.exe
"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate1c9d247ad93fc3c)" (gupdate1c9d247ad93fc3c) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Kaspersky Security Suite CBE 09" (AVP) - "Kaspersky Lab" - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe
"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
"MSSQL$PINNACLESYS" (MSSQL$PINNACLESYS) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
"MSSQLServerADHelper" (MSSQLServerADHelper) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe
"Norton Ghost" (Norton Ghost) - "Symantec Corporation" - C:\Programme\Norton\Norton Ghost\Agent\VProSvc.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Pinnacle Systems Media Service" (PinnacleSys.MediaServer) - "Pinnacle Systems" - c:\programme\pinnacle\shared files\programs\mediaserver\pmshost.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"SQLAgent$PINNACLESYS" (SQLAgent$PINNACLESYS) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE
"StarWind iSCSI Service" (StarWindService) - "Rocket Division Software" - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
"Symantec Core LC" (Symantec Core LC) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
"Symantec Event Manager" (ccEvtMgr) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
"Symantec Network Drivers Service" (SNDSrvc) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
"Symantec Password Validation" (ccPwdSvc) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
"Symantec Settings Manager" (ccSetMgr) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL
"klogon" - "Kaspersky Lab" - C:\WINDOWS\system32\klogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]


MBRCHECK:

Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x00001fdd

Kernel Drivers (total 164):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806CE000 \WINDOWS\system32\hal.dll
0xF79BD000 \WINDOWS\system32\KDCOM.DLL
0xF78CD000 \WINDOWS\system32\BOOTVID.dll
0xF72E9000 sptd.sys
0xF79BF000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xF72D1000 \WINDOWS\System32\Drivers\SPTD0669.SYS
0xF72AA000 Vax347b.sys
0xF727B000 ACPI.sys
0xF726A000 pci.sys
0xF74BD000 isapnp.sys
0xF74CD000 ohci1394.sys
0xF74DD000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF74ED000 MountMgr.sys
0xF724B000 ftdisk.sys
0xF773D000 PartMgr.sys
0xF74FD000 VolSnap.sys
0xF7235000 nvatabus.sys
0xF79C1000 Vax347s.sys
0xF721D000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF750D000 disk.sys
0xF751D000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF71FE000 fltMgr.sys
0xF71EC000 sr.sys
0xF752D000 klbg.sys
0xF71D6000 SymSnap.sys
0xF71BF000 KSecDD.sys
0xF7132000 Ntfs.sys
0xF7105000 NDIS.sys
0xF7745000 sfhlp02.sys
0xF79C3000 sfhlp01.sys
0xF70F3000 sfdrv01.sys
0xF79C5000 prosync1.sys
0xF753D000 prohlp02.sys
0xF774D000 nvcchflt.sys
0xF70D8000 Mup.sys
0xF6BB9000 kl1.sys
0xF7755000 \WINDOWS\system32\drivers\TDI.SYS
0xF63DE000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF761D000 \SystemRoot\system32\DRIVERS\ATITool.sys
0xF75FD000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF7815000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF56C1000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF766D000 \SystemRoot\system32\DRIVERS\klfltdev.sys
0xF77A5000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF548B000 \SystemRoot\system32\drivers\ALCXWDM.SYS
0xF5467000 \SystemRoot\system32\drivers\portcls.sys
0xF76ED000 \SystemRoot\system32\drivers\drmk.sys
0xF5444000 \SystemRoot\system32\drivers\ks.sys
0xF756D000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF638E000 \SystemRoot\System32\Drivers\AnyDVD.sys
0xF79D9000 \SystemRoot\System32\Drivers\ElbyDelay.sys
0xF77CD000 \SystemRoot\system32\drivers\ASAPIW2k.sys
0xF757D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF762D000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF77ED000 \SystemRoot\System32\Drivers\GearAspiWDM.SYS
0xF76CD000 \SystemRoot\system32\DRIVERS\fetnd5bv.sys
0xF5357000 \SystemRoot\system32\DRIVERS\3xHybrid.sys
0xF6B31000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
0xF6B2D000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
0xF5317000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
0xF52E4000 \SystemRoot\system32\DRIVERS\NVSNPU.SYS
0xF4C5A000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF0CB7000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF0C6D000 \SystemRoot\System32\Drivers\dtscsi.sys
0xF1990000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF0C5C000 \SystemRoot\system32\DRIVERS\serial.sys
0xF1C51000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF0C48000 \SystemRoot\system32\DRIVERS\parport.sys
0xF1D17000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF1988000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF1980000 \SystemRoot\system32\DRIVERS\klim5.sys
0xF7AF7000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF1D07000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF1C4D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF0BE1000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF1CF7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF1AEB000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF0BD0000 \SystemRoot\system32\DRIVERS\psched.sys
0xF1ADB000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF1978000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF1970000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF1ACB000 \SystemRoot\System32\Drivers\pcouffin.sys
0xF1ABB000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF1968000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7A47000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF0AFC000 \SystemRoot\system32\DRIVERS\update.sys
0xF1C3D000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF1AAB000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF1A9B000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7A69000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF1A5B000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
0xF189B000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7A41000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xEE6E8000 \SystemRoot\system32\DRIVERS\klif.sys
0xF3A4B000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF17AD000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF187B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF0AF4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7B0B000 \SystemRoot\System32\Drivers\Null.SYS
0xF0AF8000 \SystemRoot\System32\Drivers\Beep.SYS
0xF788D000 \SystemRoot\System32\drivers\vga.sys
0xF0AF2000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF0AF0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF1B0D000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF19A0000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF1C39000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEE6B5000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEE635000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEE5F5000 \SystemRoot\System32\Drivers\SYMTDI.SYS
0xEE5D8000 \??\C:\Programme\Symantec\SYMEVENT.SYS
0xEE5B0000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEE58E000 \SystemRoot\System32\drivers\afd.sys
0xF179D000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF177D000 \SystemRoot\System32\Drivers\V2IMount.SYS
0xF0C38000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xEE51C000 \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
0xF0C30000 \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
0xEE4F1000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEE4DE000 \SystemRoot\System32\drivers\prodrv06.sys
0xF3A47000 \SystemRoot\system32\ckldrv.sys
0xEE46F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF176D000 \SystemRoot\System32\Drivers\Fips.SYS
0xEE44E000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF5724000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF1D27000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xEE3E5000 \SystemRoot\system32\DRIVERS\fwlanusb.sys
0xF0C08000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xEE69D000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF1D67000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEB25D000 \SystemRoot\System32\Drivers\dump_nvatabus.sys
0xF79F5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xED306000 \SystemRoot\System32\drivers\Dxapi.sys
0xF3CFE000 \SystemRoot\System32\watchdog.sys
0xBF9C1000 \SystemRoot\System32\drivers\dxg.sys
0xEB71C000 \SystemRoot\System32\drivers\dxgthk.sys
0xEB608000 \SystemRoot\system32\DRIVERS\nvcap.sys
0xF5714000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0xED2CA000 \SystemRoot\system32\DRIVERS\NVxbar.sys
0xBF9D3000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xBAFEA000 \SystemRoot\system32\DRIVERS\nwlnkipx.sys
0xEC84D000 \SystemRoot\system32\DRIVERS\nwlnknb.sys
0xEE53E000 \SystemRoot\System32\Drivers\SYMREDRV.SYS
0xECD9B000 \SystemRoot\System32\Drivers\SYMDNS.SYS
0xF5774000 \SystemRoot\System32\Drivers\SYMNDIS.SYS
0xBAFC1000 \SystemRoot\System32\Drivers\SYMFW.SYS
0xF7875000 \SystemRoot\System32\Drivers\SYMIDS.SYS
0xBAF93000 \??\C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20061113.031\symidsco.sys
0xBAF2E000 \SystemRoot\system32\drivers\wdmaud.sys
0xEB463000 \SystemRoot\system32\drivers\sysaudio.sys
0xBAEBE000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xBADA1000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xEB2D1000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xBADDE000 \SystemRoot\System32\Drivers\Aspi32.SYS
0xEB2C1000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0xBAC0E000 \SystemRoot\system32\DRIVERS\srv.sys
0xF1395000 \SystemRoot\system32\DRIVERS\nwlnkspx.sys
0xBAD41000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xF784D000 \??\C:\WINDOWS\system32\drivers\symlcbrd.sys
0xBA5B3000 \SystemRoot\System32\Drivers\HTTP.sys
0xBA499000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 43):
0 System Idle Process
4 System
2044 C:\WINDOWS\system32\smss.exe
240 csrss.exe
300 C:\WINDOWS\system32\winlogon.exe
352 C:\WINDOWS\system32\services.exe
364 C:\WINDOWS\system32\lsass.exe
500 C:\WINDOWS\system32\svchost.exe
560 svchost.exe
604 C:\WINDOWS\system32\svchost.exe
856 svchost.exe
1084 C:\Programme\Gemeinsame Dateien\Symantec Shared\CCSETMGR.EXE
1148 C:\WINDOWS\explorer.exe
1160 C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
1236 C:\Programme\Gemeinsame Dateien\Symantec Shared\CCEVTMGR.EXE
1384 C:\WINDOWS\system32\spoolsv.exe
1808 C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe
1824 C:\Programme\Microsoft ActiveSync\wcescomm.exe
1832 C:\Programme\Eraser\Eraser.exe
1840 C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
1852 C:\Programme\Odometer\Odometer.exe
1868 C:\Programme\AnalogX\CookieWall\cookie.exe
1900 C:\PROGRA~1\MI3AA1~1\rapimgr.exe
232 C:\Programme\avmwlanstick\WLanNetService.exe
368 C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 09\avp.exe
636 C:\WINDOWS\system32\Crypserv.exe
700 C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
720 C:\WINDOWS\system32\gearsec.exe
1068 C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\MDM.EXE
1576 C:\Programme\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
2008 C:\Programme\Norton\Norton Ghost\Agent\VProSvc.exe
2364 C:\WINDOWS\system32\nvsvc32.exe
2460 C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
2524 C:\WINDOWS\system32\svchost.exe
2596 C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
3056 wdfmgr.exe
3444 C:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
2876 C:\WINDOWS\system32\wscntfy.exe
1616 alg.exe
3996 C:\Programme\Outlook Express\msimn.exe
2964 C:\Programme\Internet Explorer\iexplore.exe
3100 C:\Programme\Internet Explorer\iexplore.exe
1992 C:\Dokumente und Einstellungen\USER\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3160023AS, Rev: 3.00
PhysicalDrive1 Model Number: ST3160023AS, Rev: 3.00

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
149 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

cosinus 04.05.2011 16:22
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Wenn keine Funde dabei waren bzw. nur Cookies bitte umgehend das SP3 installieren!!!
  1. Das SP3 von hier downloaden => Detail Seite Windows XP Service Pack 3-Netzwerkinstallationspaket für IT-Spezialisten und Entwickler (und ja es ist das richtige Paket für dich)
  2. Alle Programme beenden, Internetverbindung trennen, Virenscanner abstellen!
  3. SP3 instalieren, Anweisungen folgen - Installation sollte ca. 15-20 Minuten dauern. Kann auch schneller gehen, bei älteren Rechnern dauert es ca. ne halbe Stunde - nach der Installation Rechner neu starten

Bin 04.05.2011 22:38
Hier der Log von Malwarebytes:

Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6504

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

04.05.2011 21:45:23
mbam-log-2011-05-04 (21-45-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 472444
Laufzeit: 2 Stunde(n), 27 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Der andere kommt morgen!


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131