Trojaner-Board - Trojan.Generic.xxx, Exploit.JS.Pdf.AK, Gen:Variant.Kazy.154, Trojanerbefall

gmer:

Code:

GMER 1.0.15.15627 - hxxp://www.gmer.net

Rootkit scan 2011-05-28 07:45:36

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD2500BJKT-75F4T0 rev.11.01A11

Running: 5q2gumbu.exe; Driver: C:\DOKUME~1\Frank\LOKALE~1\Temp\uxldypog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F7A7DA1E                                  ZwCreateKey

SSDT            F7A7DA14                                  ZwCreateThread

SSDT            F7A7DA23                                  ZwDeleteKey

SSDT            F7A7DA2D                                  ZwDeleteValueKey

SSDT            F7A7DA32                                  ZwLoadKey

SSDT            F7A7DA00                                  ZwOpenProcess

SSDT            F7A7DA05                                  ZwOpenThread

SSDT            F7A7DA3C                                  ZwReplaceKey

SSDT            F7A7DA37                                  ZwRestoreKey

SSDT            F7A7DA28                                  ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\system32\DRIVERS\ati2mtag.sys  section is writeable [0xB96F9000, 0x1C5D38, 0xE8000020]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0   SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
 

---- Disk sectors - GMER 1.0.15 ----
 

Disk            \Device\Harddisk0\DR0                     malicious Win32:MBRoot code @ sector 488376003

Disk            \Device\Harddisk0\DR0                     PE file @ sector 488376025
 

---- EOF - GMER 1.0.15 ----

osam:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 07:56:37 on 28.05.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 3.6.17
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"WGASetup.job" - "Microsoft Corporation" - C:\WINDOWS\system32\KB905474\wgasetup.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"BACSCPL.cpl" - ? - C:\WINDOWS\system32\BACSCPL.cpl

"BCMWLCPL.CPL" - "Dell Inc." - C:\WINDOWS\system32\BCMWLCPL.CPL

"btcpl.cpl" - "Broadcom Corporation." - C:\WINDOWS\system32\btcpl.cpl

"DMdm32.cpl" - ? - C:\WINDOWS\system32\DMdm32.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AFS2k" (AFS2K) - "Oak Technology Inc." - C:\WINDOWS\system32\drivers\AFS2K.sys

"ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOKUME~1\Frank\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"DAEMON Tools Virtual Bus Driver" (dtsoftbus01) - "DT Soft Ltd" - C:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

"uxldypog" (uxldypog) - ? - C:\DOKUME~1\Frank\LOKALE~1\Temp\uxldypog.sys  (Hidden registry entry, rootkit activity | File not found)

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" - "Broadcom Corporation." - C:\WINDOWS\system32\BTNEIG~1.DLL

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\WINDOWS\system32\btncopy.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\SDShelEx-win32.dll

{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"Digital Line Detect.lnk" - "Avanquest Software " - C:\Programme\Digital Line Detect\DLG.exe  (Shortcut exists | File exists)

"BTTray.lnk" - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Frank\Startmenü\Programme\Autostart\desktop.ini

"DesktopVideoPlayer.lnk" - "Totem Entertainment" - C:\Dokumente und Einstellungen\Frank\Lokale Einstellungen\Anwendungsdaten\vghd\bin\vghd.exe  (Shortcut exists | File exists)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"Broadcom Wireless Manager UI" - "Dell Inc." - C:\WINDOWS\system32\WLTRAY.exe

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Dell Wireless WLAN Card Logon Provider" - "Dell Inc." - C:\WINDOWS\System32\BCMLogon.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Bluetooth-Druckeranschluss" - "Broadcom Corporation." - C:\WINDOWS\system32\bthcrp.dll

"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe

"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Dell Wireless WLAN Tray Service" (wltrysvc) - ? - C:\WINDOWS\System32\WLTRYSVC.EXE  (File found, but it contains no detailed information)

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"SupportSoft Sprocket Service (DellSupportCenter)" (sprtsvc_DellSupportCenter) - "SupportSoft, Inc." - C:\Programme\Dell Support Center\bin\sprtsvc.exe

"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"AtiExtEvent" - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

mbrcheck:

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Professional

Windows Information:                Service Pack 3 (build 2600)

Logical Drives Mask:                0x0000003c
 

Kernel Drivers (total 143):

  0x804D7000 \WINDOWS\system32\TUKERNEL.EXE

  0x80722000 \WINDOWS\system32\hal.dll

  0xF7987000 \WINDOWS\system32\KDCOM.DLL

  0xF7897000 \WINDOWS\system32\BOOTVID.dll

  0xF75A7000 ACPI.sys

  0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS

  0xF7596000 pci.sys

  0xF75F7000 isapnp.sys

  0xF7607000 ohci1394.sys

  0xF7617000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF789B000 compbatt.sys

  0xF789F000 \WINDOWS\system32\DRIVERS\BATTC.SYS

  0xF7A4F000 pciide.sys

  0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF7627000 MountMgr.sys

  0xF74D7000 ftdisk.sys

  0xF798B000 dmload.sys

  0xF74B1000 dmio.sys

  0xF770F000 PartMgr.sys

  0xF7637000 VolSnap.sys

  0xF7499000 atapi.sys

  0xF7647000 disk.sys

  0xF7657000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF7479000 fltMgr.sys

  0xF7467000 sr.sys

  0xF7450000 KSecDD.sys

  0xF7B52000 Ntfs.sys

  0xF7423000 NDIS.sys

  0xF7409000 Mup.sys

  0xBA7D8000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0xF7677000 \SystemRoot\system32\DRIVERS\processr.sys

  0xB96F8000 \SystemRoot\system32\DRIVERS\ati2mtag.sys

  0xB96E4000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF77C7000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0xB95AD000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF77CF000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF7687000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF7697000 \SystemRoot\System32\Drivers\AFS2K.SYS

  0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xB958A000 \SystemRoot\system32\DRIVERS\ks.sys

  0xB9562000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0xF76C7000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xB9530000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0xF79AD000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF77D7000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF77DF000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF76D7000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys

  0xF7556000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xB951C000 \SystemRoot\system32\DRIVERS\sdbus.sys

  0xF7546000 \SystemRoot\system32\DRIVERS\rimmptsk.sys

  0xB94EA000 \SystemRoot\system32\DRIVERS\rimsptsk.sys

  0xB9499000 \SystemRoot\system32\DRIVERS\rixdptsk.sys

  0xBA01D000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0xBA019000 \SystemRoot\system32\DRIVERS\wmiacpi.sys

  0xB93C8000 \SystemRoot\system32\DRIVERS\btkrnl.sys

  0xF7A88000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF7536000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xBA015000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xB9311000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF7526000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF7516000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF77E7000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xB9300000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF7506000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF77F7000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF77FF000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xB92A8000 \SystemRoot\system32\DRIVERS\rdpdr.sys

  0xF74F6000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF79B5000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xB924A000 \SystemRoot\system32\DRIVERS\update.sys

  0xF791F000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xB920F000 \SystemRoot\system32\DRIVERS\dtsoftbus01.sys

  0xBA7A0000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xBA770000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xAADF2000 \SystemRoot\system32\drivers\sthda.sys

  0xAADCE000 \SystemRoot\system32\drivers\portcls.sys

  0xBA730000 \SystemRoot\system32\drivers\drmk.sys

  0xAAD9A000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys

  0xAACA8000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys

  0xAABF5000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

  0xF781F000 \SystemRoot\System32\Drivers\Modem.SYS

  0xF79E1000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF7ABE000 \SystemRoot\System32\Drivers\Null.SYS

  0xF79E3000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF7777000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0xF777F000 \SystemRoot\System32\drivers\vga.sys

  0xF79E5000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF79E7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF7787000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF778F000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xBA7C4000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xAABC2000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xAAB69000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xAAB41000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xAAB1B000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xAAAE3000 \SystemRoot\system32\DRIVERS\tcpip6.sys

  0xAAAC1000 \SystemRoot\System32\drivers\afd.sys

  0xBA720000 \SystemRoot\system32\DRIVERS\Ip6Fw.sys

  0xBA710000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF7797000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xAA9F6000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xAA95E000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF76E7000 \SystemRoot\System32\Drivers\Fips.SYS

  0xAA938000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF79F7000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xF779F000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0xF7576000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xF7566000 \SystemRoot\System32\Drivers\btwusb.sys

  0xF794B000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0xB93B8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0xAA8FE000 \SystemRoot\system32\DRIVERS\OEM02Dev.sys

  0xF7A03000 \SystemRoot\system32\DRIVERS\OEM02Vfx.sys

  0xBA7F8000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0xBA7F4000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0xAA8BE000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF7A05000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xB9398000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xBA7E0000 \SystemRoot\System32\drivers\Dxapi.sys

  0xAAF78000 \SystemRoot\System32\watchdog.sys

  0xBF000000 \SystemRoot\System32\drivers\dxg.sys

  0xF7AA2000 \SystemRoot\System32\drivers\dxgthk.sys

  0xB9368000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xBF012000 \SystemRoot\System32\ati2dvag.dll

  0xBF065000 \SystemRoot\System32\ati2cqag.dll

  0xBF0FE000 \SystemRoot\System32\atikvmag.dll

  0xBF182000 \SystemRoot\System32\atiok3x2.dll

  0xBF1CD000 \SystemRoot\System32\ati3duag.dll

  0xBF572000 \SystemRoot\System32\ativvaxx.dll

  0xBF9C6000 \SystemRoot\System32\ATMFD.DLL

  0xA8405000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xA8361000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xA80E0000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xA807B000 \SystemRoot\system32\drivers\wdmaud.sys

  0xA82F5000 \SystemRoot\system32\drivers\sysaudio.sys

  0xA80B8000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

  0xA7E1D000 \SystemRoot\system32\DRIVERS\srv.sys

  0xBA20E000 \??\C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

  0xA76FC000 \SystemRoot\System32\Drivers\HTTP.sys

  0xA7341000 \??\C:\DOKUME~1\Frank\LOKALE~1\Temp\uxldypog.sys

  0xA722E000 \SystemRoot\system32\DRIVERS\bcmwl5.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll
 

Processes (total 41):

       0 System Idle Process

       4 System

     508 C:\WINDOWS\system32\smss.exe

     964 csrss.exe

    1060 C:\WINDOWS\system32\winlogon.exe

    1104 C:\WINDOWS\system32\services.exe

    1116 C:\WINDOWS\system32\lsass.exe

    1308 C:\WINDOWS\system32\ati2evxx.exe

    1328 C:\WINDOWS\system32\svchost.exe

    1412 svchost.exe

    1484 C:\WINDOWS\system32\svchost.exe

    1544 C:\WINDOWS\system32\ati2evxx.exe

    1636 svchost.exe

    1720 svchost.exe

    1868 C:\WINDOWS\system32\WLTRYSVC.EXE

    1880 C:\WINDOWS\system32\BCMWLTRY.EXE

    1936 C:\WINDOWS\system32\spoolsv.exe

    1988 C:\Programme\Avira\AntiVir Desktop\sched.exe

    2024 svchost.exe

     280 C:\Programme\Avira\AntiVir Desktop\avguard.exe

     636 C:\Programme\Java\jre6\bin\jqs.exe

     684 C:\Programme\Avira\AntiVir Desktop\avshadow.exe

     784 C:\Programme\Dell Support Center\bin\sprtsvc.exe

     932 C:\WINDOWS\system32\svchost.exe

    1008 C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

    1520 wdfmgr.exe

    1700 C:\WINDOWS\explorer.exe

    2300 C:\WINDOWS\OEM02Mon.exe

    2308 C:\Programme\Synaptics\SynTP\SynTPEnh.exe

    2316 C:\WINDOWS\system32\WLTRAY.EXE

    2336 C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    2352 C:\Programme\Sigmatel\C-Major Audio\WDM\stsystra.exe

    2372 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    2516 C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

    2544 C:\Programme\Digital Line Detect\DLG.exe

    3424 C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

    3452 C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    3676 alg.exe

    4016 C:\WINDOWS\system32\wuauclt.exe

    1572 C:\WINDOWS\system32\wbem\wmiapsrv.exe

    2944 C:\Dokumente und Einstellungen\Frank\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000c`34f34a00  (NTFS)
 

PhysicalDrive0 Model Number: WDCWD2500BJKT-75F4T0, Rev: 11.01A11
 

      Size  Device Name          MBR Status

  --------------------------------------------

    232 GB  \\.\PhysicalDrive0   Windows XP MBR code detected

            SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
 
 

Done!

malwarebytes:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org
 

Datenbank Version: 6711
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702
 

29.05.2011 14:43:12

mbam-log-2011-05-29 (14-43-12).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Durchsuchte Objekte: 252026

Laufzeit: 1 Stunde(n), 21 Minute(n), 25 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

sasw:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 05/29/2011 at 05:36 PM
 

Application Version : 4.53.1000
 

Core Rules Database Version : 7162

Trace Rules Database Version: 4974
 

Scan type       : Complete Scan

Total Scan Time : 02:23:05
 

Memory items scanned      : 637

Memory threats detected   : 0

Registry items scanned    : 6042

Registry threats detected : 2

File items scanned        : 111895

File threats detected     : 83
 

Adware.Tracking Cookie

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@zanox[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@advertise[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad4.adfarm1.adition[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@server.iad.liveperson[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@cofidis2.solution.weborama[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@track[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@cgi-bin[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@weborama[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@server.cpmstar[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@at.atwola[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adjuggler[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adfarm1.adition[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad3.adfarm1.adition[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@click.xmlmonetize[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@www.trekmedia[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@p386t1s4354870.kronos.bravenetmedia[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@eu.gomeotrack[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@trafficengine[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@eas.apm.emediate[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@atdmt[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@tacoda[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@advertising[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@mediabrandsww[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@gotacha.rotator.hadj7.adjuggler[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ads.inextmedia[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ads.247activemedia[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@serving-sys[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adbrite[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@statcounter[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@traffictrack[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@trackor[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@vidasco.rotator.hadj7.adjuggler[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adsrv1.admediate[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad.adbull[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad.yieldmanager[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@webmasterplan[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ads.cpxcenter[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@revsci[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad.zanox[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@s1.trekmedia[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad.adition[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@vdwp.solution.weborama[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad1.adtitan[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@atwola[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@media6degrees[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@bidtraffic[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@harrenmedianetwork[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@tracking1.aleadpay[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adserving.versaneeds[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@yadro[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@p353t1s4018665.kronos.bravenetmedia[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@clicksor[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adxpose[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@xml.trafficengine[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@www.cpcadnet[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@atdmt.combing[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@zbox.zanox[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@myroitracking[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad.dyntracker[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@liveperson[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@www.zanox-affiliate[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad.ad-srv[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@specificclick[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@overture[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@content.yieldmanager[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@a[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad1.adfarm.adtelligence[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ads.creative-serving[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@adtech[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ak[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@doubleclick[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad2.adfarm1.adition[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@mm.chitika[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@xml.happytofind[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ru4[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@clicks.thespecialsearch[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@invitemedia[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@zanox-affiliate[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ad1.adfarm1.adition[2].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@ads.medienhaus[1].txt

        C:\Dokumente und Einstellungen\Frank\Cookies\frank@usatoday1.112.2o7[1].txt

        media.mtvnservices.com [ C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\Z89VRK7F ]

        secure-us.imrworldwide.com [ C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Macromedia\Flash Player\#SharedObjects\Z89VRK7F ]
 

Malware.Trace

        HKU\.DEFAULT\Software\NtWqIVLZEWZU

        HKU\S-1-5-18\Software\NtWqIVLZEWZU

eset:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6427

# api_version=3.0.2

# EOSSerial=f70d961812a8bc4b9c5b72d3a26f83bf

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-05-29 05:24:05

# local_time=2011-05-29 07:24:05 (+0100, Westeuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16775141 100 93 165397 43222086 10494 0

# compatibility_mode=8192 67108863 100 0 193 193 0 0

# scanned=112442

# found=7

# cleaned=0

# scan_time=4580

C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\12\3cc664c-6837f3ee        Java/Exploit.CVE-2010-4452.A trojan (unable to clean)        00000000000000000000000000000000        I

C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\27\5b0c76db-229e83d9        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\32\4144d260-1747c9a7        Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean)        00000000000000000000000000000000        I

C:\Programme\Application Updater\ApplicationUpdater.exe        probably a variant of Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

C:\Programme\Gemeinsame Dateien\Spigot\Search Settings\SearchSettings.exe        Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

D:\Eigene Dateien\Downloads\backups\backup-20110101-135656-970.dll        a variant of Win32/Adware.Toolbar.Dealio application (unable to clean)        00000000000000000000000000000000        I

D:\Frank's Dateien\Ausm Internet\Nero-8.1.1.0b_deu.exe        Win32/Toolbar.AskSBar application (unable to clean)        00000000000000000000000000000000        I