Sebastian - 06-10-30 17:13:00,20    Service Pack 2
ComboFix 06.10.19 - Running from: "D:\Dokumente und Einstellungen\Sebastian\Desktop"

((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
 

D:\WINDOWS\system32\ishost.exe
D:\WINDOWS\system32\ismini.exe
D:\WINDOWS\system32\issearch.exe
D:\WINDOWS\system32\winsys.exe
D:\Programme\Inetget2
D:\Programme\Ipwins
D:\WINDOWS\system32\components
D:\Programme\Gemeinsame Dateien\{94E9F1E2-0711-1031-1128-050113050031}
D:\WINDOWS\system32\ixt0.dll 

 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~    Purity    ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 

Folders Quarantined:

D:\QooBox\Purity\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\ASEMBL~1
D:\QooBox\Purity\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\YMANTE~1
D:\QooBox\Purity\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\ASEMBL~1\?ttrib.exe
D:\QooBox\Purity\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\YMANTE~1\?ymantec
D:\QooBox\Purity\Dokumente und Einstellungen\Sebastian\Eigene Dateien\CROSOF~1
D:\QooBox\Purity\Programme\APPATC~1
D:\QooBox\Purity\WINDOWS\CROSOF~1
D:\QooBox\Purity\WINDOWS\DOBE~1
D:\QooBox\Purity\WINDOWS\FNTS~1
D:\QooBox\Purity\WINDOWS\RACLE~1
D:\QooBox\Purity\WINDOWS\CROSOF~1\??crosoft
D:\QooBox\Purity\WINDOWS\DOBE~1\m?iexec.exe
D:\QooBox\Purity\WINDOWS\FNTS~1\?poolsv.exe
D:\QooBox\Purity\WINDOWS\RACLE~1\?racle

 
(((((((((((((((((((((((((((((((   Files Created from 2006-09-30 to 2006-10-30  ))))))))))))))))))))))))))))))))))
 
 
2006-10-30	13:59	57,384	--a------	D:\WINDOWS\system32\avsda.dll
2006-10-30	13:59	32,768	--a------	D:\WINDOWS\system32\drivers\avgntdd.sys
2006-10-30	13:59	14,848	--a------	D:\WINDOWS\system32\drivers\avgntmgr.sys
2006-10-30	11:08	10,344	--a------	D:\WINDOWS\system32\drivers\symlcbrd.sys
2006-10-30	11:06	48,816	--a------	D:\WINDOWS\system32\S32EVNT1.DLL
2006-10-30	11:06	109,744	--a------	D:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-30	08:42	8,704	--a------	D:\WINDOWS\system32\SpOrder.dll
2006-10-30	07:22	2	--a------	D:\WINDOWS\system32\wtssvsu.exe
2006-10-01	11:02	2,368	--a------	D:\WINDOWS\system32\SVKP.sys


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))	


2006-10-30 17:13	--------	d--------	D:\Programme\Gemeinsame Dateien
2006-10-30 15:19	--------	d--------	D:\Programme\CleanUp!
2006-10-30 14:41	--------	d--------	D:\Programme\Gemeinsame Dateien\Symantec Shared
2006-10-30 13:59	--------	d--------	D:\Programme\AntiVir PersonalEdition Classic
2006-10-30 13:02	--------	d--------	D:\Programme\Norton Internet Security
2006-10-30 11:25	--------	d--------	D:\Programme\Symantec
2006-10-30 10:13	--------	d--------	D:\Programme\MSI
2006-10-30 08:14	--------	d--------	D:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\Symantec
2006-10-30 07:36	--------	d--h-----	D:\Programme\InstallShield Installation Information
2006-10-30 07:33	--------	d--------	D:\Programme\RegCleaner
2006-10-27 23:17	--------	d--------	D:\Dokumente und Einstellungen\Sebastian\Anwendungsdaten\teamspeak2
2006-10-26 16:14	--------	d--------	D:\Programme\Gemeinsame Dateien\InstallShield
2006-10-11 13:14	--------	d--------	D:\Programme\Yahoo!
2006-10-09 10:17	43520	--a------	D:\WINDOWS\system32\CmdLineExt03.dll
2006-09-27 10:24	--------	d--------	D:\Programme\LimeWire
2006-09-13 06:02	1084416	--a------	D:\WINDOWS\system32\msxml3.dll
2006-09-07 13:27	--------	d--------	D:\Programme\Windows Media Player
2006-08-25 16:46	617472	--a------	D:\WINDOWS\system32\comctl32.dll
2006-08-21 13:26	16896	--a------	D:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14	23040	--a------	D:\WINDOWS\system32\fltmc.exe
2006-08-16 12:58	100352	--a------	D:\WINDOWS\system32\6to4svc.dll
2006-08-07 16:02	534208	--a------	D:\WINDOWS\system32\SymNeti.dll
2006-08-07 16:02	161472	--a------	D:\WINDOWS\system32\SymRedir.dll
 
 
((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"BLASC"="\"H:\\World of Warcraft\\BLASC\\BLASC.exe\""
"Aaes"="\"D:\\DOKUME~1\\SEBAST~1\\ANWEND~1\\YMANTE~1\\taskmgr.exe\" -vt ndrv"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"="D:\\Programme\\ICQLite\\ICQLite.exe -trayboot"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE D:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NVCLOCK"="Rundll32 nvclock.dll,fnNvclock"
"NVIDIA nTune"="\"D:\\Programme\\NVIDIA Corporation\\nTune\\\\nTune.exe\" clear"
"NVMixerTray"="\"D:\\Programme\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe\""
"nTrayFw"="D:\\Programme\\NVIDIA Corporation\\NetworkAccessManager\\bin\\nTrayFw.exe"
"LiveMonitor"="D:\\Programme\\MSI\\Live Update 3\\LMonitor.exe"
"EM_EXEC"="D:\\PROGRA~1\\Logitech\\MOUSEW~1\\SYSTEM\\EM_EXEC.EXE"
"SoundMan"="SOUNDMAN.EXE"
"NeroFilterCheck"="D:\\WINDOWS\\system32\\NeroCheck.exe"
"NvMediaCenter"="RUNDLL32.EXE D:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"SunJavaUpdateSched"="D:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"ICQ Lite"="\"D:\\Programme\\ICQLite\\ICQLite.exe\" -minimize"
"RemoveWGA"="\\\\server2003\\Allgemein\\Förster\\RemoveWGA.exe -startup"
"ISUSPM Startup"="\"D:\\Programme\\Gemeinsame Dateien\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"D:\\Programme\\Gemeinsame Dateien\\InstallShield\\UpdateService\\issch.exe\" -start"
"ccApp"="\"D:\\Programme\\Gemeinsame Dateien\\Symantec Shared\\ccApp.exe\""
"avgnt"="\"D:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
  00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
  00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="D:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="D:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"ZboardTray"="\"D:\\Programme\\Ideazon\\Zboard Software\\Driver\\ZboardTray.exe\" /autolaunch"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^3D!Turbo Experience.lnk]
"path"="D:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\3D!Turbo Experience.lnk"
"backup"="D:\\WINDOWS\\pss\\3D!Turbo Experience.lnkCommon Startup"
"location"="Common Startup"
"command"="D:\\PROGRA~1\\MSI\\3D!TUR~1\\3D!Turbo.exe "
"item"="3D!Turbo Experience"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
"path"="D:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\Adobe Reader - Schnellstart.lnk"
"backup"="D:\\WINDOWS\\pss\\Adobe Reader - Schnellstart.lnkCommon Startup"
"location"="Common Startup"
"command"="D:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader - Schnellstart"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^SecureDoc.lnk]
"path"="D:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\SecureDoc.lnk"
"backup"="D:\\WINDOWS\\pss\\SecureDoc.lnkCommon Startup"
"location"="Common Startup"
"command"="D:\\PROGRA~1\\MSI\\SECURE~1\\Logon.exe "
"item"="SecureDoc"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\D:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinZip Quick Pick.lnk]
"path"="D:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\WinZip Quick Pick.lnk"
"backup"="D:\\WINDOWS\\pss\\WinZip Quick Pick.lnkCommon Startup"
"location"="Common Startup"
"command"="D:\\PROGRA~1\\WinZip\\WZQKPICK.EXE "
"item"="WinZip Quick Pick"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ICQLite"
"hkey"="HKLM"
"command"="D:\\Programme\\ICQLite\\ICQLite.exe -minimize"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="InCD"
"hkey"="HKLM"
"command"="D:\\Programme\\Ahead\\InCD\\InCD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"D:\\Programme\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PowerBar"
"hkey"="HKCU"
"command"="\"D:\\Programme\\CyberLink DVD Solution\\Multimedia Launcher\\PowerBar.exe\" /AtBootTime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PDVDServ"
"hkey"="HKLM"
"command"="\"D:\\Programme\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="D:\\Programme\\Winamp\\winampa.exe"
"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhab32
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Zboard

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]	
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 
Contents of the 'Scheduled Tasks' folder
D:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - Sebastian.job

Completion time: 06-10-30 17:16:10.28 
D:\ComboFix.txt ... 06-10-30 17:16