ComboFix 08-10-08.02 - user 2008-10-09 11:02:38.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1031.18.285 [GMT 2:00] ausgeführt von:: C:\Dokumente und Einstellungen\user\Desktop\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt [COLOR=RED][B]Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !![/B][/COLOR] . ((((((((((((((((((((((( Dateien erstellt von 2008-09-09 bis 2008-10-09 )))))))))))))))))))))))))))))) . 2008-10-08 22:57 . 2008-10-08 22:57 d--hs---- C:\Dokumente und Einstellungen\user\UserData 2008-10-08 11:50 . 2008-10-08 11:50 580,096 --a------ C:\WINDOWS\system32\dllcache\user32.dll 2008-10-08 11:48 . 2008-10-08 11:48 d-------- C:\WINDOWS\ERUNT 2008-10-08 10:29 . 2008-10-08 10:29 d-------- C:\Programme\SUPERAntiSpyware 2008-10-08 10:29 . 2008-10-08 10:29 d-------- C:\Dokumente und Einstellungen\user\Anwendungsdaten\SUPERAntiSpyware.com 2008-10-08 10:29 . 2008-10-08 10:29 d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com 2008-10-08 02:51 . 2008-10-08 02:51 d-------- C:\rsit 2008-10-07 22:46 . 2008-10-07 22:46 d-------- C:\Programme\Malwarebytes' Anti-Malware 2008-10-07 22:46 . 2008-10-07 22:46 d-------- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Malwarebytes 2008-10-07 22:46 . 2008-10-07 22:46 d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2008-10-07 22:46 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-07 22:46 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-07 22:38 . 2008-10-07 22:38 d-------- C:\Programme\CCleaner 2008-10-07 19:47 . 2008-10-07 19:47 d-------- C:\Programme\Spybot - Search & Destroy 2008-10-07 19:47 . 2008-10-07 19:47 d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy 2008-10-07 16:49 . 2008-10-07 16:49 d--h----- C:\$AVG8.VAULT$ 2008-10-07 15:36 . 2008-10-07 15:36 d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg8 2008-10-07 15:18 . 2008-10-07 15:18 d-------- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\SmartSurfer 2008-10-07 14:59 . 2008-10-07 14:59 d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files 2008-10-05 23:11 . 2008-10-05 23:11 d-------- C:\Programme\Trend Micro 2008-10-03 13:13 . 2008-10-03 13:14 d-------- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ratiopharm 2008-09-29 19:10 . 2008-04-13 20:54 22,016 --a------ C:\WINDOWS\system32\drivers\MSIRCOMM.sys 2008-09-29 19:10 . 2008-04-13 20:54 22,016 --a------ C:\WINDOWS\system32\dllcache\msircomm.sys 2008-09-26 17:36 . 2008-09-26 17:36 d-------- C:\Programme\LingoPad 2008-09-26 17:36 . 2008-09-26 17:36 d-------- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Lingo4u 2008-09-19 15:28 . 2008-09-19 15:28 d-------- C:\WINDOWS\system32\de 2008-09-19 15:28 . 2008-09-19 15:28 d-------- C:\WINDOWS\system32\bits 2008-09-19 15:28 . 2008-09-19 15:28 d-------- C:\WINDOWS\l2schemas . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-07 15:52 --------- d-----w C:\Programme\Bullfrog 2008-08-28 21:01 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard 2008-08-25 13:24 --------- d-----w C:\Programme\Google 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2008-04-01 21:38 14,852 ----a-w C:\Programme\settings.dat 2003-01-21 01:00 13,095,560 ----a-r C:\WINDOWS\system32\config\systemprofile\MpSetup.exe 2003-01-21 01:00 13,095,560 ----a-r C:\Dokumente und Einstellungen\user\MpSetup.exe 2003-01-21 01:00 13,095,560 ----a-r C:\Dokumente und Einstellungen\Default User\MpSetup.exe . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "SUPERAntiSpyware"="C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "ATIPTA"="C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-22 335872] "LtMoh"="C:\Programme\ltmoh\Ltmoh.exe" [2003-04-28 184320] "LManager"="C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE" [2003-12-15 262144] "RemoteControl"="C:\Programme\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960] "SynTPLpr"="C:\Programme\Synaptics\SynTP\SynTPLpr.exe" [2004-01-09 98304] "SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2004-01-09 491520] "SunJavaUpdateSched"="C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe" [2003-08-19 32873] "TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-05-07 185896] "Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2008-05-27 413696] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINDOWS\system32\Ati2mdxx.exe] "SoundMan"="SOUNDMAN.EXE" [2003-12-19 C:\WINDOWS\SOUNDMAN.EXE] "AGRSMMSG"="AGRSMMSG.exe" [2003-07-25 C:\WINDOWS\AGRSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360] C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\ hpoddt01.exe.lnk - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672] hp psc 2000 Series.lnk - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-06 323646] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 C:\Programme\SUPERAntiSpyware\SASWINLO.dll [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^user^Startmenü^Programme^Autostart^Registration DIE SIEDLER - Das Erbe der Könige - Gold Edition.LNK] path=C:\Dokumente und Einstellungen\user\Startmenü\Programme\Autostart\Registration DIE SIEDLER - Das Erbe der Könige - Gold Edition.LNK backup=C:\WINDOWS\pss\Registration DIE SIEDLER - Das Erbe der Könige - Gold Edition.LNKStartup [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^user^Startmenü^Programme^Autostart^WEB.DE SmartSurfer.lnk] path=C:\Dokumente und Einstellungen\user\Startmenü\Programme\Autostart\WEB.DE SmartSurfer.lnk backup=C:\WINDOWS\pss\WEB.DE SmartSurfer.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] --a------ 2008-09-01 17:08 173304 C:\Programme\ICQ6\ICQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-06-02 11:13 267048 C:\Programme\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 10:50 413696 C:\Programme\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2005-10-26 16:17 159744 C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-05-07 15:59 185896 C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Programme\Yahoo!\Messenger\YahooMessenger.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Programme\\ICQ6\\ICQ.exe"= "C:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Programme\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Programme\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R2 SmartSurferManager;SmartSurfer Manager;C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [2007-12-18 132560] R3 Eacfilt;Eacfilt Miniport;C:\WINDOWS\system32\DRIVERS\eacfilt.sys [2006-05-09 24521] R3 IPSECSHM;Nortel IPSECSHM Adapter;C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys [2006-05-09 155216] S3 IPSECEXT;Nortel Extranet Access Protocol;C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys [2006-05-09 155216] . Inhalt des "geplante Tasks" Ordners 2008-04-24 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1200855256.job - C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 00:52] 2008-10-04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Programme\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] 2008-09-30 C:\WINDOWS\Tasks\WebReg 20080930201512.job - C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2003-04-06 01:01] . . ------- Zusätzlicher Suchlauf ------- . FireFox -: Profile - C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\j6m91ii4.default\ FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll FF -: plugin - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPJava11.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPJava12.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPJava13.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPJava14.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPJava32.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPJPI142_01.dll FF -: plugin - C:\Programme\Java\j2re1.4.2_01\bin\NPOJI610.dll FF -: plugin - C:\Programme\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-09 11:05:11 Windows 5.1.2600 Service Pack 3 FAT NTAPI Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . Zeit der Fertigstellung: 2008-10-09 11:05:50 ComboFix2.txt 2008-10-08 00:37:56 ComboFix-quarantined-files.txt 2008-10-09 09:05:48 Vor Suchlauf: 19 Verzeichnis(se), 43.176.919.040 Bytes frei Nach Suchlauf: 26 Verzeichnis(se), 43,162,468,352 Bytes frei 171 --- E O F --- 2008-10-07 18:54:04 Logfile of random's system information tool 1.04 (written by random/random) Run by user at 2008-10-09 11:15:44 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 41 GB (36%) free of 114 GB Total RAM: 511 MB (55% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:15:46, on 09.10.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\AGRSMMSG.exe C:\Programme\ltmoh\Ltmoh.exe C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE C:\Programme\CyberLink\PowerDVD\PDVDServ.exe C:\Programme\Synaptics\SynTP\SynTPLpr.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\explorer.exe C:\Dokumente und Einstellungen\user\Desktop\RSIT.exe C:\Programme\Trend Micro\HijackThis\user.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Programme\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O8 - Extra context menu item: &Clean Traces - C:\Programme\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Programme\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Programme\DAP\dapextie2.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200921099553 O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartSurfer Manager (SmartSurferManager) - United Internet AG - C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe -- End of file - 6844 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1200855256.job C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\WebReg 20080930201512.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] AVG Safe Search - C:\Programme\AVG\AVG8\avgssie.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-07-07 1562448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}] PDFCreator Toolbar Helper - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-04-01 806912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll [2008-04-01 806912] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"=Alaunch [] "ATIModeChange"=C:\WINDOWS\system32\Ati2mdxx.exe [2001-09-04 28672] "ATIPTA"=C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-03-22 335872] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-12-19 65024] "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2003-07-25 88363] "LtMoh"=C:\Programme\ltmoh\Ltmoh.exe [2003-04-28 184320] "LManager"=C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE [2003-12-15 262144] "RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe [2003-10-21 40960] "SynTPLpr"=C:\Programme\Synaptics\SynTP\SynTPLpr.exe [2004-01-09 98304] "SynTPEnh"=C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2004-01-09 491520] "SunJavaUpdateSched"=C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe [2003-08-19 32873] "TkBellExe"=C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2008-05-07 185896] "Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2008-05-27 413696] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "SUPERAntiSpyware"=C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] C:\Programme\ICQ6\ICQ.exe [2008-09-01 173304] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe [2008-06-02 267048] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Programme\QuickTime\qttask.exe [2008-05-27 413696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2008-05-07 185896] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] C:\Programme\Yahoo!\Messenger\YahooMessenger.exe [2007-08-30 4670704] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^user^Startmenü^Programme^Autostart^Registration DIE SIEDLER - Das Erbe der Könige - Gold Edition.LNK] C:\PROGRA~1\Ubisoft\BLUEBY~1\DIESIE~1\support\Register\REGIST~1.EXE [2004-10-31 864256] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^user^Startmenü^Programme^Autostart^WEB.DE SmartSurfer.lnk] C:\PROGRA~1\WEB.DE\WEB~1.DES\SMARTS~1.EXE [2007-12-18 665040] C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart hpoddt01.exe.lnk - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe hp psc 2000 Series.lnk - C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] C:\Programme\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programme\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= "NoDriveAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Programme\ICQ6\ICQ.exe"="C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6" "C:\Programme\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Programme\Yahoo!\Messenger\YServer.exe"="C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 2 months====== 2008-10-09 11:05:53 ----D---- C:\WINDOWS\temp 2008-10-09 11:05:51 ----A---- C:\ComboFix.txt 2008-10-09 11:02:06 ----D---- C:\QooBox 2008-10-09 11:02:05 ----A---- C:\WINDOWS\zip.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\VFIND.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\SWSC.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\SWREG.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\sed.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\NIRCMD.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\grep.exe 2008-10-09 11:02:05 ----A---- C:\WINDOWS\fdsv.exe 2008-10-08 22:37:11 ----RASHD---- C:\autorun.inf 2008-10-08 11:48:37 ----D---- C:\WINDOWS\ERUNT 2008-10-08 10:29:14 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com 2008-10-08 10:29:08 ----D---- C:\Programme\SUPERAntiSpyware 2008-10-08 10:29:08 ----D---- C:\Dokumente und Einstellungen\user\Anwendungsdaten\SUPERAntiSpyware.com 2008-10-08 02:51:29 ----D---- C:\rsit 2008-10-08 02:27:33 ----D---- C:\WINDOWS\erdnt 2008-10-07 22:46:45 ----D---- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Malwarebytes 2008-10-07 22:46:42 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2008-10-07 22:46:41 ----D---- C:\Programme\Malwarebytes' Anti-Malware 2008-10-07 22:38:43 ----D---- C:\Programme\CCleaner 2008-10-07 20:53:57 ----HD---- C:\WINDOWS\$NtUninstallKB951748$ 2008-10-07 19:47:03 ----D---- C:\Programme\Spybot - Search & Destroy 2008-10-07 19:47:03 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy 2008-10-07 16:49:03 ----HD---- C:\$AVG8.VAULT$ 2008-10-07 15:36:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg8 2008-10-07 14:59:27 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files 2008-10-05 23:11:33 ----D---- C:\Programme\Trend Micro 2008-10-05 23:06:11 ----HD---- C:\WINDOWS\$NtUninstallKB951978$ 2008-10-03 13:13:59 ----D---- C:\Dokumente und Einstellungen\user\Anwendungsdaten\ratiopharm 2008-09-26 17:36:35 ----D---- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Lingo4u 2008-09-26 17:36:34 ----D---- C:\Programme\LingoPad 2008-09-19 17:01:07 ----HD---- C:\WINDOWS\$NtUninstallKB938464$ 2008-09-19 17:00:46 ----HD---- C:\WINDOWS\$NtUninstallKB954154_WM11$ 2008-09-19 15:35:31 ----D---- C:\WINDOWS\Prefetch 2008-09-19 15:33:33 ----HD---- C:\WINDOWS\$NtUninstallKB946648$ 2008-09-19 15:33:24 ----HD---- C:\WINDOWS\$NtUninstallKB952287$ 2008-09-19 15:33:17 ----HD---- C:\WINDOWS\$NtUninstallKB951066$ 2008-09-19 15:33:08 ----HD---- C:\WINDOWS\$NtUninstallKB952954$ 2008-09-19 15:33:01 ----HD---- C:\WINDOWS\$NtUninstallKB950974$ 2008-09-19 15:32:52 ----HD---- C:\WINDOWS\$NtUninstallKB951376-v2$ 2008-09-19 15:32:45 ----HD---- C:\WINDOWS\$NtUninstallKB950762$ 2008-09-19 15:32:36 ----HD---- C:\WINDOWS\$NtUninstallKB951376$ 2008-09-19 15:32:27 ----HD---- C:\WINDOWS\$NtUninstallKB951698$ 2008-09-19 15:28:57 ----D---- C:\WINDOWS\system32\de 2008-09-19 15:28:57 ----D---- C:\WINDOWS\l2schemas 2008-09-19 15:28:56 ----D---- C:\WINDOWS\system32\bits 2008-09-19 15:21:56 ----D---- C:\WINDOWS\network diagnostic 2008-09-07 17:52:04 ----D---- C:\Programme\Bullfrog 2008-08-31 16:33:00 ----D---- C:\WINDOWS\Minidump 2008-08-29 10:57:48 ----N---- C:\WINDOWS\system32\windowscodecs.dll 2008-08-29 10:57:48 ----N---- C:\WINDOWS\system32\msxml6.dll 2008-08-29 10:57:46 ----N---- C:\WINDOWS\system32\windowscodecsext.dll 2008-08-29 10:57:45 ----N---- C:\WINDOWS\system32\dot3ui.dll 2008-08-29 10:57:44 ----N---- C:\WINDOWS\system32\wmphoto.dll 2008-08-29 10:57:44 ----N---- C:\WINDOWS\system32\rhttpaa.dll 2008-08-29 10:57:43 ----N---- C:\WINDOWS\system32\mmcex.dll 2008-08-29 10:57:41 ----N---- C:\WINDOWS\system32\qagentrt.dll 2008-08-29 10:57:40 ----N---- C:\WINDOWS\system32\azroles.dll 2008-08-29 10:57:39 ----N---- C:\WINDOWS\system32\photometadatahandler.dll 2008-08-29 10:57:39 ----N---- C:\WINDOWS\system32\napstat.exe 2008-08-29 10:57:39 ----N---- C:\WINDOWS\system32\eapp3hst.dll 2008-08-29 10:57:38 ----N---- C:\WINDOWS\system32\eapphost.dll 2008-08-29 10:57:37 ----N---- C:\WINDOWS\system32\mssha.dll 2008-08-29 10:57:37 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll 2008-08-29 10:57:36 ----N---- C:\WINDOWS\system32\qagent.dll 2008-08-29 10:57:36 ----N---- C:\WINDOWS\system32\napmontr.dll 2008-08-29 10:57:36 ----N---- C:\WINDOWS\system32\dot3svc.dll 2008-08-29 10:57:36 ----N---- C:\WINDOWS\system32\aaclient.dll 2008-08-29 10:57:35 ----N---- C:\WINDOWS\system32\onex.dll 2008-08-29 10:57:35 ----N---- C:\WINDOWS\system32\eappcfg.dll 2008-08-29 10:57:33 ----N---- C:\WINDOWS\system32\eappgnui.dll 2008-08-29 10:57:31 ----N---- C:\WINDOWS\system32\qutil.dll 2008-08-29 10:57:31 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll 2008-08-29 10:57:28 ----N---- C:\WINDOWS\system32\wlanapi.dll 2008-08-29 10:57:25 ----N---- C:\WINDOWS\system32\kmsvc.dll 2008-08-29 10:57:24 ----N---- C:\WINDOWS\system32\qcliprov.dll 2008-08-29 10:57:24 ----N---- C:\WINDOWS\system32\eapqec.dll 2008-08-29 10:57:21 ----N---- C:\WINDOWS\system32\tspkg.dll 2008-08-29 10:57:20 ----N---- C:\WINDOWS\system32\dot3msm.dll 2008-08-29 10:57:19 ----N---- C:\WINDOWS\system32\dhcpqec.dll 2008-08-29 10:57:18 ----N---- C:\WINDOWS\system32\tsgqec.dll 2008-08-29 10:57:15 ----N---- C:\WINDOWS\system32\dot3cfg.dll 2008-08-29 10:57:14 ----N---- C:\WINDOWS\system32\dimsroam.dll 2008-08-29 10:57:11 ----N---- C:\WINDOWS\system32\l2gpstore.dll 2008-08-29 10:57:11 ----N---- C:\WINDOWS\system32\eappprxy.dll 2008-08-29 10:57:11 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll 2008-08-29 10:57:10 ----N---- C:\WINDOWS\system32\rasqec.dll 2008-08-29 10:57:10 ----N---- C:\WINDOWS\system32\msxml6r.dll 2008-08-29 10:57:10 ----N---- C:\WINDOWS\system32\mmcperf.exe 2008-08-29 10:57:10 ----N---- C:\WINDOWS\system32\eapsvc.dll 2008-08-29 10:57:09 ----N---- C:\WINDOWS\system32\napipsec.dll 2008-08-29 10:57:09 ----N---- C:\WINDOWS\system32\msshavmsg.dll 2008-08-29 10:57:04 ----N---- C:\WINDOWS\system32\eapolqec.dll 2008-08-29 10:57:01 ----N---- C:\WINDOWS\system32\setupn.exe 2008-08-29 10:57:01 ----N---- C:\WINDOWS\system32\dot3api.dll 2008-08-29 10:57:01 ----N---- C:\WINDOWS\system32\dimsntfy.dll 2008-08-29 10:56:58 ----N---- C:\WINDOWS\system32\credssp.dll 2008-08-29 10:56:56 ----N---- C:\WINDOWS\system32\dot3dlg.dll 2008-08-29 10:56:54 ----N---- C:\WINDOWS\system32\kbdpash.dll 2008-08-29 10:56:54 ----N---- C:\WINDOWS\system32\kbdnepr.dll 2008-08-29 10:56:54 ----N---- C:\WINDOWS\system32\kbdbhc.dll 2008-08-29 10:56:54 ----N---- C:\WINDOWS\system32\bitsprx4.dll 2008-08-29 10:56:53 ----N---- C:\WINDOWS\system32\kbdiultn.dll 2008-08-29 10:56:05 ----A---- C:\WINDOWS\005297_.tmp 2008-08-28 23:01:46 ----D---- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard 2008-08-25 15:27:30 ----D---- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Google 2008-08-25 15:24:45 ----D---- C:\Programme\Google 2008-08-24 10:49:54 ----SHD---- C:\FOUND.001 2008-08-22 11:41:57 ----HD---- C:\WINDOWS\$NtUninstallKB952954_0$ 2008-08-22 11:41:51 ----HD---- C:\WINDOWS\$NtUninstallKB946648_0$ 2008-08-22 11:41:46 ----HD---- C:\WINDOWS\$NtUninstallKB953839$ 2008-08-22 11:41:40 ----HD---- C:\WINDOWS\$NtUninstallKB950974_0$ 2008-08-22 11:41:33 ----HD---- C:\WINDOWS\$NtUninstallKB951072-v2$ 2008-08-22 11:41:24 ----HD---- C:\WINDOWS\$NtUninstallKB952287_0$ 2008-08-22 11:41:14 ----HD---- C:\WINDOWS\$NtUninstallKB951066_0$ ======List of files/folders modified in the last 2 months====== 2008-10-09 11:05:12 ----A---- C:\WINDOWS\system.ini 2008-10-09 11:02:28 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-10-09 10:59:42 ----A---- C:\WINDOWS\ModemLog_Agere Systems AC'97 Modem.txt 2008-10-08 12:05:18 ----RASH---- C:\BOOT.INI 2008-10-08 12:05:18 ----A---- C:\WINDOWS\win.ini 2008-09-21 21:01:10 ----A---- C:\WINDOWS\NTIWVEDT.INI 2008-09-19 16:59:12 ----A---- C:\WINDOWS\RtlRack.ini 2008-09-19 15:37:08 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-08-26 13:28:14 ----A---- C:\WINDOWS\system32\MRT.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2008-01-20 82380] R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40448] R1 SASDIFSV;SASDIFSV; \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS [] R1 SASKUTIL;SASKUTIL; \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys [] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2008-04-23 21248] R2 ACEDRV05;ACEDRV05; \??\C:\WINDOWS\system32\drivers\ACEDRV05.sys [] R2 irda;IrDA-Protokoll; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192] R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\System32\DRIVERS\AGRSM.sys [2003-07-25 1196460] R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-12-11 391424] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-12-19 541548] R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-03-22 701440] R3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952] R3 DKbFltr;Dritek HotKey Keyboard Filter Driver; C:\WINDOWS\System32\Drivers\DKbFltr.sys [2003-11-19 16512] R3 Eacfilt;Eacfilt Miniport; C:\WINDOWS\system32\DRIVERS\eacfilt.sys [2006-05-09 24521] R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168] R3 IPSECSHM;Nortel IPSECSHM Adapter; C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys [2006-05-09 155216] R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 NTIDrvr;Upper Class Filter Driver; C:\WINDOWS\System32\DRIVERS\NTIDrvr.sys [2004-03-01 6912] R3 Rasirda;WAN-Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 RTL8023;Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver; C:\WINDOWS\System32\DRIVERS\Rtlnic51.sys [2004-01-16 69504] R3 SASENUM;SASENUM; \??\C:\Programme\SUPERAntiSpyware\SASENUM.SYS [] R3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\System32\DRIVERS\smcirda.sys [2001-08-17 35913] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\System32\DRIVERS\SynTP.sys [2004-01-09 178816] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 w22n51;Intel(R) PRO/Wireless 2200 Adapter-Treiber; C:\WINDOWS\System32\DRIVERS\w22n51.sys [2004-01-02 1646720] S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2003-04-08 51208] S3 gv3;Intel GV3-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\gv3.sys [2002-11-20 33664] S3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-03-09 51024] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-03-09 16080] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-03-09 21456] S3 IPSECEXT;Nortel Extranet Access Protocol; C:\WINDOWS\system32\DRIVERS\ipsecw2k.sys [2006-05-09 155216] S3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288] S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2008-04-13 22016] S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 w70n51;Intel(R) PRO/Wireless 7100 Adapter-Treiber; C:\WINDOWS\System32\DRIVERS\w70n51.sys [2003-03-27 2379776] S3 w810bus;Sony Ericsson W810 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\w810bus.sys [2006-02-20 58288] S3 w810mdfl;Sony Ericsson W810 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\w810mdfl.sys [2006-02-20 8336] S3 w810mdm;Sony Ericsson W810 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\w810mdm.sys [2006-02-20 94064] S3 w810mgmt;Sony Ericsson W810 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\w810mgmt.sys [2006-02-20 85408] S3 w810obex;Sony Ericsson W810 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\w810obex.sys [2006-02-20 83344] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 aawservice;Lavasoft Ad-Aware Service; C:\Programme\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664] R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-01-15 110592] R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2004-03-22 397312] R2 Irmon;Infrarotüberwachung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336] R2 SmartSurferManager;SmartSurfer Manager; C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [2007-12-18 132560] S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800] S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632] S3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2008-06-02 504104] S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-03-09 65795] S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] -----------------EOF----------------- info.txt logfile of random's system information tool 1.04 2008-10-09 11:15:47 ======Uninstall list====== -->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 -->C:\WINDOWS\IsUninst.exe -f"C:\Programme\Acer Inc.\Acer German GUIDE LINK\Uninst.isu" -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe -q Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} Agere Systems AC'97 Modem-->agrsmdel Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} ATI - Dienstprogramm zur Deinstallation der Software-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Control Panel-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" ATI Display Driver-->rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean Audacity 1.2.6-->"C:\Programme\Audacity\unins000.exe" CCleaner (remove only)-->"C:\Programme\CCleaner\uninst.exe" DATA BECKER BewerbungsGenie 5-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0A06F725-CD0E-4360-BEC8-F89AF54E59D2}\setup.exe" -l0x7 DEUTSCHLAND SPIELT GAME CENTER-->"C:\Programme\OXXOGames\GPlayer\MyInstall.exe" UInstAllGPAndDS DIE SIEDLER - Das Erbe der Könige - Gold Edition-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{E08DE897-B6AF-4DFF-9E90-131E80C876B4}\setup.exe" -l0x7 -removeonly Download Accelerator Plus (DAP)-->C:\PROGRA~1\DAP\DAPREMOVE.EXE Dungeon Keeper 2-->C:\WINDOWS\IsUn0407.exe -f"C:\Programme\Bullfrog\Dungeon Keeper 2\Uninst.isu" -c"C:\Programme\Bullfrog\Dungeon Keeper 2\uninst.dll" Enter The Matrix-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{9CD92DB1-1B3B-4296-9456-93EA6BCAA4C5}\SETUP.EXE" -l0x7 Feenzauber Special-->"C:\Programme\OXXOGames\GPlayer\MyInstall.exe" ScriptUInst "C:\Programme\OXXOGames\GPlayer\Install\\Game_PLabCharmTaleCB.log" Fresko Special-->"C:\Programme\OXXOGames\GPlayer\\MyInstall.exe" ScriptUInst "C:\Programme\OXXOGames\GPlayer\Install\\Game_PLabFreskoCB.log" Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3} HijackThis 2.0.2-->"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Hotfix für Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe" Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" HP Driver Diagnostics-->MsiExec.exe /I{16BE87BC-69F5-4D36-8CF0-E1CB3ACD5ED3} HP Foto- und Bildbearbeitung 2.0 - All-in-One-->MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1} HP Foto und Bildbearbeitung 2.0 - hp psc 2170 series-->C:\Programme\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\Setup\hpzscr01.exe -datfile hposcr02.dat -forcereboot HP Foto- und Bildbearbeitung 2.0 All-in-One Treiber -->MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B} hp psc 2170 series-->MsiExec.exe /X{93FB47FB-4FDF-4131-B5FD-7A37883868E7} HP Speicher-Disc-->MsiExec.exe /X{B376402D-58EA-45EA-BD50-DD924EB67A70} Hühner-Rache Special-->"C:\Programme\OXXOGames\GPlayer\MyInstall.exe" ScriptUInst "C:\Programme\OXXOGames\GPlayer\Install\\Game_OxxoHRCB.log" ICQ6-->C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe -runfromtemp -l0x0009 -removeonly Indeo® Software-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ligos\Indeo\Uninst.isu" iTunes-->MsiExec.exe /I{9F70BF98-003C-491D-81FC-FF9792206AF0} Java 2 Runtime Environment, SE v1.4.2_01-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142010} Launch Manager-->C:\WINDOWS\UnInst32.exe CPLBCL53.UNI LingoPad 2.5.1 (Build 325)-->"C:\Programme\LingoPad\unins000.exe" Macaosolitaire 1.0-->C:\WINDOWS\iun6002.exe "C:\Programme\Macaosolitaire\irunin.ini" MahJong Special-->"C:\Programme\OXXOGames\GPlayer\\MyInstall.exe" ScriptUInst "C:\Programme\OXXOGames\GPlayer\Install\\Game_AbsMJongCB.log" Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe" Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe" Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9} Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Mission im All Special-->"C:\Programme\OXXOGames\GPlayer\MyInstall.exe" ScriptUInst "C:\Programme\OXXOGames\GPlayer\Install\\Game_AlwClashCB.log" Mozilla Firefox (3.0.3)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} Nortel Networks Contivity VPN Client-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EF964A78-078C-11D1-B7A7-0000C0134CE6}\setup.exe" Uninstall NTI CD & DVD-Maker 6.5 Gold -->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{C438B7C4-B4F8-49C5-A4DF-FF6F1F242778} /l1031 AnyText PDFCreator Toolbar-->"C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_9343.exe" _?=C:\Programme\PDFCreator Toolbar PDFCreator-->C:\Programme\PDFCreator\unins000.exe PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175} RealPlayer-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE Riva FLV Player-->"C:\Programme\Riva\Riva FLV Player\unins000.exe" Sicherheitsupdate für Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf Sicherheitsupdate für Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe" Sony Ericsson PC Suite 1.20.173-->MsiExec.exe /I{C5ADA65A-7828-4D85-B071-ECC52B51F794} Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003} Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe" Super Nautica Special-->"C:\Programme\OXXOGames\GPlayer\MyInstall.exe" ScriptUInst "C:\Programme\OXXOGames\GPlayer\Install\\Game_OxxoGSCB.log" SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} Synaptics Pointing Device Driver-->rundll32.exe "C:\Programme\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Tomb Raider - The Last Revelation-->C:\WINDOWS\IsUn0407.exe -f"C:\Programme\Core Design\Tomb Raider - The Last Revelation\Uninst.isu" Tomb Raider Chronicles-->C:\WINDOWS\IsUn0407.exe -f"C:\Programme\Core Design\Tomb Raider Chronicles\Uninst.isu" Total Commander (Remove or Repair)-->c:\programme\totalcmd\tcuninst.exe TravelMate 290-->C:\Programme\TravelMate 290\uninstall.exe Update für Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe" Update für Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" VideoLAN VLC media player 0.8.5-->C:\Programme\VideoLAN\VLC\uninstall.exe WEB.DE SmartSurfer-->C:\Programme\WEB.DE\WEB.DE SmartSurfer\Uninstall.exe Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" WinRAR Archivierer-->C:\Programme\WinRAR\uninstall.exe Yahoo! Messenger-->C:\PROGRA~1\YAHOO!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\YAHOO!\MESSEN~1\INSTALL.LOG =====HijackThis Backups===== O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) ======Hosts File====== 127.0.0.1 localhost ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Programme\ATI Technologies\ATI Control Panel;C:\Programme\Gemeinsame Dateien\Teleca Shared;C:\Programme\QuickTime\QTSystem "windir"=%SystemRoot% "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 6, GenuineIntel "PROCESSOR_REVISION"=0d06 "NUMBER_OF_PROCESSORS"=1 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "FP_NO_HOST_CHECK"=NO "CLASSPATH"=.;C:\Programme\Java\j2re1.4.2_01\lib\ext\QTJava.zip "QTJAVA"=C:\Programme\Java\j2re1.4.2_01\lib\ext\QTJava.zip -----------------EOF----------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:21:45, on 09.10.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\AGRSMMSG.exe C:\Programme\ltmoh\Ltmoh.exe C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE C:\Programme\CyberLink\PowerDVD\PDVDServ.exe C:\Programme\Synaptics\SynTP\SynTPLpr.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\explorer.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG8\avgssie.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [LtMoh] C:\Programme\ltmoh\Ltmoh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O8 - Extra context menu item: &Clean Traces - C:\Programme\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Programme\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Programme\DAP\dapextie2.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200921099553 O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartSurfer Manager (SmartSurferManager) - United Internet AG - C:\Programme\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe -- End of file - 6796 bytes