WinXP consuming 100% CPU after executing invected e-mail attachment ye

Hello from Austria! As this great forum helped me earlier long time ago removing a virus on my server, I hope I can get help this time again fixing my PC. I obviously have opened an infected attachment of an serious looking e-mail and now my cpu is running on 100%. The most consuming processes seem to be csrss.exe, DOZESVC.EXE and PresentationFontCache.exe, ntmulti.exe. A scan with Symantec Antivirus and Spybot did not found any suspicious. Thank you so much in advance! Here is the output of the DDS tool: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 10:45:09,34 on 12.08.2010 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Professional 5.1.2600.3.1252.43.1033.18.2968.1999 [GMT 2:00] AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} FW: Symantec Client Firewall *enabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187} ============== Running Processes =============== C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\WiFi\bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\program files\ibm\personal communications\PCS_AGNT.EXE C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\WINDOWS\system32\Drivers\trcboot.exe C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe C:\Program Files\IBM\Mobility Client\artstartsvc.exe C:\WINDOWS\system32\svchost.exe -k bthsvcs C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\WiFi\bin\EvtEng.exe c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\c4ebreg\c4ebreg.exe c:\sdwork\issimsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe C:\Program Files\Intel\AMT\LMS.exe C:\notes\ntmulti.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\AT&TNE~2\netcfgsvr.exe C:\program files\ibm\personal communications\tpam.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\TpShocks.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\AT&T Network Client\NetClientSvc.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Program Files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\c4ebreg\isamtray.exe C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe C:\WINDOWS\system32\igfxext.exe C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe C:\WINDOWS\system32\PGPserv.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe C:\PROGRA~1\THINKV~1\PrdCtr\LPMLCHK.exe c:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\WINDOWS\system32\svchost.exe -k imgsvc c:\program files\lenovo\system update\suservice.exe C:\PROGRA~1\SYMANT~2\SYMANT~2\vptray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\Program Files\Tivoli\CDP_for_Files\FilePathSrv.exe C:\Program Files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.5.0.20090605-2002\soffice.exe C:\WINDOWS\system32\TpKmpSVC.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe C:\Program Files\IBM\Network Print Information Frontend\npif.exe C:\Program Files\PGP Corporation\PGP Desktop\PGPtray.exe C:\Program Files\ScanWizard 5\ScannerFinder.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE C:\WINDOWS\system32\Drivers\ldlcserv.exe C:\WINDOWS\system32\Drivers\ldlcserv6.exe C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe C:\WINDOWS\System32\alg.exe C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://192.168.0.100/w3/ mDefault_Page_URL = hxxp://w3.ibm.com uInternet Connection Wizard,ShellNext = hxxp://w3.ibm.com/tools/it/ittools.nsf/main/ISAMRiskIndicator uInternet Settings,ProxyOverride = w3-501.ibm.com; mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\svchost32.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized uRun: [NetSP - restore settings on power failure] "c:\program files\at&t network client\NetSP.exe" -show uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray uRun: [] uRun: [SODCPreLoad] c:\program files\ibm\lotus\symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.5.0.20090605-2002\preload.exe c:\docume~1\admini~1\ibm\lotus\symphony\.sodc\ mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [stgclean] c:\sdwork\w32maing.exe /cleanup mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [Tpam.exe] "c:\program files\ibm\personal communications\tpam.exe" mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [] mRun: [TpShocks] TpShocks.exe mRun: [PWRMGRTR] rundll32 c:\progra~1\thinkpad\utilit~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor mRun: [BLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BatLogEx.DLL,StartBattLog mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun: [TPFNF7] c:\program files\lenovo\npdirect\TPFNF7SP.exe /r mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe mRun: [TPKMAPHELPER] c:\program files\thinkpad\utilities\TpKmapAp.exe -helper mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe mRun: [ACWLIcon] c:\program files\thinkpad\connectutilities\ACWLIcon.exe mRun: [ipmcmu] c:\program files\ibm\ipm client migration utility\ipmcmu.exe "c:\program files\ibm\IPM Client Migration Utility" mRun: [MyHelpService] c:\program files\ibm\my help\workspace\service\delayStart.exe mRun: [pmonmh] c:\program files\ibm\my help\plugins\\com.ibm.myhelp.common_1.4.19/pmonmh.exe mRun: [PSQLLauncher] "c:\program files\thinkvantage fingerprint software\launcher.exe" /startup mRun: [ISSI Service] "c:\sdwork\issimsvc.exe" mRun: [C4EBReg] "c:\program files\c4ebreg\c4ebreg.exe" /q mRun: [Isamtray] "c:\program files\c4ebreg\isamtray.exe" mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [LPManager] c:\progra~1\thinkv~1\prdctr\LPMGR.exe mRun: [LPMailChecker] c:\progra~1\thinkv~1\prdctr\LPMLCHK.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe" mRun: [picon] "c:\program files\common files\intel\privacy icon\PIconStartup.exe" mRun: [vptray] c:\progra~1\symant~2\symant~2\\vptray.exe dRun: [ctfmon.exe] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\tedapro.lnk - c:\program files\pics\TeDaPro.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\cdpfor~1.lnk - c:\program files\tivoli\cdp_for_files\FilePathSrv.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\networ~1.lnk - c:\program files\ibm\network print information frontend\npif.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pgptra~1.lnk - c:\windows\installer\{b3004fe6-dad0-4288-94c5-806eebbbc7b1}\Icon6560581611.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\scanne~1.lnk - c:\program files\scanwizard 5\ScannerFinder.exe uPolicies-explorer: NoDevMgrUpdate = 1 (0x1) IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Send to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {1ACECAFE-0015-0000-0000-ABCDEFFEDCBA} - hxxp:// DPF: {39E133DF-AE37-4918-A589-1267E085DA07} - hxxps://w3-501.ibm.com/transform/crm/europe/at/sales/21112/applets/SiebelAx_HI_Client.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {B94C2238-346E-4C5E-9B36-8CC627F35574} DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp:// DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: ACNotify - ACNotify.dll Notify: atmgrtok - atmgrtok.dll Notify: igfxcui - igfxdev.dll Notify: NavLogon - c:\windows\system32\NavLogon.dll Notify: pcsinst - pcsinst.dll LSA: Notification Packages = scecli ACGina PGPpwflt ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\taec8sgz.default\ FF - prefs.js: browser.startup.homepage - hxxp://192.168.0.100/w3/ FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\taec8sgz.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npaddtonab.dll FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\taec8sgz.default\extensions\[removed]\plugins\np-vmware-vmrc-2.5.0-122581.dll FF - plugin: c:\documents and settings\administrator\application data\mozilla\plugins\npoctoshape.dll FF - plugin: c:\documents and settings\administrator\local settings\application data\yahoo!\browserplus\2.8.1\plugins\npybrowserplus_2.8.1.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\ibm\java50\jre\bin\NPJPI150.dll FF - plugin: c:\program files\ibm\java50\jre\bin\npwebscl.dll FF - plugin: c:\program files\mozilla firefox\extensions\[removed]\platform\winnt_x86-msvc\plugins\npaddtonab.dll FF - plugin: c:\program files\mozilla firefox\plugins\npcpsweb.dll FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll FF - plugin: c:\program files\mozilla firefox\plugins\npwdplugin821.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2010-3-23 24304] R0 PGPwded;PGPwded Storage Filter Service;c:\windows\system32\drivers\PGPwded.sys [2009-9-21 215672] R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [2009-10-9 120360] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-10-9 20520] R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [2009-11-10 17968] R1 ANC;ANC;c:\windows\system32\drivers\ANC.sys [2010-1-21 11520] R1 FilePath;VitalFile;c:\windows\system32\drivers\Fp.sys [2009-6-17 313496] R1 IBMTPCHK;IBMTPCHK;c:\windows\system32\drivers\IBMBLDID.sys [2010-1-21 4224] R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2010-3-28 13480] R1 SAVRT;SAVRT;c:\program files\symantec client security\symantec antivirus\savrt.sys [2006-9-6 337592] R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec client security\symantec antivirus\Savrtpel.sys [2006-9-6 54968] R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [2010-1-21 4442] R2 agnwifi;AT&T Wi-Fi Support Driver;c:\windows\system32\drivers\agnwifi.sys [2004-4-29 19328] R2 AppnApi;AppnApi;c:\windows\system32\drivers\appnapi.sys [2009-3-12 120256] R2 artstartsvc;Verwaltungsservice für den Mobility Client;c:\program files\ibm\mobility client\artstartsvc.exe [2009-3-25 57344] R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160] R2 ccProxy;Symantec Network Proxy;c:\program files\common files\symantec shared\ccProxy.exe [2006-7-19 202400] R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632] R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2010-3-23 132456] R2 IBM_LLC2;IBM Personal Communications LLC2 Driver;c:\windows\system32\drivers\llc2.sys [2009-3-12 101696] R2 ISAMSvc;IBM Standard Asset Manager Service;c:\program files\c4ebreg\c4ebreg.exe [2010-2-25 482584] R2 ldlcserv6;IBM Enterprise Extender (IPv6);c:\windows\system32\drivers\ldlcserv6.exe [2009-3-12 40960] R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\lenovo\communications utility\CamMute.exe [2010-4-29 50536] R2 NetClientSvc;AT&T Global Network Client Service;c:\program files\at&t network client\NetClientSvc.exe [2009-10-7 263520] R2 NsTrcNT;NsTrcNT;c:\windows\system32\drivers\nstrcnt.sys [2009-3-12 12028] R2 pdlnctdl;Twinax CUT Adapter;c:\windows\system32\drivers\pdlnctdl.sys [2009-3-12 12288] R2 pdlndldl;IBM Enterprise Extender (HPR/IPv4);c:\windows\system32\drivers\pdlndldl.sys [2009-3-12 64512] R2 pdlndldl6;IBM Enterprise Extender (HPR/IPv6);c:\windows\system32\drivers\pdlndldl6.sys [2009-3-12 70656] R2 PGPdisk;PGPdisk;c:\windows\system32\drivers\PGPdisk.sys [2009-9-21 246392] R2 PGPsdkDriver;PGPsdkDriver;c:\windows\system32\drivers\PGPsdk.sys [2009-9-21 40568] R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2010-1-21 53248] R2 SavRoam;SAVRoam;c:\program files\symantec client security\symantec antivirus\SavRoam.exe [2006-9-27 116464] R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec client security\symantec antivirus\Rtvscan.exe [2006-9-27 1813232] R2 TPHKSVC;Anzeige am Bildschirm;c:\program files\lenovo\hotkey\TPHKSVC.exe [2010-1-21 63928] R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\common files\intel\privacy icon\uns\UNS.exe [2010-5-9 2058776] R3 agnfilt;AGN Filter Interface;c:\windows\system32\drivers\agnfilt.sys [2009-10-7 219776] R3 Anydlc;Anydlc;c:\windows\system32\drivers\anydlc.sys [2009-3-12 38280] R3 Appn;Appn;c:\windows\system32\drivers\appn.sys [2009-3-12 1318816] R3 AppnBase;AppnBase;c:\windows\system32\drivers\appnbase.sys [2009-3-12 208928] R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2010-1-21 243856] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-30 102448] R3 GemCCID;GemCCID;c:\windows\system32\drivers\GemCCID.sys [2009-8-10 89600] R3 IsamFilter;IsamFilter;c:\windows\system32\drivers\isamfilter.sys [2010-3-19 6400] R3 KLOGNT;KLOGNT;c:\windows\system32\drivers\klognt.sys [2009-3-12 24588] R3 lnvobus;Ericsson F3507g Mobile Broadband Minicard Composite Device driver (WDM);c:\windows\system32\drivers\lnvobus.sys [2010-1-21 282880] R3 lnvocard;Ericsson F3507g Mobile Broadband Minicard Device Management;c:\windows\system32\drivers\lnvocard.sys [2010-4-13 356480] R3 lnvogps;Ericsson F3507g Mobile Broadband Minicard GPS Port;c:\windows\system32\drivers\lnvogps.sys [2010-4-13 77864] R3 lnvomdfl;Ericsson F3507g Mobile Broadband Minicard Modem Filter;c:\windows\system32\drivers\lnvomdfl.sys [2010-4-13 15104] R3 lnvomdfl2;Ericsson F3507g Mobile Broadband Minicard Data Modem Filter;c:\windows\system32\drivers\lnvomdfl2.sys [2010-4-13 15104] R3 lnvomdm;Ericsson F3507g Mobile Broadband Minicard Modem Driver;c:\windows\system32\drivers\lnvomdm.sys [2010-4-13 365056] R3 lnvomdm2;Ericsson F3507g Mobile Broadband Minicard Data Modem;c:\windows\system32\drivers\lnvomdm2.sys [2010-4-13 408960] R3 lnvond5;Ericsson F3507g Mobile Broadband Minicard Network Adapter (NDIS);c:\windows\system32\drivers\lnvond5.sys [2010-4-13 25984] R3 lnvounic;Ericsson F3507g Mobile Broadband Minicard Network Adapter (WDM);c:\windows\system32\drivers\lnvounic.sys [2010-4-13 375424] R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100811.002\naveng.sys [2010-8-12 85424] R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100811.002\navex15.sys [2010-8-12 1362608] R3 pdlnacom;PDLC Adapter – COM;c:\windows\system32\drivers\pdlnacom.sys [2009-3-12 75184] R3 pdlnafac;PDLC Adapter Factory;c:\windows\system32\drivers\pdlnafac.sys [2009-3-12 36032] R3 pdlnatcm;Twinax Adapter Common;c:\windows\system32\drivers\pdlnatcm.sys [2009-3-12 20480] R3 pdlnatdl;Twinax Adapter;c:\windows\system32\drivers\pdlnatdl.sys [2009-3-12 18432] R3 pdlncbas;PDLC CxM Classes;c:\windows\system32\drivers\pdlncbas.sys [2009-3-12 6768] R3 pdlncfwk;PDLC Connection Manager;c:\windows\system32\drivers\pdlncfwk.sys [2009-3-12 160256] R3 pdlndint;PDLC DLC Classes;c:\windows\system32\drivers\pdlndint.sys [2009-3-12 12800] R3 pdlndlpb;PDLC LAPB;c:\windows\system32\drivers\pdlndlpb.sys [2009-3-12 70144] R3 pdlndoem;PDLC OEM Interface;c:\windows\system32\drivers\pdlndoem.sys [2009-3-12 18944] R3 pdlndqll;PDLC QLLC;c:\windows\system32\drivers\pdlndqll.sys [2009-3-12 53248] R3 pdlndsdl;PDLC SDLC;c:\windows\system32\drivers\pdlndsdl.sys [2009-3-12 67072] R3 pdlndtdl;Twinax DLC;c:\windows\system32\drivers\pdlndtdl.sys [2009-3-12 51712] R3 pdlnebas;PDLC Environment;c:\windows\system32\drivers\pdlnebas.sys [2009-3-12 8592] R3 pdlnecfg;PDLC Configuration;c:\windows\system32\drivers\pdlnecfg.sys [2009-3-12 50320] R3 pdlnemap;PDLC Mapper;c:\windows\system32\drivers\pdlnemap.sys [2009-3-12 67168] R3 pdlnemsg;PDLC Message Driver;c:\windows\system32\drivers\pdlnemsg.sys [2009-3-12 12736] R3 pdlnepkt;PDLC Buffer Manager;c:\windows\system32\drivers\pdlnepkt.sys [2009-3-12 19968] R3 pdlnshay;PDLC Hayes At signalling;c:\windows\system32\drivers\pdlnshay.sys [2009-3-12 59488] R3 pdlnslea;PDLC SDLC Leased;c:\windows\system32\drivers\pdlnslea.sys [2009-3-12 22368] R3 pdlnsv25;PDLC V25bis signalling;c:\windows\system32\drivers\pdlnsv25.sys [2009-3-12 54400] R3 pdlnsx25;PDLC X.25;c:\windows\system32\drivers\pdlnsx25.sys [2009-3-12 58416] R3 Sony_EricssonWWSC;Ericsson F3507g Mobile Broadband Minicard PC SC Port;c:\windows\system32\drivers\lnvoscard.sys [2010-4-13 24232] S2 FilePathsrv;CDPforFilesSrv;c:\windows\system32\FilePathSrv.exe [2009-6-17 569880] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-26 136176] S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2010-3-28 44984] S3 avpnnic;AGN Virtual Network Adapter;c:\windows\system32\drivers\avpnnic.sys [2003-4-4 11392] S3 csrcmds;csrcmds;c:\program files\ibm\personal communications\csrcmds.exe [2009-3-12 49152] S3 cstrcser;IBM Command Line Trace;c:\windows\system32\drivers\cstrcser.exe [2009-3-12 36864] S3 wcndis;Mobility Client Virtual Miniport;c:\windows\system32\drivers\wcndis.sys [2010-1-21 15720] =============== Created Last 30 ================ 2010-08-10 16:35 –d—– c:\temp\Checker1281450958812 2010-08-05 20:22 –d—– c:\temp\Checker1281032561562 2010-08-05 19:38 –d—– c:\docume~1\admini~1\applic~1\Saba 2010-08-05 19:38 –d—– c:\program files\Centra 2010-08-05 19:38 –d—– c:\docume~1\admini~1\applic~1\Centra 2010-08-05 18:49 –dsh— c:\windows\ftpcache 2010-08-05 18:49 –d—– c:\program files\LVC 2010-08-04 16:24 65,536 -c—— c:\windows\system32\dllcache\asycfilt.dll 2010-07-13 12:20 –d—– c:\temp\Checker1279016427875 ==================== Find3M ==================== 2010-05-17 17:29 168,110 a——- c:\windows\system32\PGPlspRollback.reg ============= FINISH: 10:47:18,73 ===============

Hi and thanks again!
Here is the log of ComboFix:

ComboFix 10-08-12.03 - AT15644 14.08.2010 19:26:34.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.43.1033.18.2968.2337 [GMT 2:00]
ausgeführt von:: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Client Firewall *enabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}
.

((((((((((((((((((((((( Dateien erstellt von 2010-07-14 bis 2010-08-14 ))))))))))))))))))))))))))))))
.

2010-08-13 23:51 . 2010-08-13 23:51 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-08-13 23:51 . 2010-04-29 13:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-13 23:51 . 2010-08-13 23:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-13 23:51 . 2010-04-29 13:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-13 23:51 . 2010-08-13 23:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-13 15:08 . 2010-08-13 15:08 ——– d—–w- c:\temp\Checker1281712094625
2010-08-12 22:35 . 2010-08-12 22:35 210816 -c–a-w- c:\windows\system32\dllcache\ndis.sys
2010-08-12 10:01 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2010-08-10 14:35 . 2010-08-10 14:35 ——– d—–w- c:\temp\Checker1281450958812
2010-08-05 18:33 . 2010-08-05 18:33 ——– d—–w- c:\documents and settings\Administrator\Application Data\Amazon
2010-08-05 18:22 . 2010-08-05 18:22 ——– d—–w- c:\temp\Checker1281032561562
2010-08-05 17:38 . 2010-08-05 17:39 ——– d—–w- c:\documents and settings\Administrator\Application Data\Saba
2010-08-05 17:38 . 2010-08-05 17:38 ——– d—–w- c:\program files\Centra
2010-08-05 17:38 . 2010-08-05 17:38 ——– d—–w- c:\documents and settings\Administrator\Application Data\Centra
2010-08-05 16:49 . 2010-08-05 16:49 ——– d-sh–w- c:\windows\ftpcache
2010-08-05 16:49 . 2010-08-05 16:49 ——– d—–w- c:\program files\LVC
2010-08-04 14:24 . 2010-03-05 14:37 65536 -c—-w- c:\windows\system32\dllcache\asycfilt.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-14 19:14 . 2010-03-24 21:42 ——– d—–w- c:\documents and settings\Administrator\Application Data\Skype
2010-08-14 19:11 . 2009-11-10 04:16 ——– d—–w- c:\program files\C4ebreg
2010-08-14 17:31 . 2010-03-24 11:04 4768352 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-08-14 17:23 . 2007-03-05 22:09 40 —-a-w- c:\windows\system32\profile.dat
2010-08-14 17:20 . 2006-01-24 00:45 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-08-14 15:55 . 2010-07-11 22:38 ——– d—–w- c:\documents and settings\Administrator\Application Data\VMware
2010-08-13 12:43 . 2006-03-27 21:50 ——– d—–w- c:\program files\WST
2010-08-12 22:35 . 2004-08-04 05:00 210816 —-a-w- c:\windows\system32\drivers\ndis.sys
2010-08-11 14:08 . 2010-03-25 23:55 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-08-09 09:00 . 2010-05-07 08:35 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-08-05 18:38 . 2010-03-24 20:54 ——– d—–w- c:\documents and settings\Administrator\Application Data\Winamp
2010-08-05 14:49 . 2010-05-30 20:53 ——– d—–w- c:\documents and settings\Administrator\Application Data\vlc
2010-08-05 09:56 . 2010-06-02 23:03 ——– d—–w- c:\program files\PC-Doctor
2010-08-05 09:18 . 2010-08-05 09:18 1573496 —-a-w- c:\documents and settings\Administrator\Application Data\Update\patch_551460to551461_32\patch_551460to551461_32.00.exe
2010-08-05 09:18 . 2010-06-16 09:02 ——– d—–w- c:\documents and settings\Administrator\Application Data\Update
2010-08-05 08:58 . 2010-03-24 09:19 ——– d—–w- c:\program files\Winamp
2010-08-05 08:58 . 2010-03-24 20:55 ——– d—–w- c:\program files\Winamp Detect
2010-07-11 22:38 . 2010-07-11 22:38 ——– d—–w- c:\documents and settings\All Users\Application Data\VMware
2010-07-11 22:33 . 2010-07-11 22:33 ——– d—–w- c:\program files\Common Files\VMware
2010-07-10 13:30 . 2010-03-26 16:03 ——– d—–w- c:\documents and settings\Administrator\Application Data\Nokia
2010-07-09 13:17 . 2005-04-05 19:45 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-09 13:17 . 2010-07-09 13:17 ——– d—–w- c:\program files\VoiceRite
2010-07-05 15:07 . 2010-03-24 20:22 ——– d—–w- c:\program files\Opera
2010-07-02 17:51 . 2010-07-02 17:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Skyline
2010-06-30 07:58 . 2010-06-30 07:58 ——– d—–w- c:\program files\Common Files\PCSuite
2010-06-30 07:58 . 2010-06-30 07:58 ——– d—–w- c:\program files\Common Files\Nokia
2010-06-30 07:58 . 2010-03-26 16:02 ——– d—–w- c:\program files\Nokia
2010-06-30 07:54 . 2010-06-30 07:54 ——– d—–w- c:\program files\PC Connectivity Solution
2010-06-30 07:52 . 2010-06-30 07:52 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\pcswpcsi.exe
2010-06-30 07:52 . 2010-06-30 07:52 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstCCD.exe
2010-06-30 07:52 . 2010-06-30 07:52 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-06-30 07:52 . 2010-06-30 07:52 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCS.exe
2010-06-30 07:51 . 2010-03-26 16:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
2010-06-30 07:51 . 2010-06-30 07:52 36426336 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_ger.exe
2010-06-22 21:33 . 2010-06-22 19:26 ——– d—–w- c:\documents and settings\Administrator\Application Data\GARMIN
2010-06-21 23:49 . 2005-04-04 20:08 ——– d—–w- c:\program files\IBM
2010-06-14 14:31 . 2005-04-04 17:42 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-30 10:25 . 2010-05-30 10:25 71960 —-a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Plugins\npoctoshape.dll
2010-05-26 11:41 . 2010-03-26 00:35 902432 —-a-w- c:\windows\system32\drivers\tdrpm251.sys
2010-05-26 11:41 . 2010-03-26 00:35 570016 —-a-w- c:\windows\system32\drivers\timntr.sys
2010-05-18 11:04 . 2010-04-20 19:09 213888 —-a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\DLLList821.dll
2010-05-18 11:04 . 2010-04-20 19:09 339344 —-a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wdappview821.dll
2010-05-18 11:04 . 2010-04-20 19:09 179096 —-a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wd_hook821.dll
2010-05-18 11:03 . 2010-05-17 08:06 157592 —-a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wd_bhook821.dll
2010-05-18 11:03 . 2010-05-17 08:06 1335184 —-a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\wdappshareui821.dll
2010-05-18 11:03 . 2010-05-17 08:06 55704 —-a-w- c:\documents and settings\Administrator\Application Data\WDPlugin\Appshare_Control_Helper_821.exe
2010-05-17 15:29 . 2010-05-17 15:29 168110 —-a-w- c:\windows\system32\PGPlspRollback.reg
.

——- Sigcheck ——-

[-] 2010-08-12 22:35 . !HASH: COULD NOT OPEN FILE !!!!! . 210816 . . [——] . . c:\windows\system32\drivers\ndis.sys
[-] 2010-08-12 22:35 . !HASH: COULD NOT OPEN FILE !!!!! . 210816 . . [——] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-04-13 19:20 . !HASH: COULD NOT OPEN FILE !!!!! . 182656 . . [——] . . c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2006-05-02 10:55 . !HASH: COULD NOT OPEN FILE !!!!! . 182656 . . [——] . . c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2004-08-04 05:00 . !HASH: COULD NOT OPEN FILE !!!!! . 182912 . . [——] . . c:\windows\$NtUninstallKB918837$\ndis.sys
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHandlerAccessible]
@="{3DBF5F01-3287-46EB-82CF-45AA5C241162}"
[HKEY_CLASSES_ROOT\CLSID\{3DBF5F01-3287-46EB-82CF-45AA5C241162}]
2009-09-21 20:31 613496 —-a-w- c:\windows\system32\PGPfsshl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
"NetSP - restore settings on power failure"="c:\program files\AT&T Network Client\NetSP.exe" [2009-10-07 87392]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]
"SODCPreLoad"="c:\program files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.5.0.20090605-2002\preload.exe" [2009-07-10 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pmonmh"="c:\program files\IBM\My Help\plugins\\com.ibm.myhelp.common_1.4.19" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"stgclean"="c:\sdwork\w32maing.exe" [2010-07-20 278528]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"Tpam.exe"="c:\program files\ibm\personal communications\tpam.exe" [2009-03-11 28672]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"TpShocks"="TpShocks.exe" [2009-12-11 337256]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2010-03-02 513384]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2010-03-02 208896]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-12-03 1594664]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2010-01-09 62240]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-12-21 69568]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2007-01-09 868352]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2010-03-01 431464]
"ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2010-03-01 181608]
"ipmcmu"="c:\program files\IBM\IPM Client Migration Utility\ipmcmu.exe" [2010-03-24 204800]
"MyHelpService"="c:\program files\IBM\My Help\workspace\service\delayStart.exe" [2009-03-13 94208]
"ISSI Service"="c:\sdwork\issimsvc.exe" [2010-07-20 241904]
"C4EBReg"="c:\program files\c4ebreg\c4ebreg.exe" [2010-02-25 482584]
"Isamtray"="c:\program files\c4ebreg\isamtray.exe" [2010-02-25 285976]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2009-12-01 256576]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-29 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-29 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-29 144920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-03-24 149280]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2009-07-23 185688]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2009-07-23 124248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2010-06-16 624056]
"picon"="c:\program files\Common Files\Intel\Privacy Icon\PIconStartup.exe" [2010-02-04 111640]
"vptray"="c:\progra~1\SYMANT~2\SYMANT~2\\vptray.exe" [2006-09-27 125168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
TeDaPro.lnk - c:\program files\pics\TeDaPro.exe [2010-3-29 855552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2010-2-25 607584]
CDPforFilesSrv.lnk - c:\program files\Tivoli\CDP_for_Files\FilePathSrv.exe [2010-3-11 569880]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-3-24 50688]
Network Print Information Frontend.lnk - c:\program files\IBM\Network Print Information Frontend\npif.exe [2010-1-21 110592]
PGPtray.exe.lnk - c:\windows\Installer\{B3004FE6-DAD0-4288-94C5-806EEBBBC7B1}\Icon6560581611.exe [2010-5-17 55296]
Scanner Finder.lnk - c:\program files\ScanWizard 5\ScannerFinder.exe [2010-3-28 315392]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pcsinst]
2009-03-11 23:54 49152 —-a-w- c:\windows\system32\pcsinst.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli PGPpwflt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"IBMconfig"=dword:00000001
"FirewallDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [23.03.2010 13:27 24304]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [09.10.2009 13:10 20520]
R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [10.11.2009 06:22 17968]
R1 FilePath;VitalFile;c:\windows\system32\drivers\Fp.sys [17.06.2009 23:59 313496]
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [28.03.2010 22:58 13480]
R2 artstartsvc;Verwaltungsservice für den Mobility Client;c:\program files\IBM\Mobility Client\artstartsvc.exe [25.03.2009 15:35 57344]
R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [23.03.2010 13:27 132456]
R2 ldlcserv6;IBM Enterprise Extender (IPv6);c:\windows\system32\drivers\ldlcserv6.exe [12.03.2009 01:55 40960]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CamMute.exe [29.04.2010 00:15 50536]
R2 NetClientSvc;AT&T Global Network Client Service;c:\program files\AT&T Network Client\NetClientSvc.exe [07.10.2009 12:36 263520]
R2 pdlndldl6;IBM Enterprise Extender (HPR/IPv6);c:\windows\system32\drivers\pdlndldl6.sys [12.03.2009 01:55 70656]
R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.exe [21.01.2010 11:23 53248]
R2 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [27.09.2006 22:33 116464]
R2 TPHKSVC;Anzeige am Bildschirm;c:\program files\Lenovo\HOTKEY\TPHKSVC.exe [21.01.2010 11:24 63928]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [09.05.2010 18:36 2058776]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [21.01.2010 18:59 243856]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [30.05.2010 18:59 102448]
R3 GemCCID;GemCCID;c:\windows\system32\drivers\GemCCID.sys [10.08.2009 13:07 89600]
R3 IsamFilter;IsamFilter;c:\windows\system32\drivers\isamfilter.sys [19.03.2010 16:02 6400]
R3 lnvobus;Ericsson F3507g Mobile Broadband Minicard Composite Device driver (WDM);c:\windows\system32\drivers\lnvobus.sys [21.01.2010 19:00 282880]
R3 lnvocard;Ericsson F3507g Mobile Broadband Minicard Device Management;c:\windows\system32\drivers\lnvocard.sys [13.04.2010 18:23 356480]
R3 lnvogps;Ericsson F3507g Mobile Broadband Minicard GPS Port;c:\windows\system32\drivers\lnvogps.sys [13.04.2010 18:23 77864]
R3 lnvomdfl;Ericsson F3507g Mobile Broadband Minicard Modem Filter;c:\windows\system32\drivers\lnvomdfl.sys [13.04.2010 18:22 15104]
R3 lnvomdfl2;Ericsson F3507g Mobile Broadband Minicard Data Modem Filter;c:\windows\system32\drivers\lnvomdfl2.sys [13.04.2010 18:22 15104]
R3 lnvomdm;Ericsson F3507g Mobile Broadband Minicard Modem Driver;c:\windows\system32\drivers\lnvomdm.sys [13.04.2010 18:22 365056]
R3 lnvomdm2;Ericsson F3507g Mobile Broadband Minicard Data Modem;c:\windows\system32\drivers\lnvomdm2.sys [13.04.2010 18:22 408960]
R3 lnvond5;Ericsson F3507g Mobile Broadband Minicard Network Adapter (NDIS);c:\windows\system32\drivers\lnvond5.sys [13.04.2010 18:23 25984]
R3 lnvounic;Ericsson F3507g Mobile Broadband Minicard Network Adapter (WDM);c:\windows\system32\drivers\lnvounic.sys [13.04.2010 18:23 375424]
R3 Sony_EricssonWWSC;Ericsson F3507g Mobile Broadband Minicard PC SC Port;c:\windows\system32\drivers\lnvoscard.sys [13.04.2010 18:23 24232]
S2 FilePathsrv;CDPforFilesSrv;c:\windows\system32\FilePathSrv.exe [17.06.2009 23:59 569880]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [26.03.2010 02:39 136176]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\Lenovo\HOTKEY\micmute.exe [28.03.2010 22:58 44984]
S3 csrcmds;csrcmds;c:\program files\IBM\personal communications\csrcmds.exe [12.03.2009 01:30 49152]
S3 cstrcser;IBM Command Line Trace;c:\windows\system32\drivers\cstrcser.exe [12.03.2009 01:55 36864]
S3 wcndis;Mobility Client Virtual Miniport;c:\windows\system32\drivers\wcndis.sys [21.01.2010 11:47 15720]
.
Inhalt des "geplante Tasks" Ordners

2010-08-13 c:\windows\Tasks\At1.job
- c:\program files\IBM\IPM Client Migration Utility\ipmcmu.exe [2010-01-21 09:02]

2010-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 00:38]

2010-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-26 00:38]

2010-06-02 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2010-05-07 19:46]

2010-08-14 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-01-21 23:20]

2010-08-13 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\pcdrcui.exe [2010-06-08 21:08]
.
.
——- Zusätzlicher Suchlauf ——-
.
uStart Page = hxxp://192.168.0.100/w3/
uInternet Connection Wizard,ShellNext = hxxp://w3.ibm.com/tools/it/ittools.nsf/main/ISAMRiskIndicator
uInternet Settings,ProxyOverride = w3-501.ibm.com;
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1ACECAFE-0015-0000-0000-ABCDEFFEDCBA} - hxxp://
DPF: {39E133DF-AE37-4918-A589-1267E085DA07} - hxxps://w3-501.ibm.com/transform/crm/europe/at/sales/21112/applets/SiebelAx_HI_Client.cab
DPF: {B94C2238-346E-4C5E-9B36-8CC627F35574}
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\taec8sgz.default\
FF - prefs.js: browser.startup.homepage - hxxp://192.168.0.100/w3/
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\taec8sgz.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npaddtonab.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\taec8sgz.default\extensions\[removed]\plugins\np-vmware-vmrc-2.5.0-122581.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\plugins\npoctoshape.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo!\BrowserPlus\2.8.1\Plugins\npybrowserplus_2.8.1.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\IBM\Java50\jre\bin\NPJPI150.dll
FF - plugin: c:\program files\IBM\Java50\jre\bin\npwebscl.dll
FF - plugin: c:\program files\Mozilla Firefox\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npaddtonab.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npcpsweb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwdplugin821.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX Richtlinien —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-PSQLLauncher - c:\program files\Thinkvantage Fingerprint Software\launcher.exe
Notify-ACNotify - ACNotify.dll
Notify-atmgrtok - atmgrtok.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-14 21:13
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse…

Scanne versteckte Autostarteinträge…

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ipmcmu = c:\program files\IBM\IPM Client Migration Utility\ipmcmu.exe "c:\program files\IBM\IPM Client Migration Utility"?run key ipmcmu was set successfully?run key ipmcmu was not set successfully?Error, Windows run key not found?The service "Task Scheduler" is not ru

Scanne versteckte Dateien…

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0x8A1710E0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0xf76bbf28
\Driver\ACPI -> 0xf75aecb8
\Driver\atapi -> 0xf746a852
\Driver\iaStor -> 0xf7b4b992
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: -> SendCompleteHandler -> 0x0
PacketIndicateHandler -> 0x0
SendHandler -> 0x0
Warning: possible MBR rootkit infection !
user & kernel MBR OK
copy of MBR has been found in sector 6 !

**************************************************************************
.
——————— Durch laufende Prozesse gestartete DLLs ———————

- - - - - - - > 'winlogon.exe'(1108)
c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll
c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll
c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll
c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll
c:\program files\ibm\personal communications\atmgrtok.dll
c:\program files\ibm\personal communications\MILLUTIL.DLL
c:\windows\system32\pcsinst.dll

- - - - - - - > 'explorer.exe'(2096)
c:\windows\system32\PGPhk.dll
c:\windows\system32\PGPfsshl.dll
c:\windows\system32\btmmhook.dll
c:\program files\PC-Doctor\ATLPcdToolbar551452.dll
.
———————— Weitere laufende Prozesse ————————
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\ibm\personal communications\PCS_AGNT.EXE
c:\program files\Common Files\Symantec Shared\ccProxy.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\Drivers\trcboot.exe
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\AMT\LMS.exe
c:\notes\ntmulti.exe
c:\progra~1\AT&TNE~2\netcfgsvr.exe
c:\windows\system32\PGPserv.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\lenovo\system update\suservice.exe
c:\program files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\TpShocks.exe
c:\windows\system32\rundll32.exe
c:\program files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Synaptics\SynTP\SynTPLpr.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\windows\system32\igfxext.exe
c:\program files\IBM\My Help\plugins\com.ibm.myhelp.common_1.4.19\pmonmh.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TpKmpSVC.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\SYMANT~2\SYMANT~2\vptray.exe
c:\program files\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.productivity.tools.base.app.win32_3.5.0.20090605-2002\soffice.exe
c:\windows\system32\Drivers\ldlcserv.exe
c:\program files\PGP Corporation\PGP Desktop\PGPtray.exe
c:\progra~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\program files\IBM\My Help\MyHelp.exe
c:\program files\IBM\My Help\jre\bin\myhelpw.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-14 21:18:33 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-08-14 19:18

Vor Suchlauf: 47.993.753.600 bytes free
Nach Suchlauf: 47.765.831.680 bytes free

- - End Of File - - 5FF0EBBAC28C174A723B40A7E498FDFA

Hi, here is the GMER result:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-15 22:04:33
Windows 5.1.2600 Service Pack 3
Running: l6tf6y7k.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kgniipoc.sys


—- System - GMER 1.0.15 —-

SSDT 89EC5738 ZwConnectPort
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0x985F8350]
SSDT 8A026788 ZwQueryValueKey
SSDT 89E61F98 ZwResumeThread
SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0x985F8580]

Code 8A1890E0 pIofCallDriver

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \FileSystem\Ntfs \Ntfs fp.sys (CDP Filesystem Filter Driver/IBM Corporation)
AttachedDevice \FileSystem\Ntfs \Ntfs fp.sys (CDP Filesystem Filter Driver/IBM Corporation)

Device \Driver\NDIS \Device\Ndis [8A163984] NDIS.sys[.reloc]

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0c607684f1b2
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0c607684f1b2 (not active ControlSet)

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 20: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 21: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 22: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 23: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 24: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 25: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 26: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 27: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 28: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 29: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 30: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 31: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 32: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 33: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 34: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 35: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 36: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 37: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 38: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 39: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 40: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 41: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 42: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 43: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 44: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 45: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 46: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 47: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 48: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 49: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 50: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 51: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 52: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 53: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 54: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 55: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 56: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 57: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 58: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 59: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 60: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 61: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;

—- EOF - GMER 1.0.15 —-

Thank you!