Spyware / Malware / Virus Removal

safeom infection

14 min read

Looking for the outcome? Ask AI

aupair2010 Topic Starter

Post #1December 27, 2010, 12:51 AM UTC

aupair got her netbook infected and i havent been able to find a virus remover for safeom trojan

patndoris

Post #2December 27, 2010, 7:19 PM UTC

Hello and

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

Please be advised I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay in response time, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.

patndoris

Post #3December 27, 2010, 7:41 PM UTC

First, let's get a couple of logs so I can take a look at what's going on with the netbook.

If you have CDEmulation drivers installed (such as Daemon Tools, Alcohol120) please follow the instructions below to run DeFogger prior to and after running GMER. If you do not have any CDEmulation drivers installed, you do not need to run DeFogger and you can go right to the instructions to run GMER.

Download DeFogger

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Download and Run GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

OTL Custom Scan

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

aupair2010

Post #4December 27, 2010, 8:58 PM UTC

Thanks. I have used Whatthetech before — 5 years ago. wng_z3r0 was my saviour – he was 16 at the time and he helped me fixed it in between doing his homework..lol You guys are awesome. This is my aupair's machine – a German netbook running XP. She clearly clicked on something malicious. I'll run the diagnostics tonight on her machine and post the results. I can bypass the trojan with a safe mode with network boot and get to the web that way so should not be a problem. I run a tech company so you can hit me whatever you need me to do. Though this level of diagnostics is beyond my skills :-)

aupair2010

Post #5December 28, 2010, 8:00 AM UTC

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-28 08:55:24
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHZ2160BH_G2 rev.008B000B
Running: gmer.exe; Driver: C:\DOKUME~1\Sarah\LOKALE~1\Temp\fxtdypow.sys

—- System - GMER 1.0.15 —-

SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF747F6FA]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF745DF68]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF745E230]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF74800B4]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF748043E]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF747E938]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF7480982]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF747FAB8]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF745D9D8]

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution + 252 804E4AAC 4 Bytes JMP AFA541F8

—- User code sections - GMER 1.0.15 —-

.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4115F4D9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 412D27F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 412D2777 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 412D27BB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 412D2703 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 412D273D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 412D2831 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 4118178A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1700] ole32.dll!OleLoadFromStream 774F981B 5 Bytes JMP 412D29F3 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4115F4D9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 412D27F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 412D2777 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 412D27BB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 412D2703 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 412D273D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 412D2831 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 4118178A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[1708] ole32.dll!OleLoadFromStream 774F981B 5 Bytes JMP 412D29F3 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

OTL logfile created on: 28.12.2010 07:30:35 - Run 2
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Dokumente und Einstellungen\Sarah\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 84,00% Memory free
3,00 Gb Paging File | 3,00 Gb Available in Paging File | 97,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 29,14 Gb Free Space | 41,01% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,91 Gb Free Space | 99,88% Space Free | Partition Type: NTFS

Computer Name: SARAH | User Name: Sarah | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\Sarah\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Dokumente und Einstellungen\Sarah\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (sdCoreService) – C:\Programme\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (Apple Mobile Device) – C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (sdAuxService) – C:\Programme\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (FlipShare Service) – C:\Programme\Flip Video\FlipShare\FlipShareService.exe ()
SRV - (AntiVirService) – C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (yksvc) – C:\WINDOWS\system32\yk51x86.dll (Marvell)
SRV - (Samsung Update Plus) – C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (pctDS) – C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (yukonwxp) – C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (avgio) – C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (VMC326) – C:\WINDOWS\system32\drivers\VMC326.sys (Vimicro Corporation)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm) – C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (DNSeFilter) – C:\WINDOWS\system32\drivers\SamsungEDS.SYS (Samsung Electronics,.LTD)
DRV - (SUEPD) – C:\WINDOWS\system32\drivers\SUE_PD.sys (Samsung)
DRV - (DOSMEMIO) – C:\WINDOWS\system32\MEMIO.SYS ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?br…N&bmod;=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?br…N&bmod;=SMSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8074

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {5631A177-FB5B-43A3-A30B-20C647DA306B}:1.9.1

FF - HKLM\software\mozilla\Firefox\extensions\\{5631A177-FB5B-43A3-A30B-20C647DA306B}: C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\{5631A177-FB5B-43A3-A30B-20C647DA306B} [2010.11.29 01:14:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.12.25 17:32:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.25 17:32:06 | 000,000,000 | —D | M]

[2009.12.29 20:18:25 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\Mozilla\Extensions
[2010.10.23 15:53:07 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\Mozilla\Firefox\Profiles\h9wnckcu.default\extensions
[2010.12.26 04:51:25 | 000,000,000 | —D | M] – C:\Programme\Mozilla Firefox\extensions
[2010.04.25 18:02:46 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.12.25 17:31:59 | 000,001,392 | —- | M] () – C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.25 17:31:59 | 000,002,344 | —- | M] () – C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.25 17:31:59 | 000,006,805 | —- | M] () – C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.25 17:32:00 | 000,001,178 | —- | M] () – C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.25 17:32:00 | 000,001,105 | —- | M] () – C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2008.04.14 13:00:00 | 000,000,820 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe ()
O4 - HKLM..\Run: [DMHotKey] C:\Programme\Samsung\Easy Display Manager\DMLoader.exe (SAMSUNG Electronics)
O4 - HKLM..\Run: [EDS] C:\Programme\Samsung\Samsung EDS\EDSAgent.exe (Samsung Electronics,.LTD)
O4 - HKLM..\Run: [ISTray] C:\Programme\PC Tools Security\pctsGui.exe (PC Tools)
O4 - HKLM..\Run: [MagicKeyboard] C:\Programme\Samsung\MagicKBD\PreMKbd.exe ()
O4 - HKLM..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe (Hewlett-Packard)
O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [wmrljowg] C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Temp\vvrrlvyvn\aeectaolajb.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\officejet 6100.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hposol08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Dokumente und Einstellungen\Sarah\Startmenü\Programme\Autostart\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki… - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O8 - Extra context menu item: Senden an &Bluetooth-Ger;ät… - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.18 15:53:03 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{3a37e6ac-f0f2-11de-b504-0024540f049a}\Shell\AutoRun\command - "" = E:\Setup_FlipShare.exe – File not found
O33 - MountPoints2\{3a37e6ac-f0f2-11de-b504-0024540f049a}\Shell\Setup FlipShare\command - "" = E:\Setup_FlipShare.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell - "" = AutoRun
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\AutoRun\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\dutch\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\english\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\french\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\german\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\italian\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\nocheck\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{50df43d8-fde3-11de-b52f-0026b62065ae}\Shell\noprompt\command - "" = E:\setup.exe – File not found
O33 - MountPoints2\{9f5e2c00-0eea-11e0-b84e-0026b62065ae}\Shell - "" = AutoRun
O33 - MountPoints2\{9f5e2c00-0eea-11e0-b84e-0026b62065ae}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{9f5e2c00-0eea-11e0-b84e-0026b62065ae}\Shell\AutoRun\command - "" = E:\PhotoViewerAP_V6.0.1.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.3IV2 - C:\WINDOWS\System32\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

========== Files/Folders - Created Within 30 Days ==========

[2010.12.28 07:15:14 | 000,602,624 | —- | C] (OldTimer Tools) – C:\Dokumente und Einstellungen\Sarah\Desktop\OTL.exe
[2010.12.27 01:16:11 | 000,189,520 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010.12.27 01:02:49 | 000,000,000 | -H-D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D81057B4-29EC-41EB-A123-4E4E49873404}
[2010.12.27 01:01:50 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fighters
[2010.12.27 01:01:04 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\Fighters
[2010.12.27 01:01:02 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\PackageAware
[2010.12.27 00:20:44 | 000,656,320 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctEFA.sys
[2010.12.27 00:20:44 | 000,338,880 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctDS.sys
[2010.12.27 00:20:43 | 000,249,616 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010.12.27 00:20:40 | 000,239,168 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2010.12.27 00:20:40 | 000,160,448 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010.12.27 00:20:28 | 000,123,968 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplfw.sys
[2010.12.27 00:20:28 | 000,087,400 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctNdis-PacketFilter.sys
[2010.12.27 00:20:28 | 000,070,536 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2010.12.27 00:20:28 | 000,031,960 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctNdis-DNS.sys
[2010.12.27 00:20:06 | 000,000,000 | —D | C] – C:\Programme\PC Tools Security
[2010.12.27 00:20:06 | 000,000,000 | —D | C] – C:\Programme\Gemeinsame Dateien\PC Tools
[2010.12.27 00:20:06 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\PC Tools
[2010.12.27 00:20:06 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools
[2010.12.27 00:20:05 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.12.26 18:24:19 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010.12.24 00:16:18 | 000,000,000 | —D | C] – C:\ST_Temp
[2010.11.29 01:46:13 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\Malwarebytes
[2010.11.29 01:45:58 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.11.29 01:45:55 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010.11.29 01:45:55 | 000,000,000 | —D | C] – C:\Programme\Malwarebytes' Anti-Malware
[2010.11.29 01:45:55 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.11.29 01:14:48 | 000,000,000 | —D | C] – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\{5631A177-FB5B-43A3-A30B-20C647DA306B}
[2007.08.13 17:46:00 | 000,102,912 | —- | C] (Albert L Faber) – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\CDRip.dll
[2007.01.18 21:09:54 | 000,623,616 | —- | C] (Ivan Bischof ©2003 - 2005) – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\No23 Recorder.exe
[2006.12.11 19:13:14 | 000,013,872 | —- | C] (Un4seen Developments) – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\basscd.dll
[2006.12.11 19:13:12 | 000,097,336 | —- | C] (Un4seen Developments) – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\bass.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.12.28 07:06:49 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Dokumente und Einstellungen\Sarah\Desktop\OTL.exe
[2010.12.28 06:13:09 | 000,000,000 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\defogger_reenable
[2010.12.28 06:03:10 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010.12.28 03:18:54 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010.12.27 02:53:44 | 000,001,084 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.27 01:43:43 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010.12.27 01:28:01 | 000,001,088 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.27 01:14:21 | 000,000,036 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2010.12.27 00:53:12 | 000,001,614 | —- | M] () – C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Doctor.lnk
[2010.12.26 19:12:52 | 000,002,121 | —- | M] () – C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2010.12.25 17:55:11 | 000,000,040 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\tmp.no23
[2010.12.25 15:48:14 | 000,012,796 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010.12.23 18:24:36 | 000,002,243 | —- | M] () – C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2010.12.16 18:41:25 | 000,093,696 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.15 17:25:27 | 000,109,400 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010.12.15 03:26:42 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010.11.29 01:46:01 | 000,000,676 | —- | M] () – C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.29 01:12:45 | 000,000,006 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\start
[2010.11.29 01:10:50 | 000,000,006 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\completescan
[2010.11.29 01:04:37 | 000,000,010 | —- | M] () – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\install
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.12.28 06:13:09 | 000,000,000 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\defogger_reenable
[2010.12.27 01:43:43 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010.12.27 01:14:21 | 000,000,036 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache
[2010.12.27 00:53:12 | 000,001,614 | —- | C] () – C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Doctor.lnk
[2010.12.25 17:55:11 | 000,000,040 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\tmp.no23
[2010.12.25 15:48:14 | 000,012,796 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010.11.29 01:46:01 | 000,000,676 | —- | C] () – C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.29 01:12:45 | 000,000,006 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\start
[2010.11.29 01:07:45 | 000,000,006 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\completescan
[2010.11.29 01:04:37 | 000,000,010 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\install
[2010.01.10 13:29:57 | 000,000,150 | —- | C] () – C:\WINDOWS\pagesuit.ini
[2010.01.10 13:29:53 | 000,023,040 | —- | C] () – C:\WINDOWS\System32\irisco32.dll
[2009.12.30 12:07:40 | 000,001,516 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\RecConfig.xml
[2009.12.30 11:37:47 | 000,000,138 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009.12.25 23:01:53 | 000,093,696 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.19 18:11:19 | 000,001,520 | —- | C] () – C:\WINDOWS\System32\Sarah_KBD.ini
[2009.09.24 13:00:06 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009.06.19 00:19:21 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2009.06.18 16:45:12 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009.06.18 16:05:07 | 000,000,002 | —- | C] () – C:\WINDOWS\HotFixList.ini
[2009.06.18 16:05:02 | 000,001,522 | —- | C] () – C:\WINDOWS\System32\MagicKBD.INI
[2009.06.18 16:05:02 | 000,001,520 | —- | C] () – C:\WINDOWS\System32\Besitzer_KBD.ini
[2009.06.18 16:05:01 | 000,003,425 | —- | C] () – C:\WINDOWS\System32\KBDR.INI
[2009.06.18 16:05:01 | 000,002,741 | —- | C] () – C:\WINDOWS\System32\KBDD.INI
[2009.06.18 16:05:01 | 000,002,699 | —- | C] () – C:\WINDOWS\System32\KBDO.INI
[2009.06.18 16:05:01 | 000,002,699 | —- | C] () – C:\WINDOWS\System32\KBDC.INI
[2009.06.18 16:05:01 | 000,002,606 | —- | C] () – C:\WINDOWS\System32\KBDB.INI
[2009.06.18 16:05:01 | 000,002,236 | —- | C] () – C:\WINDOWS\System32\KBDQ.INI
[2009.06.18 16:05:01 | 000,001,956 | —- | C] () – C:\WINDOWS\System32\KBDE.INI
[2009.06.18 16:05:01 | 000,001,885 | —- | C] () – C:\WINDOWS\System32\KBDP.INI
[2009.06.18 16:05:01 | 000,001,857 | —- | C] () – C:\WINDOWS\System32\KBDUU.INI
[2009.06.18 16:05:01 | 000,001,835 | —- | C] () – C:\WINDOWS\System32\KBDG.INI
[2009.06.18 16:05:01 | 000,001,835 | —- | C] () – C:\WINDOWS\System32\KBDA.INI
[2009.06.18 16:05:01 | 000,001,834 | —- | C] () – C:\WINDOWS\System32\KBDU.INI
[2009.06.18 16:05:01 | 000,001,819 | —- | C] () – C:\WINDOWS\System32\KBDN.INI
[2009.06.18 16:05:01 | 000,001,699 | —- | C] () – C:\WINDOWS\System32\KBDT.INI
[2009.06.18 16:05:01 | 000,001,697 | —- | C] () – C:\WINDOWS\System32\KBDV.INI
[2009.06.18 16:05:01 | 000,001,522 | —- | C] () – C:\WINDOWS\System32\KBDS.INI
[2009.06.18 16:05:01 | 000,001,476 | —- | C] () – C:\WINDOWS\System32\KBDF.INI
[2009.06.18 16:02:49 | 000,000,135 | R— | C] () – C:\WINDOWS\System32\lngEng.ini
[2009.06.18 16:02:49 | 000,000,117 | —- | C] () – C:\WINDOWS\System32\lngKor.ini
[2009.06.18 15:59:27 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009.06.18 15:57:01 | 000,004,300 | —- | C] () – C:\WINDOWS\System32\MEMIO.SYS
[2009.03.23 17:40:06 | 002,854,976 | —- | C] () – C:\WINDOWS\System32\btwicons.dll
[2008.02.19 07:33:34 | 000,446,352 | —- | C] () – C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2007.08.13 17:46:00 | 000,155,136 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\lame_enc.dll
[2006.10.26 01:06:48 | 000,064,000 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\vorbisenc.dll
[2006.10.26 01:06:48 | 000,019,456 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\vorbisfile.dll
[2006.10.26 01:06:46 | 000,143,872 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\vorbis.dll
[2006.10.26 01:06:36 | 000,015,872 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\ogg.dll
[2005.08.23 22:34:06 | 000,029,184 | —- | C] () – C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Anwendungsdaten\no23xwrapper.dll
[2002.05.29 14:50:02 | 000,552,960 | —- | C] () – C:\WINDOWS\System32\hpotscl.dll
[2001.11.14 13:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2010.12.27 01:01:50 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fighters
[2009.12.25 20:37:57 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Flip Video
[2010.12.28 06:01:58 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2009.06.18 16:00:10 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLAN
[2010.10.24 03:44:09 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.12.27 01:02:53 | 000,000,000 | -H-D | M] – C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D81057B4-29EC-41EB-A123-4E4E49873404}
[2010.12.27 01:01:07 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\Fighters
[2010.03.18 16:10:09 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\kikin
[2009.12.30 10:17:15 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\OpenOffice.org
[2010.01.10 13:26:13 | 000,000,000 | —D | M] – C:\Dokumente und Einstellungen\Sarah\Anwendungsdaten\Ordner HP Share-to-Web
[2010.08.22 18:21:29 | 000,000,334 | —- | M] () – C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1263129189.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 165 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2

< End of report >

OTL Extras logfile created on: 28.12.2010 07:27:39 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Dokumente und Einstellungen\Sarah\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 84,00% Memory free
3,00 Gb Paging File | 3,00 Gb Available in Paging File | 97,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 71,04 Gb Total Space | 29,14 Gb Free Space | 41,01% Space Free | Partition Type: NTFS
Drive D: | 72,00 Gb Total Space | 71,91 Gb Free Space | 99,88% Space Free | Partition Type: NTFS

Computer Name: SARAH | User Name: Sarah | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Programme\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Programme\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java™ 6 Update 16
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4AB60DF3-DB89-928C-023E-4001C28A49BF}" = FlipShare
"{5CBB720F-08E6-4043-B83F-76C277AF6DE7}" = Samsung Wallpaper
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Samsung Battery Manager
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{82DFB852-9594-4668-9C66-28BB6E94BCB2}" = HP Foto- und Bildbearbeitung 1.0 - [PRODUKTSERIE]
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = WIDCOMM Bluetooth Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BFFB382-0B2C-11D6-AB3E-000102B0F79A}" = Readiris 7.5
"{A19B094A-42EB-4D3F-A57E-0CDE052A1D80}" = DV 5700
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABB14904-A11B-4F42-996C-80FD608A0F17}" = Samsung EDS
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD723E53-A42C-4702-AA04-1D74A0311590}" = Magic Keyboard
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin 2.4
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{ED93995E-8BF2-480F-8EA4-7D29E29A7052}" = HP Foto- und Bildbearbeitung 1.0 HP PSC - HP OfficeJet Treiber
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}" = Atheros WLAN Client
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"HDMI" = Intel® Graphics Media Accelerator Driver
"hp psc 2100 series_Driver" = hp psc 2100 series
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PSC 2000 Series" = HP Foto und Bildbearbeitung 1.0 - HP PSC - HP OfficeJet
"Spyware Doctor" = Spyware Doctor mit Antivirus 8.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.0.3

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 30.07.2010 19:26:10 | Computer Name = SARAH | Source = MSSOAP | ID = 16
Description = Soap error: Unspecified HTTP error..

Error - 27.08.2010 16:08:58 | Computer Name = SARAH | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.5512, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 28.08.2010 12:10:31 | Computer Name = SARAH | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung skype.exe, Version 4.2.0.158, fehlgeschlagenes
Modul skype.exe, Version 4.2.0.158, Fehleradresse 0x002f26fc.

Error - 27.09.2010 00:26:45 | Computer Name = SARAH | Source = ESENT | ID = 490
Description = svchost (856) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error - 02.10.2010 22:23:10 | Computer Name = SARAH | Source = Google Update | ID = 20
Description =

Error - 04.10.2010 00:23:06 | Computer Name = SARAH | Source = Google Update | ID = 20
Description =

Error - 13.10.2010 23:23:05 | Computer Name = SARAH | Source = Google Update | ID = 20
Description =

Error - 14.10.2010 23:49:13 | Computer Name = SARAH | Source = ESENT | ID = 490
Description = svchost (864) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error - 24.10.2010 11:38:28 | Computer Name = SARAH | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung no23 recorder.exe, Version 2.1.0.3, fehlgeschlagenes
Modul kernel32.dll, Version 5.1.2600.5781, Fehleradresse 0x00012afb.

Error - 02.11.2010 16:28:16 | Computer Name = SARAH | Source = ESENT | ID = 490
Description = svchost (860) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

[ System Events ]
Error - 28.12.2010 02:20:17 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:20:17 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:20:57 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:20:59 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:21:08 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:21:10 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:21:48 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:21:50 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:21:56 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 28.12.2010 02:21:58 | Computer Name = SARAH | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

< End of report >

patndoris

Post #6December 28, 2010, 8:10 PM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8074
O4 - HKCU..\Run: [wmrljowg] C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Temp\vvrrlvyvn\aeectaolajb.exe ()

:Commands
[purity]
[emptytemp]
[emptyflash]
[createrestorepoint]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the resulting OTL log

Can you please try booting into normal mode and let me know how the computer is behaving now?

aupair2010

Post #7December 28, 2010, 8:55 PM UTC

All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wmrljowg deleted successfully. C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Temp\vvrrlvyvn\aeectaolajb.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 538992 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Sarah ->Temp folder emptied: 1628327378 bytes ->Temporary Internet Files folder emptied: 117062384 bytes ->Java cache emptied: 49824561 bytes ->FireFox cache emptied: 55042452 bytes ->Flash cache emptied: 79677 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 2951 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 7031352 bytes RecycleBin emptied: 1201677103 bytes Total Files Cleaned = 2.918,00 mb [EMPTYFLASH] User: All Users User: Default User User: LocalService User: NetworkService User: Sarah ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb Error starting restore point: The function was called in safe mode. Error closing restore point: The sequence number is invalid. OTL by OldTimer - Version 3.2.18.0 log created on 12282010_213807 Files\Folders moved on Reboot… C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QJ2LHACJ\index[6].htm moved successfully. C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QJ2LHACJ\like[2].htm moved successfully. C:\Dokumente und Einstellungen\Sarah\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9OEJ201M\iframe[2].htm moved successfully. Registry entries deleted on Reboot…

aupair2010

Post #8December 28, 2010, 8:56 PM UTC

netbook now boots without errors and there is no evidence of the safeom infection As always:

patndoris

Post #9December 28, 2010, 11:06 PM UTC

Stick with me a bit longer please. We need to run a couple more scans just to ensure everything is good. After that we need to complete some clean up of the tools. Let's start with this:

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 23 and save it to your desktop.
Scroll down to where it says JDK 6 Update 23 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u23 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u23-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Update Adobe Reader
There have been updates to Adobe Reader to address security vulnerabilities. You should download the latest version from the Adobe website.

I see you have Malwarebytes already on your machine. Please run it by double clicking the icon on the desktop.

Click on the tab labeled Update and then click on the button Check for updates. Allow it to check for and apply any updates.
Select the Scanner tab, and Perform Quick Scan
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Please post the log in your next reply.

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

Note: The online scan may take awhile so you may want to set it up to run at a time when the netbook won't be needed.

aupair2010

Post #10December 29, 2010, 5:02 AM UTC

Thanks. I updated Java and Adobe on her machine and cleared the old versions and the cache. I ran MalwareBytes with no infections found. I had to postpone the ESET Online run till tomorrow. I'll post the logs tomorrow night. Appreciate the help. No recurrence or any other problems.

patndoris

Post #11January 2, 2011, 2:47 AM UTC

Are you having any problems with the last set of instructions?

Reminder: Topics with no reply in 4 days are closed!

aupair2010

Post #12January 2, 2011, 3:04 AM UTC

YOU try and get a PC out of the hands of a 20 yo girl for a multi-hour anti-virus run! LOL I think we're going to have to call this one fixed. The Malwarebytes run was clean but I can't get the Netbook from her long enough to run the last scan. Thank you very much for all your assistance. You guys are awesome!

patndoris

Post #13January 2, 2011, 11:05 PM UTC

I understand it can be difficult to get your hands on the netbook at this point. If you are able it would be good to do the following (it won't take very long).

If you ran DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Now to remove most of the tools that we have used in fixing your machine:

Run OTL.exe
This time, click on the CleanUp button.

If you notice any remaining tools or files you can delete them by right clicking and choosing delete.

Set a New Restore Point to prevent possible reinfection from an old one.
Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
* Go to Start > Programs > Accessories > System Tools
* Click "System Restore"
* Choose the radio button marked "Create a Restore Point" on the first screen then click "Next"
* Give the Restore Point a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
* Then go to Start > Run and type: Cleanmgr
* Click "OK"
* Click the "More Options" Tab.
* Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Following is some information you may wish to print and pass along to the user for future reference.

Visit Microsoft's Windows Update Site Frequently
It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install SpywareBlaster
SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

The download and tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Update and Runl Malwarebytes Anti-Malware
Scan your computer with this program on a regular basis just as you would an antivirus software in conjunction with SuperAntiSpyware.

Install SUPERAntiSpyware Home Edition (free edition)
You should also scan your computer with this program on a regular basis just as you would an antivirus software in conjunction with Malwarebytes.

Perform an online virus scan
Every so often, also perform an online virus scan.
AntiVirus scanners use databases which are not identical, and one may find malware that another does not.

Some online scanners:
TrendMicro HouseCall: http://uk.trendmicro-europe.com/consumer/h…call_launch.php
Panda ActiveScan: http://www.pandasoftware.com/products/activescan.htm
Kaspersky Online Scanner (using Internet Explorer): http://www.kaspersky.com/virusscanner
BitDefender: http://www.bitdefender.com/scan8/

To simplify making sure you have the latest version of many of your security programs and applications, you may want to consider:
Secunia's Personal Software Inspector (PSI). It is a free utility that scans your computer for installed applications and checks to see if they have the latest security patches and updates. If it finds any applications with possible security issues, links and/or instructions are provided for the necessariy updates.

Filehippo's Update Checker. It is free utilitiy that scan your computer for installed software, checks the versions and then sends this information to see if there are any newer releases. Available software updates are displayed and you can decide which ones to download and install. Among many other types of programs, they includes a number of the Anti-Spyware, Firewall/Security and Anti-Virus programs that have been recommended (though not all of them). Note: Definition files should be updated from within the programs themselves. The Update Checker look for newer versions of the software program, not definition files.

Update all these programs regularly
Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Follow this list and your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck & Happy surfing!

oldman960

Post #14January 6, 2011, 6:10 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

safeom infection

✨ Ask AI

Ask AI