What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Unable to get rid of various malware programs - TR/...

30 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Nope, nothing else there and definitely nothing that I want to keep anyway. I am annoyed by the program being installed there as I use my partitions for a good reason and C: was always reserved for system files only (and the occasional abandonware game for old times sake that needed to be installed at C: ). So I am more than happy to erase any signs of Poker on my C: drive :)
Post #17
Hi.

Ok, lets see if we can make some progress.

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
    C:\onfwbsak.dll
    F:\abandonware\NetStorm\nslInstallC.exe
    C:\Poker

    :Reg
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}]
    [-HKEY_CLASSES_ROOT\CLSID\{49783ED4-258D-4f9f-BE11-137C18D3E543}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "onfwbsak"=-
    "rwlfsdmk"=-
    [-HKEY_CLASSES_ROOT\CLSID\{31597EA0-A0E3-4B8A-B80C-735CADB2776B}]
    [-HKEY_CLASSES_ROOT\CLSID\{29E4ACCE-2097-4DE7-A063-38AD23B30942}]

    [Reboot]

  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


You don't appear to be running any third party Firewall software.

Install a firewall! Without a firewall you are very susceptible to being hacked, and people could gain access to your computer. If you don't have a firewall I strongly recommend you download ONE of the following:
1) Comodo
2) Agnitum
3) Sunbelt/Kerio

Please reboot and post a new HijackThis log. Any change to the computer's behaviour?

Thanks.
Post #18 last edited
After pasting the content of the codebox into the clipboard (yellow bar, left hand side) and pressing "Move it!" the program seemed to quickly work through the code (half a second or so) and after that immediately shut down. Therefore I cannot paste any result from the right hand side box here. Shall I continue with a reboot and HJT log?
Post #20
No log file, but a directory called 10092008_155820 which consists of a file called onfwbsak.dll and a subdirectory abandonware which contains the empty directory NetStorm .
Post #21
Hmm.

Looks like it started working, but didn't get all the way through. Let's try disabling TeaTimer and trying again.

You need to disable TeaTimer, so that it doesn't interfere with our fix.

This is a two step process.
First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, click once on Resident Protection, then right-click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For both versions :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go to the bottom of the vertical panel on the left, click Tools
  • Then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.
OTMoveIT3
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
    C:\onfwbsak.dll
    F:\abandonware\NetStorm\nslInstallC.exe
    C:\Poker

    :Reg
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}]
    [-HKEY_CLASSES_ROOT\CLSID\{49783ED4-258D-4f9f-BE11-137C18D3E543}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "onfwbsak"=-
    "rwlfsdmk"=-
    [-HKEY_CLASSES_ROOT\CLSID\{31597EA0-A0E3-4B8A-B80C-735CADB2776B}]
    [-HKEY_CLASSES_ROOT\CLSID\{29E4ACCE-2097-4DE7-A063-38AD23B30942}]

    [Reboot]

  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


If it works, please continue with the instructions from before, if not, please post a new HijackThis log and we'll see what we can do.

Thanks.
Post #22
Yet again you proved you know my PC better than I do without ever having taken a look at it :D Here is the Results log of MoveIt: ========== FILES ========== File/Folder C:\onfwbsak.dll not found. F:\abandonware\NetStorm\nslInstallC.exe moved successfully. C:\Poker\Titan Poker\data\videopoker_jacks moved successfully. C:\Poker\Titan Poker\data\videopoker_deuceswild moved successfully. C:\Poker\Titan Poker\data\videopoker_4deuceswild moved successfully. C:\Poker\Titan Poker\data\table\topview\history moved successfully. C:\Poker\Titan Poker\data\table\topview\dialogs moved successfully. C:\Poker\Titan Poker\data\table\topview\coins moved successfully. C:\Poker\Titan Poker\data\table\topview\chat\chat_side moved successfully. C:\Poker\Titan Poker\data\table\topview\chat\chat_bottom moved successfully. C:\Poker\Titan Poker\data\table\topview\chat moved successfully. C:\Poker\Titan Poker\data\table\topview\cards moved successfully. C:\Poker\Titan Poker\data\table\topview\buttons moved successfully. C:\Poker\Titan Poker\data\table\topview\avatars moved successfully. C:\Poker\Titan Poker\data\table\topview\anim moved successfully. C:\Poker\Titan Poker\data\table\topview moved successfully. C:\Poker\Titan Poker\data\table\smallview\coins moved successfully. C:\Poker\Titan Poker\data\table\smallview\chat\chat_bottom moved successfully. C:\Poker\Titan Poker\data\table\smallview\chat moved successfully. C:\Poker\Titan Poker\data\table\smallview\buttons moved successfully. C:\Poker\Titan Poker\data\table\smallview\anim moved successfully. C:\Poker\Titan Poker\data\table\smallview moved successfully. C:\Poker\Titan Poker\data\table\chat\cards moved successfully. C:\Poker\Titan Poker\data\table\chat moved successfully. C:\Poker\Titan Poker\data\table\anim moved successfully. C:\Poker\Titan Poker\data\table\3d moved successfully. C:\Poker\Titan Poker\data\table moved successfully. C:\Poker\Titan Poker\data\slots_millionaireslane20line\wintable moved successfully. C:\Poker\Titan Poker\data\slots_millionaireslane20line\sounds moved successfully. C:\Poker\Titan Poker\data\slots_millionaireslane20line\bonusgame moved successfully. C:\Poker\Titan Poker\data\slots_millionaireslane20line\animation moved successfully. C:\Poker\Titan Poker\data\slots_millionaireslane20line moved successfully. C:\Poker\Titan Poker\data\slots_gold8line\wintable moved successfully. C:\Poker\Titan Poker\data\slots_gold8line\sounds moved successfully. C:\Poker\Titan Poker\data\slots_gold8line\fonts moved successfully. C:\Poker\Titan Poker\data\slots_gold8line\bonus\screen moved successfully. C:\Poker\Titan Poker\data\slots_gold8line\bonus moved successfully. C:\Poker\Titan Poker\data\slots_gold8line moved successfully. C:\Poker\Titan Poker\data\slots_globaltraveler20line\wintable moved successfully. C:\Poker\Titan Poker\data\slots_globaltraveler20line\sounds moved successfully. C:\Poker\Titan Poker\data\slots_globaltraveler20line\bonus moved successfully. C:\Poker\Titan Poker\data\slots_globaltraveler20line\betlines moved successfully. C:\Poker\Titan Poker\data\slots_globaltraveler20line\animation moved successfully. C:\Poker\Titan Poker\data\slots_globaltraveler20line moved successfully. C:\Poker\Titan Poker\data\shared\videopoker_jacks moved successfully. C:\Poker\Titan Poker\data\shared\videopoker_deuces moved successfully. C:\Poker\Titan Poker\data\shared\videopoker_4line\buttons moved successfully. C:\Poker\Titan Poker\data\shared\videopoker_4line moved successfully. C:\Poker\Titan Poker\data\shared\ui moved successfully. C:\Poker\Titan Poker\data\shared\tablesigns moved successfully. C:\Poker\Titan Poker\data\shared\tablegames\silver_bright moved successfully. C:\Poker\Titan Poker\data\shared\tablegames moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\valleygirl moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\oldtourist moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\olderbusinesswoman moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\mafiaguy moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\frenchman moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\frenchgirl moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\cowboy moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\bond moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\blackdude moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds\baseballer moved successfully. C:\Poker\Titan Poker\data\shared\sounds\playersounds moved successfully. C:\Poker\Titan Poker\data\shared\sounds\dealervoices\numbers moved successfully. C:\Poker\Titan Poker\data\shared\sounds\dealervoices moved successfully. C:\Poker\Titan Poker\data\shared\sounds moved successfully. C:\Poker\Titan Poker\data\shared\options moved successfully. C:\Poker\Titan Poker\data\shared\interface\chat moved successfully. C:\Poker\Titan Poker\data\shared\interface moved successfully. C:\Poker\Titan Poker\data\shared\html\chat\emoticons moved successfully. C:\Poker\Titan Poker\data\shared\html\chat moved successfully. C:\Poker\Titan Poker\data\shared\html moved successfully. C:\Poker\Titan Poker\data\shared\history\cards moved successfully. C:\Poker\Titan Poker\data\shared\history moved successfully. C:\Poker\Titan Poker\data\shared\fonts moved successfully. C:\Poker\Titan Poker\data\shared\doublescreen moved successfully. C:\Poker\Titan Poker\data\shared\dollarball\sounds moved successfully. C:\Poker\Titan Poker\data\shared\dollarball moved successfully. C:\Poker\Titan Poker\data\shared\coins\tablecoins moved successfully. C:\Poker\Titan Poker\data\shared\coins moved successfully. C:\Poker\Titan Poker\data\shared\cards\textures moved successfully. C:\Poker\Titan Poker\data\shared\cards\poker moved successfully. C:\Poker\Titan Poker\data\shared\cards moved successfully. C:\Poker\Titan Poker\data\shared\buttons moved successfully. C:\Poker\Titan Poker\data\shared\blackjack moved successfully. C:\Poker\Titan Poker\data\shared\9line moved successfully. C:\Poker\Titan Poker\data\shared moved successfully. C:\Poker\Titan Poker\data\roulette\zoom moved successfully. C:\Poker\Titan Poker\data\roulette\sounds moved successfully. C:\Poker\Titan Poker\data\roulette\buttons moved successfully. C:\Poker\Titan Poker\data\roulette\3d moved successfully. C:\Poker\Titan Poker\data\roulette moved successfully. C:\Poker\Titan Poker\data\poker_tequila moved successfully. C:\Poker\Titan Poker\data\poker_paigow moved successfully. C:\Poker\Titan Poker\data\poker_holdem moved successfully. C:\Poker\Titan Poker\data\poker_caribbean moved successfully. C:\Poker\Titan Poker\data\lobby\waitinglist moved successfully. C:\Poker\Titan Poker\data\lobby\tables moved successfully. C:\Poker\Titan Poker\data\lobby\sidegames moved successfully. C:\Poker\Titan Poker\data\lobby\login moved successfully. C:\Poker\Titan Poker\data\lobby\dialogs moved successfully. C:\Poker\Titan Poker\data\lobby\buttons moved successfully. C:\Poker\Titan Poker\data\lobby moved successfully. C:\Poker\Titan Poker\data\blackjack moved successfully. C:\Poker\Titan Poker\data moved successfully. C:\Poker\Titan Poker moved successfully. C:\Poker moved successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}\\ deleted successfully. Registry key HKEY_CLASSES_ROOT\CLSID\{49783ED4-258D-4f9f-BE11-137C18D3E543}\\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\onfwbsak deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\rwlfsdmk deleted successfully. Registry key HKEY_CLASSES_ROOT\CLSID\{31597EA0-A0E3-4B8A-B80C-735CADB2776B}\\ not found. Registry key HKEY_CLASSES_ROOT\CLSID\{29E4ACCE-2097-4DE7-A063-38AD23B30942}\\ not found. OTMoveIt3 by OldTimer - Version 1.0.4.2 log created on 10092008_162755 I installed the Comodo Firewall Pro right after that, as suggested - so far I only used the combination of my router and the XP Firewall. Haven't done the malware scan offered after the installation nor rebooted my PC after installation yet. After that I did another HJT scan. The log as follows: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:34:07, on 09.10.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe f:\Programme\FileZilla Server\FileZilla Server.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\runservice.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe F:\Programme\StorageIT 2007\StorageItService.exe C:\Program Files\Venturi2\Client\ventc.exe f:\Programme\UltraVNC\WinVNC.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\WINDOWS\SOUNDMAN.EXE F:\Darkfix.exe F:\Programme\StorageIT 2007\StorageItAgent.exe C:\Programme\Java\jre1.6.0_07\bin\jusched.exe F:\Programme\DAEMON Tools Lite\daemon.exe F:\Programme\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe C:\Programme\No-IP\DUC20.exe F:\Programme\OpenOffice.org 2.1\program\soffice.exe F:\Programme\OpenOffice.org 2.1\program\soffice.BIN C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [WinVNC] "f:\Programme\UltraVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe Version Cue CS2] "F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Gamma] F:\Darkfix.exe -silent O4 - HKLM\..\Run: [SitAgent] F:\Programme\StorageIT 2007\StorageItAgent.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Programme\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\RunOnce: [COMODO Firewall Pro] "F:\Programme\COMODO\Firewall\cfpconfg.exe" -z -o O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Programme\DAEMON Tools Lite\daemon.exe" -autorun O4 - Startup: No-IP DUC.lnk = C:\Programme\No-IP\DUC20.exe O4 - Startup: OpenOffice.org 2.1.lnk = F:\Programme\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{0CEF587A-542B-47FF-AC75-3D5745A29020}: NameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{C799A3B1-E9CE-4FB1-B181-2D3870F85A62}: NameServer = 192.168.0.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - F:\Programme\COMODO\Firewall\cmdagent.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - f:\Programme\FileZilla Server\FileZilla Server.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe O23 - Service: StorageItService - Storage IT Oy - F:\Programme\StorageIT 2007\StorageItService.exe O23 - Service: Venturi2 Client (Venturi2) - Fourelle Systems, Inc - C:\Program Files\Venturi2\Client\ventc.exe O23 - Service: VNC Server (winvnc) - UltraVNC - f:\Programme\UltraVNC\WinVNC.exe – End of file - 9123 bytes Well, it seems your "brute" force got rid of the 021 entries :) I would like to reboot my PC now but will wait for your okay - I really, really don't want to make your life more complicated by not doing exactly what I am told to and possibly screwing everything up :P
Post #23
You're good to reboot :thumbup: After rebooting, please let me know how the computer is running, and direct me to any remaining problems. Thanks.
Post #24
Rebooted my computer and finished setting up my new Comodo firewall when all of a sudden a system window pops up (title: CDBurnerXP Pro 3) with a message saying Please wait while Windows configures CDBurnerXP Pro 3 and a progress bar underneath. After a few seconds it stops and another window pops up (same title) telling me The feature you are trying to use is on a network resource that is unavailable. followed by Click OK to try again or enter an alternate path to a folder containing the installation package 'CDBurnerXP Pro 3.msi' in the box below.

My options are to either click OK, Cancel or Browse.

The same thing happened each time I started Malwarebyte.
Post #25 last edited
Hi.

Hmm, thats odd, but it doesn't scream Malware at me.

Let's have a little check of the system though, and one last check for malware (hopefully quicker than Kaserpsky…).

Random's System Information Tool
  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
Please run this online scan:

Panda Activescan
  • Once you are on the Panda site, click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on Local Disks to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location
Post the contents of the Panda scan report, along with a new HijackThis Log

Thanks.

EDIT: I've got to run now, I may be back later to check the logs. If not, should be around tomorrow. Cheers.
Post #26
Here we go:


Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-09 17:03:46
Microsoft Windows XP Professional Service Pack 2
System drive C: has 6 GB (29%) free of 20 GB
Total RAM: 2047 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:04:34, on 09.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
F:\Programme\COMODO\Firewall\cmdagent.exe
f:\Programme\FileZilla Server\FileZilla Server.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\runservice.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
F:\Programme\StorageIT 2007\StorageItService.exe
C:\Program Files\Venturi2\Client\ventc.exe
f:\Programme\UltraVNC\WinVNC.exe
C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\SOUNDMAN.EXE
F:\Darkfix.exe
F:\Programme\StorageIT 2007\StorageItAgent.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
F:\Programme\COMODO\Firewall\cfp.exe
F:\Programme\DAEMON Tools Lite\daemon.exe
C:\Programme\No-IP\DUC20.exe
F:\Programme\OpenOffice.org 2.1\program\soffice.exe
F:\Programme\OpenOffice.org 2.1\program\soffice.BIN
F:\Programme\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\kurtl\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\kurtl.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinVNC] "f:\Programme\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Gamma] F:\Darkfix.exe -silent
O4 - HKLM\..\Run: [SitAgent] F:\Programme\StorageIT 2007\StorageItAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Programme\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Startup: No-IP DUC.lnk = C:\Programme\No-IP\DUC20.exe
O4 - Startup: OpenOffice.org 2.1.lnk = F:\Programme\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CEF587A-542B-47FF-AC75-3D5745A29020}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C799A3B1-E9CE-4FB1-B181-2D3870F85A62}: NameServer = 192.168.0.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - F:\Programme\COMODO\Firewall\cmdagent.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - f:\Programme\FileZilla Server\FileZilla Server.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe
O23 - Service: StorageItService - Storage IT Oy - F:\Programme\StorageIT 2007\StorageItService.exe
O23 - Service: Venturi2 Client (Venturi2) - Fourelle Systems, Inc - C:\Program Files\Venturi2\Client\ventc.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - f:\Programme\UltraVNC\WinVNC.exe

–
End of file - 9192 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - F:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D; IE Protection - F:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"=C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"avgnt"=C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe [2008-07-18 266497]
"WinVNC"=f:\Programme\UltraVNC\WinVNC.exe [2006-06-18 712704]
"Kernel and Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2007-01-23 101136]
"Adobe Version Cue CS2"=F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [2005-04-06 856064]
"Acrobat Assistant 7.0"=F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe [2008-04-23 483328]
"amd_dc_opt"=C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2007-07-23 77824]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"Gamma"=F:\Darkfix.exe [2004-09-12 557056]
"AMD_Display"= []
"SitAgent"=F:\Programme\StorageIT 2007\StorageItAgent.exe [2008-07-30 178688]
"SunJavaUpdateSched"=C:\Programme\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"COMODO Firewall Pro"=F:\Programme\COMODO\Firewall\cfp.exe [2008-10-09 1655552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=F:\Programme\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Adobe Acrobat - Schnellstart.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe
Adobe Gamma.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe

C:\Dokumente und Einstellungen\kurtl\Startmenü\Programme\Autostart
No-IP DUC.lnk - C:\Programme\No-IP\DUC20.exe
OpenOffice.org 2.1.lnk - F:\Programme\OpenOffice.org 2.1\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Eine DLL-Datei als Anwendung ausführen"
"F:\Programme\UltraVNC\winvnc.exe"="F:\Programme\UltraVNC\winvnc.exe:*:Enabled:VNC server for Win32"
"E:\Programme\EA GAMES\Battlefield 2\BF2.exe"="E:\Programme\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"E:\Programme\Activision\Marvel - Ultimate Alliance\game.exe"="E:\Programme\Activision\Marvel - Ultimate Alliance\game.exe:*:Enabled:game"
"E:\Programme\Monte Cristo\Silverfall\Silverfall.exe"="E:\Programme\Monte Cristo\Silverfall\Silverfall.exe:*:Enabled:Silverfall"
"E:\Programme\EA SPORTS\MVP Baseball 2005\mvp2005.exe"="E:\Programme\EA SPORTS\MVP Baseball 2005\mvp2005.exe:*:Enabled:mvp2005"
"E:\Programme\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe"="E:\Programme\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"E:\Programme\Cyanide\GameCenter\GameCenter.exe"="E:\Programme\Cyanide\GameCenter\GameCenter.exe:*:Enabled:GameCenter"
"E:\Programme\America's Army\System\ArmyOps.exe"="E:\Programme\America's Army\System\ArmyOps.exe:*:Enabled:America's Army"
"E:\Programme\America's Army\System\AAEditor.exe"="E:\Programme\America's Army\System\AAEditor.exe:*:Enabled:America's Army Mission Editor"
"C:\Programme\America's Army Server Manager\AA Server Manager.exe"="C:\Programme\America's Army Server Manager\AA Server Manager.exe:*:Enabled:America's Army Server Manager"
"C:\Programme\America's Army Server Manager\AA Server Remote Control.exe"="C:\Programme\America's Army Server Manager\AA Server Remote Control.exe:*:Enabled:America's Army Server Remote Control Utility"
"E:\Programme\Anno 1701\Anno1701.exe"="E:\Programme\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701"
"E:\Programme\KONAMI\Pro Evolution Soccer 2008\PES2008.exe"="E:\Programme\KONAMI\Pro Evolution Soccer 2008\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008"
"F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe"="F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2"
"E:\Programme\Sports Interactive\Football Manager 2008\fm.exe"="E:\Programme\Sports Interactive\Football Manager 2008\fm.exe:*:Enabled:Football Manager 2008"
"E:\Programme\MiniRacingOnline\MiniRacingOnLine.exe"="E:\Programme\MiniRacingOnline\MiniRacingOnLine.exe:*:Enabled:MiniRacingOnLine"
"E:\Programme\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe"="E:\Programme\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords.exe:*:Enabled:Sid Meier's Civilization 4 Warlords"
"E:\Programme\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe"="E:\Programme\Firaxis Games\Sid Meier's Civilization 4\Warlords\Civ4Warlords_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Pitboss"
"F:\Programme\uTorrent\uTorrent.exe"="F:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"F:\Programme\Skype\Phone\Skype.exe"="F:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"
"E:\Programme\2K Games\Firaxis Games\Sid Meier's Civilization IV Colonization\Colonization.exe"="E:\Programme\2K Games\Firaxis Games\Sid Meier's Civilization IV Colonization\Colonization.exe:*:Enabled:Sid Meier's Civilization IV Colonization"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9b9ced0-c9d0-11db-9eed-0015f29f3069}]
shell\AutoRun\command - I:\StartUp.exe


======List of files/folders created in the last 1 months======

2008-10-09 17:03:46 —-D—- C:\rsit
2008-10-09 16:32:29 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Comodo
2008-10-09 16:32:27 —-D—- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\comodo
2008-10-09 16:32:27 —-A—- C:\WINDOWS\system32\guard32.dll
2008-10-09 15:58:20 —-D—- C:\_OTMoveIt
2008-10-08 12:40:24 —-A—- C:\WINDOWS\system32\javaws.exe
2008-10-08 12:40:24 —-A—- C:\WINDOWS\system32\javaw.exe
2008-10-08 12:40:24 —-A—- C:\WINDOWS\system32\java.exe
2008-10-03 18:22:04 —-D—- C:\Programme\Trend Micro
2008-10-03 17:05:49 —-A—- C:\WINDOWS\ntbtlog.txt
2008-10-03 16:55:39 —-D—- C:\WINDOWS\ERUNT
2008-10-03 16:49:35 —-D—- C:\WINDOWS\pss
2008-10-03 14:00:38 —-D—- C:\SDFix
2008-10-03 13:08:02 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Malwarebytes
2008-10-03 13:03:27 —-D—- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-10-03 12:31:09 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\TmpRecentIcons
2008-10-03 12:30:57 —-A—- C:\WINDOWS\system32\YURD2.exe
2008-10-03 11:45:25 —-A—- C:\WINDOWS\wininit.ini
2008-10-03 11:26:37 —-A—- C:\WINDOWS\system32\XAudio2_0.dll
2008-10-03 11:26:37 —-A—- C:\WINDOWS\system32\xactengine3_0.dll
2008-10-03 11:26:36 —-A—- C:\WINDOWS\system32\X3DAudio1_3.dll
2008-10-03 11:26:36 —-A—- C:\WINDOWS\system32\d3dx10_37.dll
2008-10-03 11:26:36 —-A—- C:\WINDOWS\system32\D3DCompiler_37.dll
2008-10-03 11:26:35 —-A—- C:\WINDOWS\system32\D3DX9_37.dll
2008-10-03 11:26:34 —-A—- C:\WINDOWS\system32\xactengine2_10.dll
2008-10-03 11:26:34 —-A—- C:\WINDOWS\system32\D3DCompiler_36.dll
2008-10-03 11:26:33 —-A—- C:\WINDOWS\system32\d3dx10_36.dll
2008-10-03 11:26:32 —-A—- C:\WINDOWS\system32\d3dx9_36.dll
2008-10-03 11:26:31 —-A—- C:\WINDOWS\system32\xactengine2_9.dll
2008-10-03 11:26:31 —-A—- C:\WINDOWS\system32\d3dx10_35.dll
2008-10-03 11:26:31 —-A—- C:\WINDOWS\system32\D3DCompiler_35.dll
2008-10-03 11:26:30 —-A—- C:\WINDOWS\system32\xactengine2_8.dll
2008-10-03 11:26:30 —-A—- C:\WINDOWS\system32\x3daudio1_2.dll
2008-10-03 11:26:30 —-A—- C:\WINDOWS\system32\d3dx9_35.dll
2008-10-03 11:26:29 —-A—- C:\WINDOWS\system32\d3dx9_34.dll
2008-10-03 11:26:29 —-A—- C:\WINDOWS\system32\d3dx10_34.dll
2008-10-03 11:26:29 —-A—- C:\WINDOWS\system32\D3DCompiler_34.dll
2008-10-03 11:26:28 —-A—- C:\WINDOWS\system32\xinput1_3.dll
2008-10-03 11:26:28 —-A—- C:\WINDOWS\system32\xactengine2_7.dll
2008-10-03 11:26:27 —-A—- C:\WINDOWS\system32\d3dx10_33.dll
2008-10-03 11:26:27 —-A—- C:\WINDOWS\system32\D3DCompiler_33.dll
2008-10-03 11:26:25 —-A—- C:\WINDOWS\system32\d3dx9_33.dll
2008-10-03 11:26:22 —-A—- C:\WINDOWS\system32\xactengine2_6.dll
2008-10-03 11:26:21 —-A—- C:\WINDOWS\system32\xactengine2_5.dll
2008-10-03 11:26:21 —-A—- C:\WINDOWS\system32\xactengine2_4.dll
2008-10-03 11:26:21 —-A—- C:\WINDOWS\system32\x3daudio1_1.dll
2008-10-03 11:26:21 —-A—- C:\WINDOWS\system32\d3dx9_32.dll
2008-10-03 11:26:20 —-A—- C:\WINDOWS\system32\xinput1_2.dll
2008-10-03 11:26:20 —-A—- C:\WINDOWS\system32\xactengine2_3.dll
2008-10-03 11:26:20 —-A—- C:\WINDOWS\system32\d3dx9_31.dll
2008-10-03 11:26:19 —-A—- C:\WINDOWS\system32\xinput1_1.dll
2008-10-03 11:26:19 —-A—- C:\WINDOWS\system32\xactengine2_2.dll
2008-10-03 11:26:19 —-A—- C:\WINDOWS\system32\xactengine2_1.dll
2008-10-03 11:26:08 —-A—- C:\WINDOWS\system32\xactengine2_0.dll
2008-10-03 11:26:08 —-A—- C:\WINDOWS\system32\x3daudio1_0.dll
2008-10-03 11:26:08 —-A—- C:\WINDOWS\system32\d3dx9_30.dll
2008-10-03 11:26:06 —-A—- C:\WINDOWS\system32\d3dx9_29.dll
2008-10-03 11:26:06 —-A—- C:\WINDOWS\system32\d3dx9_28.dll
2008-10-03 11:26:05 —-A—- C:\WINDOWS\system32\xinput9_1_0.dll
2008-10-03 11:26:05 —-A—- C:\WINDOWS\system32\d3dx9_27.dll
2008-10-03 11:26:04 —-A—- C:\WINDOWS\system32\d3dx9_26.dll
2008-10-03 11:26:04 —-A—- C:\WINDOWS\system32\d3dx9_25.dll
2008-10-03 11:26:03 —-A—- C:\WINDOWS\system32\d3dx9_24.dll
2008-09-29 15:42:31 —-D—- C:\Programme\Pool Sharks
2008-09-22 13:30:17 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Magic Stones
2008-09-17 00:27:01 —-D—- C:\WINDOWS\system32\CatRoot_bak
2008-09-10 18:06:15 —-HDC—- C:\WINDOWS\$NtUninstallKB938464$
2008-09-10 12:36:07 —-D—- C:\Programme\Gemeinsame Dateien\Blizzard Entertainment

======List of files/folders modified in the last 1 months======

2008-10-09 17:03:01 —-D—- C:\WINDOWS\Prefetch
2008-10-09 17:01:24 —-D—- C:\Programme\Mozilla Firefox
2008-10-09 17:01:20 —-SHD—- C:\WINDOWS\Installer
2008-10-09 16:44:11 —-D—- C:\WINDOWS\Temp
2008-10-09 16:43:55 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\OpenOffice.org2
2008-10-09 16:40:16 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-10-09 16:32:27 —-D—- C:\WINDOWS\system32\drivers
2008-10-09 16:32:27 —-D—- C:\WINDOWS\system32
2008-10-08 21:51:38 —-D—- C:\Programme\AntiVir PersonalEdition Classic
2008-10-08 21:51:25 —-D—- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
2008-10-08 19:46:37 —-D—- C:\WINDOWS\system32\CatRoot2
2008-10-08 15:22:46 —-D—- C:\Programme\DAEMON Tools Toolbar
2008-10-08 15:21:59 —-D—- C:\Programme\Java
2008-10-07 09:39:32 —-D—- C:\WINDOWS
2008-10-05 21:55:03 —-D—- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\StorageIT
2008-10-03 18:22:04 —-RD—- C:\Programme
2008-10-03 17:04:34 —-RSH—- C:\boot.ini
2008-10-03 17:04:34 —-A—- C:\WINDOWS\win.ini
2008-10-03 17:04:34 —-A—- C:\WINDOWS\system.ini
2008-10-03 16:54:20 —-D—- C:\Dokumente und Einstellungen
2008-10-03 12:35:12 —-HD—- C:\WINDOWS\inf
2008-10-03 12:30:37 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\uTorrent
2008-10-03 11:26:38 —-D—- C:\WINDOWS\system32\DirectX
2008-10-03 11:26:19 —-RSD—- C:\WINDOWS\assembly
2008-10-03 11:20:13 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Adobe
2008-10-02 16:44:00 —-A—- C:\WINDOWS\NeroDigital.ini
2008-10-02 16:42:47 —-D—- C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\dvdcss
2008-09-24 10:37:36 —-A—- C:\WINDOWS\system32\CmdLineExt.dll
2008-09-24 10:34:29 —-HD—- C:\Programme\InstallShield Installation Information
2008-09-17 00:38:38 —-D—- C:\WINDOWS\system32\CatRoot
2008-09-17 00:27:01 —-D—- C:\WINDOWS\Debug
2008-09-10 18:06:16 —-D—- C:\WINDOWS\WinSxS
2008-09-10 18:06:11 —-HD—- C:\WINDOWS\$hf_mig$
2008-09-10 12:36:07 —-D—- C:\Programme\Gemeinsame Dateien

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-02 43520]
R1 avgio;avgio; \??\C:\Programme\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-07-18 75072]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2008-10-09 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2008-10-09 24208]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 NVTCP;NVIDIA TCP/IP Protocol Driver; C:\WINDOWS\System32\DRIVERS\NVTcp.sys [2006-04-14 101888]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 acedrv11;acedrv11; \??\C:\WINDOWS\system32\drivers\acedrv11.sys []
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-04-01 278984]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2007-10-07 25416]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-01-24 4127488]
R3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304]
R3 amdtools;AMD Special Tools Driver; C:\WINDOWS\system32\DRIVERS\amdtools.sys [2007-08-14 34304]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]
R3 avgntflt;avgntflt; \??\C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-01-23 34576]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-01-23 33296]
R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2007-01-23 28176]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART-Treiber; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-04-14 34176]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-04-14 13056]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2004-04-01 10368]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2005-04-12 10144]
R3 WmXlCore;Logitech WingMan Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2005-04-12 45504]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568]
S2 vnccom;vnccom; C:\WINDOWS\System32\Drivers\vnccom.SYS [2004-06-26 6016]
S3 abokkbmq;abokkbmq; C:\WINDOWS\system32\drivers\abokkbmq.sys []
S3 catchme;catchme; \??\C:\DOKUME~1\kurtl\LOKALE~1\Temp\catchme.sys []
S3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 nm;Netzwerkmonitortreiber; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 nvax;Service for NVIDIA® nForce™ Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2005-07-26 53376]
S3 nvnforce;Service for NVIDIA® nForce™ Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2005-07-26 415360]
S3 RTCore32;RTCore32; \??\F:\Programme\RMClock\RTCore32.sys []
S3 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2008-04-15 21248]
S3 usbsermpt;Motorola USB Modem Driver for MPT; C:\WINDOWS\system32\DRIVERS\usbsermpt.sys [2008-08-25 22768]
S3 vncdrv;vncdrv; C:\WINDOWS\system32\DRIVERS\vncdrv.sys [2004-06-26 4736]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2005-04-12 5600]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Adobe Version Cue CS2;Adobe Version Cue CS2; F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [2005-04-06 163840]
R2 AntiVirScheduler;AntiVir PersonalEdition Classic Planer; C:\Programme\AntiVir PersonalEdition Classic\sched.exe [2008-07-18 68865]
R2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Programme\AntiVir PersonalEdition Classic\avguard.exe [2008-08-17 149761]
R2 cmdAgent;COMODO Firewall Pro Helper Service; F:\Programme\COMODO\Firewall\cmdagent.exe [2008-10-09 519936]
R2 FileZilla Server;FileZilla Server FTP server; f:\Programme\FileZilla Server\FileZilla Server.exe [2007-02-27 584192]
R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2005-12-21 139264]
R2 ForcewareWebInterface;Forceware Web Interface; C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2005-09-23 20543]
R2 LicCtrlService;LicCtrl Service; C:\WINDOWS\runservice.exe [2008-01-24 2560]
R2 nSvcIp;ForceWare IP service; C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2005-12-21 127035]
R2 nSvcLog;ForceWare user log service; C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2005-12-21 61503]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2007-09-11 66872]
R2 StorageItService;StorageItService; F:\Programme\StorageIT 2007\StorageItService.exe [2008-07-30 427520]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 Venturi2;Venturi2 Client; C:\Program Files\Venturi2\Client\ventc.exe [2002-07-18 868352]
R2 winvnc;VNC Server; f:\Programme\UltraVNC\WinVNC.exe [2006-06-18 712704]
S3 Adobe LM Service;Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-03-04 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Programme\WinPcap\rpcapd.exe [2005-08-02 86016]

—————–EOF—————–





info.txt logfile of random's system information tool 1.04 2008-10-09 17:04:37

======Uninstall list======

–>msiexec /I {236BB7C4-4419-42FD-0407-1E257A25E34D}
–>msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
–>msiexec /I{7F4C8163-F259-49A0-A018-2857A90578BC}
–>MsiExec /X{7032E73F-68A0-48F9-8100-E70E79169BAE}
–>MsiExec.exe /X{69495273-FCDC-4A86-BCB7-49B504D3FB0E}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Bridge 1.0–>MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000103}
Adobe Common File Installer–>MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101}
Adobe Creative Suite 2–>C:\PROGRA~1\INSTAL~1\{0134A~1\setup.exe /relaunched/rootloc=g:\adobe creative suite 2.0/lang=0407
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0–>MsiExec.exe /I{E9787678-119F-4D52-B551-6739B2B22101}
Adobe Shockwave Player–>C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe Stock Photos 1.0–>MsiExec.exe /I{EE0D5DCD-2B97-4473-98DF-E93C0BD92F7A}
Adobe SVG Viewer 3.0–>C:\Programme\Gemeinsame Dateien\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Programme\Gemeinsame Dateien\Adobe\SVG Viewer 3.0\Uninstall\Install.log
AGEIA PhysX v6.12.02–>MsiExec.exe /X{7032E73F-68A0-48F9-8100-E70E79169BAE}
AMD CPUInfo–>MsiExec.exe /X{C6783FB4-2E95-4ED0-8A32-1BF32821689F}
AMD Power Monitor–>MsiExec.exe /X{EA1A669B-302B-4E6E-BD23-FA5572A7A85C}
AsusUpdate–>C:\WINDOWS\IsUninst.exe -ff:\Programme\ASUS\AsusUpdate\Uninst.isu
Avira AntiVir Personal - Free Antivirus–>C:\Programme\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
BaboViolent 2.11–>"e:\Programme\RndLabs\BaboViolent 2\unins000.exe"
Battlefield 2™–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x9 -removeonly
Battlefield 2: Special Forces–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{50D4CB89-AF34-4978-96DC-C3034062E901}\setup.exe" -l0x9 -removeonly
Broken Crescent–>E:\Programme\SEGA\Medieval II Total War\bcuinst.exe
CCleaner (remove only)–>"f:\Programme\CCleaner\uninst.exe"
CDBurnerXP Pro 3–>MsiExec.exe /I{896D642C-7125-44F0-AC49-A23ABF82209C}
CDDRV_Installer–>MsiExec.exe /I{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}
COMODO Firewall Pro–>F:\Programme\Comodo\Firewall\cfpconfg.exe -u
Discworld II–>C:\WINDOWS\uninst.exe -f"e:\Programme\Discworld II\DeIsL1.isu"
DivX Content Uploader–>C:\Programme\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Web Player–>C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Drakensang–>"e:\Programme\Drakensang\unins000.exe"
Dual-Core Optimizer–>MsiExec.exe /X{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}
DVD Shrink 3.2–>"f:\Programme\DVD Shrink\unins000.exe"
EA SPORTS™ NBA LIVE 08–>MsiExec.exe /X{39C8EFBA-042B-11DC-A860-0EE955D89593}
Fenimore Fillmore's Revenge–>e:\Programme\Nobilis\Revenge\Uninstall.exe
FileZilla (remove only)–>"f:\Programme\FileZilla\uninstall.exe"
FileZilla Server (remove only)–>"f:\Programme\FileZilla Server\uninstall.exe"
Football Manager 2008–>"e:\Programme\Sports Interactive\Football Manager 2008\Uninstall_Football Manager 2008\Uninstall Football Manager 2008.exe"
Fourelle Venturi Personal Client 2.1.1–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{9C59FA2E-EEDA-41FA-90AC-F8FCBD032E85}\Setup.exe" -l0x9
Geheimakte 2 - Puritas Cordis–>C:\Programme\InstallShield Installation Information\{BE7347AD-2D93-4A74-8DBF-C1B073DAE509}\setup.exe -runfromtemp -l0x0007 -removeonly
GetDataBack for NTFS–>"f:\Programme\Runtime Software\GetDataBack for NTFS\Uninstall.exe" "f:\Programme\Runtime Software\GetDataBack for NTFS\install.log" -u
GPRO Organiser–>MsiExec.exe /I{DC2B8A9A-1EEC-4C00-A57F-13A97C158CBE}
Hard to be a God–>"e:\Programme\Nobilis\Hard to be a God\unins000.exe"
HijackThis 2.0.2–>"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix für Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Impulse–>"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{1EB63B4B-5639-4477-8E24-05C31B5F8019}\Impulse_setup.exe" REMOVE=TRUE MODIFY=FALSE
Impulse–>C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{1EB63B4B-5639-4477-8E24-05C31B5F8019}\Impulse_setup.exe
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
KhalSetup–>MsiExec.exe /I{C89C8D86-4423-4A58-AA40-DD259ACE07C1}
King's Bounty. The Legend (Remove Only)–>"F:\Programme\Atari\King's Bounty. The Legend\unins000.exe"
Logitech Gaming Software–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{5C1DA723-24FC-48AD-93BA-925695C3EF26}\setup.exe" -l0x9 -removeonly
Logitech SetPoint–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x7 -removeonly
Machine Check Analysis Tool–>MsiExec.exe /X{B23DD567-8CFF-40FF-A47C-6508D15986A0}
Magic Stones–>e:\Programme\Magic Stones\Uninstal.exe
Malwarebytes' Anti-Malware–>"f:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Malwarebytes' RogueRemover–>"f:\Programme\RogueRemover FREE\unins000.exe"
Marvell Miniport Driver–>MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Medieval II Total War : Kingdoms : Americas–>C:\Programme\InstallShield Installation Information\{75983B66-804C-40D1-BA13-64DAF652A6F1}\setup.exe -runfromtemp -l0x0009 -removeonly
Medieval II Total War : Kingdoms : Britannia–>C:\Programme\InstallShield Installation Information\{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}\setup.exe -runfromtemp -l0x0009 -removeonly
Medieval II Total War : Kingdoms : Crusades–>C:\Programme\InstallShield Installation Information\{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}\setup.exe -runfromtemp -l0x0009 -removeonly
Medieval II Total War : Kingdoms : Teutonic–>C:\Programme\InstallShield Installation Information\{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}\setup.exe -runfromtemp -l0x0009 -removeonly
Medieval II Total War–>C:\Programme\InstallShield Installation Information\{C0698BDA-0D29-40EE-8570-A31106DF9AB1}\setup.exe -runfromtemp -l0x0009 -removeonly
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual J# .NET Redistributable Package 1.1–>MsiExec.exe /X{1A655D51-1423-48A3-B748-8F5A0BE294C8}
Microsoft Windows Media Video 9 VCM–>RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall
Mozilla Firefox (2.0.0.17)–>C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.17)–>F:\Programme\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MySQL Connector/ODBC 3.51–>MsiExec.exe /I{0CB3C535-1171-4A20-B549-E2CB5DEB9723}
Nero 6 Ultra Edition–>f:\Programme\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NHL® 08–>MsiExec.exe /X{A7AA93B6-6909-4073-B4EC-45CCDEFD4665}
No-IP.com DUC (remove only)–>"C:\Programme\No-IP\DUC20.exe" -uninstall
NVIDIA Drivers–>C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA ForceWare Network Access Manager–>C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1031
NvMixer–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{D7A6C517-11F2-419F-B5BB-27772B939698}\Setup.exe" -uninstall
OpenOffice.org 2.1–>MsiExec.exe /I{8FB1A5EA-7DA8-4D57-80FB-BD923CCCC852}
PC Inspector File Recovery–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}\Setup.exe" -l0x7
Pool Sharks–>MsiExec.exe /I{3D89C3F7-3448-4E34-A976-FDBBA897EFA0}
Pro Evolution Soccer 2008–>C:\Programme\InstallShield Installation Information\{2FDFD600-7338-4738-90D5-FC4ACA08DC36}\setup.exe -runfromtemp -l0x0409
Project Reality 0.75 Core–>"e:\Programme\EA GAMES\Battlefield 2\unins000.exe"
ProtectDisc Driver, Version 11–>C:\Programme\ProtectDisc Driver Installer\uninstall_v11.exe
Railroad Tycoon 3–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{DE29025A-091F-4998-AD2D-24C84421190F}\setup.exe" -l0x9
Realtek AC'97 Audio–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x7 -removeonly
Sicherheitsupdate für Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Sicherheitsupdate für Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950749)–>"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950759)–>"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953838)–>"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sid Meier's Civilization 4 - Warlords–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{3E4B349F-10B5-4586-9D99-489A90A8B228}\setup.exe" -l0x7 -removeonly
Sid Meier's Civilization 4–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe" -l0x9 -removeonly
Sid Meier's Civilization IV Colonization–>C:\Programme\InstallShield Installation Information\{EF36A836-BF89-4A4F-B079-057B0C68C1E0}\setup.exe -runfromtemp -l0x0009 -removeonly
Silent Storm–>RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{D219BE4E-4B67-4354-AB10-3EF90A0CC883}\setup.exe" -l0x9
Skype™ 3.5–>MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SpeedFan (remove only)–>"f:\Programme\SpeedFan\uninstall.exe"
SPMT–>MsiExec.exe /I{5AB8B89F-CBC8-4768-962A-205AF6670AE5}
Spybot - Search & Destroy 1.5.2.20–>"C:\WINDOWS\unins000.exe"
Spybot - Search & Destroy–>"f:\Programme\Spybot - Search & Destroy\unins000.exe"
StorageIT 2007–>MsiExec.exe /X{1376A8A7-DC56-4146-96F1-7330FE324FC1}
StuffIt Expander–>MsiExec.exe /X{57DC8980-73DA-481E-AFD4-5E2D44B7F1AD}
Suite Specific–>MsiExec.exe /I{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}
System Requirements Lab–>C:\Programme\SystemRequirementsLab\Uninstall.exe
TmNationsForever–>"e:\Programme\TmNationsForever\unins000.exe"
Trillian–>f:\Programme\Trillian\trillian.exe /uninstall
Typograf4.8f–>f:\Programme\Typograf\Uninstal.exe "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Typograf"
UltraVNC v1.0.2–>"f:\Programme\UltraVNC\unins000.exe"
Update für Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
VideoLAN VLC media player 0.8.6a–>F:\Programme\VLC\uninstall.exe
Warcraft III–>C:\Programme\Gemeinsame Dateien\Blizzard Entertainment\Warcraft III\Uninstall.exe
WC3Banlist–>"f:\Programme\WC3Banlist\unins000.exe"
Winamp (remove only)–>"f:\Programme\Winamp\UninstWA.exe"
Windows Media Format Runtime–>"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10–>"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)–>C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_C710CEED791003E4D635992B02471584893356A0\amdk8.inf
WinPcap 3.1–>C:\Programme\WinPcap\uninstall.exe
WinRAR Archivierer–>f:\Programme\WinRAR\uninstall.exe
WinUHA 2.0 RC1 (2005.02.27)–>f:\Programme\WinUHA\unins000.exe

=====HijackThis Backups=====

O21 - SSODL: onfwbsak - {31597EA0-A0E3-4B8A-B80C-735CADB2776B} - (no file)
O21 - SSODL: rwlfsdmk - {29E4ACCE-2097-4DE7-A063-38AD23B30942} - (no file)
O21 - SSODL: onfwbsak - {31597EA0-A0E3-4B8A-B80C-735CADB2776B} - (no file)
O21 - SSODL: rwlfsdmk - {29E4ACCE-2097-4DE7-A063-38AD23B30942} - (no file)
O21 - SSODL: rwlfsdmk - {29E4ACCE-2097-4DE7-A063-38AD23B30942} - (no file)
O21 - SSODL: onfwbsak - {31597EA0-A0E3-4B8A-B80C-735CADB2776B} - (no file)

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: Avira AntiVir PersonalEdition
FW: ActiveArmor Firewall
FW: COMODO Firewall Pro

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\Gemeinsame Dateien\Adobe\AGL;F:\Programme\AMD\MCat\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 43 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=2b01
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

—————–EOF—————–





Currentl letting Panda scan my PC - during said scan my AntiVir Guard came up with another pop up (interrupting the scan) claiming to have found a trojan called TR/Agent.AFRN.2 on my drive C: in a file called Player.exe. I chose "Deny Access" in order to continue the scan. The scan is completed 10% and shows 67 infected files after said pop up. Once the scan is complete I will post the log and the new HJT log in my next reply.
Post #27
jp, just wanted to let you know that I will have to leave for now and will post any results later tonight or tomorrow in the morning. Thank you again for your time and your energy. So far the AntiVir Guard has popped up several more times with all sorts of TR/… related warnings (as in my listing in the first post)… my short euphoria after your great idea and advice with MoveIt has since left me again but maybe we are halfway there at least. Let's see what the log files will show. Again, thank you for all the effort so far!
Post #28
;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2008-10-09 19:42:12 PROTECTIONS: 1 MALWARE: 34 SUSPECTS: 1 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== Avira AntiVir PersonalEdition 8.0.1.27 Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.doubleclick.net/] 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.atdmt.com/] 00139535 Application/Processor HackTools No 0 Yes No C:\SDFix\apps\Process.exe 00139535 Application/Processor HackTools No 0 No No C:\Dokumente und Einstellungen\kurtl\Desktop\SDFix.exe[C:\Dokumente und Einstellungen\kurtl\Desktop\SDFix.exe][SDFix\apps\Process.exe] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tradedoubler.com/] 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tradedoubler.com/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.fastclick.net/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tribalfusion.com/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tribalfusion.com/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tribalfusion.com/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.tribalfusion.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.mediaplex.com/] 00145792 Cookie/SexList TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.sexlist.com/] 00147036 Cookie/Adverserve TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adverserve.net/] 00147036 Cookie/Adverserve TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adverserve.net/] 00147036 Cookie/Adverserve TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adverserve.net/] 00147036 Cookie/Adverserve TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adverserve.net/] 00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.ccbill.com/] 00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.ccbill.com/] 00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.ccbill.com/] 00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.ccbill.com/] 00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.ccbill.com/] 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.com.com/] 00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.yadro.ru/] 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.xiti.com/] 00167724 Cookie/HotLog TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.hotlog.ru/] 00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.toplist.cz/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.statcounter.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[ad.yieldmanager.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.serving-sys.com/] 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.serving-sys.com/] 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.bs.serving-sys.com/] 00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adtech.de/] 00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adtech.de/] 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[server.iad.liveperson.net/hc/36042171] 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[server.iad.liveperson.net/hc/39834797] 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[server.iad.liveperson.net/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.zedo.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adultfriendfinder.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adultfriendfinder.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adultfriendfinder.com/] 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.adultfriendfinder.com/] 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.smartadserver.com/] 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.smartadserver.com/] 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[.smartadserver.com/] 00286734 Cookie/Adserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[adserver.filefront.com/] 00286734 Cookie/Adserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[adserver.filefront.com/] 00286734 Cookie/Adserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[adserver.filefront.com/] 00286734 Cookie/Adserver TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Mozilla\Firefox\Profiles\uluw17sp.default\cookies.txt[adserver.filefront.com/] 02887700 W32/Tenga.A Virus No 0 Yes No D:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP556\A0176481.exe 02887700 W32/Tenga.A Virus No 0 Yes No D:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP556\A0176482.exe 03267490 Trj/Downloader.MDW Virus/Trojan No 1 Yes No E:\Programme\Tropix 2 - The Quest For the Golden Banana\Uninstall.exe 03738686 Generic Malware Virus/Trojan No 0 No No C:\Dokumente und Einstellungen\kurtl\Desktop\SDFix.exe[C:\Dokumente und Einstellungen\kurtl\Desktop\SDFix.exe][SDFix\catchme.exe] 03738686 Generic Malware Virus/Trojan No 0 Yes No C:\SDFix\apps\Cghtme.exe 03738686 Generic Malware Virus/Trojan No 0 No No C:\Dokumente und Einstellungen\kurtl\Desktop\SDFix.exe[C:\Dokumente und Einstellungen\kurtl\Desktop\SDFix.exe][SDFix\apps\Cghtme.exe] 03738686 Generic Malware Virus/Trojan No 0 Yes No C:\SDFix\catchme.exe 03790290 Adware/VapSup Adware No 0 Yes No C:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP550\A0175195.exe 03790292 Adware/VapSup Adware No 0 Yes No C:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP550\A0175184.exe 03790299 Adware/VapSup Adware No 0 Yes No C:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP550\A0175182.exe 03807072 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP550\A0175193.exe 03807466 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\WINDOWS\system32\YURD2.exe 03807466 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{B56C211D-FB1A-47A3-9B4A-2F0E60E4202B}\RP550\A0175194.exe 03809105 Generic Trojan Virus/Trojan No 0 Yes No C:\_OTMoveIt\MovedFiles\10092008_155820\onfwbsak.dll ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location Q( ;=============================================================================== ================================================================================= =================== No C:\Dokumente und Einstellungen\kurtl\Anwendungsdaten\Adobe\Player.exe Q( ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description Q( ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== And the new HJT log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:44:58, on 09.10.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe F:\Programme\COMODO\Firewall\cmdagent.exe f:\Programme\FileZilla Server\FileZilla Server.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\runservice.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe F:\Programme\StorageIT 2007\StorageItService.exe C:\Program Files\Venturi2\Client\ventc.exe f:\Programme\UltraVNC\WinVNC.exe C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe C:\WINDOWS\SOUNDMAN.EXE F:\Darkfix.exe F:\Programme\StorageIT 2007\StorageItAgent.exe C:\Programme\Java\jre1.6.0_07\bin\jusched.exe F:\Programme\COMODO\Firewall\cfp.exe F:\Programme\DAEMON Tools Lite\daemon.exe C:\Programme\No-IP\DUC20.exe F:\Programme\OpenOffice.org 2.1\program\soffice.exe F:\Programme\OpenOffice.org 2.1\program\soffice.BIN F:\Programme\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Programme\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [WinVNC] "f:\Programme\UltraVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe Version Cue CS2] "F:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Gamma] F:\Darkfix.exe -silent O4 - HKLM\..\Run: [SitAgent] F:\Programme\StorageIT 2007\StorageItAgent.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Programme\COMODO\Firewall\cfp.exe" -h O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\Programme\DAEMON Tools Lite\daemon.exe" -autorun O4 - Startup: No-IP DUC.lnk = C:\Programme\No-IP\DUC20.exe O4 - Startup: OpenOffice.org 2.1.lnk = F:\Programme\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ? O4 - Global Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://F:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{0CEF587A-542B-47FF-AC75-3D5745A29020}: NameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{C799A3B1-E9CE-4FB1-B181-2D3870F85A62}: NameServer = 192.168.0.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - F:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - F:\Programme\COMODO\Firewall\cmdagent.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - f:\Programme\FileZilla Server\FileZilla Server.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe O23 - Service: StorageItService - Storage IT Oy - F:\Programme\StorageIT 2007\StorageItService.exe O23 - Service: Venturi2 Client (Venturi2) - Fourelle Systems, Inc - C:\Program Files\Venturi2\Client\ventc.exe O23 - Service: VNC Server (winvnc) - UltraVNC - f:\Programme\UltraVNC\WinVNC.exe – End of file - 9208 bytes I will keep my fingers crossed now… at least those weird .dll files seem to be gone for good. :)
Post #29
Hi :)

Before the next fix, just a couple of things to do/think about.

Please download FileLook by jpshortstuff from one of these mirrors:
Link 1
Link 2
  • Double-click FileLook.exe to run it.
  • Ensure that the BBCode Ouput checkbox is checked.
  • Copy the content of the following codebox into the main textfield:

    C:\WINDOWS\system32\drivers\abokkbmq.sys
  • Click the FileLook button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found at C:\fl_log.txt


Note that both Panda and Kaspersky have flagged that Tropix program as a virus. Now I can't tell you to get rid of it, it is entirely your choice. Panda secified it as a Downloader. This means that if it is indeed a virus, it usually wouldn't give you any symptoms. It's job would be to download other malware onto your machine. You mentioned that there was a time gap inbetween this program being installed and malware symptoms - if it's a downloader, then yeah, there would be.

If you want more opinions, go to this website:
http://virusscan.jotti.org
And have it scan this file:
F:\Torrents\Tropix 2\Tropix 2.exe

If it is a downloader, we're gonna have a pretty hard time cleaning the machine since the malware is likely to keep coming back. Just a heads up ;)

After you post the FileLook log we'll see if we can get the last of whats I can see. If that still doesn't help, we may have to look deeper, or use bigger guns ;)

Thanks,

-jp
Post #30 last edited

FileLook by jpshortstuff



Oooh, your very own program used on my problem - now who should feel more honoured, you or me? Alright, obviously me. :)
Here is the result:

FileLook.exe v1.0 by jpshortstuff
Log created at 19:39:01 on 09/10/2008

==============================
FileLook - abokkbmq.sys

Filename: abokkbmq.sys
Path: C:\WINDOWS\system32\drivers\
Created: 03:00:00 on 04/08/2004
Modified: 03:00:00 on 04/08/2004
Size: 95360 bytes
Attributes: Archive
————————-

==============================

=EOF=



By the way, that program is by jpshortstuff, really cool guy. ;)



Note that both Panda and Kaspersky have flagged that Tropix program as a virus. Now I can't tell you to get rid of it…


You don't have to tell me, I want it gone ;)
I am just not sure whether a simple delete action would do the trick so I will wait for you to give me the go ahead and let me know what I should do to effectively get rid of it. If my flatmate's heart is hung on it … tough luck. It is my PC after all and I do a lot of work on it that I don't want to jeopardise for some fun programs that he might like. And my guess is he played it once or twice and then forgot about it again anyway, he has a very short attention span and gets bored easily.

So yes, let's kick Tropix back where it came from. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI