Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win32/conhook.d


  • Please log in to reply
1 reply to this topic

#1 mhlukito

mhlukito

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:09:04 AM

Posted 10 April 2008 - 04:54 PM

Hello,
I really need some help. My new notebook is infected with this virus (conhook.d, tr vundo gen, or whatever it is) and it's really annoying. When I use Internet Explorer 7, the ads about antivirus, malware, spyware, etc. come out of nowhere. Even when I don't use IE7 (I always use Mozilla Firefox) it come out, but not so often. Oh yeah, I use Windows Vista Home Premium.
If someone can help me, please, explain to me slowly, I'm pretty slow about computer.

Information from DSS:

from main.txt

Deckard's System Scanner v20071014.68
Run by Martin on 2008-04-10 23:24:24
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 3 Restore Point(s) --
3: 2008-04-10 20:59:37 UTC - RP104 - Windows Defender Checkpoint
2: 2008-04-10 18:23:22 UTC - RP101 - Windows Defender Checkpoint
1: 2008-04-10 17:44:00 UTC - RP99 - Windows Defender Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Martin.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:28:35, on 10.04.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Martin\Desktop\dss.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Martin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {ED7CCC2E-0E96-4403-B370-2E903EC3C9BC} - C:\Users\Martin\AppData\Local\Temp\geBsrOHb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [f6a4059f] rundll32.exe "C:\Windows\system32\yknanxxa.dll",b
O4 - HKLM\..\Run: [BMf5973603] Rundll32.exe "C:\Windows\system32\ldodfose.dll",s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\windows sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Martin\AppData\Local\Temp\geBsrOHb.dll,c
O4 - HKCU\..\Run: [f6a4059f] rundll32.exe "C:\Windows\system32\yknanxxa.dll",b
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Martin\AppData\Local\Temp\lraamtcn.dll",run
O4 - HKCU\..\Run: [BMf5973603] Rundll32.exe "C:\Users\Martin\AppData\Local\Temp\igtjyvmq.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Program Files\Common Files\AVM\de_serv.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\Windows\SYSTEM32\VundoFixSVC.exe

--
End of file - 9123 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AVM IGD CTRL Service - c:\program files\fritz!dsl\igdctrl.exe <Not Verified; AVM Berlin; AVM IGD Service>
R2 RegSrvc (Intel® PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel® PROSet/Wireless Registry Service>
R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter

S3 de_serv (AVM FRITZ!web Routing Service) - c:\program files\common files\avm\de_serv.exe <Not Verified; AVM Berlin; AVM Rocky>
S3 VundoFixSvc (VundoFix Service) - vundofixsvc.exe <Not Verified; Atribune.org; Vundofix Service>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-04-10 20:37:23 420 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{BD99F957-F934-49B3-8099-5F1DA1E8DA5E}.job


-- Files created between 2008-03-10 and 2008-04-10 -----------------------------

2008-04-10 23:28:20 0 d-------- C:\Program Files\Trend Micro
2008-04-10 19:24:28 0 d-------- C:\VundoFix Backups
2008-04-10 02:16:21 0 d-------- C:\Program Files\AceMoney
2008-04-10 01:04:32 0 d-------- C:\Program Files\Microsoft Small Business
2008-04-10 00:59:57 0 d-------- C:\Windows\PCHEALTH
2008-04-10 00:59:49 0 d-------- C:\Program Files\Microsoft SQL Server
2008-04-10 00:36:30 0 d-------- C:\Program Files\OpenOffice.org 2.4
2008-04-09 18:22:12 17860 --a------ C:\Windows\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
2008-04-09 01:11:25 0 d-------- C:\Program Files\Microsoft Silverlight
2008-04-08 17:31:52 0 -rahs---- C:\MSDOS.SYS
2008-04-08 17:31:52 0 -rahs---- C:\IO.SYS
2008-04-08 17:12:15 0 d-------- C:\Windows\Downloaded Installations
2008-04-08 16:59:02 24576 --a------ C:\Windows\system32\VundoFixSVC.exe <Not Verified; Atribune.org; Vundofix Service>
2008-04-08 15:07:54 83520 -----n--- C:\Windows\system32\yknanxxa.dll
2008-04-08 15:04:59 3648 --a------ C:\Windows\system32\jxqeogen.dll
2008-04-08 15:04:53 88640 --a------ C:\Windows\system32\ldodfose.dll
2008-04-07 22:00:34 147456 --a------ C:\VundoFix.exe <Not Verified; Atribune.org; VundoFix>
2008-04-07 19:36:33 0 d-------- C:\Program Files\Windows Live Safety Center
2008-04-04 15:57:58 0 d-------- C:\QUARANTINE
2008-04-03 22:23:11 0 d-------- C:\Program Files\Yahoo!
2008-03-31 20:43:15 0 d-------- C:\Program Files\Common Files\Adobe
2008-03-24 16:03:43 3173 --a------ C:\Windows\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
2008-03-24 16:02:53 3050 --a------ C:\Windows\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat
2008-03-24 16:01:03 167936 --a------ C:\Windows\system32\SpoonUninstall.exe
2008-03-24 16:00:59 0 d-------- C:\Program Files\dBpoweramp
2008-03-20 00:52:09 0 d-------- C:\Program Files\Common Files\xing shared
2008-03-20 00:51:27 0 d-------- C:\Program Files\Common Files\Real
2008-03-20 00:51:25 0 d-------- C:\Program Files\Real
2008-03-19 22:36:05 0 d-------- C:\Users\Martin\Application Data
2008-03-19 22:36:05 0 d-------- C:\Users\Martin\Application Data\deskUNPDF
2008-03-19 12:51:19 31232 --a------ C:\Windows\system32\i2errDeu.dll <Not Verified; AVM Berlin GmbH; I2ERR>
2008-03-19 12:51:18 367104 --a------ C:\Windows\system32\drivers\Netfwdsl.sys <Not Verified; AVM Berlin; AVM FRITZ!web>
2008-03-19 12:51:18 11264 --a------ C:\Windows\system32\drivers\NETDSL.SYS <Not Verified; Microsoft Corporation; AVM DSL Products>
2008-03-19 12:51:18 28160 --a------ C:\Windows\system32\drivers\Aadev.sys <Not Verified; AVM Berlin; AVM ADSL Adapter Device>
2008-03-19 12:51:14 0 d-------- C:\Program Files\FRITZ!DSL
2008-03-19 12:51:14 0 d-------- C:\Program Files\Common Files\AVM
2008-03-19 12:51:11 16896 -ra------ C:\Windows\system32\avmprmon.dll <Not Verified; AVM Berlin GmbH; avmprmon Dynamic Link Library>
2008-03-19 12:51:11 53760 -ra------ C:\Windows\system32\avmadd32.dll <Not Verified; AVM GmbH; AVM avmadd32>
2008-03-19 12:51:06 0 d-------- C:\Program Files\FRITZ!Box
2008-03-19 12:51:04 328704 --a------ C:\Windows\IsUn0407.exe <Not Verified; InstallShield Software Corporation; InstallShield® Deinstaller>
2008-03-19 02:35:19 0 d-------- C:\Program Files\QuickTime
2008-03-18 23:12:11 0 d-------- C:\Program Files\Pcsx2_0.9.4
2008-03-18 22:00:53 0 d-------- C:\Program Files\7-Zip
2008-03-18 21:11:29 0 d-------- C:\Program Files\EA GAMES
2008-03-18 19:43:54 0 d-------- C:\Program Files\CDisplay
2008-03-18 17:20:19 442368 -ra------ C:\Windows\system32\vp6vfw.dll <Not Verified; On2.com; On2_VP6>
2008-03-18 17:15:55 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-03-18 16:29:26 0 d-------- C:\Program Files\Winamp
2008-03-18 16:19:46 0 d-------- C:\Program Files\Trillian
2008-03-18 16:14:57 0 d-------- C:\Program Files\LowRateVoip
2008-03-18 16:07:58 0 d-------- C:\Program Files\Stellarium
2008-03-18 16:02:30 0 d-------- C:\Program Files\Azureus
2008-03-18 16:00:40 0 d-------- C:\Age.of.Mythology.and.Titans.PCCD.[GaMesFive.NeT]
2008-03-18 15:59:56 717296 --a------ C:\Windows\system32\drivers\sptd.sys
2008-03-18 15:30:29 0 d-------- C:\Program Files\The KMPlayer
2008-03-18 15:13:50 1495552 --a------ C:\Windows\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk>
2008-03-18 15:13:50 0 d-------- C:\Program Files\Common Files\Cisco Systems
2008-03-18 15:05:58 0 --a------ C:\Windows\nsreg.dat
2008-03-18 15:05:27 0 d-------- C:\Program Files\Netscape
2008-03-18 14:50:35 0 d-------- C:\Users\Martin\Bluetooth Software
2008-03-18 14:49:46 0 dr------- C:\Users\Martin\Searches
2008-03-18 14:49:35 0 dr------- C:\Users\Martin\Contacts
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Vorlagen
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Videos
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Startmenü
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\SendTo
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Saved Games
2008-03-18 14:48:38 0 d-------- C:\Users\Martin\Roaming
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Recent
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Pictures
2008-03-18 14:48:38 2883584 --ahs---- C:\Users\Martin\NTUSER.DAT
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Netzwerkumgebung
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Music
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Lokale Einstellungen
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Links
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Favorites
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Eigene Dateien
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Druckumgebung
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Downloads
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Documents
2008-03-18 14:48:38 0 dr------- C:\Users\Martin\Desktop
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Cookies
2008-03-18 14:48:38 0 d--h----- C:\Users\Martin\AppData
2008-03-18 14:48:38 0 d--hs---- C:\Users\Martin\Anwendungsdaten
2008-03-18 14:45:13 0 d--hs---- C:\Programme
2008-03-18 14:45:13 0 d--hs---- C:\Program Files\Gemeinsame Dateien
2008-03-18 14:45:13 0 d--hs---- C:\Dokumente und Einstellungen
2008-03-14 09:29:11 0 d-------- C:\Program Files\DellTPad
2008-03-14 09:16:52 0 d-------- C:\Windows\Users
2008-03-14 09:13:18 0 d-------- C:\doctemp
2008-03-14 09:11:24 0 d-------- C:\Windows\system32\oem
2008-03-14 09:11:23 0 d-------- C:\Drivers
2008-03-14 09:11:23 0 d-------- C:\DELL
2008-03-14 02:08:15 0 d-------- C:\Program Files\Common Files\McAfee
2008-03-14 02:08:05 0 d-------- C:\Program Files\McAfee
2008-03-14 02:07:42 0 d-------- C:\Program Files\Common Files\SureThing Shared
2008-03-14 02:06:10 0 d-------- C:\Program Files\Common Files\PX Storage Engine
2008-03-14 02:06:09 0 d-------- C:\Program Files\Common Files\Sonic Shared
2008-03-14 02:05:11 0 d-------- C:\Program Files\Common Files\Roxio Shared
2008-03-14 02:04:46 0 d-------- C:\Program Files\Roxio
2008-03-14 02:04:06 0 d-------- C:\Program Files\Microsoft Works
2008-03-14 02:01:22 0 d-------- C:\Program Files\CyberLink
2008-03-14 02:00:52 0 d-------- C:\Program Files\Dell Support Center
2008-03-14 02:00:51 0 d-------- C:\Program Files\Common Files\supportsoft
2008-03-14 01:57:12 229376 --a------ C:\Windows\system32\BtwRSupport.dll <Not Verified; Broadcom Corporation.; Bluetooth Software 6.0.1.3100>
2008-03-14 01:56:58 0 d-------- C:\Windows\system32\es-MX
2008-03-14 01:56:58 0 d-------- C:\Windows\system32\es-AR
2008-03-14 01:56:57 0 d-------- C:\Program Files\WIDCOMM
2008-03-14 01:52:36 126976 --a------ C:\Windows\system32\Imsmudlg.exe <Not Verified; Intel® Corporation; Uninstset Installation Utility>
2008-03-14 01:52:36 0 d-------- C:\Windows\system32\DEU
2008-03-14 01:52:01 76 -r-hs---- C:\Windows\CT4CET.bin
2008-03-14 01:51:41 0 d-------- C:\Documents and Settings
2008-03-14 01:51:25 0 d-------- C:\Program Files\Common Files\Reallusion
2008-03-14 01:50:40 0 d-------- C:\Program Files\Creative Live! Cam
2008-03-14 01:50:10 0 d-------- C:\Program Files\Dell
2008-03-14 01:49:59 0 d-------- C:\Program Files\Creative
2008-03-14 01:48:28 0 d-------- C:\Program Files\Protector Suite QL
2008-03-14 01:47:34 0 d-------- C:\Program Files\Intel, Inc
2008-03-14 01:46:57 0 d-------- C:\Program Files\Intel
2008-03-14 01:46:46 0 d-------- C:\Windows\java
2008-03-14 01:46:46 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-03-14 01:46:43 0 d-------- C:\Program Files\Common Files\InstallShield
2008-03-14 01:46:35 0 d-------- C:\Program Files\Java
2008-03-14 01:46:35 0 d-------- C:\Program Files\Common Files\Java
2008-03-14 01:46:31 0 d--hs---- C:\Windows\Installer
2008-03-14 01:46:30 0 d-------- C:\Windows\system32\Macromed
2008-03-14 01:36:40 12 --a------ C:\Windows\bthservsdp.dat
2008-03-14 01:35:39 0 d-------- C:\Windows\SoftwareDistribution
2008-03-14 01:35:23 0 d-------- C:\Program Files\Sigmatel
2008-03-14 01:34:19 0 d--hs---- C:\System Volume Information


-- Find3M Report ---------------------------------------------------------------

2008-04-10 22:56:51 54342 --a------ C:\Users\Martin\AppData\Roaming\nvModes.001
2008-04-10 19:13:01 0 d-------- C:\Users\Martin\AppData\Roaming\OpenOffice.org2
2008-04-10 16:36:34 641344 --a------ C:\Windows\system32\perfh007.dat
2008-04-10 16:36:34 116706 --a------ C:\Windows\system32\perfc007.dat
2008-04-10 00:41:53 0 d-------- C:\Users\Martin\AppData\Roaming\Download Manager
2008-04-09 23:22:37 1342 --a------ C:\Users\Martin\AppData\Roaming\wklnhst.dat
2008-04-09 14:26:32 0 d-------- C:\Program Files\Windows Mail
2008-04-08 00:24:27 0 d-------- C:\Users\Martin\AppData\Roaming\Azureus
2008-04-07 21:32:59 0 d-------- C:\Users\Martin\AppData\Roaming\Real
2008-04-07 01:53:51 54342 --a------ C:\Users\Martin\AppData\Roaming\nvModes.dat
2008-03-31 20:43:15 0 d-------- C:\Program Files\Common Files
2008-03-30 23:13:16 0 d-------- C:\Users\Martin\AppData\Roaming\Winamp
2008-03-24 16:01:04 0 d-------- C:\Users\Martin\AppData\Roaming\AccurateRip
2008-03-24 00:04:33 0 d-------- C:\Users\Martin\AppData\Roaming\Roxio
2008-03-20 15:51:06 0 d-------- C:\Users\Martin\AppData\Roaming\CyberLink
2008-03-19 21:49:13 0 d-------- C:\Users\Martin\AppData\Roaming\Template
2008-03-19 16:55:24 0 d-------- C:\Users\Martin\AppData\Roaming\FRITZ!
2008-03-19 13:14:58 0 d-------- C:\Users\Martin\AppData\Roaming\WinRAR
2008-03-19 01:31:49 0 d-------- C:\Users\Martin\AppData\Roaming\Stellarium
2008-03-18 20:49:28 0 d-------- C:\Users\Martin\AppData\Roaming\Mozilla
2008-03-18 19:11:08 0 d-------- C:\Users\Martin\AppData\Roaming\LowRateVoip
2008-03-18 17:16:51 0 d-------- C:\Users\Martin\AppData\Roaming\Intel
2008-03-18 16:49:54 0 d-------- C:\Users\Martin\AppData\Roaming\DAEMON Tools
2008-03-18 16:40:18 0 d-------- C:\Program Files\Windows Sidebar
2008-03-18 15:05:55 0 d-------- C:\Users\Martin\AppData\Roaming\Netscape
2008-03-18 14:58:18 0 d-------- C:\Users\Martin\AppData\Roaming\Adobe
2008-03-18 14:57:24 0 d-------- C:\Users\Martin\AppData\Roaming\Macromedia
2008-03-18 14:56:10 0 d-------- C:\Users\Martin\AppData\Roaming\Google
2008-03-18 14:49:37 0 d-------- C:\Users\Martin\AppData\Roaming\Identities
2008-03-18 14:45:13 0 d-------- C:\Program Files\Windows NT
2008-03-14 09:24:06 0 d-------- C:\Program Files\Windows Calendar
2008-03-14 09:20:54 0 d-------- C:\Program Files\Windows Defender
2008-03-14 01:37:15 174 --ahs---- C:\Program Files\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ED7CCC2E-0E96-4403-B370-2E903EC3C9BC}]
07.04.2008 00:31 268288 --a------ C:\Users\Martin\AppData\Local\Temp\geBsrOHb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [14.03.2008 09:20]
"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [25.05.2007 08:03]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [07.09.2007 10:50]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [28.08.2007 07:51]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [03.12.2007 06:28]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [14.03.2008 01:46]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [28.03.2007 21:23]
"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [27.07.2007 18:43]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [21.03.2007 15:00]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [15.11.2007 11:24]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [01.11.2007 17:39]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [16.10.2007 21:50]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [25.10.2007 11:04]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01.02.2008 00:13]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [20.03.2008 00:51]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11.01.2008 22:16]
"f6a4059f"="C:\Windows\system32\yknanxxa.dll" [08.04.2008 15:07]
"BMf5973603"="C:\Windows\system32\ldodfose.dll" [08.04.2008 15:04]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [04.10.2007 21:24]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [04.10.2007 21:24]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [04.10.2007 21:24]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [04.10.2007 21:24]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [02.11.2006 14:35]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [14.03.2008 13:55]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [15.11.2007 11:23]
"Sidebar"="C:\Program Files\windows sidebar\sidebar.exe" [18.03.2008 15:11]
"cmds"="C:\Users\Martin\AppData\Local\Temp\geBsrOHb.dll,c" []
"f6a4059f"="C:\Windows\system32\yknanxxa.dll,b" []
"MS Juan"="C:\Users\Martin\AppData\Local\Temp\lraamtcn.dll,run" []
"BMf5973603"="C:\Users\Martin\AppData\Local\Temp\igtjyvmq.dll,s" []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [03.11.2006 19:55:50]
QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [07.09.2007 18:27:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
"DisableCAD"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
C:\Windows\system32\psqlpwd.dll 28.03.2007 21:46 90112 C:\Windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli psqlpwd
"Authentication Packages"= msv1_0 C:\Users\Martin\AppData\Local\Temp\geBsrOHb

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum
bthsvcs BthServ


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-04-10 23:29:32 ------------




from extra.txt


Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: German

CPU 0: Intel® Core™2 Duo CPU T7500 @ 2.20GHz
Percentage of Memory in Use: 42%
Physical Memory (total/avail): 3069.45 MiB / 1772.95 MiB
Pagefile Memory (total/avail): 6323.36 MiB / 5030.74 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1920.97 MiB

C: is Fixed (NTFS) - 285.47 GiB total, 176.07 GiB free.
D: is Fixed (NTFS) - 10 GiB total, 5.77 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - SAMSUNG HM320JI - 298.09 GiB - 4 partitions
\PARTITION0 - Unknown - 117.63 MiB
\PARTITION1 - Installierbares Dateisystem - 10 GiB - D:
\PARTITION2 (bootable) - Installierbares Dateisystem - 285.47 GiB - C:
\PARTITION3 - Erweitert mit Int 13 (erweitert) - 2.5 GiB



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: McAfee VirusScan Enterprise v8.5.0.781 (McAfee, Inc.)
AS: Avira AntiVir PersonalEdition v 7.0.3.130
(Avira GmbH)
AS: Windows-Defender v1.1.1505.0 (Microsoft Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Martin\AppData\Roaming
CLASSPATH=.;C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=MARTIN-DELL
ComSpec=C:\Windows\system32\cmd.exe
DEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Martin
LOCALAPPDATA=C:\Users\Martin\AppData\Local
LOGONSERVER=\\MARTIN-DELL
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 11, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0b
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
RoxioCentral=C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Martin\AppData\Local\Temp
TMP=C:\Users\Martin\AppData\Local\Temp
USERDOMAIN=Martin-Dell
USERNAME=Martin
USERPROFILE=C:\Users\Martin
VSEDEFLOGDIR=C:\ProgramData\McAfee\DesktopProtection
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

Martin


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x7
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}\setup.exe" -l0x7
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x7
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x7
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6366726-BA44-4D6A-8ECE-476E2E616AD1}\setup.exe" -l0x7
7-Zip 4.57 --> "C:\Program Files\7-Zip\Uninstall.exe"
AceMoney Lite --> "C:\Program Files\AceMoney\unins000.exe"
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Deutsch --> MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A81200000003}
Advanced Audio FX Engine --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x7 /remove
Advanced Video FX Engine --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x7 /remove
AVM FRITZ!Box Dokumentation --> C:\Program Files\FRITZ!Box\install.exe -d
AVM FRITZ!DSL --> C:\Windows\IsUn0407.exe -f"C:\Program Files\FRITZ!DSL\WebUnins.isu" -c"C:\Program Files\FRITZ!DSL\Webunins.dll"
Azureus Vuze --> C:\Program Files\Azureus\uninstall.exe
Benutzerhandbuch --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe"
CDisplay 1.8 --> "C:\Program Files\CDisplay\unins000.exe"
Compatibility Pack für 2007 Office System --> MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}
dBpowerAMP Music Converter --> "C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
dBpoweramp Ogg Vorbis Codec --> "C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat
dBpoweramp Windows Media Audio 10 Codec --> "C:\Windows\system32\SpoonUninstall.exe" <uninstall>C:\Windows\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
Dell Handbuch zum Einstieg --> MsiExec.exe /I{FD023F61-65E9-465C-B558-7C64EB2B97E6}
Dell Support Center --> MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
Dell Touchpad --> C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE
Dell Webcam Center --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}\setup.exe" -l0x7 /remove
Dell Webcam Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6366726-BA44-4D6A-8ECE-476E2E616AD1}\setup.exe" -l0x7 /remove
HijackThis 2.0.2 --> "C:\PROGRA~1\TRENDM~1\HIJACK~1\HijackThis.exe" /uninstall
Intel® Matrix Storage Manager --> C:\Windows\System32\Imsmudlg.exe
Intel® PROSet/Wireless Software --> C:\Windows\Installer\iProInst.exe
Java™ SE Runtime Environment 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Laptop Integrated Webcam Driver (1.04.01.1011) --> C:\Windows\CtDrvIns.exe -uninstall -script OEM002.uns -plugin OEM02Pin.dll -pluginres OEM02Pin.crl -nodisconprompt -langid 0x0407
Live! Cam Avatar --> C:\Program Files\InstallShield Installation Information\{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}\setup.exe -runfromtemp -l0x0007 -removeonly /remove
Live! Cam Avatar Creator --> C:\Program Files\InstallShield Installation Information\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}\setup.exe -runfromtemp -l0x0007 -removeonly /remove
LowRateVoip --> "C:\Program Files\LowRateVoip\unins000.exe"
McAfee VirusScan Enterprise --> MsiExec.exe /X{35C03C04-3F1F-42C2-A989-A757EE691F65}
mCore --> MsiExec.exe /I{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}
MediaDirect --> C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0007 -cluninstall
mHelp --> MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft Office Small Business Connectivity Components --> MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
mMHouse --> MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}
Mozilla Firefox (2.0.0.13) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
mPfMgr --> MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mWMI --> MsiExec.exe /I{63DB9CCD-2B56-4217-9A3D-507AC78320CA}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
OpenOffice.org 2.4 --> MsiExec.exe /I{1B14B0C3-2D60-477C-A1FE-B88E60948854}
OutlookAddinSetup --> MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}
Protector Suite QL 5.6 --> MsiExec.exe /I{A2289997-10A3-48F2-AA03-99180D761661}
QuickSet --> MsiExec.exe /I{C4972073-2BFE-475D-8441-564EA97DA161}
QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
RICOH R5C83x Flash Media Controller Driver Ver.3.30 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -l0x7 anything
Roxio Creator Audio --> MsiExec.exe /I{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}
Roxio Creator Copy --> MsiExec.exe /I{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}
Roxio Creator Data --> MsiExec.exe /I{08E81ABD-79F7-49C2-881F-FD6CB0975693}
Roxio Creator DE --> C:\ProgramData\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe /x {09760D42-E223-42AD-8C3E-55B47D0DDAC3}
Roxio Creator DE --> MsiExec.exe /I{ED439A64-F018-4DD4-8BA5-328D85AB09AB}
Roxio Creator Tools --> MsiExec.exe /I{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}
Roxio Express Labeler 3 --> MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio Update Manager --> MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Stellarium 0.9.1 --> "C:\Program Files\Stellarium\unins000.exe"
The KMPlayer (remove only) --> "C:\Program Files\The KMPlayer\uninstall.exe"
The Sims 2 --> C:\Program Files\EA GAMES\The Sims 2\EAUninstall.exe
The Sims 2 Nightlife --> C:\Program Files\EA GAMES\The Sims 2 Nightlife\EAUninstall.exe
The Sims 2 Open For Business --> C:\Program Files\EA GAMES\The Sims 2 Open For Business\EAUninstall.exe
The Sims 2 Pets --> C:\Program Files\EA GAMES\The Sims 2 Pets\EAUninstall.exe
The Sims 2 University --> C:\Program Files\EA GAMES\The Sims 2 University\EAUninstall.exe
The Sims™ 2 Bon Voyage --> C:\Program Files\EA GAMES\The Sims 2 Bon Voyage\EAUninstall.exe
The Sims™ 2 FreeTime --> C:\Program Files\EA GAMES\The Sims 2 FreeTime\EAUninstall.exe
The Sims™ 2 Seasons --> C:\Program Files\EA GAMES\The Sims 2 Seasons\EAUninstall.exe
Trillian --> C:\Program Files\Trillian\trillian.exe /uninstall
WIDCOMM Bluetooth Software 6.0.1.3100 --> MsiExec.exe /X{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}
Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Live OneCare safety scanner --> %ProgramFiles%\Windows Live Safety Center\wlschost.exe -Uninstall
Windows Live OneCare safety scanner --> MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Windows Media Player Firefox Plugin --> MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR --> C:\Program Files\WinRAR\uninstall.exe
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG


-- Application Event Log -------------------------------------------------------

Event Record #/Type3798 / Error
Event Submitted/Written: 04/10/2008 11:22:47 PM
Event ID/Source: 1000 / Application Error
Event Description:
Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6000.16549, Zeitstempel 0x46d230c5, fehlerhaftes Modul yknanxxa.dll, Version 0.0.0.0, Zeitstempel 0x1861e4fd, Ausnahmecode 0xc0000005, Fehleroffset 0x00001279,
Prozess-ID 0x7f8, Anwendungsstartzeit Explorer.EXE0.

Event Record #/Type3792 / Error
Event Submitted/Written: 04/10/2008 10:59:37 PM
Event ID/Source: 8194 / VSS
Event Description:
Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
Generatordaten werden gesammelt

Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {7040c901-2744-4983-bbc8-22ce3ca5e906}

Event Record #/Type3784 / Success
Event Submitted/Written: 04/10/2008 10:57:24 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type3783 / Success
Event Submitted/Written: 04/10/2008 10:57:24 PM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type3779 / Success
Event Submitted/Written: 04/10/2008 10:56:40 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
Der Softwarelizenzierungsdienst wurde gestartet.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type49526 / Warning
Event Submitted/Written: 04/10/2008 11:28:50 PM
Event ID/Source: 3004 / WinDefend
Event Description:
Vom %Martin-Dell27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %Martin-Dell27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen.

Weitere Informationen finden Sie im Folgenden:
%Martin-Dell275

Scan-ID: {12AD9653-E24E-4E35-A5D3-EFCF0D07D893}

Benutzer: Martin-Dell\Martin

Name: %Martin-Dell271

ID: %Martin-Dell272

Schweregrad-ID: %Martin-Dell273

Kategorie-ID: %Martin-Dell274

Gefundener Pfad: %Martin-Dell276

Warnungsart: %Martin-Dell278

Feststellungstyp: 1.1.1505.02

Event Record #/Type49525 / Warning
Event Submitted/Written: 04/10/2008 11:28:50 PM
Event ID/Source: 3004 / WinDefend
Event Description:
Vom %Martin-Dell27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %Martin-Dell27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen.

Weitere Informationen finden Sie im Folgenden:
%Martin-Dell275

Scan-ID: {B2C06B4A-D98C-4BC5-A23A-5D7856560B7B}

Benutzer: Martin-Dell\Martin

Name: %Martin-Dell271

ID: %Martin-Dell272

Schweregrad-ID: %Martin-Dell273

Kategorie-ID: %Martin-Dell274

Gefundener Pfad: %Martin-Dell276

Warnungsart: %Martin-Dell278

Feststellungstyp: 1.1.1505.02

Event Record #/Type49524 / Warning
Event Submitted/Written: 04/10/2008 11:28:50 PM
Event ID/Source: 3004 / WinDefend
Event Description:
Vom %Martin-Dell27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %Martin-Dell27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen.

Weitere Informationen finden Sie im Folgenden:
%Martin-Dell275

Scan-ID: {D597AD02-D196-4CEE-A22C-8F34A9549DA9}

Benutzer: Martin-Dell\Martin

Name: %Martin-Dell271

ID: %Martin-Dell272

Schweregrad-ID: %Martin-Dell273

Kategorie-ID: %Martin-Dell274

Gefundener Pfad: %Martin-Dell276

Warnungsart: %Martin-Dell278

Feststellungstyp: 1.1.1505.02

Event Record #/Type49523 / Warning
Event Submitted/Written: 04/10/2008 11:28:48 PM
Event ID/Source: 3004 / WinDefend
Event Description:
Vom %Martin-Dell27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %Martin-Dell27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen.

Weitere Informationen finden Sie im Folgenden:
%Martin-Dell275

Scan-ID: {1D393087-F3D8-4DA6-97A6-87839086B0EB}

Benutzer: Martin-Dell\Martin

Name: %Martin-Dell271

ID: %Martin-Dell272

Schweregrad-ID: %Martin-Dell273

Kategorie-ID: %Martin-Dell274

Gefundener Pfad: %Martin-Dell276

Warnungsart: %Martin-Dell278

Feststellungstyp: 1.1.1505.02

Event Record #/Type49522 / Warning
Event Submitted/Written: 04/10/2008 11:28:47 PM
Event ID/Source: 3004 / WinDefend
Event Description:
Vom %Martin-Dell27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %Martin-Dell27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen.

Weitere Informationen finden Sie im Folgenden:
%Martin-Dell275

Scan-ID: {9C5ECDAB-16DB-4B85-A44A-9CE810F59331}

Benutzer: Martin-Dell\Martin

Name: %Martin-Dell271

ID: %Martin-Dell272

Schweregrad-ID: %Martin-Dell273

Kategorie-ID: %Martin-Dell274

Gefundener Pfad: %Martin-Dell276

Warnungsart: %Martin-Dell278

Feststellungstyp: 1.1.1505.02



-- End of Deckard's System Scanner: finished at 2008-04-10 23:29:32 ------------

BC AdBot (Login to Remove)

 


#2 Thunder

Thunder

  • Members
  • 3,294 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belgium
  • Local time:09:04 AM

Posted 15 April 2008 - 04:19 AM

Hello Mhlukito and welcome to BleepingComputer,

1. * Clean your Cache and Cookies in IE:
  • Close all instances of Outlook Express and Internet Explorer
  • Go to Control Panel > Internet Options > General tab
  • Under Browsing History, click Delete.
  • Click Delete Files, Delete cookies and Delete history
  • Click Close below.
* Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):
  • Go to Tools > Options.
  • Click Privacy in the menu..
  • Click the Clear now button below.. A new window will popup what to clear.
  • Select all and click the Clear button again.
  • Click OK to close the Options window
* Clean other Temporary files + Recycle bin
  • Go to start > run and type: cleanmgr and click ok.
  • Let it scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
  • Press OK to remove them.
2. Please download Malwarebytes' Anti-Malware from Here or Here

Doubleclick mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply along with a fresh HijackThis log.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

3. Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery mode, in case your computer has a problem after an attempted removal of malware. This allows us to help you .

In the event you already have Combofix, delete your current version and download the latest version as described in the tutorial.
It must be saved directly to your desktop.


Note: Make sure not to click ComboFix's window while it's running. That may cause it to stall or freeze.

Please post the log from ComboFix (can also be found as C:\ComboFix.txt) in your next reply. :thumbsup:

If you have any questions along the way, STOP and ask them before proceeding !!

Greetings,
Thunder
Whatever happens, make believe it was intended to ...
-----------------------------------------------------------------------
Posted Image - If I have helped you in any way, please consider a donation to help me continue the fight against malware.
-----------------------------------------------------------------------
Stand Up & Be Counted --> Posted Image <-- And make a difference




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users