Hallo,

hab mir gestern dummerweise was auf einem ungeschütztem rechner eingefangen und hab nun die befürchtung das meine passwörter aus firefox geklaut wurden sind. (die hab ich natürlich sofort alle geändert) tät mich aber trotzdem interessieren ob das wirklich so einfach ist die auszulesen.

daher habe ich die sache auf nem testsystem ohne wichtige daten nochmal nachgestellt. und filemon und wireshark mitlaufen lassen.

im filemon log (siehe unnten) sieht man auf jedenfall das die datei imrec.exe aufs firefoxprofil zugegriffen hat tät mich jetzt nur interessieren ob da auch wirklich was entschlüsselt werden konnte von den passwörtern.

dannach hat eine mail.exe aufs internet zugegriffen.

im wireshark mittschnitt konnte ich aber nichts weiter finden da die verbindung wahrscheinlich verschlüsselt war.

aber ich bin da halt auch nicht so der pro deshalb hier die frage an die profis ob diese beiden programme bekannt sind und wirklich schaden anrichten können (hab über die such leider nix gefunden)

1805	00:06:22	~ZY5.tmp:592	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	NOT FOUND	Attributes: Error	
1846	00:06:22	~ZY5.tmp:592	QUERY INFORMATION	C:\WINDOWS\system32\imrec.exe	SUCCESS	Length: 64000	
1847	00:06:22	~ZY5.tmp:592	QUERY INFORMATION	C:\WINDOWS\system32\imrec.exe	SUCCESS	Attributes: A	
6188	00:06:33	cmd.exe:1980	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Attributes: A	
6193	00:06:33	cmd.exe:1980	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Length: 64000	
6194	00:06:33	cmd.exe:1980	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Attributes: A	
6197	00:06:33	cmd.exe:1980	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Length: 64000	
6206	00:06:33	csrss.exe:472	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Attributes: A	
6217	00:06:33	csrss.exe:472	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Attributes: A	
6218	00:06:33	csrss.exe:472	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe	SUCCESS	Length: 64000	
6332	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe.Local\	NOT FOUND	Attributes: Error	
6333	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B	SUCCESS	Attributes: D	
6336	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\COMCTL32.dll	SUCCESS	Length: 928768	
6337	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\COMCTL32.dll	SUCCESS	Attributes: A	
6341	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Attributes: A	
6343	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Length: 720200	
6344	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Attributes: A	
6347	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Length: 720200	
6349	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Attributes: A	
6351	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Length: 720200	
6352	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\wl_hook.dll	SUCCESS	Attributes: A	
6358	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\machine.ini	SUCCESS	Length: 34553	
6359	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1\machine.ini	SUCCESS	Length: 34553	
6361	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\progra~1\agnitum\outpos~1	SUCCESS	Attributes: D	
6371	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Attributes: RHA	
6373	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Length: 749	
6374	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Attributes: RHA	
6377	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Length: 749	
6379	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Attributes: RHA	
6381	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Length: 749	
6384	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Length: 749	
6385	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WindowsShell.Manifest	SUCCESS	Length: 749	
6432	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\SHELL32.dll	SUCCESS	Length: 8207360	
6433	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\SHELL32.dll	SUCCESS	Attributes: A	
6436	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\SHELL32.dll	SUCCESS	Length: 8207360	
6480	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\imrec.exe.Local\	NOT FOUND	Attributes: Error	
6481	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B	SUCCESS	Attributes: D	
6485	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\imrec_lng.ini	NOT FOUND	Attributes: Error	
6488	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\trillian	NOT FOUND	Attributes: Error	
6489	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten	SUCCESS	Attributes: DRH	
6490	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Profiles	NOT FOUND	Attributes: Error	
6491	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\.gaim	NOT FOUND	Attributes: Error	
6492	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\.purple	NOT FOUND	Attributes: Error	
6493	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Miranda	NOT FOUND	Attributes: Error	
6515	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten	SUCCESS	Attributes: DH	
6531	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\Secur32.dll	SUCCESS	Attributes: A	
6533	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\Secur32.dll	SUCCESS	Length: 64512	
6534	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\Secur32.dll	SUCCESS	Attributes: A	
6538	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\MySpace\IM\users.txt	PATH NOT FOUND	Attributes: Error	
6539	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Digsby\digsby.dat	PATH NOT FOUND	Attributes: Error	
6546	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\history.dat	NOT FOUND	Attributes: Error	
6547	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\places.sqlite	SUCCESS	Attributes: A	
6549	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\places.sqlite	SUCCESS	Attributes: A	
6551	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Attributes: A	
6554	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Attributes: A	
6556	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Length: 718328	
6557	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Attributes: A	
6560	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Length: 718328	
6563	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Attributes: A	
6565	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Length: 718328	
6566	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nss3.dll	SUCCESS	Attributes: A	
6570	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssutil3.dll	SUCCESS	Attributes: A	
6572	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssutil3.dll	SUCCESS	Length: 87544	
6573	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssutil3.dll	SUCCESS	Attributes: A	
6577	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\plc4.dll	SUCCESS	Attributes: A	
6579	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\plc4.dll	SUCCESS	Length: 20472	
6580	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\plc4.dll	SUCCESS	Attributes: A	
6584	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nspr4.dll	SUCCESS	Attributes: A	
6586	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nspr4.dll	SUCCESS	Length: 198136	
6587	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nspr4.dll	SUCCESS	Attributes: A	
6591	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\WSOCK32.dll	NOT FOUND	Attributes: Error	
6592	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WSOCK32.dll	SUCCESS	Attributes: A	
6594	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WSOCK32.dll	SUCCESS	Length: 24576	
6595	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WSOCK32.dll	SUCCESS	Attributes: A	
6599	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\WS2_32.dll	NOT FOUND	Attributes: Error	
6600	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WS2_32.dll	SUCCESS	Attributes: A	
6602	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WS2_32.dll	SUCCESS	Length: 89600	
6603	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WS2_32.dll	SUCCESS	Attributes: A	
6607	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\WS2HELP.dll	NOT FOUND	Attributes: Error	
6608	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WS2HELP.dll	SUCCESS	Attributes: A	
6610	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WS2HELP.dll	SUCCESS	Length: 19968	
6611	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WS2HELP.dll	SUCCESS	Attributes: A	
6615	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\WINMM.dll	NOT FOUND	Attributes: Error	
6616	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WINMM.dll	SUCCESS	Attributes: A	
6618	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WINMM.dll	SUCCESS	Length: 172032	
6619	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\WINMM.dll	SUCCESS	Attributes: A	
6623	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\MOZCRT19.dll	SUCCESS	Attributes: A	
6625	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\MOZCRT19.dll	SUCCESS	Length: 710136	
6626	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\MOZCRT19.dll	SUCCESS	Attributes: A	
6630	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\plds4.dll	SUCCESS	Attributes: A	
6632	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\plds4.dll	SUCCESS	Length: 17400	
6633	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\plds4.dll	SUCCESS	Attributes: A	
6637	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Attributes: A	
6639	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Length: 151552	
6640	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Attributes: A	
6643	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Length: 151552	
6645	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Attributes: A	
6647	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Length: 151552	
6648	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\softokn3.dll	SUCCESS	Attributes: A	
6652	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\sqlite3.dll	NOT FOUND	Attributes: Error	
6653	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\sqlite3.dll	NOT FOUND	Attributes: Error	
6654	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system\sqlite3.dll	NOT FOUND	Attributes: Error	
6655	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\sqlite3.dll	NOT FOUND	Attributes: Error	
6656	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\sqlite3.dll	SUCCESS	Attributes: A	
6658	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\sqlite3.dll	SUCCESS	Length: 395768	
6659	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\sqlite3.dll	SUCCESS	Attributes: A	
6663	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Attributes: A	
6665	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Length: 103928	
6666	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Attributes: A	
6669	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Length: 103928	
6671	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Attributes: A	
6673	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Length: 103928	
6674	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\nssdbm3.dll	SUCCESS	Attributes: A	
6683	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db	SUCCESS	Length: 16384	
6684	00:06:33	imrec.exe:1996	READ	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db	SUCCESS	Offset: 4096 Length: 4096	
6685	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db	SUCCESS	Length: 16384	
6686	00:06:33	imrec.exe:1996	READ	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\secmod.db	SUCCESS	Offset: 8192 Length: 4096	
6688	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Attributes: A	
6690	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Length: 233472	
6691	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Attributes: A	
6694	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Length: 233472	
6696	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Attributes: A	
6698	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Length: 233472	
6699	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Programme\Mozilla Firefox\freebl3.dll	SUCCESS	Attributes: A	
6792	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\$winnt$.inf	END OF FILE	Offset: 289 Length: 4096	
6793	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\$winnt$.inf	END OF FILE	Offset: 289 Length: 4096	
6832	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\12520437.cpx	END OF FILE	Offset: 2151 Length: 4096	
6833	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\12520437.cpx	END OF FILE	Offset: 2151 Length: 4096	
6840	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\12520850.cpx	END OF FILE	Offset: 2233 Length: 4096	
6841	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\12520850.cpx	END OF FILE	Offset: 2233 Length: 4096	
6859	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\6to4svc.dll	SUCCESS	Length: 64512	
6860	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\6to4svc.dll	SUCCESS	Attributes: A	
6869	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\aaaamon.dll	SUCCESS	Length: 29184	
6870	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\aaaamon.dll	SUCCESS	Attributes: A	
6883	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\ABCpdf6.dll	SUCCESS	Length: 10080200	
6884	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\ABCpdf6.dll	SUCCESS	Attributes: A	
6899	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\acctres.dll	SUCCESS	Length: 70144	
6900	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\acctres.dll	SUCCESS	Attributes: A	
6904	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\acctres.dll	SUCCESS	Offset: 4096 Length: 4096	
6910	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\accwiz.exe	SUCCESS	Length: 186368	
6911	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\accwiz.exe	SUCCESS	Attributes: A	
6921	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\acelpdec.ax	SUCCESS	Offset: 4096 Length: 4096	
6927	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\acledit.dll	SUCCESS	Length: 138240	
6928	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\acledit.dll	SUCCESS	Attributes: A	
6942	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\comp.exe	SUCCESS	Length: 16384	
6943	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\comp.exe	SUCCESS	Attributes: A	
6972	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\dfrg.msc	END OF FILE	Offset: 41397 Length: 4096	
6973	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\dfrg.msc	END OF FILE	Offset: 41397 Length: 4096	
6985	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\gpkrsrc.dll	SUCCESS	Length: 10752	
6986	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\gpkrsrc.dll	SUCCESS	Attributes: A	
7005	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\kbdpl1.dll	SUCCESS	Length: 6144	
7006	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\kbdpl1.dll	SUCCESS	Attributes: RA	
7021	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\mqtrig.dll	SUCCESS	Length: 134144	
7022	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\mqtrig.dll	SUCCESS	Attributes: A	
7045	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\netui2.dll	SUCCESS	Length: 321024	
7046	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\netui2.dll	SUCCESS	Attributes: A	
7061	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Length: 35916	
7062	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Attributes: A	
7067	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 4096 Length: 4096	
7068	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 8192 Length: 4096	
7069	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 12288 Length: 4096	
7070	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 16384 Length: 4096	
7071	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 20480 Length: 4096	
7072	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 24576 Length: 4096	
7073	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 28672 Length: 4096	
7074	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 32768 Length: 1	
7075	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	SUCCESS	Offset: 32768 Length: 4096	
7076	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	END OF FILE	Offset: 35916 Length: 4096	
7077	00:06:33	imrec.exe:1996	READ	C:\WINDOWS\system32\prnjobs.vbs	END OF FILE	Offset: 35916 Length: 4096	
7089	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\setupapi.dll	SUCCESS	Length: 1044992	
7090	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\setupapi.dll	SUCCESS	Attributes: A	
7105	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\ulib.dll	SUCCESS	Length: 310272	
7106	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\ulib.dll	SUCCESS	Attributes: A	
7122	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\wupdmgr.exe	SUCCESS	Length: 32256	
7123	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\system32\wupdmgr.exe	SUCCESS	Attributes: A	
7136	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\cert8.db	SUCCESS	Length: 65536	
7137	00:06:33	imrec.exe:1996	READ	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\cert8.db	SUCCESS	Offset: 16384 Length: 16384	
7143	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db	SUCCESS	Length: 16384	
7144	00:06:33	imrec.exe:1996	READ	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db	SUCCESS	Offset: 4096 Length: 4096	
7145	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\nssckbi.dll	NOT FOUND	Attributes: Error	
7146	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\nssckbi.dll	NOT FOUND	Attributes: Error	
7147	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons.txt	NOT FOUND	Attributes: Error	
7148	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons2.txt	NOT FOUND	Attributes: Error	
7149	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons3.txt	SUCCESS	Attributes: A	
7151	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\signons3.txt	SUCCESS	Length: 265	
7153	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db	SUCCESS	Length: 16384	
7154	00:06:33	imrec.exe:1996	READ	C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\7hfj5s56.default\key3.db	SUCCESS	Offset: 8192 Length: 4096	
7161	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Attributes: A	
7163	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Length: 181072	
7164	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Attributes: A	
7167	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Length: 181072	
7168	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Length: 181072	
7170	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Attributes: A	
7172	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Length: 181072	
7173	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\rsaenh.dll	SUCCESS	Attributes: A	
7177	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\PSAPI.DLL	SUCCESS	Attributes: A	
7179	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\PSAPI.DLL	SUCCESS	Length: 22016	
7180	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\PSAPI.DLL	SUCCESS	Attributes: A	
7184	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\crypt32.dll	SUCCESS	Attributes: A	
7186	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\crypt32.dll	SUCCESS	Length: 617472	
7187	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\crypt32.dll	SUCCESS	Attributes: A	
7190	00:06:33	imrec.exe:1996	QUERY INFORMATION	C:\WINDOWS\System32\crypt32.dll	SUCCESS	Length: 617472
         

kann keiner was zu sagen ?

Hi,

wahrscheinlich wurden sie geklaut. Die Lösung ist aber ganz einfach: Zuerst den Rechner sauber machen, eine Neuinstallation liefert richtig ausgeführt die Garantie dafür. Danach die Passwörter ändern. Wenn es Passwörter sind, die sehr schnell geändert werden müssen, musst Du dir dafür einen anderen Rechner suchen.

Karl