exp/cve-2012-0507 eingefangen + 6 andere Dateien

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_31
Run by Schni at 10:49:09 on 2012-04-17
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3583.2516 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Users\Schni\AppData\Local\Apps\2.0\CM9OTVX4.WTK\L5KTQH3X.KE1\curs..tion_eee711038731a406_0004.0000_2bd39706d04e72c8\CurseClient.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "c:\program files\amd avt\bin\kdbsync.exe" aml
StartupFolder: c:\users\schni\appdata\roaming\microsoft\windows\start menu\programs\startup\CurseClientStartup.ccip
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{0E6645B6-4BB3-4D02-B15A-5C2146DE265E} : DhcpNameServer = 192.168.2.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\schni\appdata\roaming\mozilla\firefox\profiles\oj3e7fln.default\
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\users\schni\appdata\roaming\mozilla\firefox\profiles\oj3e7fln.default\extensions\2020player_ikea@2020technologies.com\plugins\NP_2020Player_IKEA.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_228.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-3-2 36000]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-3-9 163328]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ati technologies\ati.ace\fuel\Fuel.Service.exe [2012-3-9 291840]
R2 AntiVirSchedulerService;Avira Planer;c:\program files\avira\antivir desktop\sched.exe [2012-3-2 86224]
R2 AntiVirService;Avira Echtzeit Scanner;c:\program files\avira\antivir desktop\avguard.exe [2012-3-2 110032]
R2 AODDriver4.01;AODDriver4.01;c:\program files\ati technologies\ati.ace\fuel\i386\aoddriver2.sys [2012-2-1 46720]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-3-2 74640]
R3 amdiox86;AMD IO Driver;c:\windows\system32\drivers\amdiox86.sys [2012-3-2 37944]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2012-3-9 9183232]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2012-3-9 265216]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-12-5 86032]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ati technologies\ati.ace\fuel\i386\aoddriver2.sys [2012-2-1 46720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-2-15 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-1 253600]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-3-4 52224]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2012-3-10 1343400]
.
=============== Created Last 30 ================
.
2012-04-17 07:49:25	6582328	----a-w-	c:\programdata\microsoft\windows defender\definition updates\{0ffaad03-53fc-4d10-ab6b-200459eed195}\mpengine.dll
2012-04-12 07:32:52	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-12 07:32:52	19824	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-12 07:32:52	172544	----a-w-	c:\windows\system32\wintrust.dll
2012-04-12 07:32:52	159232	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-12 07:32:41	3968368	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-04-12 07:32:41	3913072	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-04-05 07:15:00	--------	d-----w-	c:\program files\World of Warcraft Beta
2012-04-05 07:14:14	--------	d-----w-	c:\programdata\Battle.net
2012-04-01 06:37:57	418464	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-03-30 05:57:47	--------	d-----w-	c:\program files\AMD AVT
2012-03-30 05:57:46	--------	d-----w-	c:\program files\AMD APP
2012-03-18 11:00:14	592824	----a-w-	c:\program files\mozilla firefox\gkmedias.dll
2012-03-18 11:00:14	44472	----a-w-	c:\program files\mozilla firefox\mozglue.dll
.
==================== Find3M  ====================
.
2012-04-01 06:37:57	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-14 09:07:51	472808	----a-w-	c:\windows\system32\deployJava1.dll
2012-03-09 06:26:40	9183232	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2012-03-09 05:16:44	159744	----a-w-	c:\windows\system32\atiapfxx.exe
2012-03-09 05:16:28	791552	----a-w-	c:\windows\system32\aticfx32.dll
2012-03-09 05:11:24	442368	----a-w-	c:\windows\system32\ATIDEMGX.dll
2012-03-09 05:10:54	405504	----a-w-	c:\windows\system32\atieclxx.exe
2012-03-09 05:10:06	163328	----a-w-	c:\windows\system32\atiesrxx.exe
2012-03-09 05:08:40	159744	----a-w-	c:\windows\system32\atitmmxx.dll
2012-03-09 05:07:58	20992	----a-w-	c:\windows\system32\atimuixx.dll
2012-03-09 05:07:50	43520	----a-w-	c:\windows\system32\ati2edxx.dll
2012-03-09 05:04:18	6200320	----a-w-	c:\windows\system32\atidxx32.dll
2012-03-09 04:39:20	19739136	----a-w-	c:\windows\system32\atioglxx.dll
2012-03-09 04:36:10	1828864	----a-w-	c:\windows\system32\atiumdmv.dll
2012-03-09 04:23:44	5062656	----a-w-	c:\windows\system32\atiumdva.dll
2012-03-09 04:23:16	5954048	----a-w-	c:\windows\system32\atiumdag.dll
2012-03-09 04:18:26	46080	----a-w-	c:\windows\system32\aticalrt.dll
2012-03-09 04:18:12	44032	----a-w-	c:\windows\system32\aticalcl.dll
2012-03-09 04:12:38	13715968	----a-w-	c:\windows\system32\aticaldd.dll
2012-03-09 04:05:12	53760	----a-w-	c:\windows\system32\atimpc32.dll
2012-03-09 04:05:12	53760	----a-w-	c:\windows\system32\amdpcom32.dll
2012-03-09 03:58:40	356352	----a-w-	c:\windows\system32\atiadlxx.dll
2012-03-09 03:58:26	14336	----a-w-	c:\windows\system32\atiglpxx.dll
2012-03-09 03:58:10	33280	----a-w-	c:\windows\system32\atigktxx.dll
2012-03-09 03:57:34	265216	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2012-03-09 03:56:56	33280	----a-w-	c:\windows\system32\atiuxpag.dll
2012-03-09 03:56:38	30208	----a-w-	c:\windows\system32\atiu9pag.dll
2012-03-09 03:55:58	53248	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2012-03-09 03:47:16	51200	----a-w-	c:\windows\system32\coinst.dll
2012-03-08 23:26:32	64512	----a-w-	c:\windows\system32\OpenVideo.dll
2012-03-08 23:26:20	54784	----a-w-	c:\windows\system32\OVDecode.dll
2012-03-08 23:25:16	13238272	----a-w-	c:\windows\system32\amdocl.dll
2012-03-08 23:24:14	48128	----a-w-	c:\windows\system32\OpenCL.dll
2012-03-05 07:08:44	152576	----a-w-	c:\windows\system32\msclmd.dll
2012-03-02 15:45:12	0	----a-w-	c:\windows\ativpsrm.bin
2012-02-28 01:18:55	1799168	----a-w-	c:\windows\system32\jscript9.dll
2012-02-28 01:11:21	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2012-02-28 01:11:07	1127424	----a-w-	c:\windows\system32\wininet.dll
2012-02-28 01:03:16	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-02-23 08:18:36	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-02-17 05:34:22	826880	----a-w-	c:\windows\system32\rdpcore.dll
2012-02-17 04:14:08	183808	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:13:22	24576	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-02-10 05:38:43	1077248	----a-w-	c:\windows\system32\DWrite.dll
2012-02-03 03:54:27	2343424	----a-w-	c:\windows\system32\win32k.sys
2012-01-31 07:56:33	74640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-01-31 05:00:24	16896	----a-w-	c:\windows\system32\kdbsdk32.dll
2012-01-25 05:32:35	58880	----a-w-	c:\windows\system32\rdpwsx.dll
2012-01-25 05:32:34	129536	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-01-25 05:27:51	8192	----a-w-	c:\windows\system32\rdrmemptylst.exe
.
============= FINISH: 10:49:43,62 ===============