| |
| |||||||
Log-Analyse und Auswertung: Rootkit/Trojaner on board?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
25.08.2007, 23:15
| #1 |
 |  Rootkit/Trojaner on board? Wieso ist das ungewöhnlich ? Die mir vom router intern zugeteilte ip sieht doch niemand. Daher ist es doch egal wie sie aussieht. und man kann ja selber dem router seine eigene ip ändern und dann vergibt er ja auch dem entsprechend in den gewählten ranges die ip´s . Die IP ist 192.243.69.149. Aber wozu ist das denn so wichtig ??? |
|
25.08.2007, 23:19
| #2 |
| | Rootkit/Trojaner on board? Blacklight findet nichts. Das hier ist das Log von Silent Runners.
__________________Wozu dienen eigentlich immer diese Desktop.ini files ?? "Silent Runners.vbs", revision 52, Silent Runners - Adware? Disinfect, don't reformat! Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "ICQ" = ""C:\Programme\ICQ6\ICQ.exe" silent" ["ICQ, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RMETray" = "digi96.exe" ["RME"] "Flashget" = "C:\Programme\FlashGet\FlashGet.exe /min" ["FlashGet.com"] "ZoneAlarm Client" = ""C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"] "Matrox PowerDesk SE" = ""c:\Programme\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe"" ["Matrox Graphics Inc."] "avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Programme\FlashGet\jccatch.dll" ["www.flashget.com"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Programme\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung" -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Programme\Nokia\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"] "{EF479680-EA35-4EA9-B093-7114F3E3E0DA}" = "Directory Lister" -> {HKLM...CLSID} = "ShlMenu Class" \InProcServer32\(Default) = "C:\Programme\Directory Lister Pro\DirListerExt.dll" ["KRKsoft.com"] "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" = "Multiscan" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshserviceobj.dll" [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> dimsntfy\DLLName = "C:\WINDOWS\System32\dimsntfy.dll" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ DirLister\(Default) = "{EF479680-EA35-4EA9-B093-7114F3E3E0DA}" -> {HKLM...CLSID} = "ShlMenu Class" \InProcServer32\(Default) = "C:\Programme\Directory Lister Pro\DirListerExt.dll" ["KRKsoft.com"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp" Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range: %SystemRoot%\system32\mswsock.dll [MS], 1 - 3 %SystemRoot%\system32\rsvpsp.dll [MS], 4 - 5 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Programme\FlashGet\FlashGet.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {E59EB121-F339-4851-A3BA-FE49C35617C2}\ "ButtonText" = "ICQ6" "MenuText" = "ICQ6" "Exec" = "C:\Programme\ICQ6\ICQ.exe" ["ICQ, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir PersonalEdition Classic Guard, AntiVirService, ""C:\Programme\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"] AntiVir PersonalEdition Classic Planer, AntiVirScheduler, ""C:\Programme\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"] MGABGEXE, MGABGEXE, "C:\WINDOWS\system32\mgabg.exe" ["Matrox Graphics Inc."] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ EPSON Stylus DX4000 Series 32MonitorBE\Driver = "E_FLBBEE.DLL" ["SEIKO EPSON CORPORATION"] ---------- (launch time: 2007-08-26 00:02:47) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 92 seconds. ---------- (total run time: 160 seconds) |
|
25.08.2007, 23:36
| #3 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Rootkit/Trojaner on board?Zitat:
Es ist schon wichtig, da z.B. 192.243.69.149 eine öffentliche IP-nummer ist, die durchaus im Internet jmd. anderem genutzt wird - sowas im privaten LAN zu betreiben ist m.E. richtiger Murks. Nur private Adressen werden im Internet nicht geroutet! Änder die ab in irgendeinem privaten Adressraum, also z.B. 192.168.*.* (es gibt noch mehr private Adressräume)
__________________ |
|
26.08.2007, 00:59
| #4 |
| | Rootkit/Trojaner on board? Ok weiter im Text: GMER LOG: Code:
ATTFilter GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-08-26 01:28:02
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.13 ----
SSDT \SystemRoot\System32\vsdatant.sys ZwConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateFile
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys ZwCreatePort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcessEx
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateSection
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateWaitablePort
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteFile
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDuplicateObject
SSDT sptd.sys ZwEnumerateKey
SSDT sptd.sys ZwEnumerateValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenFile
SSDT sptd.sys ZwOpenKey
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenThread
SSDT sptd.sys ZwQueryKey
SSDT sptd.sys ZwQueryValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys ZwRequestWaitReplyPort
SSDT \SystemRoot\System32\vsdatant.sys ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys ZwSecureConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwSetInformationFile
SSDT \SystemRoot\System32\vsdatant.sys ZwSetValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwTerminateProcess
---- Kernel code sections - GMER 1.0.13 ----
.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ F0, D1, 19, F4, 80, 34, 1A, ... ]
? C:\WINDOWS\system32\drivers\sptd.sys Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
? srescan.sys Das System kann die angegebene Datei nicht finden.
.text USBPORT.SYS!DllUnload F74487AE 5 Bytes JMP 8662F1C8
.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ F0, D1, 19, F4, 80, 34, 1A, ... ]
---- Kernel IAT/EAT - GMER 1.0.13 ----
IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!IoConnectInterrupt] [F773D886] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F773D832] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F775F892] sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F773D886] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7727AD4] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F7727C1A] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F7727B9C] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F7728748] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F772861E] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F773CACA] sptd.sys
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F41A1950] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F41A1E70] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F41A1FD0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F41A1AC0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F41A1950] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F41A1FD0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F41A1E70] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F41A1AC0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F41A1FD0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F41A1E70] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F41A1950] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F41A1AC0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F41A1950] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F41A1E70] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F41A1FD0] \SystemRoot\System32\vsdatant.sys
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [F41AEFB0] \SystemRoot\System32\vsdatant.sys
---- User IAT/EAT - GMER 1.0.13 ----
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[1024] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS\system32\ShimEng.dll
---- EOF - GMER 1.0.13 ----
|
|
26.08.2007, 01:09
| #5 |
| | Rootkit/Trojaner on board? COMBOFIX LOG-FILE Code:
ATTFilter ComboFix 07-08-25.2 - 2007-08-26 1:48:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.547 [GMT 2:00]
* Created a new restore point
((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))
2007-08-26 01:31 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-25 23:46 <DIR> d-------- C:\Programme\Div
2007-08-25 21:01 <DIR> d-------- C:\Programme\JackThis
2007-08-25 20:52 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic
2007-08-24 14:12 737,280 --a------ C:\WINDOWS\system32\msvcp70d.dll
2007-08-24 14:12 163,840 --a------ C:\WINDOWS\system32\ArtFfct.dll
2007-08-24 14:12 <DIR> d-------- C:\Programme\Arturia
2007-08-24 13:55 <DIR> d-------- C:\Programme\YAMAHA
2007-08-24 10:29 22,304 --a------ C:\WINDOWS\system32\drivers\usbmn4x4.sys
2007-08-24 10:29 214,016 --a------ C:\WINDOWS\system32\usbmn4x4.dll
2007-08-24 10:29 16,416 --a------ C:\WINDOWS\system32\drivers\usb44ldr.sys
2007-08-24 10:19 962,560 --a------ C:\WINDOWS\system32\g400icd.dll
2007-08-24 10:19 87,560 --a------ C:\WINDOWS\system32\mgabg.exe
2007-08-24 10:19 350,464 --a------ C:\WINDOWS\system32\drivers\g400dhm.sys
2007-08-24 10:19 2,399,232 --a------ C:\WINDOWS\system32\g400dhd.dll
2007-08-24 10:19 139,264 --a------ C:\WINDOWS\system32\MtxCIP.dll
2007-08-24 10:19 <DIR> d-------- C:\WINDOWS\system32\PDesk
2007-08-24 10:19 <DIR> d-------- C:\Programme\Matrox Graphics Inc
2007-08-24 10:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Matrox Graphics Inc
2007-08-24 10:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Matrox
2007-08-24 10:18 <DIR> d-------- C:\mgafold
2007-08-24 09:04 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-08-24 09:03 75,512 --a------ C:\WINDOWS\zllsputility.exe
2007-08-24 09:03 54,936 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll
2007-08-24 09:03 42,648 --a------ C:\WINDOWS\zllsputility_loc0407.dll
2007-08-24 09:03 22,168 --a------ C:\WINDOWS\system32\imsinstall_loc0407.dll
2007-08-24 09:03 18,072 --a------ C:\WINDOWS\system32\imslsp_install_loc0407.dll
2007-08-24 09:03 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-08-24 09:02 1,087,216 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-08-24 09:02 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-08-24 09:02 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-08-24 06:17 <DIR> d-------- C:\Programme\Directory Lister Pro
2007-08-24 06:17 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\KRKsoft
2007-08-21 13:05 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\FabFilter
2007-08-21 09:32 <DIR> d-------- C:\HijackThis
2007-08-21 09:21 <DIR> d-------- C:\Programme\HiJackThis(2)
2007-08-21 06:41 286,720 --a------ C:\WINDOWS\iun506.exe
2007-08-21 06:41 <DIR> d-------- C:\Programme\War Drumz VST
2007-08-21 05:50 <DIR> d-------- C:\Programme\EDIROL
2007-08-21 05:45 <DIR> d-------- C:\Programme\iZotope
2007-08-21 05:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\iZotope
2007-08-21 05:45 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\iZotope
2007-08-21 05:30 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Twin
2007-08-20 15:57 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-08-20 15:57 <DIR> d-------- C:\Programme\MSXML 6.0
2007-08-20 15:57 <DIR> d-------- C:\Programme\MSXML 4.0
2007-08-10 19:35 <DIR> d-------- C:\Programme\WinAVI Video Converter
2007-08-10 09:02 <DIR> d-------- C:\Programme\WNAS
2007-08-09 18:02 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-08-09 18:02 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-08-09 18:02 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-08-09 13:41 <DIR> d-------- C:\Programme\thriXXX
2007-08-09 12:44 <DIR> d-------- C:\Program Files
2007-08-09 03:28 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\DivX
2007-08-09 03:25 <DIR> d-------- C:\Programme\DivX
2007-08-08 21:42 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\ICQ
2007-08-08 21:41 <DIR> d-------- C:\Programme\ICQ6
2007-08-08 21:41 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\InstallShield
2007-08-08 18:27 <DIR> d-------- C:\Programme\AVI MPEG RM WMV Joiner
2007-08-08 18:26 <DIR> d-------- C:\Programme\Blaze Media Pro
2007-08-08 18:23 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
2007-08-08 18:14 <DIR> d-------- C:\Programme\Amor Video Joiner
2007-08-08 16:15 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Roni Music
2007-08-08 16:14 <DIR> d-------- C:\Programme\Roni Music
2007-08-08 15:42 <DIR> d-------- C:\Programme\CCleaner
2007-08-06 22:16 <DIR> d-------- C:\Programme\ArtsAcoustic Reverb
2007-08-06 22:16 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\ArtsAcoustic
2007-08-06 22:11 <DIR> d-------- C:\Programme\OHMFORCE
2007-08-06 22:08 <DIR> d-------- C:\Programme\Buzz
2007-08-06 22:07 <DIR> d-------- C:\Programme\Jeskola Buzz
2007-08-06 22:06 <DIR> d-------- C:\Programme\Tone2
2007-08-06 22:06 <DIR> d-------- C:\Programme\Kjaerhus Audio
2007-08-06 22:04 <DIR> d-------- C:\Programme\Pro-53
2007-08-06 22:02 611,840 --a------ C:\WINDOWS\system32\vobhw.dll
2007-08-06 22:02 19,456 --a------ C:\WINDOWS\system32\asapi.dll
2007-08-06 22:02 153,088 --a------ C:\WINDOWS\system32\IWUninstall.exe
2007-08-06 22:02 11,264 --a------ C:\WINDOWS\system32\drivers\asapi.sys
2007-08-06 21:54 61,440 --a------ C:\WINDOWS\system32\NI_DFD_1_5.dll
2007-08-06 21:54 393,216 --a------ C:\WINDOWS\system32\NI_IRC_1_2.dll
2007-08-06 21:54 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2007-08-06 21:54 1,990,656 --a------ C:\WINDOWS\system32\kconvert.dll
2007-08-06 21:54 <DIR> d-------- C:\Programme\Native Instruments
2007-08-06 21:50 <DIR> d-------- C:\Programme\AudioRetoucher
2007-08-05 14:11 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Waves Audio
2007-08-04 23:53 <DIR> d-------- C:\Programme\NO1 Video Converter
2007-08-04 01:43 <DIR> d-------- C:\Programme\Nexus
2007-08-03 23:29 <DIR> d-------- C:\Programme\Waves
2007-08-03 23:28 <DIR> d-------- C:\Programme\Extreme Sample Converter 3
2007-08-03 22:14 724,992 --a------ C:\WINDOWS\iun6002.exe
2007-08-03 22:14 <DIR> d-------- C:\Programme\M-Audio Midisport 4x4
2007-08-03 22:03 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Steinberg
2007-08-03 22:00 225,280 --a------ C:\WINDOWS\system32\ReWire.dll
2007-08-03 21:51 <DIR> d-------- C:\Programme\z3ta+
2007-08-03 21:51 <DIR> d-------- C:\Documents and Settings
2007-08-03 21:50 86,016 --a------ C:\WINDOWS\unvise32.exe
2007-08-03 21:46 6,352,896 --a------ C:\WINDOWS\system32\PSP VintageWarmer2.dll
2007-08-03 21:46 <DIR> d-------- C:\Programme\PSPaudioware
2007-08-03 21:45 129,024 --a------ C:\WINDOWS\UNWISE.EXE
2007-08-03 21:45 <DIR> d-------- C:\Programme\SpectralDesign
2007-08-03 21:45 <DIR> d-------- C:\audio
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-25 20:47 --------- d-------- C:\Programme\FlashGet
2007-08-24 13:55 --------- d--h----- C:\Programme\InstallShield Installation Information
2007-08-22 16:43 --------- d-------- C:\Programme\Winamp
2007-08-21 03:10 --------- d-------- C:\Programme\Online-Dienste
2007-08-02 22:21 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-24 22:16 --------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2007-07-24 22:16 --------- d-------- C:\Programme\ATI Technologies
2007-07-21 01:00 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia Multimedia Player
2007-07-21 01:00 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia Multimedia Player
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\PC Suite
2007-07-19 21:33 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\PC Suite
2007-07-19 21:33 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\PC Suite
2007-07-19 21:31 --------- d-------- C:\Programme\Nokia
2007-07-19 21:31 --------- d-------- C:\Programme\Gemeinsame Dateien\PCSuite
2007-07-19 21:31 --------- d-------- C:\Programme\Gemeinsame Dateien\Nokia
2007-07-19 21:31 --------- d-------- C:\Programme\DIFX
2007-07-19 21:30 --------- d-------- C:\Programme\PC Connectivity Solution
2007-07-19 21:30 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Installations
2007-07-18 22:56 3584000 --------- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-16 21:51 --------- d-------- C:\Programme\Xilisoft
2007-07-16 21:51 --------- d-------- C:\Programme\QuickTime
2007-07-13 01:30 765952 --------- C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-02 21:41 524288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-07-02 21:41 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 21:41 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-07-02 21:41 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-07-02 21:37 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 21:37 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 21:37 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 21:37 740442 --a------ C:\WINDOWS\system32\DivX.dll
2007-07-02 21:37 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-07-02 21:37 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 21:37 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-07-02 21:37 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 21:37 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-07-02 21:37 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-07-02 21:37 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-07-02 21:37 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-07-02 21:36 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 21:36 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-06-27 16:12 824320 --------- C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 16:12 671232 --------- C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 16:12 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 16:12 477696 --------- C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 16:12 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 16:12 27648 --------- C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 16:12 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 16:12 193024 --------- C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 16:12 1154048 --------- C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 16:12 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 16:12 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 16:11 6059008 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 16:11 44544 --------- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 16:11 384512 --------- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 16:11 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 16:11 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 16:11 230400 --------- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 16:11 153088 --------- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 16:11 132608 --------- C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 16:11 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 11:16 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 11:16 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 11:16 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 09:07 161792 --------- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 08:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-26 08:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 15:40 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 15:40 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 15:10 1036288 --a------ C:\WINDOWS\explorer.exe
2007-06-13 15:10 1036288 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-05-29 02:35 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-05-29 02:34 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-05-29 02:17 0 -rahs---- C:\MSDOS.SYS
2007-05-29 02:17 0 -rahs---- C:\IO.SYS
2007-05-29 02:17 0 --a------ C:\CONFIG.SYS
2007-05-29 02:17 0 --a------ C:\AUTOEXEC.BAT
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RMETray"="digi96.exe" [2005-06-14 18:20 C:\WINDOWS\system32\digi96.exe]
"Flashget"="C:\Programme\FlashGet\FlashGet.exe" [2007-06-29 13:44]
"H2O"="C:\Programme\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 00:00]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"Matrox PowerDesk SE"="c:\Programme\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2007-04-04 09:48]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2007-03-18 00:04]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:57]
"ICQ"="C:\Programme\ICQ6\ICQ.exe" [2007-08-08 17:03]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"EPSON Stylus DX4000 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S384.tmp" /EF "HKCU"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^PlexTools Professional LE.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\PlexTools Professional LE.lnk
backup=C:\WINDOWS\pss\PlexTools Professional LE.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\DOKUME~1\TEIBER~1\LOKALE~1\Temp\E_S1CF.tmp" /EF "HKCU"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager]
C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewport]
C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Programme\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSDrvCheck]
C:\WINDOWS\system32\PSDrvCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Programme\Java\jre1.6.0_02\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Programme\Winamp\winampa.exe
R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys
R1 avgio;avgio;\??\C:\Programme\AntiVir PersonalEdition Classic\avgio.sys
R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
R1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
R2 digi96;RME Digi Audio Device;C:\WINDOWS\system32\DRIVERS\digi96.sys
R3 avgntflt;avgntflt;\??\C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys
R3 G400DH;G400DH;C:\WINDOWS\system32\DRIVERS\g400dhm.sys
R3 USBMN4X4;M-Audio USB MidiSport 4x4;C:\WINDOWS\system32\drivers\usbmn4x4.sys
S2 Matrox Centering Service;Matrox Centering Service;"c:\Programme\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe"
S3 USB44LDR;M-Audio USB MidiSport 4x4 Loader;C:\WINDOWS\system32\drivers\usb44ldr.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac238761-51f1-11dc-b288-8c764b8e5d89}]
verb1\command- desktop.exe
*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
*Newly Created Service* - CATCHME
*Newly Created Service* - GMER
*Newly Created Service* - SSMDRV
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-26 01:50:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-26 1:50:58
--- E O F ---
|
|
26.08.2007, 01:42
| #6 |
| | Rootkit/Trojaner on board? COMBOFIX LOG-FILE Code:
ATTFilter ComboFix 07-08-25.2 - 2007-08-26 1:48:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.547 [GMT 2:00]
* Created a new restore point
((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))
2007-08-26 01:31 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-25 23:46 <DIR> d-------- C:\Programme\Div
2007-08-25 21:01 <DIR> d-------- C:\Programme\JackThis
2007-08-25 20:52 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic
2007-08-24 14:12 737,280 --a------ C:\WINDOWS\system32\msvcp70d.dll
2007-08-24 14:12 163,840 --a------ C:\WINDOWS\system32\ArtFfct.dll
2007-08-24 14:12 <DIR> d-------- C:\Programme\Arturia
2007-08-24 13:55 <DIR> d-------- C:\Programme\YAMAHA
2007-08-24 10:29 22,304 --a------ C:\WINDOWS\system32\drivers\usbmn4x4.sys
2007-08-24 10:29 214,016 --a------ C:\WINDOWS\system32\usbmn4x4.dll
2007-08-24 10:29 16,416 --a------ C:\WINDOWS\system32\drivers\usb44ldr.sys
2007-08-24 10:19 962,560 --a------ C:\WINDOWS\system32\g400icd.dll
2007-08-24 10:19 87,560 --a------ C:\WINDOWS\system32\mgabg.exe
2007-08-24 10:19 350,464 --a------ C:\WINDOWS\system32\drivers\g400dhm.sys
2007-08-24 10:19 2,399,232 --a------ C:\WINDOWS\system32\g400dhd.dll
2007-08-24 10:19 139,264 --a------ C:\WINDOWS\system32\MtxCIP.dll
2007-08-24 10:19 <DIR> d-------- C:\WINDOWS\system32\PDesk
2007-08-24 10:19 <DIR> d-------- C:\Programme\Matrox Graphics Inc
2007-08-24 10:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Matrox Graphics Inc
2007-08-24 10:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Matrox
2007-08-24 10:18 <DIR> d-------- C:\mgafold
2007-08-24 09:04 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-08-24 09:03 75,512 --a------ C:\WINDOWS\zllsputility.exe
2007-08-24 09:03 54,936 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll
2007-08-24 09:03 42,648 --a------ C:\WINDOWS\zllsputility_loc0407.dll
2007-08-24 09:03 22,168 --a------ C:\WINDOWS\system32\imsinstall_loc0407.dll
2007-08-24 09:03 18,072 --a------ C:\WINDOWS\system32\imslsp_install_loc0407.dll
2007-08-24 09:03 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-08-24 09:02 1,087,216 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-08-24 09:02 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-08-24 09:02 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-08-24 06:17 <DIR> d-------- C:\Programme\Directory Lister Pro
2007-08-24 06:17 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\KRKsoft
2007-08-21 13:05 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\FabFilter
2007-08-21 09:32 <DIR> d-------- C:\HijackThis
2007-08-21 09:21 <DIR> d-------- C:\Programme\HiJackThis(2)
2007-08-21 06:41 286,720 --a------ C:\WINDOWS\iun506.exe
2007-08-21 06:41 <DIR> d-------- C:\Programme\War Drumz VST
2007-08-21 05:50 <DIR> d-------- C:\Programme\EDIROL
2007-08-21 05:45 <DIR> d-------- C:\Programme\iZotope
2007-08-21 05:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\iZotope
2007-08-21 05:45 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\iZotope
2007-08-21 05:30 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Twin
2007-08-20 15:57 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-08-20 15:57 <DIR> d-------- C:\Programme\MSXML 6.0
2007-08-20 15:57 <DIR> d-------- C:\Programme\MSXML 4.0
2007-08-10 19:35 <DIR> d-------- C:\Programme\WinAVI Video Converter
2007-08-10 09:02 <DIR> d-------- C:\Programme\WNAS
2007-08-09 18:02 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-08-09 18:02 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-08-09 18:02 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-08-09 13:41 <DIR> d-------- C:\Programme\thriXXX
2007-08-09 12:44 <DIR> d-------- C:\Program Files
2007-08-09 03:28 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\DivX
2007-08-09 03:25 <DIR> d-------- C:\Programme\DivX
2007-08-08 21:42 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\ICQ
2007-08-08 21:41 <DIR> d-------- C:\Programme\ICQ6
2007-08-08 21:41 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\InstallShield
2007-08-08 18:27 <DIR> d-------- C:\Programme\AVI MPEG RM WMV Joiner
2007-08-08 18:26 <DIR> d-------- C:\Programme\Blaze Media Pro
2007-08-08 18:23 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
2007-08-08 18:14 <DIR> d-------- C:\Programme\Amor Video Joiner
2007-08-08 16:15 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Roni Music
2007-08-08 16:14 <DIR> d-------- C:\Programme\Roni Music
2007-08-08 15:42 <DIR> d-------- C:\Programme\CCleaner
2007-08-06 22:16 <DIR> d-------- C:\Programme\ArtsAcoustic Reverb
2007-08-06 22:16 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\ArtsAcoustic
2007-08-06 22:11 <DIR> d-------- C:\Programme\OHMFORCE
2007-08-06 22:08 <DIR> d-------- C:\Programme\Buzz
2007-08-06 22:07 <DIR> d-------- C:\Programme\Jeskola Buzz
2007-08-06 22:06 <DIR> d-------- C:\Programme\Tone2
2007-08-06 22:06 <DIR> d-------- C:\Programme\Kjaerhus Audio
2007-08-06 22:04 <DIR> d-------- C:\Programme\Pro-53
2007-08-06 22:02 611,840 --a------ C:\WINDOWS\system32\vobhw.dll
2007-08-06 22:02 19,456 --a------ C:\WINDOWS\system32\asapi.dll
2007-08-06 22:02 153,088 --a------ C:\WINDOWS\system32\IWUninstall.exe
2007-08-06 22:02 11,264 --a------ C:\WINDOWS\system32\drivers\asapi.sys
2007-08-06 21:54 61,440 --a------ C:\WINDOWS\system32\NI_DFD_1_5.dll
2007-08-06 21:54 393,216 --a------ C:\WINDOWS\system32\NI_IRC_1_2.dll
2007-08-06 21:54 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2007-08-06 21:54 1,990,656 --a------ C:\WINDOWS\system32\kconvert.dll
2007-08-06 21:54 <DIR> d-------- C:\Programme\Native Instruments
2007-08-06 21:50 <DIR> d-------- C:\Programme\AudioRetoucher
2007-08-05 14:11 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Waves Audio
2007-08-04 23:53 <DIR> d-------- C:\Programme\NO1 Video Converter
2007-08-04 01:43 <DIR> d-------- C:\Programme\Nexus
2007-08-03 23:29 <DIR> d-------- C:\Programme\Waves
2007-08-03 23:28 <DIR> d-------- C:\Programme\Extreme Sample Converter 3
2007-08-03 22:14 724,992 --a------ C:\WINDOWS\iun6002.exe
2007-08-03 22:14 <DIR> d-------- C:\Programme\M-Audio Midisport 4x4
2007-08-03 22:03 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Steinberg
2007-08-03 22:00 225,280 --a------ C:\WINDOWS\system32\ReWire.dll
2007-08-03 21:51 <DIR> d-------- C:\Programme\z3ta+
2007-08-03 21:51 <DIR> d-------- C:\Documents and Settings
2007-08-03 21:50 86,016 --a------ C:\WINDOWS\unvise32.exe
2007-08-03 21:46 6,352,896 --a------ C:\WINDOWS\system32\PSP VintageWarmer2.dll
2007-08-03 21:46 <DIR> d-------- C:\Programme\PSPaudioware
2007-08-03 21:45 129,024 --a------ C:\WINDOWS\UNWISE.EXE
2007-08-03 21:45 <DIR> d-------- C:\Programme\SpectralDesign
2007-08-03 21:45 <DIR> d-------- C:\audio
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-25 20:47 --------- d-------- C:\Programme\FlashGet
2007-08-24 13:55 --------- d--h----- C:\Programme\InstallShield Installation Information
2007-08-22 16:43 --------- d-------- C:\Programme\Winamp
2007-08-21 03:10 --------- d-------- C:\Programme\Online-Dienste
2007-08-02 22:21 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-24 22:16 --------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2007-07-24 22:16 --------- d-------- C:\Programme\ATI Technologies
2007-07-21 01:00 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia Multimedia Player
2007-07-21 01:00 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia Multimedia Player
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\PC Suite
2007-07-19 21:33 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\PC Suite
2007-07-19 21:33 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\PC Suite
2007-07-19 21:31 --------- d-------- C:\Programme\Nokia
2007-07-19 21:31 --------- d-------- C:\Programme\Gemeinsame Dateien\PCSuite
2007-07-19 21:31 --------- d-------- C:\Programme\Gemeinsame Dateien\Nokia
2007-07-19 21:31 --------- d-------- C:\Programme\DIFX
2007-07-19 21:30 --------- d-------- C:\Programme\PC Connectivity Solution
2007-07-19 21:30 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Installations
2007-07-18 22:56 3584000 --------- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-16 21:51 --------- d-------- C:\Programme\Xilisoft
2007-07-16 21:51 --------- d-------- C:\Programme\QuickTime
2007-07-13 01:30 765952 --------- C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-02 21:41 524288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-07-02 21:41 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 21:41 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-07-02 21:41 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-07-02 21:37 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 21:37 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 21:37 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 21:37 740442 --a------ C:\WINDOWS\system32\DivX.dll
2007-07-02 21:37 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-07-02 21:37 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 21:37 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-07-02 21:37 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 21:37 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-07-02 21:37 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-07-02 21:37 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-07-02 21:37 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-07-02 21:36 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 21:36 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-06-27 16:12 824320 --------- C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 16:12 671232 --------- C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 16:12 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 16:12 477696 --------- C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 16:12 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 16:12 27648 --------- C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 16:12 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 16:12 193024 --------- C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 16:12 1154048 --------- C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 16:12 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 16:12 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 16:11 6059008 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 16:11 44544 --------- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 16:11 384512 --------- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 16:11 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 16:11 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 16:11 230400 --------- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 16:11 153088 --------- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 16:11 132608 --------- C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 16:11 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 11:16 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 11:16 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 11:16 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 09:07 161792 --------- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 08:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-26 08:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 15:40 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 15:40 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 15:10 1036288 --a------ C:\WINDOWS\explorer.exe
2007-06-13 15:10 1036288 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-05-29 02:35 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-05-29 02:34 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-05-29 02:17 0 -rahs---- C:\MSDOS.SYS
2007-05-29 02:17 0 -rahs---- C:\IO.SYS
2007-05-29 02:17 0 --a------ C:\CONFIG.SYS
2007-05-29 02:17 0 --a------ C:\AUTOEXEC.BAT
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RMETray"="digi96.exe" [2005-06-14 18:20 C:\WINDOWS\system32\digi96.exe]
"Flashget"="C:\Programme\FlashGet\FlashGet.exe" [2007-06-29 13:44]
"H2O"="C:\Programme\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 00:00]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"Matrox PowerDesk SE"="c:\Programme\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2007-04-04 09:48]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2007-03-18 00:04]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:57]
"ICQ"="C:\Programme\ICQ6\ICQ.exe" [2007-08-08 17:03]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"EPSON Stylus DX4000 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S384.tmp" /EF "HKCU"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^PlexTools Professional LE.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\PlexTools Professional LE.lnk
backup=C:\WINDOWS\pss\PlexTools Professional LE.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\DOKUME~1\TEIBER~1\LOKALE~1\Temp\E_S1CF.tmp" /EF "HKCU"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager]
C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewport]
C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Programme\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSDrvCheck]
C:\WINDOWS\system32\PSDrvCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Programme\Java\jre1.6.0_02\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Programme\Winamp\winampa.exe
R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys
R1 avgio;avgio;\??\C:\Programme\AntiVir PersonalEdition Classic\avgio.sys
R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
R1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
R2 digi96;RME Digi Audio Device;C:\WINDOWS\system32\DRIVERS\digi96.sys
R3 avgntflt;avgntflt;\??\C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys
R3 G400DH;G400DH;C:\WINDOWS\system32\DRIVERS\g400dhm.sys
R3 USBMN4X4;M-Audio USB MidiSport 4x4;C:\WINDOWS\system32\drivers\usbmn4x4.sys
S2 Matrox Centering Service;Matrox Centering Service;"c:\Programme\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe"
S3 USB44LDR;M-Audio USB MidiSport 4x4 Loader;C:\WINDOWS\system32\drivers\usb44ldr.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac238761-51f1-11dc-b288-8c764b8e5d89}]
verb1\command- desktop.exe
*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
*Newly Created Service* - CATCHME
*Newly Created Service* - GMER
*Newly Created Service* - SSMDRV
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-26 01:50:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-26 1:50:58
--- E O F ---
|
|
26.08.2007, 01:56
| #7 |
| | Rootkit/Trojaner on board? COMBOFIX LOG-FILE Code:
ATTFilter ComboFix 07-08-25.2 - 2007-08-26 1:48:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.547 [GMT 2:00]
* Created a new restore point
((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))
2007-08-26 01:31 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-25 23:46 <DIR> d-------- C:\Programme\Div
2007-08-25 21:01 <DIR> d-------- C:\Programme\JackThis
2007-08-25 20:52 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic
2007-08-24 14:12 737,280 --a------ C:\WINDOWS\system32\msvcp70d.dll
2007-08-24 14:12 163,840 --a------ C:\WINDOWS\system32\ArtFfct.dll
2007-08-24 14:12 <DIR> d-------- C:\Programme\Arturia
2007-08-24 13:55 <DIR> d-------- C:\Programme\YAMAHA
2007-08-24 10:29 22,304 --a------ C:\WINDOWS\system32\drivers\usbmn4x4.sys
2007-08-24 10:29 214,016 --a------ C:\WINDOWS\system32\usbmn4x4.dll
2007-08-24 10:29 16,416 --a------ C:\WINDOWS\system32\drivers\usb44ldr.sys
2007-08-24 10:19 962,560 --a------ C:\WINDOWS\system32\g400icd.dll
2007-08-24 10:19 87,560 --a------ C:\WINDOWS\system32\mgabg.exe
2007-08-24 10:19 350,464 --a------ C:\WINDOWS\system32\drivers\g400dhm.sys
2007-08-24 10:19 2,399,232 --a------ C:\WINDOWS\system32\g400dhd.dll
2007-08-24 10:19 139,264 --a------ C:\WINDOWS\system32\MtxCIP.dll
2007-08-24 10:19 <DIR> d-------- C:\WINDOWS\system32\PDesk
2007-08-24 10:19 <DIR> d-------- C:\Programme\Matrox Graphics Inc
2007-08-24 10:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Matrox Graphics Inc
2007-08-24 10:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Matrox
2007-08-24 10:18 <DIR> d-------- C:\mgafold
2007-08-24 09:04 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-08-24 09:03 75,512 --a------ C:\WINDOWS\zllsputility.exe
2007-08-24 09:03 54,936 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll
2007-08-24 09:03 42,648 --a------ C:\WINDOWS\zllsputility_loc0407.dll
2007-08-24 09:03 22,168 --a------ C:\WINDOWS\system32\imsinstall_loc0407.dll
2007-08-24 09:03 18,072 --a------ C:\WINDOWS\system32\imslsp_install_loc0407.dll
2007-08-24 09:03 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-08-24 09:02 1,087,216 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-08-24 09:02 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-08-24 09:02 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-08-24 06:17 <DIR> d-------- C:\Programme\Directory Lister Pro
2007-08-24 06:17 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\KRKsoft
2007-08-21 13:05 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\FabFilter
2007-08-21 09:32 <DIR> d-------- C:\HijackThis
2007-08-21 09:21 <DIR> d-------- C:\Programme\HiJackThis(2)
2007-08-21 06:41 286,720 --a------ C:\WINDOWS\iun506.exe
2007-08-21 06:41 <DIR> d-------- C:\Programme\War Drumz VST
2007-08-21 05:50 <DIR> d-------- C:\Programme\EDIROL
2007-08-21 05:45 <DIR> d-------- C:\Programme\iZotope
2007-08-21 05:45 <DIR> d-------- C:\Programme\Gemeinsame Dateien\iZotope
2007-08-21 05:45 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\iZotope
2007-08-21 05:30 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Twin
2007-08-20 15:57 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-08-20 15:57 <DIR> d-------- C:\Programme\MSXML 6.0
2007-08-20 15:57 <DIR> d-------- C:\Programme\MSXML 4.0
2007-08-10 19:35 <DIR> d-------- C:\Programme\WinAVI Video Converter
2007-08-10 09:02 <DIR> d-------- C:\Programme\WNAS
2007-08-09 18:02 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2007-08-09 18:02 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-08-09 18:02 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-08-09 13:41 <DIR> d-------- C:\Programme\thriXXX
2007-08-09 12:44 <DIR> d-------- C:\Program Files
2007-08-09 03:28 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\DivX
2007-08-09 03:25 <DIR> d-------- C:\Programme\DivX
2007-08-08 21:42 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\ICQ
2007-08-08 21:41 <DIR> d-------- C:\Programme\ICQ6
2007-08-08 21:41 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\InstallShield
2007-08-08 18:27 <DIR> d-------- C:\Programme\AVI MPEG RM WMV Joiner
2007-08-08 18:26 <DIR> d-------- C:\Programme\Blaze Media Pro
2007-08-08 18:23 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
2007-08-08 18:14 <DIR> d-------- C:\Programme\Amor Video Joiner
2007-08-08 16:15 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Roni Music
2007-08-08 16:14 <DIR> d-------- C:\Programme\Roni Music
2007-08-08 15:42 <DIR> d-------- C:\Programme\CCleaner
2007-08-06 22:16 <DIR> d-------- C:\Programme\ArtsAcoustic Reverb
2007-08-06 22:16 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\ArtsAcoustic
2007-08-06 22:11 <DIR> d-------- C:\Programme\OHMFORCE
2007-08-06 22:08 <DIR> d-------- C:\Programme\Buzz
2007-08-06 22:07 <DIR> d-------- C:\Programme\Jeskola Buzz
2007-08-06 22:06 <DIR> d-------- C:\Programme\Tone2
2007-08-06 22:06 <DIR> d-------- C:\Programme\Kjaerhus Audio
2007-08-06 22:04 <DIR> d-------- C:\Programme\Pro-53
2007-08-06 22:02 611,840 --a------ C:\WINDOWS\system32\vobhw.dll
2007-08-06 22:02 19,456 --a------ C:\WINDOWS\system32\asapi.dll
2007-08-06 22:02 153,088 --a------ C:\WINDOWS\system32\IWUninstall.exe
2007-08-06 22:02 11,264 --a------ C:\WINDOWS\system32\drivers\asapi.sys
2007-08-06 21:54 61,440 --a------ C:\WINDOWS\system32\NI_DFD_1_5.dll
2007-08-06 21:54 393,216 --a------ C:\WINDOWS\system32\NI_IRC_1_2.dll
2007-08-06 21:54 233,472 --a------ C:\WINDOWS\system32\REX Shared Library.dll
2007-08-06 21:54 1,990,656 --a------ C:\WINDOWS\system32\kconvert.dll
2007-08-06 21:54 <DIR> d-------- C:\Programme\Native Instruments
2007-08-06 21:50 <DIR> d-------- C:\Programme\AudioRetoucher
2007-08-05 14:11 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Waves Audio
2007-08-04 23:53 <DIR> d-------- C:\Programme\NO1 Video Converter
2007-08-04 01:43 <DIR> d-------- C:\Programme\Nexus
2007-08-03 23:29 <DIR> d-------- C:\Programme\Waves
2007-08-03 23:28 <DIR> d-------- C:\Programme\Extreme Sample Converter 3
2007-08-03 22:14 724,992 --a------ C:\WINDOWS\iun6002.exe
2007-08-03 22:14 <DIR> d-------- C:\Programme\M-Audio Midisport 4x4
2007-08-03 22:03 <DIR> d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Steinberg
2007-08-03 22:00 225,280 --a------ C:\WINDOWS\system32\ReWire.dll
2007-08-03 21:51 <DIR> d-------- C:\Programme\z3ta+
2007-08-03 21:51 <DIR> d-------- C:\Documents and Settings
2007-08-03 21:50 86,016 --a------ C:\WINDOWS\unvise32.exe
2007-08-03 21:46 6,352,896 --a------ C:\WINDOWS\system32\PSP VintageWarmer2.dll
2007-08-03 21:46 <DIR> d-------- C:\Programme\PSPaudioware
2007-08-03 21:45 129,024 --a------ C:\WINDOWS\UNWISE.EXE
2007-08-03 21:45 <DIR> d-------- C:\Programme\SpectralDesign
2007-08-03 21:45 <DIR> d-------- C:\audio
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-08-25 20:47 --------- d-------- C:\Programme\FlashGet
2007-08-24 13:55 --------- d--h----- C:\Programme\InstallShield Installation Information
2007-08-22 16:43 --------- d-------- C:\Programme\Winamp
2007-08-21 03:10 --------- d-------- C:\Programme\Online-Dienste
2007-08-02 22:21 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-07-24 22:16 --------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2007-07-24 22:16 --------- d-------- C:\Programme\ATI Technologies
2007-07-21 01:00 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia Multimedia Player
2007-07-21 01:00 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia Multimedia Player
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\Nokia
2007-07-19 21:42 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\PC Suite
2007-07-19 21:33 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\PC Suite
2007-07-19 21:33 --------- d-------- C:\DOKUME~1\TEIBER~1\ANWEND~1\PC Suite
2007-07-19 21:31 --------- d-------- C:\Programme\Nokia
2007-07-19 21:31 --------- d-------- C:\Programme\Gemeinsame Dateien\PCSuite
2007-07-19 21:31 --------- d-------- C:\Programme\Gemeinsame Dateien\Nokia
2007-07-19 21:31 --------- d-------- C:\Programme\DIFX
2007-07-19 21:30 --------- d-------- C:\Programme\PC Connectivity Solution
2007-07-19 21:30 --------- d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Installations
2007-07-18 22:56 3584000 --------- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-16 21:51 --------- d-------- C:\Programme\Xilisoft
2007-07-16 21:51 --------- d-------- C:\Programme\QuickTime
2007-07-13 01:30 765952 --------- C:\WINDOWS\system32\dllcache\vgx.dll
2007-07-02 21:41 524288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-07-02 21:41 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-07-02 21:41 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-07-02 21:41 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-07-02 21:37 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-07-02 21:37 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-07-02 21:37 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-07-02 21:37 740442 --a------ C:\WINDOWS\system32\DivX.dll
2007-07-02 21:37 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-07-02 21:37 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll
2007-07-02 21:37 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-07-02 21:37 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll
2007-07-02 21:37 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-07-02 21:37 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-07-02 21:37 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-07-02 21:37 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-07-02 21:36 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe
2007-07-02 21:36 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-06-27 16:12 824320 --------- C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-27 16:12 671232 --------- C:\WINDOWS\system32\dllcache\mstime.dll
2007-06-27 16:12 52224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-06-27 16:12 477696 --------- C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-06-27 16:12 459264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-06-27 16:12 27648 --------- C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-06-27 16:12 232960 --------- C:\WINDOWS\system32\dllcache\webcheck.dll
2007-06-27 16:12 193024 --------- C:\WINDOWS\system32\dllcache\msrating.dll
2007-06-27 16:12 1154048 --------- C:\WINDOWS\system32\dllcache\urlmon.dll
2007-06-27 16:12 105984 --------- C:\WINDOWS\system32\dllcache\url.dll
2007-06-27 16:12 102400 --------- C:\WINDOWS\system32\dllcache\occache.dll
2007-06-27 16:11 6059008 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
2007-06-27 16:11 44544 --------- C:\WINDOWS\system32\dllcache\iernonce.dll
2007-06-27 16:11 384512 --------- C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-06-27 16:11 383488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-06-27 16:11 267776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll
2007-06-27 16:11 230400 --------- C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-06-27 16:11 153088 --------- C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-06-27 16:11 132608 --------- C:\WINDOWS\system32\dllcache\extmgr.dll
2007-06-27 16:11 124928 --------- C:\WINDOWS\system32\dllcache\advpack.dll
2007-06-27 11:16 63488 --------- C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-06-27 11:16 625152 --------- C:\WINDOWS\system32\dllcache\iexplore.exe
2007-06-27 11:16 13824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-06-27 09:07 161792 --------- C:\WINDOWS\system32\dllcache\ieakui.dll
2007-06-26 08:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-26 08:08 1104896 --------- C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 15:40 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-19 15:40 282112 --------- C:\WINDOWS\system32\dllcache\gdi32.dll
2007-06-13 15:10 1036288 --a------ C:\WINDOWS\explorer.exe
2007-06-13 15:10 1036288 --------- C:\WINDOWS\system32\dllcache\explorer.exe
2007-05-29 02:35 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-05-29 02:34 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-05-29 02:17 0 -rahs---- C:\MSDOS.SYS
2007-05-29 02:17 0 -rahs---- C:\IO.SYS
2007-05-29 02:17 0 --a------ C:\CONFIG.SYS
2007-05-29 02:17 0 --a------ C:\AUTOEXEC.BAT
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RMETray"="digi96.exe" [2005-06-14 18:20 C:\WINDOWS\system32\digi96.exe]
"Flashget"="C:\Programme\FlashGet\FlashGet.exe" [2007-06-29 13:44]
"H2O"="C:\Programme\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 00:00]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"Matrox PowerDesk SE"="c:\Programme\Matrox Graphics Inc\PowerDesk SE\Matrox.PowerDesk SE.exe" [2007-04-04 09:48]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2007-03-18 00:04]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:57]
"ICQ"="C:\Programme\ICQ6\ICQ.exe" [2007-08-08 17:03]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"EPSON Stylus DX4000 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S384.tmp" /EF "HKCU"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^PlexTools Professional LE.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\PlexTools Professional LE.lnk
backup=C:\WINDOWS\pss\PlexTools Professional LE.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\DOKUME~1\TEIBER~1\LOKALE~1\Temp\E_S1CF.tmp" /EF "HKCU"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionDesktopManager]
C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HydraVisionViewport]
C:\Programme\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Programme\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSDrvCheck]
C:\WINDOWS\system32\PSDrvCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Programme\Java\jre1.6.0_02\bin\jusched.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Programme\Winamp\winampa.exe
R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys
R1 avgio;avgio;\??\C:\Programme\AntiVir PersonalEdition Classic\avgio.sys
R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
R1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
R2 digi96;RME Digi Audio Device;C:\WINDOWS\system32\DRIVERS\digi96.sys
R3 avgntflt;avgntflt;\??\C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys
R3 G400DH;G400DH;C:\WINDOWS\system32\DRIVERS\g400dhm.sys
R3 USBMN4X4;M-Audio USB MidiSport 4x4;C:\WINDOWS\system32\drivers\usbmn4x4.sys
S2 Matrox Centering Service;Matrox Centering Service;"c:\Programme\Matrox Graphics Inc\PowerDesk\Services\Matrox.PowerDesk.Services.exe"
S3 USB44LDR;M-Audio USB MidiSport 4x4 Loader;C:\WINDOWS\system32\drivers\usb44ldr.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac238761-51f1-11dc-b288-8c764b8e5d89}]
verb1\command- desktop.exe
*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
*Newly Created Service* - CATCHME
*Newly Created Service* - GMER
*Newly Created Service* - SSMDRV
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-26 01:50:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-08-26 1:50:58
--- E O F ---
|
|
26.08.2007, 11:28
| #8 |
| /// AVZ-Toolkit Guru | Rootkit/Trojaner on board? Morgen. Lasse bitte folgende Dateien auf VT überprüfen: " C:\WINDOWS\zllsputility_loc0407.dll " " C:\WINDOWS\zllsputility.exe " " C:\WINDOWS\system32\zllictbl.dat " Wozu nutzt du "Nir" ? Überprüfe bitte die Größe folgender Datei: " C:\WINDOWS\iun6002.exe " 724992 Byte , 737280 Byte ? Wenn nicht lade sie bitte bei VT hoch.. Gruß Undoreal
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
26.08.2007, 16:58
| #9 |
| | Rootkit/Trojaner on board? Hallo Undoreal, vielen Dank erstmal soweit. zllsputility_loc0407.dll: KEIN ERGEBNIS / KEIN VIRUS zllsputility.exe: KEIN ERGEBNIS / KEIN VIRUS zllictbl.dat: KEIN ERGEBNIS / KEIN VIRUS iun6002.exe: 724.992 bytes Was meinst du mit "nir" ??? Kann es sein, dass das System sobald ich onl. gehe eine mir nicht sichtbare Partition mounted. Die immer wieder getrennt wird wenn ich bzw der Server dann offl. geht!? Ist nur so eine waage Vermutung von mir ?! In der Registry hab ich diese Einträge gefunden. Weis jetzt nicht ob die Standart sind oder nicht. \??\Volume{23b9a234-33c2-11dc-b756-806d6172696f} \??\Volume{23b9a235-33c2-11dc-b756-806d6172696f} \??\Volume{23b9a236-33c2-11dc-b756-87061987558b} \??\Volume{23b9a237-33c2-11dc-b756-87061987558b} \??\Volume{341ddf94-3c6b-11dc-b25f-806d6172696f} \??\Volume{38a6a804-0d84-11dc-bd0b-806d6172696f} \??\Volume{38a6a805-0d84-11dc-bd0b-806d6172696f} \??\Volume{38a6a807-0d84-11dc-bd0b-806d6172696f} \??\Volume{38a6a808-0d84-11dc-bd0b-806d6172696f} \??\Volume{38a6a809-0d84-11dc-bd0b-806d6172696f} \??\Volume{38a6a80a-0d84-11dc-bd0b-806d6172696f} \??\Volume{38a6a80c-0d84-11dc-bd0b-806d6172696f} \??\Volume{ac238761-51f1-11dc-b288-8c764b8e5d89} \DosDevices\A: \DosDevices\C: \DosDevices\D: \DosDevices\E: \DosDevices\F: \DosDevices\G: \DosDevices\H: Ich habe nämlich lediglich HDD1 (C:+E  , HDD2 (D und F: (DVD-Brenner)Als ich mir meinen Rechner die Nacht über ansah stellte ich auch fest, dass irgendetwas od irgendjemand auf meinem PC sehr großer MSXML-Fan zu sein scheint. Denn es wurde jede Menge XML Kram irgendwie überallhin installiert. (Microsoft XML Core Services) sowie Microsoft .NET Framework´s Dateien etc. Ich hab auch mal Filelist laufen lassen, vlt. gibt das ja noch einen Aufschluss: Code:
ATTFilter ----- Root ----------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\ 26.08.2007 16:34 1.073.270.784 hiberfil.sys 26.08.2007 16:34 1.610.612.736 pagefile.sys 26.08.2007 03:41 211 boot.ini 26.08.2007 01:50 18.232 ComboFix.txt 01.08.2007 22:11 13.760 Introduction.wav ----- System32 ------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\WINDOWS\system32 26.08.2007 16:35 55.081 vsconfig.xml 25.08.2007 20:41 2.206 wpa.dbl 24.08.2007 10:50 214.016 usbmn4x4.dll 24.08.2007 09:09 4.212 zllictbl.dat 04.08.2007 23:53 16.832 amcompat.tlb 04.08.2007 23:53 23.392 nscompat.tlb 03.08.2007 22:02 146.808 FNTCACHE.DAT 03.08.2007 21:46 6.352.896 PSP VintageWarmer2.dll 03.08.2007 20:17 34.308 BASSMOD.dll 03.08.2007 06:34 16.789.464 MRT.exe 30.07.2007 19:20 30.040 wuaucpl.cpl.mui 30.07.2007 19:20 30.040 wuapi.dll.mui 30.07.2007 19:19 1.712.984 wuaueng.dll 30.07.2007 19:19 549.720 wuapi.dll 30.07.2007 19:19 325.976 wucltui.dll 30.07.2007 19:19 203.096 wuweb.dll 30.07.2007 19:19 216.408 wuaucpl.cpl 30.07.2007 19:19 92.504 cdm.dll 30.07.2007 19:19 53.080 wuauclt.exe 30.07.2007 19:19 43.352 wups2.dll 30.07.2007 19:19 271.224 mucltui.dll 30.07.2007 19:19 207.736 muweb.dll 30.07.2007 19:18 34.136 wucltui.dll.mui 30.07.2007 19:18 30.072 mucltui.dll.mui 30.07.2007 19:18 33.624 wups.dll 30.07.2007 19:18 20.824 wuaueng.dll.mui 27.07.2007 18:31 419.328 perfh009.dat 27.07.2007 18:31 63.000 perfc009.dat 27.07.2007 18:31 74.732 perfc007.dat 27.07.2007 18:31 433.738 perfh007.dat ----- Prefetch ------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\WINDOWS\Prefetch 26.08.2007 17:41 28.198 WMIPRVSE.EXE-28F301A9.pf 26.08.2007 17:41 21.066 IPCONFIG.EXE-2395F30B.pf 26.08.2007 17:41 62.542 WSCRIPT.EXE-32960AB9.pf 26.08.2007 17:40 48.098 CMD.EXE-087B4001.pf 26.08.2007 17:40 12.150 FIND.EXE-0EC32F1E.pf 26.08.2007 17:40 18.548 REGEDIT.EXE-1B606482.pf 26.08.2007 17:40 108.404 EXPLORER.EXE-082F38A9.pf 26.08.2007 17:39 178.488 WINRAR.EXE-3588DFE8.pf 26.08.2007 17:39 18.112 VERCLSID.EXE-3667BD89.pf 26.08.2007 17:03 91.048 WINAMP.EXE-08C38ED9.pf 26.08.2007 16:49 29.216 FLASHGOT.EXE-04996CCA.pf 26.08.2007 16:49 111.222 FIREFOX.EXE-1D57670A.pf 26.08.2007 16:41 90.084 ICQ.EXE-3425F561.pf 26.08.2007 16:37 71.834 WUAUCLT.EXE-399A8E72.pf 26.08.2007 16:36 33.418 IMAPI.EXE-0BF740A4.pf 26.08.2007 12:41 47.664 NMIndexStoreSvr.exe-1DBCF9FD.pf 26.08.2007 12:41 16.862 NMBGMONITOR.EXE-0BC10095.pf 26.08.2007 12:41 108.992 NERO.EXE-2031B565.pf 26.08.2007 12:38 57.016 NOTEPAD.EXE-336351A9.pf 26.08.2007 12:31 78.208 ACRORD32INFO.EXE-19D979CC.pf 26.08.2007 11:42 91.782 SOFFICE.BIN-101FBE2A.pf 26.08.2007 11:42 72.604 SOFFICE.EXE-08302903.pf 26.08.2007 11:31 25.342 VSMON.EXE-1609C098.pf 26.08.2007 11:31 38.412 ZLCLIENT.EXE-0120F620.pf 26.08.2007 11:22 49.974 HIJACKTHIS.EXE-38B9BC14.pf 26.08.2007 09:53 109.324 RUNDLL32.EXE-2576181F.pf 26.08.2007 09:52 98.922 WMPLAYER.EXE-0996933A.pf 26.08.2007 09:51 64.266 DRWTSN32.EXE-2B4B52AC.pf 26.08.2007 09:51 97.124 DWWIN.EXE-30875ADC.pf 26.08.2007 09:47 21.896 TASKMGR.EXE-20256C55.pf 26.08.2007 09:47 21.574 AVGNT.EXE-36CA4640.pf 26.08.2007 09:47 55.148 FLASHGET.EXE-0B7C6B66.pf 26.08.2007 09:47 9.924 DIGI96.EXE-30084671.pf 26.08.2007 09:40 33.242 DIVXSM.EXE-3407AB62.pf 26.08.2007 09:29 51.546 MMC.EXE-0A5AF4A1.pf 26.08.2007 09:04 44.406 ACDSEEQV.EXE-05193191.pf 26.08.2007 09:02 14.010 SERVICELAYER.EXE-2529B377.pf 26.08.2007 08:59 37.016 NETSTAT.EXE-2B2B4428.pf 26.08.2007 08:54 70.834 MMC.EXE-0A1E6301.pf 26.08.2007 08:54 13.258 DCOMCNFG.EXE-3A58F964.pf 26.08.2007 08:54 129.320 RUNDLL32.EXE-327ED30F.pf 26.08.2007 08:54 92.030 RUNDLL32.EXE-44A0B4BC.pf 26.08.2007 08:48 48.710 DLLHOST.EXE-5353C76C.pf 26.08.2007 08:38 49.128 AVSCAN.EXE-05AECC0E.pf 26.08.2007 08:37 55.796 AVCENTER.EXE-37584419.pf 26.08.2007 08:03 12.776 FINDSTR.EXE-0CA6274B.pf 26.08.2007 07:35 44.128 CONTROL.EXE-013DBFB5.pf 26.08.2007 03:35 67.322 MSCONFIG.EXE-35E4DAE9.pf 26.08.2007 03:00 33.110 MSIEXEC.EXE-2F8A8CAE.pf 26.08.2007 02:51 57.400 MMC.EXE-398DCF39.pf 26.08.2007 02:46 21.898 TCPVIEW.EXE-3A99ECB5.pf 26.08.2007 02:45 16.480 SPYBOTSD14.EXE-3B710653.pf 26.08.2007 02:09 84.788 SPYBOTSD.EXE-1D495A65.pf 26.08.2007 02:06 15.296 SPYBOTSD_INCLUDES.EXE-06D2A0B6.pf 26.08.2007 02:05 20.658 IS-NBNFM.TMP-08583FB4.pf 26.08.2007 02:04 20.622 IS-SIL53.TMP-0368E423.pf 26.08.2007 02:03 15.556 SPYBOTSD_TCPIP.EXE-118C73BD.pf 26.08.2007 01:51 10.066 NIRCMD.EXE-2C39EF53.pf 26.08.2007 01:50 10.048 CATCHME.CFEXE-0F2A0789.pf 26.08.2007 01:50 17.734 DUMPHIVE.CFEXE-2ED3B134.pf 26.08.2007 01:50 59.270 CSCRIPT.EXE-1C26180C.pf 26.08.2007 01:50 3.014 VFIND.CFEXE-2033727F.pf 26.08.2007 01:50 11.378 SORT.EXE-194AE83C.pf 26.08.2007 01:50 11.628 REGT.CFEXE-15DB5DAE.pf 26.08.2007 01:49 53.840 REGSVR32.EXE-25EEFE2F.pf 26.08.2007 01:49 4.180 SED.CFEXE-268D7E58.pf 26.08.2007 01:49 9.250 NIRCMD.CFEXE-19FF4781.pf 26.08.2007 01:49 10.682 SWREG.CFEXE-2BF4FFCD.pf 26.08.2007 01:49 7.178 SWXCACLS.CFEXE-365F7973.pf 26.08.2007 01:49 7.698 SWSC.CFEXE-3B4FE4FE.pf 26.08.2007 01:49 4.424 HANDLE.CFEXE-13427ED2.pf 26.08.2007 01:49 2.816 VFIND.EXE-0CB9A64E.pf 26.08.2007 01:48 4.298 MTEE.CFEXE-1E067BC7.pf 26.08.2007 01:48 11.922 ATTRIB.EXE-39EAFB02.pf 26.08.2007 01:48 3.924 SF.CFEXE-164B3B2D.pf 26.08.2007 01:48 53.504 ERUNT.CFEXE-039977DB.pf 26.08.2007 01:48 5.928 CHCP.COM-18156052.pf 26.08.2007 01:47 21.886 SETPATH.CFEXE-034E3D26.pf 26.08.2007 01:47 19.066 CHKDSK.EXE-2CC4C59D.pf 26.08.2007 01:47 9.242 SWREG.EXE-3560BE42.pf 26.08.2007 01:47 8.996 NIRCMD.EXE-1F7FED22.pf 26.08.2007 01:47 46.020 COMBOFIX.EXE-274F9816.pf 26.08.2007 01:46 14.632 NOTEPAD.EXE-189578DA.pf 26.08.2007 01:42 53.222 MMC.EXE-071F1333.pf 26.08.2007 01:37 90.772 XCOPY.EXE-21FC761A.pf 26.08.2007 01:36 38.520 KILLBOX.EXE-2BB0886A.pf 26.08.2007 01:34 21.212 KILLBOX.EXE-152A2C8E.pf 26.08.2007 01:25 27.152 GMER.EXE-0A54CC3B.pf 26.08.2007 00:54 13.102 PING.EXE-31216D26.pf 26.08.2007 00:45 13.268 RUNDLL32.EXE-39EEDEC6.pf 26.08.2007 00:26 17.910 RUNDLL32.EXE-42D47126.pf 26.08.2007 00:16 31.556 CCLEANER.EXE-065E2F3F.pf 25.08.2007 23:50 10.498 FSBL.EXE-0CEE9DAC.pf 25.08.2007 23:48 14.382 FSBL.EXE-37172625.pf 25.08.2007 23:41 59.476 ACRORD32.EXE-153330F0.pf 25.08.2007 23:31 30.822 RUNDLL32.EXE-409BCF4C.pf 25.08.2007 23:29 48.728 RUNDLL32.EXE-1BC55A4F.pf 25.08.2007 23:28 39.418 RSTRUI.EXE-03C49A96.pf 25.08.2007 23:26 34.372 RUNDLL32.EXE-492E603A.pf 25.08.2007 23:01 63.402 RUNDLL32.EXE-2905E326.pf 25.08.2007 23:00 82.564 RUNDLL32.EXE-4C75EBF8.pf 25.08.2007 22:43 59.896 DIRLISTERPRO.EXE-0887F4CB.pf 25.08.2007 21:46 53.826 AVCONFIG.EXE-3B8B9C26.pf 25.08.2007 21:00 50.370 AVGUARD.EXE-3490B18B.pf 25.08.2007 20:55 35.656 AVNOTIFY.EXE-22AE9451.pf 25.08.2007 20:54 39.346 UPDATE.EXE-13D57D76.pf 25.08.2007 20:54 15.308 PREUPD.EXE-358AA1C1.pf 25.08.2007 20:52 28.768 SCHED.EXE-236A886F.pf 25.08.2007 20:52 17.872 RUNDLL32.EXE-375EBC99.pf 25.08.2007 20:52 12.498 GRPCONV.EXE-111CD845.pf 25.08.2007 20:52 17.970 RUNDLL32.EXE-3D56695D.pf 25.08.2007 20:52 18.546 RUNONCE.EXE-2803F297.pf 25.08.2007 20:52 38.516 SETUP.EXE-0EA4EA7E.pf 25.08.2007 20:51 66.900 ANTIVIR_WORKSTATION_WIN7U_DE_-23576162.pf 24.08.2007 21:34 78.374 WMPLAYER.EXE-0996933B.pf 24.08.2007 20:22 40.180 UPDCLIENT.EXE-215FC96B.pf 24.08.2007 20:04 19.984 RUNDLL32.EXE-2341BBC5.pf 24.08.2007 19:56 21.082 MSDTC.EXE-0E6E4AF7.pf 24.08.2007 19:54 52.874 MMC.EXE-239D8F72.pf 24.08.2007 19:42 56.580 SETUP_WM.EXE-19AC5A9B.pf 24.08.2007 15:22 75.036 HELPSVC.EXE-2878DDA2.pf 24.08.2007 15:00 477.336 Layout.ini 24.08.2007 13:45 18.862 GLJ61.TMP-13647BA5.pf 24.08.2007 13:41 58.476 FOXITR~1.EXE-2C735C97.pf 24.08.2007 13:38 114.498 H2O.EXE-36BC3096.pf 24.08.2007 12:24 19.566 WPSETUP.EXE-132D9515.pf 24.08.2007 10:52 109.056 CUBASESX3.EXE-187256A3.pf 24.08.2007 10:47 7.294 NCLINSTALLER.EXE-29B54FA6.pf 22.08.2007 13:29 18.410 DEFRAG.EXE-273F131E.pf 31.05.2007 11:46 364.664 NTOSBOOT-B00DFAAD.pf 130 Datei(en) 6.137.536 Bytes 0 Verzeichnis(se), 4.886.695.936 Bytes frei ----- Windows -------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\WINDOWS 26.08.2007 17:41 15.588 SchedLgU.Txt 26.08.2007 16:36 159 wiadebug.log 26.08.2007 16:36 1.062.622 WindowsUpdate.log 26.08.2007 16:36 50 wiaservc.log 26.08.2007 16:34 2.048 bootstat.dat 26.08.2007 13:19 250.846 setupapi.log 26.08.2007 12:31 202 NeroDigital.ini 26.08.2007 03:41 260 system.ini 26.08.2007 03:41 507 win.ini 26.08.2007 01:25 250 gmer.ini 26.08.2007 01:25 80 gmer_uninstall.cmd 26.08.2007 01:25 585.791 gmer.dll 24.08.2007 19:44 857 wmsetup.log 24.08.2007 10:50 12.658 Midisport 4x4 Setup Log.txt 24.08.2007 10:50 724.992 iun6002.exe 24.08.2007 10:19 376 MtxCIPLog.txt 24.08.2007 09:12 3.473.359 pfirewall.log 24.08.2007 08:52 120 setupact.log 23.08.2007 15:12 86.794 ntbtlog.txt 22.08.2007 14:20 4.194.601 pfirewall.log.old 21.08.2007 06:41 286.720 iun506.exe 20.08.2007 17:50 922 spupdsvc.log 20.08.2007 15:57 2.494 ntdtcsetup.log 20.08.2007 15:57 622 tabletoc.log 20.08.2007 15:57 5.642 tsoc.log 20.08.2007 15:57 4.116 comsetup.log 20.08.2007 15:57 13.064 iis6.log 20.08.2007 15:57 684 ocmsn.log 20.08.2007 15:57 1.374 imsins.log 20.08.2007 15:57 9.775 KB936021.log 20.08.2007 15:57 2.166 netfxocm.log 20.08.2007 15:57 8.716 ocgen.log 20.08.2007 15:57 850 MedCtrOC.log 20.08.2007 15:57 618 msgsocm.log 20.08.2007 15:57 12.366 FaxSetup.log 20.08.2007 15:57 3.798 msmqinst.log 20.08.2007 15:57 506 updspapi.log 20.08.2007 15:57 518.726 msxml6-KB933579-deu-x86.LOG 20.08.2007 15:57 286.250 msxml4-KB936181-deu.LOG 20.08.2007 15:57 1.374 imsins.BAK 20.08.2007 15:57 7.876 KB936782.log 20.08.2007 15:57 0 setuperr.log 09.08.2007 09:26 67 #1 Video Converter.INI 07.08.2007 00:21 5 kkcoacne.ini 03.08.2007 23:28 64 maizesampler.ini 03.08.2007 20:07 5 kkcoacli.ini 03.08.2007 20:07 5 kkcoacel.ini 03.08.2007 20:07 5 kkcoacgh.ini 03.08.2007 20:07 5 kkcoacae.ini 01.08.2007 23:43 249.856 Setup1.exe 01.08.2007 23:43 73.216 ST6UNST.EXE 01.08.2007 22:17 104 attsr.INI 28.07.2007 20:28 1.862 RouterControl_Uninstall.in 27.07.2007 21:43 1.451 mozver.dat ----- Tasks ---------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\WINDOWS\tasks 26.08.2007 17:41 6 SA.DAT 18.08.2001 17:00 65 desktop.ini 2 Datei(en) 71 Bytes 0 Verzeichnis(se), 4.886.695.936 Bytes frei ----- Wintemp -------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\WINDOWS\temp 26.08.2007 16:35 256 ZLT00494.TMP 26.08.2007 16:34 256 ZLT0044f.TMP 26.08.2007 16:34 255 WGAErrLog.txt 26.08.2007 01:35 256 ZLT0540a.TMP 26.08.2007 01:35 256 ZLT05407.TMP 5 Datei(en) 1.279 Bytes 0 Verzeichnis(se), 4.886.695.936 Bytes frei ----- Temp ----------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 98FF-447D Verzeichnis von C:\DOKUME~1\TEIBER~1\LOKALE~1\Temp 26.08.2007 17:47 128.786 filelist.txt 26.08.2007 17:03 1.020 ~ROMFN_000004E8 26.08.2007 09:29 0 mmc143A0F90.xml 26.08.2007 08:54 0 mmc1C4350D6.xml 26.08.2007 08:47 0 mmc112CAA9C.xml 26.08.2007 07:27 49.152 ~DFBC05.tmp 6 Datei(en) 178.958 Bytes 0 Verzeichnis(se), 4.886.695.936 Bytes frei |
|
26.08.2007, 17:09
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit/Trojaner on board? Was sind das für *.ini files im %windir% : HTML-Code: 07.08.2007 00:21 5 kkcoacne.ini 03.08.2007 23:28 64 maizesampler.ini 03.08.2007 20:07 5 kkcoacli.ini 03.08.2007 20:07 5 kkcoacel.ini 03.08.2007 20:07 5 kkcoacgh.ini 03.08.2007 20:07 5 kkcoacae.ini
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.08.2007, 17:16
| #11 |
| | Rootkit/Trojaner on board? Gibt es eigentlich irgendwo so etwas wie ein "Grundinhaltsverzeichnis" für Windows? Damit meine ich eine Auflistung sämtlicher Ordner und Dateien die nach einer sauberen Neuinstallation von Windows auf dem System sein sollen u. dürfen. Und falls noch andere, züsätzliche Dateien mitinstalliert wurden weis man ja dann dass mit denen was nicht stimmen kann. |
|
| Themen zu Rootkit/Trojaner on board? |
| antivir, avira, bho, blinkt, blockiert, dllhost.exe, drivers, firefox, handel, helfen, hijack, hijackthis, internet, internet explorer, monitor, mozilla, mozilla firefox, netstat, programm, prozesse, scan, software, solution, starten, svchost.exe, system, tcp, träge, viren, virus, windows, windows xp |
Hybrid-Darstellung
