Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\Users\xxx\AppData\Local\Temp\awturQGX.dll" not found!
Deletion of file "C:\Users\xxx\AppData\Local\Temp\awturQGX.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\Users\xxx\AppData\Local\Temp\kmcbghbx.dll" deleted successfully.
File "C:\Users\xxx\AppData\Local\Temp\syivgbnc.dll" deleted successfully.
File "C:\Users\xxx\AppData\Local\Temp\fccddcBQ.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

ComboFix 08-08-17.05 - XXX 2008-08-18 19:41:06.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1101 [GMT 2:00]
ausgeführt von:: D:\XXX\2 downloads\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\x64

.
((((((((((((((((((((((( Dateien erstellt von 2008-07-18 bis 2008-08-18 ))))))))))))))))))))))))))))))
.

2008-08-18 17:28 . 2008-08-18 17:29 <DIR> d--h----- C:\$AVG8.VAULT$
2008-08-18 17:11 . 2008-08-18 17:13 <DIR> d-------- C:\Windows\System32\drivers\Avg
2008-08-18 17:11 . 2008-08-18 17:11 97,928 --a------ C:\Windows\System32\drivers\avgldx86.sys
2008-08-18 17:11 . 2008-08-18 17:11 69,128 --a------ C:\Windows\System32\drivers\avgwfpx.sys
2008-08-18 17:11 . 2008-08-18 17:11 12,936 --a------ C:\Windows\System32\drivers\avgrkx86.sys
2008-08-18 17:11 . 2008-08-18 17:11 10,520 --a------ C:\Windows\System32\avgrsstx.dll
2008-08-18 17:10 . 2008-08-18 17:10 <DIR> d-------- C:\Users\All Users\avg8
2008-08-18 17:10 . 2008-08-18 17:10 <DIR> d-------- C:\ProgramData\avg8
2008-08-18 17:10 . 2008-08-18 17:10 <DIR> d-------- C:\Program Files\AVG
2008-08-18 16:14 . 2008-08-18 16:14 <DIR> d-------- C:\Users\XXX\AppData\Roaming\PC Tools
2008-08-18 16:14 . 2008-08-18 19:15 <DIR> d-a------ C:\Users\All Users\TEMP
2008-08-18 16:14 . 2008-08-18 19:15 <DIR> d-a------ C:\ProgramData\TEMP
2008-08-18 16:14 . 2008-08-18 18:45 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-08-18 16:14 . 2008-06-10 21:22 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-08-18 16:14 . 2008-06-02 15:19 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-08-18 16:14 . 2008-06-02 15:19 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-08-18 16:14 . 2008-06-02 15:19 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-08-18 11:23 . 2008-08-18 11:25 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-08-18 11:23 . 2008-08-18 11:25 <DIR> d-------- C:\ProgramData\Lavasoft
2008-08-18 11:23 . 2008-08-18 11:23 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-18 11:21 . 2008-08-18 11:21 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-17 17:18 . 2008-08-17 17:56 <DIR> d-------- C:\Users\XXX\.housecall6.6
2008-08-17 17:00 . 2008-08-17 17:00 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-17 16:57 . 2008-08-17 16:57 <DIR> d-------- C:\Program Files\Opera
2008-08-16 13:11 . 2008-08-16 13:11 <DIR> d-------- C:\Users\XXX\AppData\Roaming\ArcSoft
2008-08-15 18:20 . 2008-05-27 06:59 106,605 --a------ C:\Windows\System32\StructuredQuerySchema.bin
2008-08-15 18:20 . 2008-05-27 07:17 34,816 --a------ C:\Windows\System32\msscb.dll
2008-08-15 18:20 . 2008-05-27 06:59 18,904 --a------ C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-08-15 18:20 . 2008-05-27 07:17 11,776 --a------ C:\Windows\System32\msshooks.dll
2008-08-15 09:59 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 11:50 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 11:50 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 10:54 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 10:44 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-14 10:30 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-10 11:12 . 2008-08-10 11:12 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-08-09 22:24 . 2008-08-09 22:24 <DIR> d-------- C:\Program Files\pdfsam
2008-08-09 11:10 . 2008-08-09 11:10 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-02 11:31 . 2008-08-02 11:31 <DIR> d-------- C:\Program Files\iTunes
2008-08-02 11:31 . 2008-08-02 11:31 <DIR> d-------- C:\Program Files\iPod
2008-07-26 19:15 . 2008-07-26 19:15 <DIR> d-------- C:\Users\XXX\AppData\Roaming\Logitech
2008-07-26 19:15 . 2008-07-26 19:15 <DIR> d-------- C:\Users\All Users\LogiShrd
2008-07-26 19:15 . 2008-07-26 19:15 <DIR> d-------- C:\ProgramData\LogiShrd
2008-07-26 19:13 . 2008-07-26 19:13 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-07-26 19:12 . 2008-05-02 02:38 301,656 --a------ C:\Windows\System32\BtCoreIf.dll
2008-07-26 19:12 . 2008-05-02 02:39 170,512 --a------ C:\Windows\System32\kemutb.dll
2008-07-26 19:12 . 2008-05-02 02:39 145,936 --a------ C:\Windows\System32\KemUtil.dll
2008-07-26 19:12 . 2008-05-02 02:40 117,264 --a------ C:\Windows\System32\KemWnd.dll
2008-07-26 19:12 . 2008-05-02 02:40 84,496 --a------ C:\Windows\System32\KemXML.dll
2008-07-26 19:11 . 2008-07-26 19:11 <DIR> d-------- C:\Users\All Users\Logitech
2008-07-26 19:11 . 2008-07-26 19:11 <DIR> d-------- C:\ProgramData\Logitech
2008-07-26 19:11 . 2008-07-26 19:11 <DIR> d-------- C:\Program Files\Logitech
2008-07-26 19:11 . 2008-07-26 19:12 <DIR> d-------- C:\Program Files\Common Files\Logishrd

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-18 17:29 352,614 ---ha-w C:\Windows\system32\drivers\vsconfig.xml
2008-08-17 18:19 --------- d-----w C:\Users\XXX\AppData\Roaming\Azureus
2008-08-15 16:21 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-15 07:54 --------- d-----w C:\Program Files\Windows Mail
2008-07-26 17:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-15 08:19 --------- d-----w C:\Program Files\Java
2008-07-13 16:27 --------- d-----w C:\Program Files\Winamp
2008-07-13 16:20 --------- d-----w C:\ProgramData\OrbNetworks
2008-07-13 16:19 --------- d-----w C:\Program Files\Winamp Remote
2008-07-13 16:17 --------- d-----w C:\Users\XXX\AppData\Roaming\Winamp
2008-07-13 16:16 --------- d-----w C:\Program Files\DivX
2008-07-11 09:28 --------- d-----w C:\Program Files\QuickTime
2008-07-11 09:28 --------- d-----w C:\Program Files\Bonjour
2008-07-11 09:27 --------- d-----w C:\ProgramData\Apple Computer
2008-06-26 16:40 64,873 ----a-w C:\Windows\Internet Logs\zlclient_2nd_2008_06_26_07_07_06_small.dmp.zip
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-25 15:28 --------- d-----w C:\Users\XXX\AppData\Roaming\Teleca
2008-06-25 15:27 --------- d-----w C:\Program Files\Sony
2008-06-25 15:04 --------- d-----w C:\Users\XXX\AppData\Roaming\Sony Ericsson
2008-06-25 15:03 --------- d-----w C:\ProgramData\Teleca
2008-06-25 15:03 --------- d-----w C:\ProgramData\Sony Ericsson
2008-06-25 15:03 --------- d-----w C:\Program Files\Sony Ericsson
2008-06-25 15:03 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2008-06-25 15:03 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2008-06-25 13:10 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-24 19:13 174 --sha-w C:\Program Files\desktop.ini
2008-06-24 19:04 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-24 19:04 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-24 19:04 --------- d-----w C:\Program Files\Windows Journal
2008-06-24 19:04 --------- d-----w C:\Program Files\Windows Defender
2008-06-24 19:04 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-24 19:04 --------- d-----w C:\Program Files\Windows Calendar
2008-06-24 15:45 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-24 15:45 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-18 17:52 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-06-11 00:07 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-06-11 00:04 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-06-11 00:04 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-08 13:03 3,619 ----a-w C:\Program Files\digibib.ini
1999-12-14 17:48 3,489 ----a-w C:\Program Files\www.txt
1998-09-27 14:09 352 ----a-w C:\Program Files\makros.txt
2007-08-20 20:24 80 --sh--r C:\Windows\System32\D6142EC217.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2008-04-01 12:40 172280]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PLFSet"="C:\Windows\PLFSet.dll" [2007-04-24 05:49 45056]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 13:00 174872]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-04-10 10:07 678672]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-12 17:42 457728]
"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-05-09 10:36 1286144]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2006-11-07 14:57 159744]
"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-03 11:16 206952]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 14:16 185896]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 13:45 75304]
"WrtMon.exe"="C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 09:35 20480]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-01-09 04:31 959976]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 10:14 528384]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-02-11 20:13 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-02-11 20:13 166424]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-02-11 20:13 133656]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-18 17:10 1235736]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 09:51 4435968 C:\Windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-04-13 09:36 1822720 C:\Windows\SkyTel.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\Windows\KHALMNPR.Exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-26 19:12:00 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=eNetHook.dll,avgrsstx.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=C:\Windows\pss\Acrobat Assistant.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--a------ 2001-07-09 11:50 155648 C:\Windows\System32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-08-20 16:49 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{E13DAC76-9080-488E-B14A-A09E8C7C96A0}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{2FE687CD-69B4-4000-9C49-A375970046B5}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exeVDivine
"{FB05615A-3F6C-48B2-912A-FECB096B4D62}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
"{26122130-B5C0-440D-A7C7-F064D0C3FDAB}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
"{E2061A89-8B2B-4C34-A0F5-85D6D996A2B4}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exeV Wizard
"{E3C8278D-2F11-4DF0-9DBF-7563068C09FF}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie
"{16835740-B6C8-4B3E-A789-61E5EDB2413B}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program
"{D960270F-794A-4A5C-9D01-4E683AC8CE39}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0014D922-F136-46A8-AF3C-4E1F9F3492C2}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{309D1667-237A-4CCE-8E11-B030A426E979}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{24AB2137-68C8-4B5A-BD0C-CEDEC3F9C689}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{39E6577F-D9A5-43FB-B154-EDE90E554BD9}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{0C4804A0-7898-47B3-B7F0-2540710A4AA7}"= UDP:C:\Program Files\Morpheus\Morpheus.exe:Morpheus
"{B9F4008D-708C-4C0F-855D-16D9374B79F8}"= TCP:C:\Program Files\Morpheus\Morpheus.exe:Morpheus
"TCP Query User{A2FBB3D8-BFB4-4AB7-A5BA-AF04BC06CF0E}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5E886C1A-0C9C-49AE-BFF3-A95657264382}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{EDC43DE0-CE04-440B-8A98-737CAF6BE06A}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{460F136E-3551-4214-A41E-19872101EAF6}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{4FA673C7-D388-427F-9821-5673ECA02D10}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{13FAC42C-0CFC-45CB-AF09-800A6CB1321F}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library
"TCP Query User{AFD89852-BB55-45A7-A78D-54A2B8DB899D}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{1025AB56-1F62-4B20-8083-A4D84EADB293}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{820C3D02-517A-4149-8970-58DD416B2DCD}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{48EEF1D5-D605-40C5-A005-76B9DA304B75}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"{81F6D99D-351F-49AC-AFF3-39F0508D5816}"= UDP:80:wamp
"{95B8B0D7-32AD-4195-AD77-217FFD597210}"= UDP:C:\Program Files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{5D653754-0389-4F2C-8576-36A3D551F18E}"= TCP:C:\Program Files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{C476AC52-5880-4240-8B89-E1A6FEDA3ECE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{173F1804-6A22-4B79-911F-63E0B683AFB4}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{9BE5CEFC-148B-4757-A86C-281F2E9C7FA0}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{45C54E97-D7C4-40FD-A16C-900B04942AA4}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{2D1D4216-3D15-430A-BB6C-7D66831A3323}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{9DEA562A-2DBD-439C-BF3A-B2D7552A921A}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{EE3A0A7A-BF69-4F65-87F6-8BEA41437262}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{98747B03-21F9-4E6D-B389-F490F09D0102}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{BDECF57A-FBE6-462B-8B0B-90E8DBC1BDB4}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{CE55104A-8277-4C2F-A95B-4D50EDC3EEEA}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{FA5A1764-9F73-4266-9214-8AEA03785646}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{18806ECE-7B4A-4495-B2C2-2AA54DD78A67}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{769B6E20-9200-4A01-8E61-DDCE7B8D5194}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{27403140-6AD0-46C4-94B0-593931D3A74A}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{88F2848C-71C8-492A-A6C5-0B411B63DA9A}"= Disabled:UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{151C1293-C4D8-4D15-9787-6D57D063D82A}"= Disabled:TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{B9504299-B6F1-420F-A34A-ED1A475CFB1E}C:\\program files\\morpheus\\morpheus.exe"= Disabled:UDP:C:\program files\morpheus\morpheus.exe:Morpheus
"UDP Query User{46DA5395-9F70-424F-AEAD-F9B321A4C4D3}C:\\program files\\morpheus\\morpheus.exe"= Disabled:TCP:C:\program files\morpheus\morpheus.exe:Morpheus
"{1C5E5686-6076-468F-9002-A91933431928}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{619421AF-66D2-4189-8BC7-C98C19DF74C2}"= C:\Program Files\AVG\AVG8\avgnsx.exe:avgnsx.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AvgRkx86;avgrkx86.sys;C:\Windows\system32\Drivers\avgrkx86.sys [2008-08-18 17:11]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-08-18 17:11]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 16:51]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-18 17:10]
R2 avgfws8;AVG8 Firewall;C:\PROGRA~1\AVG\AVG8\avgfws8.exe [2008-08-18 17:10]
R2 U3sHlpDr;U3sHlpDr;C:\Windows\System32\Drivers\U3sHlpDr.sys [2007-08-21 11:41]
R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-08-18 17:11]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 15:03]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\Windows\system32\DRIVERS\s716bus.sys [2007-04-04 12:43]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s716mdfl.sys [2007-04-04 12:43]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s716mdm.sys [2007-04-04 12:43]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\Windows\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s716obex.sys [2007-04-04 12:43]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\Windows\system32\DRIVERS\s716unic.sys [2007-04-04 12:43]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKCU-Run-Octoshape Streaming Services - C:\Users\XXX\AppData\Local\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
HKLM-Run-ALaunch - C:\Acer\ALaunch\AlaunchClient.exe
HKLM-Run-SetPanel - C:\Acer\APanel\APanel.cmd
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)


.
------- Zusätzlicher Scan -------
.
FireFox -: Profile - C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\48vl2zqv.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.web.de
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
.
.
------- File Associations (Beta) -------
.
VBEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
VBSFile="%SystemRoot%\System32\WScript.exe" "%1" %*
vbefile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
vbsfile\shell\open\command="%SystemRoot%\System32\WScript.exe" "%1" %*
jsefile\shell\open\command=%SystemRoot%\System32\WScript.exe "%1" %*
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 19:46:15
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-08-18 19:48:19
ComboFix-quarantined-files.txt 2008-08-18 17:47:53

Pre-Run: 14 Verzeichnis(se), 32,615,092,224 Bytes frei
Post-Run: 23 Verzeichnis(se), 34,418,556,928 Bytes frei

315 --- E O F --- 2008-08-17 19:05:09

Hi,

bitte MAM nicht vergessen.
Das hier kann legitim oder auch nicht sein, bitte online prüfen lassen:
c:\windows\system32\eNetHook.dll

chris

Datei eNetHook.dll empfangen 2008.08.20 14:19:47 (CET)
Status: Beendet
Ergebnis: 0/36 (0%)



Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.8.19.0 2008.08.20 -
AntiVir 7.8.1.23 2008.08.20 -
Authentium 5.1.0.4 2008.08.20 -
Avast 4.8.1195.0 2008.08.19 -
AVG 8.0.0.161 2008.08.20 -
BitDefender 7.2 2008.08.20 -
CAT-QuickHeal 9.50 2008.08.19 -
ClamAV 0.93.1 2008.08.19 -
DrWeb 4.44.0.09170 2008.08.20 -
eSafe 7.0.17.0 2008.08.20 -
eTrust-Vet 31.6.6035 2008.08.15 -
Ewido 4.0 2008.08.20 -
F-Prot 4.4.4.56 2008.08.19 -
F-Secure 7.60.13501.0 2008.08.20 -
Fortinet 3.14.0.0 2008.08.20 -
GData 2.0.7306.1023 2008.08.20 -
Ikarus T3.1.1.34.0 2008.08.20 -
K7AntiVirus 7.10.421 2008.08.19 -
Kaspersky 7.0.0.125 2008.08.20 -
McAfee 5364 2008.08.19 -
Microsoft 1.3807 2008.08.20 -
NOD32v2 3370 2008.08.20 -
Norman 5.80.02 2008.08.20 -
Panda 9.0.0.4 2008.08.19 -
PCTools 4.4.2.0 2008.08.19 -
Prevx1 V2 2008.08.20 -
Rising 20.58.22.00 2008.08.20 -
Sophos 4.32.0 2008.08.20 -
Sunbelt 3.1.1564.1 2008.08.20 -
Symantec 10 2008.08.20 -
TheHacker 6.3.0.5.054 2008.08.19 -
TrendMicro 8.700.0.1004 2008.08.20 -
VBA32 3.12.8.3 2008.08.20 -
ViRobot 2008.8.20.1342 2008.08.20 -
VirusBuster 4.5.11.0 2008.08.20 -
Webwasher-Gateway 6.6.2 2008.08.20 -
weitere Informationen
File size: 90112 bytes
MD5...: c41a868bfc6c68c7a72a2553c44460fa
SHA1..: 8882f859f3ee24a1e54fee3be1d698bf839ca922
SHA256: 87dd090ec488fb2e4727544553586bd938f9ff4e2675c971c1fcae3d1aeac283
SHA512: 66732df0523fb9888d5736e3620541a1044eb29e22b834214ca0c1ca5352872e
5ad38d3f72b051dec176110bc23f18a3eaf63cc35b366c5779bd143f7b688f19
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10001c46
timedatestamp.....: 0x4624afc5 (Tue Apr 17 11:30:13 2007)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x92c8 0xa000 6.32 880be5356fb208397ba3d16723721b93
.rdata 0xb000 0x2cc8 0x3000 5.13 8618547b269933e63669574086652711
.data 0xe000 0x2e1c 0x1000 2.32 6a6798a21dd884a0efe61ff25e851c40
.REX 0x11000 0x3cf8 0x4000 0.00 ce338fe6899778aacfc28414f2d9498b
.rsrc 0x15000 0x460 0x1000 3.79 aeb4b4275ac31b71fdca1471aa2ccc2f
.reloc 0x16000 0x165e 0x2000 2.98 2bac3af7a195bc17441a65d88ac446c5

( 4 imports )
> KERNEL32.dll: Process32FirstW, CloseHandle, lstrcmpiW, Process32NextW, GetLastError, FormatMessageW, CreateToolhelp32Snapshot, GetModuleFileNameW, FlushFileBuffers, GetCurrentProcessId, ProcessIdToSessionId, OutputDebugStringW, LocalFree, DisableThreadLibraryCalls, CreateFileA, GetCurrentThreadId, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RaiseException, GetProcAddress, GetModuleHandleA, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, InterlockedDecrement, Sleep, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, SetFilePointer, WriteFile, GetConsoleCP, GetConsoleMode, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, GetACP, GetOEMCP, MultiByteToWideChar, HeapSize, VirtualAlloc, HeapReAlloc, LoadLibraryA, InitializeCriticalSection, RtlUnwind, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA
> USER32.dll: PostMessageW, FindWindowW, wsprintfW
> ADVAPI32.dll: RegOpenKeyExW, RegEnumValueW, RegQueryInfoKeyW, RegCloseKey
> SHLWAPI.dll: PathStripPathW

( 2 exports )
_StartSwWatching@@YAKXZ, _StopSwWatching@@YAXXZ

Hi,

scheint OK zu sein!
Hat MAM noch etwas gefunden?

chris

Malwarebytes' Anti-Malware 1.25
Datenbank Version: 1066
Windows 6.0.6001 Service Pack 1

16:59:34 20.08.2008
mbam-log-08-20-2008 (16-59-33).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 177120
Laufzeit: 2 hour(s), 29 minute(s), 11 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Hab nun keine Probleme mehr mit Fehlermeldungen und Trojaner scheinen auch keine mehr auf dem Rechenr zu sein...Allerdings ist der Rechner merklich langsamer geworden als vorher (auch die Internetverbindung lahmt etwas...) Vielleicht hängt das damit zusammen, dass ich mir AVG 8 installiert habe und das Programm mit ihrer Firewall die Verbindungen abbremst...) Kann man die Rechner-Geschwindigkeit irgendwie auf den alten Stand hinbekommen?

Hi,

Du solltest unbedingt den Rechner noch updaten (SP3), das gilt auch für den Rest z.B. Acrobat etc.

Du kannst probehalber versuchen Firewall und Guard abzuschalten und schauen ob Du dann die alte Performance erreichst (aber um Gotteswillen dann nicht gleich wieder im ungeschützten Zustand seltsame Seiten ansurfen...;o)...

Wir können abschließend noch auf einen MBR-Rootkit prüfen:
MBR-Rootkit

Lade den MBR-Rootkitscanner von GMER auf Deine Bootplatte:
http://www2.gmer.net/mbr/mbr.exe
Merke Dir das Verzeichnis wo Du ihn runtergeladen hast;
Start->Ausführen->cmd
Wechsle in das Verzeichnis des Downloads und starte durch Eingabe
von mbr das Programm...

Das Ergebnis sollte so aussehen:

D:\Downloads>mbr
Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

In dem Verzeichnis wo mbr.exe liegt findest Du das Log,

poste es im Thread;

Dann solltest Du noch combofix entfernen (er wird täglich aktualisiert)..
Start->Ausführen->combofix /u

Dann müssen noch die Backups der Tools entfernt werden:
Falls der Rechner einwandfrei läuft, können die Backups der
Bereinigungstools gelöscht werden (soweit vorhanden):

C:\Qoobox - loeschen und Papierkorb leeren
C:\avenger\backup.zip - loeschen und Papierkorb leeren
C:\VundoFix Backups - loeschen und Papierkorb leeren
C:\RVAXO-results.log -->Papierkorb leeren


chris