Infiziert mit Malware durch JPEG.exe

iaminfected · 11.11.2008, 02:32

Dies sind die letzten beiden:

log.txt:

Code:

ATTFilter

Logfile of random's system information tool 1.04 (written by random/random)
Run by Meli at 2008-11-11 02:28:15
Microsoft Windows XP Professional Service Pack 3
System drive C: has 16 GB (41%) free of 38 GB
Total RAM: 446 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:28:24, on 11.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\PeerGuardian2\pg2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Windows Live\Messenger\usnsvc.exe
C:\Programme\ICQ6\ICQ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Dokumente und Einstellungen\Meli\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\Meli.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1031
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: (no name) - {024B53C4-7D1B-4DE4-BDEA-4ABC3C3FE233} - C:\WINDOWS\system32\opnlIBUO.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B0B3393C-62D1-44D8-ABF5-08E0F067F29E} - C:\WINDOWS\system32\ddcAqRjg.dll
O2 - BHO: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\Programme\Neopets\Toolbar\Toolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\Programme\Neopets\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware  (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Programme\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: pgdhtp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: ddcAqRjg - C:\WINDOWS\SYSTEM32\ddcAqRjg.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

--
End of file - 6453 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{024B53C4-7D1B-4DE4-BDEA-4ABC3C3FE233}]
C:\WINDOWS\system32\opnlIBUO.dll [2008-11-08 245760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B0B3393C-62D1-44D8-ABF5-08E0F067F29E}]
C:\WINDOWS\system32\ddcAqRjg.dll [2008-11-08 35328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CD292324-974F-4224-D074-CACA427AA030}]
Neopets - C:\Programme\Neopets\Toolbar\Toolbar.dll [2007-01-08 640552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQ Toolbar - C:\PROGRA~1\ICQTOO~1\toolbaru.dll [2008-03-09 824656]
{CD292324-974F-4224-D074-CACA427AA030} - Neopets - C:\Programme\Neopets\Toolbar\Toolbar.dll [2007-01-08 640552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2005-05-17 77824]
"avgnt"=C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]
"LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]
" Malwarebytes Anti-Malware  (reboot)"=C:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2008-10-22 1261200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2008-10-22 399504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"PeerGuardian"=C:\Programme\PeerGuardian2\pg2.exe [2005-07-15 1401856]
"msnmsgr"=C:\Programme\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
"SUPERAntiSpyware"=C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Generic Host]
C:\WINDOWS\system32\wauclt.exe [2008-11-08 626688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Programme\ICQ6\ICQ.exe [2008-09-01 173304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Programme\iTunes\iTunesHelper.exe [2008-09-10 289576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
C:\Programme\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
C:\Programme\Logitech\Video\ISStart.exe [2005-06-08 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
C:\Programme\Logitech\Video\LogiTray.exe [2005-06-08 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Programme\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
C:\Programme\Ahead\Nero BackItUp\NBJ.exe [2005-02-10 1937408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\QTTask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
C:\WINDOWS\sm56hlpr.exe [2005-04-07 544768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe [2005-08-26 36975]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
C:\WINDOWS\system32\VTTimer.exe [2005-03-08 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]
C:\WINDOWS\system32\VTtrayp.exe [2005-11-01 163840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="pgdhtp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programme\SUPERAntiSpyware\SASWINLO.dll [2008-07-23 352256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcAqRjg]
C:\WINDOWS\system32\ddcAqRjg.dll [2008-11-08 35328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B0B3393C-62D1-44D8-ABF5-08E0F067F29E}"=C:\WINDOWS\system32\ddcAqRjg.dll [2008-11-08 35328]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programme\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\opnlIBUO

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\ICQ6\ICQ.exe"="C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Programme\SmartFTP Client\SmartFTP.exe"="C:\Programme\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

======List of files/folders created in the last 1 months======

2008-11-11 02:28:15 ----D---- C:\rsit
2008-11-11 01:34:41 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2008-11-11 01:34:22 ----D---- C:\Programme\SUPERAntiSpyware
2008-11-11 01:34:21 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\SUPERAntiSpyware.com
2008-11-11 01:33:43 ----D---- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-11-11 01:30:31 ----ASH---- C:\WINDOWS\system32\OUBIlnpo.ini2
2008-11-11 01:28:24 ----A---- C:\gpyzjtat.txt
2008-11-11 00:21:34 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\Malwarebytes
2008-11-11 00:21:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-11-11 00:21:18 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2008-11-10 23:01:47 ----N---- C:\WINDOWS\system32\whlfkukl.dll
2008-11-10 22:58:48 ----N---- C:\WINDOWS\system32\pgdhtp.dll
2008-11-10 22:58:47 ----N---- C:\WINDOWS\system32\ftihstvo.dll
2008-11-08 20:49:51 ----D---- C:\Programme\Trend Micro
2008-11-08 20:29:03 ----A---- C:\WINDOWS\system32\e33a53e6-.txt
2008-11-08 20:28:39 ----ASH---- C:\WINDOWS\system32\OUBIlnpo.ini
2008-11-08 20:28:35 ----N---- C:\WINDOWS\system32\opnlIBUO.dll
2008-11-08 20:23:32 ----N---- C:\WINDOWS\system32\ddcAqRjg.dll
2008-11-08 20:23:28 ----RSH---- C:\WINDOWS\system32\wauclt.exe
2008-11-08 20:23:27 ----AD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-11-08 20:23:05 ----HD---- C:\WINDOWS\PIF
2008-11-07 16:10:12 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\Ahead
2008-11-07 15:57:58 ----D---- C:\Programme\Gemeinsame Dateien\Nero
2008-11-07 15:56:02 ----A---- C:\WINDOWS\system32\TwnLib20.dll
2008-11-07 15:55:55 ----N---- C:\WINDOWS\system32\ImagXRA7.dll
2008-11-07 15:55:55 ----N---- C:\WINDOWS\system32\ImagXR7.dll
2008-11-07 15:55:55 ----N---- C:\WINDOWS\system32\ImagXpr7.dll
2008-11-07 15:55:55 ----N---- C:\WINDOWS\system32\ImagX7.dll
2008-11-07 15:55:54 ----A---- C:\WINDOWS\system32\NeroCheck.exe
2008-11-07 15:55:48 ----D---- C:\Programme\Gemeinsame Dateien\Ahead
2008-11-07 15:55:47 ----D---- C:\Programme\Ahead
2008-11-06 13:51:53 ----A---- C:\WINDOWS\system32\TubeFinder.exe
2008-11-06 13:51:52 ----A---- C:\WINDOWS\system32\VB6STKIT.DLL
2008-11-06 13:51:52 ----A---- C:\WINDOWS\system32\VB6FR.DLL
2008-11-06 13:51:51 ----A---- C:\WINDOWS\system32\PCCLPFR.DLL
2008-11-06 13:51:51 ----A---- C:\WINDOWS\system32\MSCMCFR.DLL
2008-11-06 13:51:51 ----A---- C:\WINDOWS\system32\CMDLGFR.DLL
2008-11-06 13:51:50 ----D---- C:\Programme\Free FLV Converter
2008-11-02 13:37:21 ----D---- C:\Programme\PokerStars
2008-11-02 13:04:35 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Genuine Advantage
2008-11-02 13:01:27 ----A---- C:\WINDOWS\system32\hidserv.dll
2008-10-26 22:30:24 ----D---- C:\Program Files
2008-10-26 22:19:35 ----D---- C:\Programme\GpotatoEu
2008-10-24 18:32:51 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-24 18:30:14 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\Neopets Toolbar
2008-10-24 18:30:11 ----D---- C:\Programme\Neopets
2008-10-21 17:47:05 ----A---- C:\WINDOWS\system32\ltimg13n.dll
2008-10-21 17:47:05 ----A---- C:\WINDOWS\system32\ltefx13n.dll
2008-10-21 17:47:05 ----A---- C:\WINDOWS\system32\ltdis13n.dll
2008-10-21 17:47:05 ----A---- C:\WINDOWS\system32\lfgif13n.dll
2008-10-21 17:47:05 ----A---- C:\WINDOWS\system32\lfcmp13n.dll
2008-10-21 17:47:05 ----A---- C:\WINDOWS\system32\lfbmp13n.dll
2008-10-21 17:47:04 ----A---- C:\WINDOWS\system32\ltkrn13n.dll
2008-10-21 17:47:04 ----A---- C:\WINDOWS\system32\ltfil13n.dll
2008-10-21 17:38:16 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\SmartFTP
2008-10-21 17:37:51 ----D---- C:\Programme\SmartFTP Client
2008-10-21 17:37:16 ----D---- C:\Programme\SmartFTP Client 3.0 Setup Files
2008-10-21 10:42:56 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FLEXnet
2008-10-21 10:26:33 ----D---- C:\Programme\Gemeinsame Dateien\Macrovision Shared
2008-10-17 10:33:05 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-17 10:33:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-17 10:32:56 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-17 10:32:24 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-17 10:32:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$

======List of files/folders modified in the last 1 months======

2008-11-11 02:28:22 ----D---- C:\Programme\PeerGuardian2
2008-11-11 02:26:21 ----D---- C:\WINDOWS\Temp
2008-11-11 02:24:58 ----D---- C:\Programme\Mozilla Firefox
2008-11-11 01:34:29 ----SHD---- C:\WINDOWS\Installer
2008-11-11 01:34:22 ----RD---- C:\Programme
2008-11-11 01:33:43 ----D---- C:\Programme\Gemeinsame Dateien
2008-11-11 01:30:31 ----D---- C:\WINDOWS\system32
2008-11-11 01:28:24 ----D---- C:\WINDOWS\system32\drivers
2008-11-10 22:18:39 ----D---- C:\Programme\ICQToolbar
2008-11-10 22:12:09 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-10 22:08:08 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-10 22:06:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-10 22:06:03 ----SH---- C:\boot.ini
2008-11-10 22:06:03 ----A---- C:\WINDOWS\win.ini
2008-11-10 22:06:03 ----A---- C:\WINDOWS\system.ini
2008-11-10 21:58:06 ----D---- C:\WINDOWS\Prefetch
2008-11-10 21:55:12 ----D---- C:\WINDOWS\system32\config
2008-11-10 21:55:00 ----D---- C:\WINDOWS\system32\wbem
2008-11-10 21:54:59 ----D---- C:\WINDOWS\Registration
2008-11-10 21:52:26 ----D---- C:\WINDOWS\system32\Restore
2008-11-08 21:31:34 ----RSD---- C:\WINDOWS\Fonts
2008-11-08 20:23:05 ----D---- C:\WINDOWS
2008-11-08 14:31:04 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\ICQ
2008-11-07 15:57:46 ----HD---- C:\WINDOWS\inf
2008-11-02 19:54:32 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2008-11-02 13:04:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-10-31 07:41:47 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2008-10-24 18:32:48 ----HD---- C:\WINDOWS\$hf_mig$
2008-10-21 17:47:02 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-10-21 10:44:09 ----D---- C:\Dokumente und Einstellungen\Meli\Anwendungsdaten\Adobe
2008-10-21 10:38:05 ----D---- C:\Programme\Adobe
2008-10-21 10:36:42 ----D---- C:\Programme\Gemeinsame Dateien\Adobe
2008-10-18 13:50:46 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLInstaller
2008-10-18 13:38:44 ----D---- C:\WINDOWS\system32\CatRoot
2008-10-17 10:33:08 ----A---- C:\WINDOWS\imsins.BAK
2008-10-17 10:32:45 ----D---- C:\Programme\Internet Explorer
2008-10-15 17:35:02 ----A---- C:\WINDOWS\system32\netapi32.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-06-27 75072]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 SASDIFSV;SASDIFSV; \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-05-18 2319680]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 avgntflt;avgntflt; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 BCM43XX;Treiber Broadcom 802.11 Netzwerkadapter; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2005-02-11 371712]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 EKBfltr;ENE Keyboard Controller; C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-01-14 5504]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pgfilter;pgfilter; \??\C:\Programme\PeerGuardian2\pgfilter.sys []
R3 SASENUM;SASENUM; \??\C:\Programme\SUPERAntiSpyware\SASENUM.SYS []
R3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys [2005-04-07 923826]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 viagfx;viagfx; C:\WINDOWS\system32\DRIVERS\vtmini.sys [2005-12-27 247040]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2005-03-18 42496]
S3 FETNDIS;VIA PCI 10/100-MBit/s-Fast Ethernetadapter-NT-Treiber; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 PID_0920;Logitech QuickCam Express(PID_0920); C:\WINDOWS\system32\DRIVERS\LV532AV.SYS [2005-01-31 163328]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

Infiziert mit Malware durch JPEG.exe

Plagegeister aller Art und deren Bekämpfung: Infiziert mit Malware durch JPEG.exe

Infiziert mit Malware durch JPEG.exe

Ähnliche Themen: Infiziert mit Malware durch JPEG.exe