| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System infizert gewesen - wieder sauber?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
17.04.2009, 08:12
| #1 |
  |  System infizert gewesen - wieder sauber? Nicht so voreilig, lasst nochmal SUPERAntiSpyware laufen.
__________________ Avira Upgrade 10 ist auf dem Markt! Agressive Einstellung von Avira What goes around comes around!  |
|
18.04.2009, 16:09
| #2 |
 | System infizert gewesen - wieder sauber? So habs 2mal laufen lassen der erste log ist konnte nicht vollständig durchlaufen deswegen noch der zweite
__________________erster scan: Code:
ATTFilter SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 04/17/2009 at 03:17 PM
Application Version : 4.26.1000
Core Rules Database Version : 3849
Trace Rules Database Version: 1803
Scan type : Complete Scan
Total Scan Time : 00:53:30
Memory items scanned : 659
Memory threats detected : 0
Registry items scanned : 6262
Registry threats detected : 21
File items scanned : 98639
File threats detected : 2
Adware.Tracking Cookie
C:\Dokumente und Einstellungen\Zitrone\Cookies\zitrone@doubleclick[2].txt
C:\Dokumente und Einstellungen\Zitrone\Cookies\zitrone@xiti[1].txt
Trojan.Unknown Origin
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\legacy_msupdate\0000#DeviceDesc
Unclassified.Oreans32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#DeviceDesc
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Capabilities
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000#Driver
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_OREANS32\0000\LogConf
Code:
ATTFilter SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 04/18/2009 at 03:56 AM
Application Version : 4.26.1000
Core Rules Database Version : 3849
Trace Rules Database Version: 1803
Scan type : Complete Scan
Total Scan Time : 01:35:32
Memory items scanned : 585
Memory threats detected : 0
Registry items scanned : 6283
Registry threats detected : 0
File items scanned : 153427
File threats detected : 2
Adware.Tracking Cookie
C:\Dokumente und Einstellungen\Zitrone\Cookies\zitrone@doubleclick[1].txt
C:\Dokumente und Einstellungen\Zitrone\Cookies\zitrone@xiti[1].txt
|
|
18.04.2009, 16:21
| #3 |
| | System infizert gewesen - wieder sauber? Falls du noch irgendetwas hast, dass du mit dem Computer verbindest, wie Speicherkarten, USB-Sticks, externe Festplatten, ... dann stecke alles an.
__________________ComboFix Achtung: Die Anleitung ist veraltet. Den Teil mit der Systemwiederherstellungskonsole nicht ausführen. Die wird bei Internetverbindung automatisch installiert. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.
__________________ |
|
18.04.2009, 17:10
| #4 |
| | System infizert gewesen - wieder sauber? hier log teil 1: Code:
ATTFilter * Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - system32: deleted 702286 bytes in 1 streams.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\ksl48.bin
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games
((((((((((((((((((((((( Dateien erstellt von 2009-03-18 bis 2009-04-18 ))))))))))))))))))))))))))))))
.
2009-04-18 15:38 . 2009-04-18 15:38 -------- d-----w c:\windows\l2schemas
2009-04-18 15:38 . 2009-04-18 15:38 -------- d-----w c:\windows\system32\de
2009-04-18 15:38 . 2009-04-18 15:38 -------- d-----w c:\windows\system32\bits
2009-04-18 15:36 . 2009-04-18 15:38 -------- d-----w c:\windows\ServicePackFiles
2009-04-17 12:34 . 2009-04-17 12:35 -------- d-----w c:\programme\Hamachi
2009-04-17 12:20 . 2009-04-17 12:20 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2009-04-17 12:20 . 2009-04-17 12:20 -------- d-----w c:\programme\SUPERAntiSpyware
2009-04-17 12:20 . 2009-04-17 12:20 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\SUPERAntiSpyware.com
2009-04-17 12:10 . 2008-10-16 12:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-04-17 12:10 . 2008-10-16 12:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-17 12:10 . 2008-10-16 12:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-04-17 00:34 . 2009-04-17 00:34 -------- d-----w c:\programme\Gemeinsame Dateien\Windows Live
2009-04-17 00:28 . 2009-04-17 12:46 -------- d-----w c:\programme\Fake Webcam
2009-04-16 22:36 . 2009-04-16 23:00 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Wippien
2009-04-16 22:36 . 2008-12-30 22:43 23480 ----a-w c:\windows\system32\drivers\wip0204.sys
2009-04-16 22:36 . 2009-04-16 23:00 -------- d-----w c:\programme\Wippien
2009-04-15 22:27 . 2009-04-15 22:27 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Malwarebytes
2009-04-15 22:27 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-15 22:27 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-15 22:27 . 2009-04-15 22:27 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-04-15 22:27 . 2009-04-15 22:27 -------- d-----w c:\programme\Malwarebytes' Anti-Malware
2009-04-15 15:09 . 2009-04-15 15:09 -------- d-----w c:\programme\Trend Micro
2009-04-15 10:26 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 10:26 . 2009-03-06 14:19 286720 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-15 10:26 . 2009-02-09 11:21 2191360 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-15 10:26 . 2009-02-09 11:21 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-15 10:26 . 2009-02-09 10:51 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 10:26 . 2009-02-09 10:51 736768 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 10:26 . 2009-02-09 10:51 678400 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 10:26 . 2009-02-09 10:51 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 10:26 . 2009-02-09 10:51 740352 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 10:26 . 2009-02-09 10:51 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 10:26 . 2009-02-09 11:21 2026496 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-15 10:26 . 2009-02-09 11:21 2147840 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-15 10:25 . 2008-04-21 21:13 217600 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-14 19:53 . 2009-04-14 20:09 76523 ----a-w c:\windows\War3Unin.dat
2009-04-14 19:53 . 2009-04-14 19:59 2829 ----a-w c:\windows\War3Unin.pif
2009-04-14 19:53 . 2009-04-14 19:59 139264 ----a-w c:\windows\War3Unin.exe
2009-04-14 19:51 . 2009-04-14 20:49 -------- d-----w c:\programme\Warcraft III
2009-04-04 15:44 . 2009-04-04 15:51 -------- d-----w c:\dokumente und einstellungen\Zitrone\Lokale Einstellungen\Anwendungsdaten\kaneandlynch
2009-04-04 09:38 . 2009-04-04 09:38 -------- d-----w c:\programme\Webocton - Scriptly
2009-04-04 09:38 . 2009-04-04 09:38 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Webocton - Scriptly
2009-04-03 21:02 . 2009-04-03 21:02 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\FOG Downloader
2009-04-03 17:59 . 2009-04-03 17:59 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Microsoft Games
2009-04-03 17:59 . 2009-04-03 17:59 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Games
2009-04-03 16:07 . 2009-03-11 20:04 393956 ----a-w C:\kontakt.jpg
2009-04-03 16:06 . 2009-04-03 16:06 -------- d-----w c:\programme\iPod
2009-04-03 16:06 . 2009-04-03 16:06 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-04-03 16:04 . 2009-04-03 16:04 -------- d-----w c:\programme\QuickTime
2009-04-03 15:56 . 2009-04-03 15:56 -------- d-----w c:\programme\Bonjour
2009-03-27 18:01 . 2009-03-27 18:01 -------- d-----w c:\programme\MSXML 6.0
2009-03-24 14:39 . 2009-03-24 14:40 -------- d-----w c:\programme\Microsoft Games for Windows - LIVE
2009-03-24 14:29 . 2009-03-24 14:29 -------- d-----w c:\dokumente und einstellungen\Zitrone\Lokale Einstellungen\Anwendungsdaten\Fallout3
2009-03-24 14:19 . 2009-03-24 14:19 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Fallout3
2009-03-24 14:19 . 2009-03-24 14:19 -------- d-----w c:\programme\Bethesda Softworks
2009-03-24 14:17 . 2009-03-24 14:17 -------- d-----w c:\programme\MSBuild
2009-03-24 14:17 . 2009-03-24 14:17 147128 ----a-w c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2009-03-24 14:16 . 2009-03-24 14:16 -------- d-----w c:\windows\system32\XPSViewer
2009-03-24 14:16 . 2009-03-24 14:16 -------- d-----w c:\programme\Reference Assemblies
2009-03-24 14:15 . 2006-06-29 12:07 14048 ------w c:\windows\system32\spmsg2.dll
2009-03-24 14:14 . 2009-03-24 14:14 -------- d-----w c:\windows\system32\xlive
2009-03-23 19:46 . 2009-03-23 19:46 -------- d-----w c:\programme\Lavalys
2009-03-21 16:21 . 2009-03-21 16:21 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\InstallShield
2009-03-21 16:07 . 2009-03-21 16:07 68 ----a-w c:\windows\GPlrLanc.dat
2009-03-21 16:07 . 2009-03-21 16:07 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Metaboli Player
2009-03-21 16:07 . 2004-02-04 09:01 2238 ------w c:\windows\metaboli.ico
2009-03-21 16:07 . 2009-03-21 16:07 -------- d-----w C:\Remote Programs
2009-03-21 16:07 . 2009-03-21 20:19 -------- d-----w c:\programme\Metaboli Player
2009-03-21 16:07 . 2008-05-15 13:12 53314 ------w c:\windows\ExentInfo.exe
2009-03-21 16:06 . 2008-09-08 11:49 277096 ----a-w c:\windows\system32\YSys.dll
2009-03-21 16:06 . 2008-08-20 13:20 40040 ----a-w c:\windows\system32\SysChkVC.dll
2009-03-21 16:06 . 2008-08-20 13:20 350312 ----a-w c:\windows\system32\SysCheck2.dll
2009-03-21 16:06 . 2008-03-06 13:59 146 ----a-w c:\windows\system32\SysChkVC.dll.manifest
2009-03-21 16:06 . 2009-03-21 16:06 -------- d-----w C:\Metaboli
2009-03-21 14:06 . 2009-03-21 14:06 1063424 -c----w c:\windows\system32\dllcache\kernel32.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-18 15:59 . 2009-02-25 21:42 -------- d-----w c:\programme\Steam
2009-04-18 15:56 . 2008-10-31 14:11 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Skype
2009-04-18 15:52 . 2006-08-11 19:31 87688 ----a-w c:\windows\system32\perfc007.dat
2009-04-18 15:52 . 2006-08-11 19:31 465358 ----a-w c:\windows\system32\perfh007.dat
2009-04-18 15:50 . 2008-10-31 14:13 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\skypePM
2009-04-18 15:40 . 2006-08-11 19:37 86811 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-18 15:34 . 2001-08-18 12:00 251712 --sha-r C:\ntldr
2009-04-18 12:00 . 2008-12-06 14:03 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Hamachi
2009-04-17 13:20 . 2006-12-25 09:40 -------- d-----w c:\programme\Microsoft Works
2009-04-17 12:34 . 2007-02-09 23:23 25280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-04-17 12:19 . 2007-11-28 14:24 -------- d-----w c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2009-04-17 12:10 . 2006-12-25 09:38 71424 ----a-w c:\dokumente und einstellungen\Zitrone\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-04-16 23:31 . 2008-06-06 22:43 -------- d-----w c:\programme\Gemeinsame Dateien\Ahead
2009-04-16 23:31 . 2008-05-07 09:51 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nero
2009-04-16 23:00 . 2009-03-12 14:30 268 ---ha-w C:\sqmdata10.sqm
2009-04-16 23:00 . 2009-03-12 14:30 244 ---ha-w C:\sqmnoopt10.sqm
2009-04-16 00:59 . 2009-03-11 17:59 268 ---ha-w C:\sqmdata09.sqm
2009-04-16 00:59 . 2009-03-11 17:59 244 ---ha-w C:\sqmnoopt09.sqm
2009-04-15 19:53 . 2008-02-20 16:51 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\OpenOffice.org2
2009-04-15 10:23 . 2009-01-17 15:22 268 ---ha-w C:\sqmdata08.sqm
2009-04-15 10:23 . 2009-01-17 15:22 244 ---ha-w C:\sqmnoopt08.sqm
2009-04-14 18:04 . 2007-01-03 00:42 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\teamspeak2
2009-04-14 16:28 . 2008-06-09 20:10 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\FileZilla
2009-04-14 15:35 . 2009-02-15 19:57 -------- d-----w c:\programme\Celtx
2009-04-14 10:29 . 2009-01-17 00:01 268 ---ha-w C:\sqmdata07.sqm
2009-04-14 10:29 . 2009-01-17 00:01 244 ---ha-w C:\sqmnoopt07.sqm
2009-04-13 10:31 . 2009-01-16 10:47 268 ---ha-w C:\sqmdata06.sqm
2009-04-13 10:31 . 2009-01-16 10:47 244 ---ha-w C:\sqmnoopt06.sqm
2009-04-12 11:39 . 2009-01-15 14:39 268 ---ha-w C:\sqmdata05.sqm
2009-04-12 11:39 . 2009-01-15 14:39 244 ---ha-w C:\sqmnoopt05.sqm
2009-04-11 21:42 . 2008-03-06 14:04 -------- d-----w c:\programme\phase5
2009-04-11 13:42 . 2009-01-14 23:16 268 ---ha-w C:\sqmdata04.sqm
2009-04-11 13:42 . 2009-01-14 23:16 244 ---ha-w C:\sqmnoopt04.sqm
2009-04-10 11:56 . 2009-01-14 16:20 268 ---ha-w C:\sqmdata03.sqm
2009-04-10 11:56 . 2009-01-14 16:20 244 ---ha-w C:\sqmnoopt03.sqm
2009-04-09 21:34 . 2009-01-13 17:57 268 ---ha-w C:\sqmdata02.sqm
2009-04-09 21:34 . 2009-01-13 17:57 244 ---ha-w C:\sqmnoopt02.sqm
2009-04-09 19:50 . 2009-04-09 19:49 4322 ----a-w C:\Porno.txt
2009-04-09 12:21 . 2009-01-12 21:28 268 ---ha-w C:\sqmdata01.sqm
2009-04-09 12:21 . 2009-01-12 21:28 244 ---ha-w C:\sqmnoopt01.sqm
2009-04-08 09:36 . 2009-01-12 19:44 268 ---ha-w C:\sqmdata00.sqm
2009-04-08 09:36 . 2009-01-12 19:44 244 ---ha-w C:\sqmnoopt00.sqm
2009-04-07 17:25 . 2009-03-18 13:37 268 ---ha-w C:\sqmdata19.sqm
2009-04-07 17:25 . 2009-03-18 13:37 244 ---ha-w C:\sqmnoopt19.sqm
2009-04-07 11:05 . 2009-03-18 12:31 268 ---ha-w C:\sqmdata18.sqm
2009-04-07 11:05 . 2009-03-18 12:31 244 ---ha-w C:\sqmnoopt18.sqm
2009-04-06 15:06 . 2008-10-31 14:11 -------- d-----w c:\programme\Skype
2009-04-06 09:34 . 2009-03-17 13:01 268 ---ha-w C:\sqmdata17.sqm
2009-04-06 09:34 . 2009-03-17 13:01 244 ---ha-w C:\sqmnoopt17.sqm
2009-04-05 08:50 . 2009-03-16 13:02 268 ---ha-w C:\sqmdata16.sqm
2009-04-05 08:50 . 2009-03-16 13:02 244 ---ha-w C:\sqmnoopt16.sqm
2009-04-04 22:37 . 2009-03-15 09:20 268 ---ha-w C:\sqmdata15.sqm
2009-04-04 22:37 . 2009-03-15 09:20 244 ---ha-w C:\sqmnoopt15.sqm
2009-04-04 15:25 . 2009-01-08 22:08 413696 ----a-w c:\windows\system32\wrap_oal.dll
2009-04-04 15:25 . 2009-01-08 22:08 110592 ----a-w c:\windows\system32\OpenAL32.dll
2009-04-03 23:20 . 2009-03-14 23:33 268 ---ha-w C:\sqmdata14.sqm
2009-04-03 23:20 . 2009-03-14 23:33 244 ---ha-w C:\sqmnoopt14.sqm
2009-04-03 16:06 . 2008-10-30 19:09 -------- d-----w c:\programme\iTunes
2009-04-03 16:06 . 2008-02-11 15:27 -------- d-----w c:\programme\Gemeinsame Dateien\Apple
2009-04-03 15:58 . 2008-12-05 21:41 -------- d-----w c:\programme\Safari
2009-04-02 20:37 . 2009-03-14 16:10 268 ---ha-w C:\sqmdata13.sqm
2009-04-02 20:37 . 2009-03-14 16:10 244 ---ha-w C:\sqmnoopt13.sqm
2009-04-01 21:20 . 2009-03-14 10:22 268 ---ha-w C:\sqmdata12.sqm
2009-04-01 21:20 . 2009-03-14 10:22 244 ---ha-w C:\sqmnoopt12.sqm
2009-03-31 21:14 . 2009-03-13 17:20 268 ---ha-w C:\sqmdata11.sqm
2009-03-31 21:14 . 2009-03-13 17:20 244 ---ha-w C:\sqmnoopt11.sqm
2009-03-31 18:17 . 2008-02-05 18:21 -------- d-----w c:\programme\ICQ6
2009-03-30 13:19 . 2006-08-11 19:41 -------- d--h--w c:\programme\InstallShield Installation Information
2009-03-24 14:13 . 2007-03-04 11:50 107888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-03-23 19:04 . 2009-03-07 17:12 -------- d-----w c:\programme\TrackMania Nations ESWC
2009-03-14 23:55 . 2009-03-14 23:55 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\The Creative Assembly
2009-03-13 17:56 . 2008-02-08 23:35 -------- d-----w c:\programme\Gamesload Spiele
2009-03-12 17:28 . 2009-01-20 18:38 -------- d-----w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\gtk-2.0
2009-03-10 13:58 . 2009-03-10 13:58 -------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Media Center Programs
2009-03-10 13:43 . 2009-03-10 13:43 -------- d-----w c:\programme\THQ
2009-03-06 14:19 . 2004-08-10 19:00 286720 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:03 . 2006-03-04 04:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 16:49 . 2004-08-10 19:00 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 10:59 . 2009-02-20 10:59 4096 ----a-w c:\windows\d3dx.dat
2009-02-20 10:52 . 2009-02-20 10:52 -------- d-----w c:\programme\PiranhaBytes
2009-02-09 14:04 . 2005-10-06 03:08 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:21 . 2005-09-29 18:28 2026496 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:21 . 2005-09-29 18:27 2147840 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:21 . 2004-08-10 19:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:51 . 2005-07-26 04:39 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:51 . 2004-10-28 01:23 736768 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:51 . 2004-08-10 19:00 678400 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:51 . 2004-08-10 19:00 740352 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 10:39 . 2004-08-10 19:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:57 . 2004-08-10 19:00 56832 ----a-w c:\windows\system32\secur32.dll
2008-10-07 17:42 . 2008-03-27 19:36 22328 ----a-w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\PnkBstrK.sys
2008-06-16 09:02 . 2008-06-16 09:02 0 ----a-w c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\wklnhst.dat
2008-05-25 23:28 . 2008-05-25 23:28 5120 ----a-w c:\programme\wgvids.db
2007-01-25 02:52 . 2007-01-25 02:52 65536 ----a-w c:\programme\Gemeinsame Dateien\NMSAccessU.exe
2006-12-25 09:34 . 2006-12-24 18:53 140 ----a-w c:\dokumente und einstellungen\Zitrone\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
2006-08-11 19:31 . 2006-08-11 19:31 146 ----a-w c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
|
|
18.04.2009, 17:11
| #5 |
| | System infizert gewesen - wieder sauber? log teil 2: Code:
ATTFilter
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2008-05-07 11:15 1470488 ----a-w c:\programme\free-downloads.net\tbfre1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\programme\free-downloads.net\tbfre1.dll" [2008-05-07 1470488]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\programme\free-downloads.net\tbfre1.dll" [2008-05-07 1470488]
[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-17 68856]
"AlcoholAutomount"="c:\programme\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
"Steam"="c:\programme\Steam\Steam.exe" [2009-02-25 1410296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-11 7626752]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-11 86016]
"ntiMUI"="c:\programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut"="c:\programme\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"avgnt"="c:\programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 266497]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-08-14 185896]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-05 177472]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2009-03-12 342312]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-11 1519616]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-31 16208384]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w c:\programme\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^MA111 Configuration Utility.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\MA111 Configuration Utility.lnk
backup=c:\windows\pss\MA111 Configuration Utility.lnkCommon Startup
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WeGame.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\WeGame.lnk
backup=c:\windows\pss\WeGame.lnkCommon Startup
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Zitrone^Startmenü^Programme^Autostart^OpenOffice.org 2.3.lnk]
path=c:\dokumente und einstellungen\Zitrone\Startmenü\Programme\Autostart\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Steam\\steamapps\\ander1992\\counter-strike source\\hl2.exe"=
"c:\\Programme\\Gemeinsame Dateien\\aol\\System Information\\sinf.exe"=
"c:\\Programme\\ICQ6\\ICQ.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Programme\\mIRC\\mirc.exe"=
"d:\\Programme\\World In Conflict\\wic.exe"=
"d:\\Programme\\World In Conflict\\wic_online.exe"=
"d:\\Programme\\World In Conflict\\wic_ds.exe"=
"d:\\Programme\\World of Warcraft\\WoW-1.12.0-deDE-downloader.exe"=
"c:\\Programme\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Programme\\THQ\\Gas Powered Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"=
"c:\\Programme\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
"c:\\Programme\\Steam\\steamapps\\common\\empire total war\\Empire.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"d:\\Programme\\KAL\\kaneandlynch.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
R3 ATP;Comodo EasyVPN Miniport Driver; [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2006-12-27 4352]
R3 cdiskdun;cdiskdun; [x]
R3 EraserUtilDrv10633;EraserUtilDrv10633; [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2006-12-27 265088]
R3 HotSpotFSvc;Hotspot Manager; [x]
R3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
R3 TSMPacket;T-DSL Manager Service; [x]
R3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\DRIVERS\wip0204.sys [2008-12-30 23480]
S1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [2008-07-17 99840]
S2 ContentMgrService;Content Management Service;c:\programme\Videoload Manager\ContentManager.exe [2008-03-12 508928]
S2 X4HSX32Ex;X4HSX32Ex;c:\programme\Metaboli Player\X4HSX32Ex.Sys [2007-11-14 29856]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2008-05-15 21920]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edfacba6-1c1c-11dd-9231-00038a000015}]
\Shell\AutoRun\command - K:\SETUP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{97317135-AC06-E7DA-E5BC-088DD99ED025}]
c:\windows\system32:msnsrve.exe
.
Inhalt des "geplante Tasks" Ordners
2009-04-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2009-04-18 c:\windows\Tasks\RegCure Program Check.job
- c:\programme\RegCure\RegCure.exe [2008-04-21 21:21]
2009-01-08 c:\windows\Tasks\RegCure.job
- c:\programme\RegCure\RegCure.exe [2008-04-21 21:21]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
Notify-flashcft - flashcft.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.filmstarts.de/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Link mit Mega Manager herunterladen... - c:\programme\Megaupload\Mega Manager\mm_file.htm
TCP: {13016BD4-C878-4BF0-A25C-4B9E15E87769} = 192.168.2.1
TCP: {D8D1909B-B190-436B-A9EB-7A2E51A7AADA} = 192.168.2.1
Handler: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax
Handler: fluxhttp\0x00000007 - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax
FF - ProfilePath - c:\dokumente und einstellungen\Zitrone\Anwendungsdaten\Mozilla\Firefox\Profiles\mejx3xt1.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\programme\Mozilla Firefox\extensions\YPlayer@yummy.net\components\FYPlayer.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programme\GameTap\bin\Release\npgametaptool.dll
FF - plugin: c:\programme\Gemeinsame Dateien\fluxDVD\APIX\NPAPIX.dll
FF - plugin: c:\programme\Gemeinsame Dateien\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
FF - plugin: c:\programme\Gemeinsame Dateien\mpDRM\NPMPDRM.dll
FF - plugin: c:\programme\Gemeinsame Dateien\mpDRM\NPWMDRMWrapper.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPAPIX.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npExentCtl.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPMPDRM.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPWMDRMWrapper.dll
FF - plugin: c:\programme\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\programme\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\programme\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
---- FIREFOX Richtlinien ----
FF - user.js: signed.applets.codebase_principal_support - true
/* To avoid the user interaction, add the following lines: */
FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_YAEL.id - hxxp://yael.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_GLDEINT.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GLDEINT.id - hxxp://glde-int.metaboli.fr/
FF - user.js: capability.principal.codebase.YummyPlayer_GLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_GLDE.id - hxxp://gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_WGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_WGLDE.id - hxxp://www.gamesflatrate.de/
FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_LHOST.id - hxxp://localhost/
FF - user.js: capability.principal.codebase.YummyPlayer_SGLDE.granted - UniversalXPConnect
FF - user.js: capability.principal.codebase.YummyPlayer_SGLDE.id - hxxps://gamesflatrate.de/
c:\programme\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-18 17:59
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Boonty Games]
"ImagePath"="\"c:\programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-427066467-3079093524-2493077868-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-427066467-3079093524-2493077868-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:4b,3c,04,22,7f,8d,56,ba,31,75,cd,9e,5b,4b,bb,47,95,15,41,15,50,c9,b4,
4a,61,08,7d,07,03,ce,99,68,e1,f8,bc,03,fa,1f,99,86,54,04,d1,24,4e,b4,7f,d4,\
"??"=hex:e7,c5,77,f1,83,bd,6b,bf,5a,b7,47,0e,04,35,92,1a
[HKEY_USERS\S-1-5-21-427066467-3079093524-2493077868-1005\Software\SecuROM\License information*]
"datasecu"=hex:ce,fd,01,54,84,d5,82,e9,75,01,55,bb,df,fe,fa,4f,47,26,c6,dc,53,
ce,71,43,03,f5,98,92,9d,ec,5d,aa,23,43,3a,40,ed,fc,ed,7b,8a,94,90,91,db,bb,\
"rkeysecu"=hex:82,c3,15,4f,bb,1d,3b,7f,84,f5,53,93,76,d6,d1,ff
[HKEY_LOCAL_MACHINE\software\mpDRM\LicenseStore*]
"CheckValue"=dword:febfbd00
"41F4A104"="4616266D"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(792)
c:\programme\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(4020)
c:\programme\iTunes\iTunesMiniPlayer.dll
c:\programme\iTunes\iTunesMiniPlayer.Resources\de.lproj\iTunesMiniPlayerLocalized.dll
c:\programme\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\programme\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\programme\Gemeinsame Dateien\NMSAccessU.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\programme\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\tcpsvcs.exe
c:\programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\ehome\mcrdsvc.exe
c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\programme\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2009-04-18 18:03 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2009-04-18 16:03
Vor Suchlauf: 29 Verzeichnis(se), 15.479.144.448 Bytes frei
Nach Suchlauf: 28 Verzeichnis(se), 15.642.750.976 Bytes frei
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect
443 --- E O F --- 2009-04-17 13:21
|
|
18.04.2009, 17:36
| #6 |
| | System infizert gewesen - wieder sauber? Erstelle bitte ein Softwareliste mit HiJackthis: 1. open the misc tool section 2. open uninstall manager 3. save list und poste die Liste hier rein. Ebenso führe ZHPDiag aus, nach dieser Anleitung: http://www.trojaner-board.de/72020-a...g-zhpdiag.html Hinweis: Wenn Du Zeit sparen möchtest, dann setze das System neu auf, das ist sehr vermurkst das System.
__________________ --> System infizert gewesen - wieder sauber? |
|
18.04.2009, 17:52
| #7 |
| | System infizert gewesen - wieder sauber? hier log teil 1: Code:
ATTFilter Rapport de ZHPDiag v1.18 par Nicolas Coolman Enregistré le 18.04.2009 18:42:30 Platform : Microsoft Windows XP (5.1.2600) Service Pack 3 MSIE: Internet Explorer v7.0.5730.11 MFIE: Mozilla Firefox (3.0.8) ---\\ Processus lancés C:\WINDOWS\ehome\ehtray.exe nwiz.exe RTHDCPL.EXE SkyTel.EXE c:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe C:\Programme\CyberLink\PowerDVD\PDVDServ.exe C:\Programme\CyberLink\PowerDVD\Language\Language.exe C:\Programme\Java\jre1.6.0_05\bin\jusched.exe C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ati2sgag.exe C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme\Videoload Manager\ContentManager.exe C:\WINDOWS\system32\services.exe c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Programme\Gemeinsame Dateien\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\lsass.exe C:\Programme\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe ---\\ Pages de recherche de Mozilla Firefox (M1) M1 - SPR:Search Page Redirection - C:\Programme\Mozilla FireFox\extensions\YPlayer@yummy.net ---\\ Pages de démarrage d'Internet Explorer (R0) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmstarts.de/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 ---\\ Pages de recherche d'Internet Explorer (R1) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local ---\\ Browser Helper Objects de navigateur(O2) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\GEMEIN~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Programme\free-downloads.net\tbfre1.dll ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Programme\free-downloads.net\tbfre1.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programme\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll ---\\ Applications démarrées automatiquement par le registre (O4) O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ntiMUI] c:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.6.0_05\bin\jusched.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programme\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [Steam] "C:\Programme\Steam\Steam.exe" -silent O4 - HKLM\..\policies\Explorer: [HonorAutoRunSetting] Data="1" O4 - HKLM\..\policies\Explorer: [NoDriveAutoRun] Data="67108863" O4 - HKLM\..\policies\Explorer: [NoDriveTypeAutoRun] Data="323" O4 - HKLM\..\policies\Explorer: [NoDrives] Data="0" ---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8) O8 - Extra context menu item: Link mit Mega Manager herunterladen... - C:\Programme\Megaupload\Mega Manager\mm_file.htm ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe,302 O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe,1040 O9 - Extra button: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe,1040 O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe,302 ---\\ Piratage de l'Option 'Rétablir les paramètres Web' (O14) O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="ie.search.msn.com" ---\\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.lokalisten.de/iup/ImageUploader4.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab ---\\ Piratage de domaine (Lop.com) (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{13016BD4-C878-4BF0-A25C-4B9E15E87769}: 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{D8D1909B-B190-436B-A9EB-7A2E51A7AADA}: 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{13016BD4-C878-4BF0-A25C-4B9E15E87769}: 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{D8D1909B-B190-436B-A9EB-7A2E51A7AADA}: 192.168.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{13016BD4-C878-4BF0-A25C-4B9E15E87769}: 192.168.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{D8D1909B-B190-436B-A9EB-7A2E51A7AADA}: 192.168.2.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{13016BD4-C878-4BF0-A25C-4B9E15E87769}: 192.168.2.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{D8D1909B-B190-436B-A9EB-7A2E51A7AADA}: 192.168.2.1 ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: SABWINLOStartup - C:\Programme\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: AtiStartupEvent - C:\WINDOWS\System32\Ati2evxx.dll O20 - Winlogon Notify: WlDimsStartup - C:\WINDOWS\System32\%SystemRoot%\System32\dimsntfy.dll ---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22) O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device (Apple Mobile Device) - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: (Ati HotKey Poller) - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart (ATI Smart) - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler (Automatic LiveUpdate Scheduler) - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Content Management Service (ContentMgrService) - C:\Programme\Videoload Manager\ContentManager.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: Media Center Extender Service (McrdSvc) - C:\WINDOWS\ehome\mcrdsvc.exe O23 - Service: NMSAccessU (NMSAccessU) - C:\Programme\Gemeinsame Dateien\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA (PnkBstrA) - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB (PnkBstrB) - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - C:\Programme\CyberLink\Shared Files\RichVideo.exe O23 - Service: Einfache TCP/IP-Dienste (SimpTcp) - C:\WINDOWS\system32\tcpsvcs.exe O23 - Service: Druckwarteschlange (Spooler) - C:\WINDOWS\system32\spoolsv.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe ---\\ Enumération des composants Active Desktop (O24) O24 - Desktop Component 0: (no name) - file:http://de.wikipedia.org/skins-1.5/monobook/headbg.jpg O24 - Desktop Component 1: Die derzeitige Homepage - file:About:Home ---\\ Composants installés (ActiveSetup Installed Components) (O40) O40 - ASIC: IE7 Uninstall Stub - <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP O40 - ASIC: Internet Explorer - {26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE O40 - ASIC: Browser Customizations - {60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP O40 - ASIC: Browseranpassungen - {60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP O40 - ASIC: Outlook Express - {881dd1c5-3dcf-431b-b061-f3f88e8be88a} - C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE O40 - ASIC: KB910393 - KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall O40 - ASIC: Viewpoint Media Player - {03F998B2-0E00-11D3-A498-00104B6EB52E} - (not file) O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file) O40 - ASIC: Vektorgrafik-Rendering (VML) - {10072CEC-8CC1-11D1-986E-00A0C955B42F} - (not file) O40 - ASIC: Sicherheitsupdate für Windows XP (KB913433) - {1325db73-d9f1-48f8-8895-6d814ec58889} - (not file) O40 - ASIC: Viewpoint Media Player - {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - (not file) O40 - ASIC: Microsoft .NET Framework 1.0 Hotfix (KB887998) - {1BC46932-21B2-4130-86E0-B4EB4F7A7A7B} - (not file) O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - C:\WINDOWS\system32\wmpdxm.dll O40 - ASIC: Microsoft Windows Media Player 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\system32\wmpdxm.dll O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} - (not file) O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll O40 - ASIC: Dynamic HTML-Datenbindung für Java - {36f8ec70-c29a-11d1-b5c7-0000f8051515} - (not file) O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file) O40 - ASIC: Uniscribe - {3bf42070-b3b1-11d1-b5c5-0000f8051515} - (not file) O40 - ASIC: Media Center - {407408d4-94ed-4d86-ab69-a7f649d112ee} - C:\WINDOWS\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 C:\WINDOWS\inf\mcdftreg.inf O40 - ASIC: Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) - {411EDCF7-755D-414E-A74B-3DCD6583F589} - (not file) O40 - ASIC: Erweitertes Authoring - {4278c270-a269-11d1-b5bf-0000f8051515} - (not file) O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT O40 - ASIC: DirectShow - {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - (not file) O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file) O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file) O40 - ASIC: DirectAnimation Java Classes - {4f216970-c90c-11d1-b5c7-0000f8051515} - (not file) O40 - ASIC: Microsoft Windows Script 5.7 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file) O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser O40 - ASIC: (no name) - {5A8D6EE0-3E18-11D0-821E-444553540000} - (not file) O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file) O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file) O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file) O40 - ASIC: .NET Framework - {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - (not file) O40 - ASIC: Adressbuch 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install O40 - ASIC: Viewpoint Media Player - {7AA6739A-9EC5-6C7D-DC8D-EBA5768EA16B} - (not file) O40 - ASIC: Windows Desktop-Update - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install O40 - ASIC: Fax - {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser O40 - ASIC: Microsoft .NET Framework 1.1 Hotfix (KB928366) - {8D1D0E9A-C799-4D28-9E29-0061D1E66E43} - (not file) O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file) O40 - ASIC: Fax Provider - {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - rundll32.exe C:\WINDOWS\system32\Setup\FxsOcm.dll,XP_UninstallProvider O40 - ASIC: (no name) - {97317135-AC06-E7DA-E5BC-088DD99ED025} - C:\WINDOWS\system32:msnsrve.exe O40 - ASIC: .NET Framework - {B508B3F1-A24A-32C0-B310-85786919EF28} - (not file) O40 - ASIC: IE7 Uninstall Stub - {B6B6F056-320C-116A-31B2-CB99A3A77D0F} - (not file) O40 - ASIC: Microsoft .NET Framework 1.0 Hotfix (KB930494) - {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - (not file) O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file) O40 - ASIC: .NET Framework - {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - (not file) O40 - ASIC: Taskplaner - {CC2A9BA0-3BDD-11D0-821E-444553540000} - (not file) O40 - ASIC: (no name) - {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - (not file) O40 - ASIC: Macromedia Shockwave Flash - {D27CDB6E-AE6D-11cf-96B8-444553540000} - C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file) O40 - ASIC: .NET Framework - {E78BFA60-5393-4C38-82AB-E8019E464EB4} - (not file) O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file) O40 - ASIC: Microsoft .NET Framework 1.0 Service Pack 3 - {EA29D410-CE41-4953-A862-2DE706A1DAD7} - (not file) O40 - ASIC: .NET Framework - {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - (not file) |
|
| Themen zu System infizert gewesen - wieder sauber? |
| add-on, adobe, adware.trace, avira, bho, bonjour, browser, desktop, disabled.securitycenter, entfernen, explorer, google, gservice, hijack, hijackthis, hijackthis log, hkus\s-1-5-18, hotspot, internet, internet explorer, logfile, magix, malware, malwarebytes' anti-malware, mbam log, nvidia, object, plug-in, pop-up-blocker, registrierungsschlüssel, rootkit, rootkit.agent, rundll, security, software, symantec, system, toolbars, windows xp |
Hybrid-Darstellung
