| |
| |||||||
Log-Analyse und Auswertung: Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durchWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
04.12.2009, 16:21
| #1 |
 |  Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch Wie angeordnet habe ich jetzt ein neues Thema eröffnet, mein Problem habe ich ja vorher schon beschrieben, also hier die Logs: Code:
ATTFilter Logfile of random's system information tool 1.06 (written by random/random) Run by Administrator at 2009-12-04 15:20:26 Microsoft Windows XP Professional Service Pack 2 System drive C: has 62 GB (78%) free of 80 GB Total RAM: 1918 MB (56% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:20:45, on 04.12.2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Programme\AVG\AVG9\avgrsx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programme\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Programme\Winamp\winampa.exe C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE C:\WINDOWS\RTHDCPL.EXE C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\SweetIM\Messenger\SweetIM.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\QuickTime\QTTask.exe C:\Programme\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe C:\Programme\Lingoes\Translator2\Lingoes.exe C:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe C:\WINDOWS\System32\svchost.exe C:\Programme\iPod\bin\iPodService.exe C:\Programme\AVG\AVG9\avgchsvx.exe C:\Programme\AVG\AVG9\avgwdsvc.exe C:\Programme\AVG\AVG9\avgnsx.exe C:\Programme\AVG\AVG9\avgtray.exe C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE C:\Programme\Microsoft\Office Live\OfficeLiveSignIn.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Malwarebytes' Anti-Malware\mbam.exe C:\Dokumente und Einstellungen\Administrator\Desktop\RSIT.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Dokumente und Einstellungen\Administrator\Desktop\Administrator.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.radiofips.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG9\avgssie.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll O3 - Toolbar: (no name) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - (no file) O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKLM\..\RunOnce: [AGCoreCleanup] CMD /C RD /S /Q "C:/Programme/AGI" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Lingoes] C:\Programme\Lingoes\Translator2\Lingoes.exe -minimize O4 - HKCU\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /M "Stylus DX3800" /EF "HKCU" O4 - HKCU\..\Run: [Google Update] "C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [bkcic] "c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe" bkcic O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Programme\Bonjour\ExplorerPlugin.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O15 - Trusted Zone: *.moove.com O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231149529781 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1232376656125 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O18 - Protocol: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG9\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programme\AVG\AVG9\avgwdsvc.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Google Update Service (gupdate1c9d168ee0e7a60) (gupdate1c9d168ee0e7a60) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe -- End of file - 14235 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\1-Klick-Wartung.job C:\WINDOWS\tasks\Google Software Updater.job C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1645522239-839522115-500Core.job C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1645522239-839522115-500UA.job C:\WINDOWS\tasks\Norton Security Scan for Administrator.job C:\WINDOWS\tasks\Norton Security Scan.job C:\WINDOWS\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - c:\program files\real\realplayer\rpbrowserrecordplugin.dll [2009-09-26 329312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}] AVG Safe Search - C:\Programme\AVG\AVG9\avgssie.dll [2009-12-03 1475864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll [2009-12-01 263280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] AcroIEToolbarHelper Class - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-24 231160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-12-01 764912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}] EpsonToolBandKicker Class - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}] SweetIM Toolbar Helper - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2008-10-08 1172792] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-24 231160] {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640] {EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2008-10-08 1172792] {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} {2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll [2009-12-01 263280] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] ""= [] "Acrobat Assistant 7.0"=C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2005-09-24 483328] "NeroFilterCheck"=C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe [2006-01-12 155648] "WinampAgent"=C:\Programme\Winamp\winampa.exe [2006-05-25 35328] "ATICCC"=C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe [2006-09-25 90112] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488] "TrueImageMonitor.exe"=C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe [2007-02-17 1194728] "AcronisTimounterMonitor"=C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe [2007-02-17 1966928] "Acronis Scheduler2 Service"=C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe [2007-02-16 149024] "EPSON Stylus DX3800 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE [2005-02-08 98304] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-06-28 16248320] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-03-09 148888] "avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "SweetIM"=C:\Programme\SweetIM\Messenger\SweetIM.exe [2009-03-05 111928] "TkBellExe"=C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2009-09-26 198160] "QuickTime Task"=C:\Programme\QuickTime\QTTask.exe [2009-09-05 417792] "iTunesHelper"=C:\Programme\iTunes\iTunesHelper.exe [2009-09-21 305440] "AVG9_TRAY"=C:\PROGRA~1\AVG\AVG9\avgtray.exe [2009-12-03 2020120] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "AGCoreCleanup"=CMD /C RD /S /Q C:/Programme/AGI [] "Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-03 429392] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-06-01 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe [2006-04-21 94208] "swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-12-27 68856] "Lingoes"=C:\Programme\Lingoes\Translator2\Lingoes.exe [2009-07-16 2191360] "EPSON Stylus DX3800 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE [2005-02-08 98304] "Google Update"=C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2009-04-05 133104] "bkcic"=c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe [2009-12-03 328192] C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2007-01-08 110592] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter] C:\WINDOWS\system32\avgrsstx.dll [2009-12-03 12464] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2006-06-01 240128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "authentication packages"=msv1_0 relog_ap [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Programme\Windows Live\Sync\WindowsLiveSync.exe"="C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Programme\Windows Live\Sync\WindowsLiveSync.exe"="C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1eec13cc-1485-11de-ae9d-00e04d283001}] shell\AutoRun\command - K:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e9da2bd-cdd8-11dd-adfb-00e04d283001}] shell\AutoRun\command - K:\DPFMate.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75f98c0d-b409-11de-afa7-00e04d283001}] shell\AutoRun\command - G:\LaunchU3.exe -a ======File associations====== .reg - open - "regedit.exe" "%1" ======List of files/folders created in the last 3 months====== 2009-12-04 15:20:26 ----D---- C:\rsit 2009-12-04 15:16:54 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes 2009-12-04 15:16:42 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2009-12-04 15:16:36 ----D---- C:\Programme\Malwarebytes' Anti-Malware 2009-12-03 12:08:30 ----HD---- C:\$AVG 2009-12-03 12:08:17 ----A---- C:\WINDOWS\system32\avgrsstx.dll 2009-12-03 12:07:47 ----D---- C:\Programme\AVG 2009-12-03 12:07:46 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\avg9 2009-12-01 19:37:28 ----D---- C:\Programme\Microsoft 2009-11-06 13:12:55 ----A---- C:\WINDOWS\FA123.INI 2009-11-06 13:11:27 ----D---- C:\FA-123 2009-10-31 11:36:40 ----D---- C:\My Music 2009-10-30 22:12:22 ----A---- C:\WINDOWS\cryavitowmv.ini 2009-10-30 22:10:37 ----D---- C:\Programme\Crystal Software 2009-10-30 21:02:42 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Shareaza 2009-10-30 13:23:34 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DivX 2009-10-30 13:21:24 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared 2009-10-30 13:21:23 ----D---- C:\Programme\DivX 2009-10-29 15:56:58 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NOS 2009-10-25 18:44:50 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lingoes 2009-10-16 14:43:55 ----D---- C:\Programme\XMedia Recode 2009-10-16 10:45:08 ----D---- C:\Programme\iPod 2009-10-16 10:45:05 ----D---- C:\Programme\iTunes 2009-10-16 10:45:05 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-10-10 16:46:06 ----D---- C:\Programme\Pinnacle 2009-10-10 16:46:06 ----D---- C:\Programme\Gemeinsame Dateien\Yahoo! 2009-10-10 16:46:06 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle VideoSpin 2009-10-10 16:45:15 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle 2009-10-09 15:12:17 ----D---- C:\Programme\Bonjour 2009-10-05 19:36:03 ----D---- C:\Programme\Free M4a to MP3 Converter 2009-10-02 20:08:42 ----D---- C:\Programme\Conduit 2009-10-02 20:08:38 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\LimeWire 2009-09-30 19:56:57 ----D---- C:\Programme\phase5 2009-09-26 06:55:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real 2009-09-26 06:55:09 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2009-09-26 06:55:04 ----A---- C:\WINDOWS\system32\pndx5032.dll 2009-09-26 06:55:04 ----A---- C:\WINDOWS\system32\pndx5016.dll 2009-09-26 06:55:02 ----D---- C:\Programme\Gemeinsame Dateien\xing shared ======List of files/folders modified in the last 3 months====== 2009-12-04 15:16:44 ----D---- C:\WINDOWS\system32\drivers 2009-12-04 15:16:36 ----RD---- C:\Programme 2009-12-04 15:11:02 ----D---- C:\Programme\Mozilla Firefox 2009-12-04 15:03:40 ----D---- C:\Programme\AGI 2009-12-04 14:38:05 ----SD---- C:\WINDOWS\Tasks 2009-12-04 13:07:52 ----D---- C:\WINDOWS\Temp 2009-12-04 13:02:09 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater 2009-12-04 13:01:52 ----D---- C:\WINDOWS\system32\CatRoot2 2009-12-03 19:48:16 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-12-03 19:09:27 ----D---- C:\WINDOWS 2009-12-03 12:52:26 ----SHD---- C:\WINDOWS\Installer 2009-12-03 12:52:02 ----D---- C:\Programme\Safari 2009-12-03 12:40:05 ----D---- C:\WINDOWS\Microsoft.NET 2009-12-03 12:08:17 ----D---- C:\WINDOWS\system32 2009-12-03 12:07:35 ----D---- C:\WINDOWS\WinSxS 2009-12-03 11:58:14 ----D---- C:\WINDOWS\lhsp 2009-12-02 12:46:03 ----A---- C:\WINDOWS\NeroDigital.ini 2009-12-02 10:55:10 ----D---- C:\Programme\Microsoft Silverlight 2009-12-01 19:39:59 ----D---- C:\Programme\Windows Live 2009-12-01 19:39:55 ----RSD---- C:\WINDOWS\assembly 2009-12-01 19:38:45 ----D---- C:\WINDOWS\system32\DirectX 2009-11-08 18:00:03 ----D---- C:\Programme\Norton Security Scan 2009-11-06 19:42:37 ----RSD---- C:\WINDOWS\Fonts 2009-11-06 19:42:37 ----D---- C:\WINDOWS\system 2009-10-31 10:48:45 ----A---- C:\WINDOWS\system.ini 2009-10-30 13:27:33 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-10-30 13:21:24 ----D---- C:\Programme\Gemeinsame Dateien 2009-10-25 18:24:44 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-10-16 10:54:37 ----HD---- C:\WINDOWS\inf 2009-10-16 10:54:13 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Apple Computer 2009-10-16 10:45:41 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-10-16 10:45:07 ----D---- C:\Programme\Gemeinsame Dateien\Apple 2009-10-16 10:44:07 ----D---- C:\Programme\QuickTime 2009-10-08 19:33:53 ----D---- C:\Programme\PhotoCardMaker 2009-10-08 14:34:41 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\U3 2009-10-03 17:14:41 ----D---- C:\Programme\Sony Online Entertainment 2009-10-02 20:08:27 ----D---- C:\WINDOWS\Prefetch 2009-09-26 06:55:23 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Real 2009-09-26 06:55:13 ----D---- C:\Programme\Gemeinsame Dateien\Real 2009-09-26 06:54:52 ----A---- C:\WINDOWS\system32\pncrt.dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys [] R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-12-03 333192] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-12-03 28424] R1 AvgTdiX;AVG Free Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-12-03 360584] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-05-22 96104] R1 BIOS;BIOS; \??\C:\WINDOWS\system32\drivers\BIOS.sys [] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-11 28520] R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-08-05 55656] R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2007-12-26 32768] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-01-08 1921536] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-28 4304384] R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys [] R3 ovt519;%USB\vid_054c&pid_0155.DeviceDesc%; C:\WINDOWS\System32\Drivers\ov519vid.sys [2003-10-15 174530] R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtHDMI.sys [2007-01-11 3624832] R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-08-14 83200] R3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264] R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024] S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys [] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376] S3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS\system32\drivers\nchssvad.sys [2009-02-18 27136] S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880] S3 QV2KUX;Casio-Digitalkamera; C:\WINDOWS\system32\DRIVERS\qv2kux.sys [2001-08-17 3328] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136] S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448] S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528] S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-04-11 87808] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 mchInjDrv;mchInjDrv; \??\C:\WINDOWS\TEMP\mc21.tmp [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe [2007-02-16 411168] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-06-11 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089] R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712] R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-01-08 434176] R2 avg9wd;AVG Free WatchDog; C:\Programme\AVG\AVG9\avgwdsvc.exe [2009-12-03 285392] R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-09 152984] R2 TUWinStylerThemeSvc;TuneUp WinStyler Theme Service; C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe [2005-08-24 118272] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2006-06-01 14336] R3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-09-21 545568] S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2007-01-08 520192] S2 gupdate1c9d168ee0e7a60;Google Update Service (gupdate1c9d168ee0e7a60); C:\Programme\Google\Update\GoogleUpdate.exe [2009-05-10 133104] S2 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-25 183280] S3 Adobe LM Service;Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-12-17 69632] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-06-01 89136] S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-10-24 920576] -----------------EOF----------------- Code:
ATTFilter info.txt logfile of random's system information tool 1.06 2009-12-04 15:21:24
======Uninstall list======
-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Programme\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acronis*True*Image*Home-->MsiExec.exe /X{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}
Adobe Acrobat 7.0.5 Professional - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-7760-000000000002}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Alarm für Cobra 11 Vol.2-->D:\Spiele\ALARMF~1\ALARMF~1.2\UNINST32.EXE D:\Spiele\ALARMF~1\ALARMF~1.2\INSTALL.LOG
AoA Audio Extractor 1.0-->"C:\Programme\AoA Audio Extractor\unins000.exe"
Apple Application Support-->MsiExec.exe /I{3FA365DF-2D68-45ED-8F83-8C8A33E65143}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI - Dienstprogramm zur Deinstallation der Software-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->MsiExec.exe /I{9FFDBF28-DA86-44CC-BCD2-9948EE49E7A4}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
Audacity 1.2.6-->"C:\Programme\Audacity\unins000.exe"
AVG Free 9.0-->C:\Programme\AVG\AVG9\setup.exe /UNINSTALL
AVI To WMV Converter 1.00-->"C:\Programme\Crystal Software\AVI To WMV Converter\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CDex extraction audio-->"C:\Programme\CDex_150\uninstall.exe"
DeskBot-->"C:\Programme\BellCraft.com\DeskBot\unins000.exe"
DivX Converter-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EPSON Copy Utility 3-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x7 -UnInstall
EPSON Scan-->C:\Programme\epson\escndv\setup\setup.exe /r
EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x7 -anything
EPSON-Drucker-Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
Favorit-->"c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe" -uninstall
Free Audio Dub version 1.4-->"C:\Programme\DVDVideoSoft\Free Audio Dub\unins000.exe"
Free M4a to MP3 Converter 6.1-->"C:\Programme\Free M4a to MP3 Converter\unins000.exe"
Free Video Dub version 1.4-->"C:\Programme\DVDVideoSoft\Free Video Dub\unins000.exe"
Free YouTube to iPod Converter version 3.1-->"C:\Programme\DVDVideoSoft\Free YouTube to iPod Converter\unins000.exe"
Free YouTube to Mp3 Converter version 3.1-->"C:\Programme\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe"
GIMP 2.6.6-->"C:\Programme\GIMP-2.0\setup\unins000.exe"
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
Google Toolbar for Internet Explorer-->"C:\Programme\Google\Google Toolbar\Component\GoogleToolbarManager_0E996B068B56FCA2.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater-->"C:\Programme\Google\Google Updater\GoogleUpdater.exe" -uninstall
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs-->MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
HijackThis 2.0.2-->"C:\Dokumente und Einstellungen\Administrator\Desktop\HijackThis.exe" /uninstall
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
IrfanView (remove only)-->C:\Programme\IrfanView\iv_uninstall.exe
iTunes-->MsiExec.exe /I{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
L&H TTS3000 Deutsch-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSGED.inf, Uninstall
L&H TTS3000 Français-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSFRF.inf, Uninstall
L&H TTS3000 Japanese-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSJPJ.inf, Uninstall
Lingoes 2.6.2-->"C:\Programme\Lingoes\Translator2\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5.5)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
mp3-2-wav converter 1.14-->C:\WINDOWS\iun506.exe C:\Programme\Mp3 File Editor\plugins\\irunin_mp32wav.ini
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Nero 7 Premium-->MsiExec.exe /I{42347B75-9660-2DA4-63FD-D35E344E1031}
Norton Security Scan (Symantec Corporation)-->"C:\Programme\Gemeinsame Dateien\Symantec Shared\NSSSetup\{D16D8A48-65A4-4B19-8A02-DC9A40FB80C4}_2_0_0\NSSSetup.exe" /X
Norton Security Scan-->MsiExec.exe /I{80A97464-A741-44B0-8AD6-0C16B1FEF7F6}
Norton Security Scan-->MsiExec.exe /X{D16D8A48-65A4-4B19-8A02-DC9A40FB80C4}
PCM4Everio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{39CEE1F2-12B6-4C50-9131-04BFCA110578}\setup.exe" -uninst
Pinnacle VideoSpin-->MsiExec.exe /I{FEB15887-0932-4D2D-BB85-6AC03FBF1AA8}
Prince of Persia The Sands of Time-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{8C453F13-6877-4D34-8816-009ABDE306DB}\setup.exe" -l0x7
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
RealPlayer-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|12.0
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Programme\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\Setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x7 -removeonly
Safari-->MsiExec.exe /I{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}
ScanToWeb-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}\setup.exe" ADDREMOVEDLG
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Sicherheitsupdate für Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB913433)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB913433.inf
Sony Eyetoy Webcam-->C:\WINDOWS\CleanDev.exe C:\WINDOWS\ov519.TXT
SweetIM for Messenger 2.6-->MsiExec.exe /X{023EC958-023C-42D1-B2A4-E9E4BEF599FC}
SweetIM Toolbar for Internet Explorer 3.3-->MsiExec.exe /X{266C7330-C0F4-49E5-8F20-A56F9F822875}
TuneUp Utilities 2006-->MsiExec.exe /I{868D7896-99D4-4513-BC62-2B3AD3E24926}
Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
Update für Windows Internet Explorer 8 (KB972636)-->"C:\WINDOWS\ie8updates\KB972636-IE8\spuninst\spuninst.exe"
Update für Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VideoLAN VLC media player 0.8.2-->C:\Programme\VideoLAN\VLC\uninstall.exe
Winamp (remove only)-->"C:\Programme\Winamp\UninstWA.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Programme\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}
Windows Live Fotogalerie-->MsiExec.exe /X{2BA722D1-48D1-406E-9123-8AE5431D63EF}
Windows Live Mail-->MsiExec.exe /I{C4D738F7-996A-4C81-B8FA-C4E26D767E41}
Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}
Windows Live Sync-->MsiExec.exe /X{76618402-179D-4699-A66B-D351C59436BC}
Windows Live Writer-->MsiExec.exe /X{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows XP-Hotfix - KB834707-->C:\WINDOWS\$NtUninstallKB834707$\spuninst\spuninst.exe
Windows XP-Hotfix - KB867282-->C:\WINDOWS\$NtUninstallKB867282$\spuninst\spuninst.exe
Windows XP-Hotfix - KB885250-->C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
WinRAR Archivierer-->C:\Programme\WinRAR\uninstall.exe
XMedia Recode 2.1.3.7-->C:\Programme\XMedia Recode\uninst.exe
XP-Clean-->MsiExec.exe /I{95F48480-6D51-49A5-BFC3-7D8043AC5386}
XviD 1.1 final uninstall-->"C:\Programme\XviD\unins000.exe"
=====HijackThis Backups=====
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - (no file) [2009-12-04]
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file) [2009-12-04]
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/SmileyCentralInitialSetup1.0.1.1.cab [2009-12-04]
======Hosts File======
127.0.0.1 mpa.one.microsoft.com
127.0.0.1 localhost
======Security center information======
AV: AntiVir Desktop (disabled) (outdated)
======System event log======
Computer Name: HOME-PC
Event Code: 7036
Message: Dienst "Ati HotKey Poller" befindet sich jetzt im Status "Beendet".
Record Number: 25093
Source Name: Service Control Manager
Time Written: 20091022172118.000000+120
Event Type: Informationen
User:
Computer Name: HOME-PC
Event Code: 7023
Message: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:
Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben.
Record Number: 25092
Source Name: Service Control Manager
Time Written: 20091022163036.000000+120
Event Type: Fehler
User:
Computer Name: HOME-PC
Event Code: 7036
Message: Dienst "Computerbrowser" befindet sich jetzt im Status "Beendet".
Record Number: 25091
Source Name: Service Control Manager
Time Written: 20091022163036.000000+120
Event Type: Informationen
User:
Computer Name: HOME-PC
Event Code: 7036
Message: Dienst "Google Software Updater" befindet sich jetzt im Status "Beendet".
Record Number: 25090
Source Name: Service Control Manager
Time Written: 20091022162652.000000+120
Event Type: Informationen
User:
Computer Name: HOME-PC
Event Code: 7036
Message: Dienst "Google Update Service (gupdate1c9d168ee0e7a60)" befindet sich jetzt im Status "Beendet".
Record Number: 25089
Source Name: Service Control Manager
Time Written: 20091022162652.000000+120
Event Type: Informationen
User:
=====Application event log=====
Computer Name: HOME-PC
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: WindowsLive.Writer.CoreServices, Version=14.0.8064.206, Culture=neutral, PublicKeyToken=31bf3856ad364e35
Record Number: 5115
Source Name: .NET Runtime Optimization Service
Time Written: 20090520162537.000000+120
Event Type: Informationen
User:
Computer Name: HOME-PC
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: System.Runtime.Serialization.Formatters.Soap, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Record Number: 5114
Source Name: .NET Runtime Optimization Service
Time Written: 20090520162536.000000+120
Event Type:
User:
Computer Name: HOME-PC
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: System.Runtime.Serialization.Formatters.Soap, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
Record Number: 5113
Source Name: .NET Runtime Optimization Service
Time Written: 20090520162536.000000+120
Event Type: Informationen
User:
Computer Name: HOME-PC
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: System.Data.SqlXml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Record Number: 5112
Source Name: .NET Runtime Optimization Service
Time Written: 20090520162536.000000+120
Event Type:
User:
Computer Name: HOME-PC
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: System.Data.SqlXml, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Record Number: 5111
Source Name: .NET Runtime Optimization Service
Time Written: 20090520162533.000000+120
Event Type: Informationen
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\Pinnacle\Shared Files\;C:\Programme\QuickTime\QTSystem\;C:\Programme\Gemeinsame Dateien\DivX Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 67 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=4303
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre6\lib\ext\QTJava.zip
-----------------EOF-----------------
Gmer und das von Malwarebytes' folgen noch, denn die brauchen ja ewig! |
|
04.12.2009, 17:09
| #2 |
| | Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch Mein PC spackt grad total ich hab schon probleme, die scans durchzuführen und des hier reinzustellen. Das müsste jetzt das von GMER seein:
__________________Code:
ATTFilter GMER 1.0.15.15252 - http://www.gmer.net
Rootkit scan 2009-12-04 17:04:54
Windows 5.1.2600 Service Pack 2
Running: je9x664p.exe; Driver: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\kwldipow.sys
---- System - GMER 1.0.15 ----
SSDT F7A5A0FE ZwCreateKey
SSDT F7A5A0F4 ZwCreateThread
SSDT F7A5A103 ZwDeleteKey
SSDT F7A5A10D ZwDeleteValueKey
SSDT F7A5A112 ZwLoadKey
SSDT F7A5A0E0 ZwOpenProcess
SSDT F7A5A0E5 ZwOpenThread
SSDT F7A5A11C ZwReplaceKey
SSDT F7A5A117 ZwRestoreKey
SSDT F7A5A108 ZwSetValueKey
SSDT F7A5A0EF ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.rsrc C:\WINDOWS\system32\drivers\atapi.sys entry point in ".rsrc" section [0xF74AF3AC]
? C:\WINDOWS\TEMP\mc21.tmp Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\Programme\AVG\AVG9\avgcsrvx.exe[252] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\Explorer.EXE[264] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\Explorer.EXE[264] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\Explorer.EXE[264] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\spoolsv.exe[552] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\spoolsv.exe[552] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\spoolsv.exe[552] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Avira\AntiVir Desktop\sched.exe[616] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Avira\AntiVir Desktop\sched.exe[616] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Avira\AntiVir Desktop\sched.exe[616] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\csrss.exe[856] KERNEL32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\csrss.exe[856] KERNEL32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\winlogon.exe[884] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\winlogon.exe[884] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\services.exe[936] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\lsass.exe[948] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\Ati2evxx.exe[1144] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\Ati2evxx.exe[1144] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1260] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe[1296] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe[1296] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[1460] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[1460] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[1460] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Lingoes\Translator2\Lingoes.exe[1520] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Lingoes\Translator2\Lingoes.exe[1520] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Lingoes\Translator2\Lingoes.exe[1520] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\svchost.exe[1536] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\Ati2evxx.exe[1584] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\Ati2evxx.exe[1584] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\Ati2evxx.exe[1584] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\AVG\AVG9\avgrsx.exe[1612] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\AVG\AVG9\avgrsx.exe[1612] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\AVG\AVG9\avgrsx.exe[1612] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe[1712] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe[1712] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe[1712] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1740] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1740] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\svchost.exe[1740] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1768] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1768] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\AVG\AVG9\avgchsvx.exe[1768] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Dokumente und Einstellungen\Administrator\Desktop\je9x664p.exe[1776] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Dokumente und Einstellungen\Administrator\Desktop\je9x664p.exe[1776] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Dokumente und Einstellungen\Administrator\Desktop\je9x664p.exe[1776] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[2024] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[2024] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[2024] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\svchost.exe[2032] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe[2064] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe[2064] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe[2064] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[2136] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[2136] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[2136] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[2164] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Bonjour\mDNSResponder.exe[2368] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Bonjour\mDNSResponder.exe[2368] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Bonjour\mDNSResponder.exe[2368] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe[2412] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe[2412] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe[2412] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe[2432] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe[2432] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe[2432] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\AVG\AVG9\avgnsx.exe[2668] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\AVG\AVG9\avgnsx.exe[2668] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\AVG\AVG9\avgnsx.exe[2668] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Java\jre6\bin\jqs.exe[2780] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Java\jre6\bin\jqs.exe[2780] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Java\jre6\bin\jqs.exe[2780] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\iPod\bin\iPodService.exe[2804] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\iPod\bin\iPodService.exe[2804] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\iPod\bin\iPodService.exe[2804] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[2860] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[2860] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\svchost.exe[2860] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!CreateWindowExW 77D1FF50 5 Bytes JMP 4126D3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!DialogBoxParamW 77D2662C 5 Bytes JMP 411951FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!DialogBoxIndirectParamW 77D32043 5 Bytes JMP 41363C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!MessageBoxIndirectA 77D3A05A 5 Bytes JMP 41363B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!DialogBoxParamA 77D3B11C 5 Bytes JMP 41363BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!MessageBoxExW 77D50538 5 Bytes JMP 41363A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!MessageBoxExA 77D5055C 5 Bytes JMP 41363A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!DialogBoxIndirectParamA 77D56CAD 5 Bytes JMP 41363C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[3000] USER32.dll!MessageBoxIndirectW 77D66093 5 Bytes JMP 41363AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Microsoft\Office Live\OfficeLiveSignIn.exe[3092] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Microsoft\Office Live\OfficeLiveSignIn.exe[3092] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Microsoft\Office Live\OfficeLiveSignIn.exe[3092] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE[3296] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE[3296] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE[3296] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[3504] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[3504] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe[3504] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Winamp\winampa.exe[3548] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Winamp\winampa.exe[3548] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Winamp\winampa.exe[3548] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe[3604] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe[3604] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe[3604] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Mozilla Firefox\firefox.exe[3648] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Mozilla Firefox\firefox.exe[3648] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Mozilla Firefox\firefox.exe[3648] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Mozilla Firefox\firefox.exe[3648] WS2_32.dll!send 71A1428A 5 Bytes JMP 0220212F
.text C:\Programme\Mozilla Firefox\firefox.exe[3648] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 02202812
.text C:\Programme\Mozilla Firefox\firefox.exe[3648] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 02202C96
.text C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe[3668] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe[3668] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe[3668] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe[3680] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe[3680] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe[3680] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE[3688] KERNEL32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE[3740] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE[3740] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE[3740] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\RTHDCPL.EXE[3764] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\RTHDCPL.EXE[3764] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\RTHDCPL.EXE[3764] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Java\jre6\bin\jusched.exe[3840] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Java\jre6\bin\jusched.exe[3840] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Java\jre6\bin\jusched.exe[3840] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3852] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3852] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3852] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\SweetIM\Messenger\SweetIM.exe[3892] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\SweetIM\Messenger\SweetIM.exe[3892] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\SweetIM\Messenger\SweetIM.exe[3892] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[3920] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[3920] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[3920] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\QuickTime\QTTask.exe[3940] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\QuickTime\QTTask.exe[3940] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\QuickTime\QTTask.exe[3940] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\iTunes\iTunesHelper.exe[3952] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\iTunes\iTunesHelper.exe[3952] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\iTunes\iTunesHelper.exe[3952] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\ctfmon.exe[4092] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\ctfmon.exe[4092] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\ctfmon.exe[4092] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\NOTEPAD.EXE[4140] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\NOTEPAD.EXE[4140] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\NOTEPAD.EXE[4140] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\NOTEPAD.EXE[5120] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\NOTEPAD.EXE[5120] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\NOTEPAD.EXE[5120] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbam.exe[5144] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbam.exe[5144] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Malwarebytes' Anti-Malware\mbam.exe[5144] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[5328] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[5328] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\AVG\AVG9\avgwdsvc.exe[5328] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!CallNextHookEx 77D1EB03 5 Bytes JMP 4125CB69 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!CreateWindowExW 77D1FF50 5 Bytes JMP 4126D3AC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!UnhookWindowsHookEx 77D20DF3 5 Bytes JMP 411D43F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!DialogBoxParamW 77D2662C 5 Bytes JMP 411951FD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 41269521 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!DialogBoxIndirectParamW 77D32043 5 Bytes JMP 41363C10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!MessageBoxIndirectA 77D3A05A 5 Bytes JMP 41363B42 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!DialogBoxParamA 77D3B11C 5 Bytes JMP 41363BAD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!MessageBoxExW 77D50538 5 Bytes JMP 41363A13 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!MessageBoxExA 77D5055C 5 Bytes JMP 41363A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!DialogBoxIndirectParamA 77D56CAD 5 Bytes JMP 41363C73 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] USER32.dll!MessageBoxIndirectW 77D66093 5 Bytes JMP 41363AD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] ole32.dll!CoCreateInstance 774CFAC3 5 Bytes JMP 4126D408 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] ole32.dll!OleLoadFromStream 774FA257 5 Bytes JMP 41363F78 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\AVG\AVG9\avgtray.exe[5864] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\AVG\AVG9\avgtray.exe[5864] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes CALL 5F00003D
.text C:\Programme\AVG\AVG9\avgtray.exe[5864] kernel32.dll!CreateFileW 7C810976 6 Bytes JMP 5F040F5A
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Programme\Internet Explorer\IEXPLORE.EXE[5836] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Programme\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\00001389 -> \Driver\atapi \Device\Harddisk0\DR0 89AA050C
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xDF 0x20 0x58 0x62 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xB2 0x46 0x9A 0xE2 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xF8 0x31 0x0F 0xA9 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...
---- Files - GMER 1.0.15 ----
File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification
---- EOF - GMER 1.0.15 ----
|
|
04.12.2009, 20:04
| #3 |
| | Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch So und hier jetzt noch der Mini-Log, nach 4 1/2 Stunden Malwarebytes' Anti-Malware:
__________________Code:
ATTFilter Malwarebytes' Anti-Malware 1.42
Datenbank Version: 3292
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702
04.12.2009 19:51:50
mbam-log-2009-12-04 (19-51-50).txt
Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 102956
Laufzeit: 4 hour(s), 32 minute(s), 36 second(s)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 6
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\xml.xml (Worm.Allaple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Worm.Allaple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Worm.Allaple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bkcic (Trojan.Agent.H) -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe (Trojan.Agent.H) -> Delete on reboot.
Ich hoffe mit diesen Logs kann man jetzt was anfangen und ihr könnt mir helfen Vielen Dank im Vorraus Tim |
|
03.01.2010, 17:44
| #4 |
  | Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch Hi, Rootkit (TDSS, atapi.sys) Verdacht... Zur Sicherheit das hier zuerst: Anleitung Avenger (by swandog46) 1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:  2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist. Kopiere nun folgenden Text in das weiße Feld: (bei -> "input script here") Code:
ATTFilter
Files to delete:
C:\WINDOWS\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job
c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe
C:\WINDOWS\cryavitowmv.ini
4.) Um den Avenger zu starten klicke auf -> Execute Dann bestätigen mit "Yes" das der Rechner neu startet! 5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board. Combofix Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop. Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter. Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird. Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen. chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
04.01.2010, 13:08
| #5 |
| | Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job" deleted successfully. File "C:\WINDOWS\tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job" deleted successfully. Error: file "c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe" not found! Deletion of file "c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "C:\WINDOWS\cryavitowmv.ini" deleted successfully. Completed script processing. ******************* Finished! Terminate. Übrigens benutze ich jetzt Google Chrome, das funktioniert ganz gut, bis auf so ein Teil in der Registry die Chrome auf den Internet Explorer umleitet, wenn ich das lösche, erscheint es wieder sobald ich den Computer neu starte oder an und ausschalte, ich muss das also jedes mal erst wieder löschen. Irgend so ein Debugger. Wenn der Internet Explorer gestartet wird kommt immer sofort: Internet Explorer hat ein Problem festgestellt und muss beendet werden. Mit Firefox hab ich im Moment keine Probleme mehr. Geändert von Timme95 (04.01.2010 um 13:42 Uhr) |
|
04.01.2010, 13:38
| #6 |
| | Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch Während Combo Fix hat AntiVir einen Trojaner gemeldet und gelöscht. Code:
ATTFilter ComboFix 10-01-03.05 - Administrator 04.01.2010 13:21:01.1.2 - x86
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\bkcic.dat
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\bkcic_nav.dat
c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\bkcic_navps.dat
c:\programme\driver
c:\programme\FunWebProducts
c:\programme\MyWebSearch
Infizierte Kopie von c:\windows\system32\DRIVERS\atapi.sys wurde gefunden und desinfiziert
Kopie von - Kitty ate it :p wurde wiederhergestellt
.
((((((((((((((((((((((( Dateien erstellt von 2009-12-04 bis 2010-01-04 ))))))))))))))))))))))))))))))
.
2009-12-17 14:22 . 2009-12-17 14:26 -------- d-----w- C:\Temp
2009-12-17 14:22 . 2001-10-19 13:40 438608 ----a-w- c:\windows\system32\wmv8dmod.dll
2009-12-17 14:22 . 2001-10-19 13:40 665424 ----a-w- c:\windows\system32\wmv8dmoe.dll
2009-12-17 14:22 . 2001-10-19 13:39 572752 ----a-w- c:\windows\system32\wmvdmoe.dll
2009-12-17 14:22 . 2001-10-19 13:40 1683792 ----a-w- c:\windows\system32\wmvcore2.dll
2009-12-17 13:48 . 2009-12-17 17:43 -------- d-----w- c:\programme\mAirList 3.0
2009-12-17 13:48 . 2009-12-17 13:48 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\mAirList
2009-12-16 15:29 . 2009-12-16 15:29 -------- d-----w- c:\programme\OpenLibraries
2009-12-16 15:29 . 2009-12-16 15:29 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2009-12-16 15:29 . 2009-12-16 15:29 262144 ----a-w- c:\windows\system32\wrap_oal.dll
2009-12-16 15:28 . 2009-12-16 15:28 -------- d-----w- c:\programme\gtk2
2009-12-16 14:38 . 2009-12-16 14:38 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\MPEG Streamclip
2009-12-16 04:49 . 2004-08-03 23:57 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-12-16 04:49 . 2001-08-18 03:54 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-12-15 14:44 . 2009-12-15 15:05 -------- d-----w- c:\programme\Hammerhead
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-04 12:01 . 2009-11-24 12:30 79488 ----a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-03 14:51 . 2008-03-02 10:46 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Google Updater
2010-01-01 19:15 . 2009-12-04 14:16 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-01-01 15:14 . 2009-06-04 14:34 -------- d-----w- c:\programme\Safari
2009-12-28 19:03 . 2007-12-26 16:53 -------- d-----w- c:\programme\Google
2009-12-23 09:53 . 2009-12-23 09:53 4043544 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9\update\backup\avgui.exe
2009-12-23 09:53 . 2009-12-04 12:07 3966744 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9\update\backup\avgcorex.dll
2009-12-20 17:53 . 2009-12-20 17:53 294656 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9\update\backup\avglngx.dll
2009-12-17 17:39 . 2009-12-04 19:31 -------- d-----w- c:\programme\iDump (Freeware)
2009-12-16 16:31 . 2008-04-15 13:21 -------- d-----w- c:\programme\Gemeinsame Dateien\DVDVideoSoft
2009-12-16 16:31 . 2009-02-15 10:48 -------- d-----w- c:\programme\DVDVideoSoft
2009-12-16 15:16 . 2009-12-03 11:07 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9
2009-12-13 20:05 . 2010-01-01 14:06 2033432 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9\update\backup\avgtray.exe
2009-12-13 20:05 . 2009-12-23 09:53 3776280 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9\update\backup\setup.exe
2009-12-13 20:04 . 2009-12-13 20:05 2352920 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\avg9\update\backup\avgresf.dll
2009-12-07 18:27 . 2009-05-22 07:56 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-06 17:00 . 2008-04-16 15:52 -------- d-----w- c:\programme\Norton Security Scan
2009-12-04 20:01 . 2009-06-28 15:30 41632 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-04 19:12 . 2009-12-04 19:12 -------- d-----w- c:\programme\PC Inspector File Recovery
2009-12-04 19:12 . 2007-12-17 17:13 -------- d--h--w- c:\programme\InstallShield Installation Information
2009-12-04 18:54 . 2007-12-26 11:41 -------- d-----w- c:\programme\OXXOGames
2009-12-04 14:16 . 2009-12-04 14:16 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2009-12-04 14:16 . 2009-12-04 14:16 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-12-03 11:08 . 2009-12-03 11:08 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-03 11:08 . 2009-12-03 11:08 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-03 11:08 . 2009-12-03 11:08 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-03 11:08 . 2009-12-03 11:08 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-03 11:07 . 2009-12-03 11:07 -------- d-----w- c:\programme\AVG
2009-12-02 09:55 . 2009-03-20 14:05 -------- d-----w- c:\programme\Microsoft Silverlight
2009-12-01 18:39 . 2009-01-05 19:16 -------- d-----w- c:\programme\Windows Live
2009-12-01 18:37 . 2009-12-01 18:37 -------- d-----w- c:\programme\Microsoft
2009-11-15 11:25 . 2009-10-30 20:02 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Shareaza
2009-11-06 18:43 . 2007-12-17 17:50 51752 ----a-w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-10-31 09:46 . 2009-10-30 21:10 5 ----a-w- c:\windows\system32\SySavitowmv.dat
2009-10-30 12:29 . 2009-10-30 12:29 1962544 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-10-29 14:57 . 2009-10-29 14:57 1925024 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS\Adobe_Downloads\install_flash_player.exe
2009-10-25 17:24 . 2006-06-01 19:06 71598 ----a-w- c:\windows\system32\perfc007.dat
2009-10-25 17:24 . 2006-06-01 19:06 408618 ----a-w- c:\windows\system32\perfh007.dat
2009-10-16 09:41 . 2009-10-16 09:41 79144 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2009-10-08 09:31 . 2009-10-28 17:28 3204096 ----a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o1n16qlx.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\SSS.dll
2009-10-07 17:06 . 2009-10-28 17:28 106496 ----a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o1n16qlx.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin.dll
2009-07-30 20:07 . 2009-07-30 20:07 104302 ----a-w- c:\programme\lame_enc.zip
2009-04-05 15:55 . 2009-04-05 15:55 547496 ----a-w- c:\programme\ChromeSetup.exe
2009-04-03 17:59 . 2009-04-03 17:59 16070968 ----a-w- c:\programme\gimp-2.6.6-i686-setup.exe
2009-04-02 13:50 . 2009-04-02 13:50 5931218 ----a-w- c:\programme\FreeVideoDub143.exe
2009-03-30 13:55 . 2009-03-30 13:55 3151056 ----a-w- c:\programme\lhttsjpj.exe
2009-03-30 13:54 . 2009-03-30 13:54 2354376 ----a-w- c:\programme\lhttsfrf.exe
2009-03-30 13:53 . 2009-03-30 13:53 131784 ----a-w- c:\programme\AgtX040C.exe
2009-03-30 13:53 . 2009-03-30 13:53 202880 ----a-w- c:\programme\joe.exe
2009-03-30 13:50 . 2009-03-30 13:50 2296520 ----a-w- c:\programme\lhttsged.exe
2009-03-30 13:49 . 2009-03-30 13:49 131784 ----a-w- c:\programme\AgtX0407.exe
2009-03-30 13:47 . 2009-03-30 13:47 5369831 ----a-w- c:\programme\deskbot_full_setup.exe
2009-03-13 19:28 . 2009-03-13 19:28 4633192 ----a-w- c:\programme\SweetImSetup.exe
2009-01-09 20:43 . 2009-01-09 20:43 7353592 ----a-w- c:\programme\Firefox Setup 3.0.5.exe
2009-01-06 18:19 . 2009-01-06 18:19 1668496 ----a-w- c:\programme\EyeToyWinDrivers.zip
2009-01-05 19:14 . 2009-01-05 19:14 2404880 ----a-w- c:\programme\WLinstaller.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\programme\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\programme\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-27 68856]
"Lingoes"="c:\programme\Lingoes\Translator2\Lingoes.exe" [2009-07-16 2191360]
"EPSON Stylus DX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
"Google Update"="c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" [2009-04-05 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-06-01 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acrobat Assistant 7.0"="c:\programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-09-24 483328]
"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"WinampAgent"="c:\programme\Winamp\winampa.exe" [2006-05-25 35328]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"TrueImageMonitor.exe"="c:\programme\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-17 1194728]
"AcronisTimounterMonitor"="c:\programme\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-17 1966928]
"Acronis Scheduler2 Service"="c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" [2007-02-16 149024]
"EPSON Stylus DX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2009-09-26 198160]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-01 2033432]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-06-01 15360]
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2007-12-17 25214]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-03 11:08 12464 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [03.12.2009 12:08 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [03.12.2009 12:08 360584]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [17.12.2007 18:36 13696]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [22.05.2009 08:56 108289]
R2 avg9wd;AVG Free WatchDog;c:\programme\AVG\AVG9\avgwdsvc.exe [03.12.2009 12:07 285392]
S2 gupdate1c9d168ee0e7a60;Google Update Service (gupdate1c9d168ee0e7a60);c:\programme\Google\Update\GoogleUpdate.exe [10.05.2009 13:14 133104]
--- Andere Dienste/Treiber im Speicher ---
*Deregistered* - mchInjDrv
.
Inhalt des "geplante Tasks" Ordners
2009-12-04 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUpUtilities2006\SystemOptimizer.exe [2005-08-24 01:29]
2010-01-04 c:\windows\Tasks\Google Software Updater.job
- c:\programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-26 13:22]
2010-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-10 12:14]
2010-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-10 12:14]
2010-01-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1645522239-839522115-500Core.job
- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2009-04-05 15:55]
2010-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1645522239-839522115-500UA.job
- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2009-04-05 15:55]
2009-12-06 c:\windows\Tasks\Norton Security Scan for Administrator.job
- c:\programme\Norton Security Scan\Nss.exe [2008-09-19 03:18]
2009-12-06 c:\windows\Tasks\Norton Security Scan.job
- c:\programme\Norton Security Scan\Nss.exe [2008-09-19 03:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.radiofips.de/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: In vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
Trusted Zone: moove.com
Handler: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax
Handler: fluxhttp\0x00000007 - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o1n16qlx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2055800&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.radiofips.de/
FF - prefs.js: keyword.URL - hxxp://kwtb.search.imgag.com/?c=GNKIW29193&sbs=1&sc=2&f=web&vernum=1.0&uid=&did=f8d4a70c-98e2-4081-901d-01bf93043ede&q=
FF - component: c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o1n16qlx.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o1n16qlx.default\extensions\{e0007d18-baa4-4573-ae78-8bea0958c610}\components\FFExternalAlert.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\programme\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\o1n16qlx.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071302000004.dll
FF - plugin: c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\real\realplayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realplayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\real\realplayer\Netscape6\nprpjplug.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\programme\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\programme\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPAPIX.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPMPDRM.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\NPWMDRMWrapper.dll
FF - plugin: c:\programme\Windows Live\Photo Gallery\NPWLPG.dll
---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.interval - 750000
FF - user.js: nglayout.initialpaint.delay - 750
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
AddRemove-bkcic - c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\bkcic.exe
AddRemove-HijackThis - c:\dokumente und einstellungen\Administrator\Desktop\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-04 13:28
Windows 5.1.2600 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\windows\TEMP\mc21.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-746137067-1645522239-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,d6,97,0e,ee,89,38,4f,b9,b0,87,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dc,d5,0f,4e,24,22,da,43,98,f9,0f,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,d6,97,0e,ee,89,38,4f,b9,b0,87,\
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\sfc_os.dll
c:\programme\TuneUpUtilities2006\WinStylerThemeHelper.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(944)
c:\windows\system32\relog_ap.dll
c:\programme\TuneUpUtilities2006\WinStylerThemeHelper.dll
- - - - - - - > 'explorer.exe'(3144)
c:\programme\TuneUpUtilities2006\WinStylerThemeHelper.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programme\TuneUpUtilities2006\WinStylerThemeSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\AVG\AVG9\avgchsvx.exe
c:\programme\AVG\AVG9\avgrsx.exe
c:\programme\AVG\AVG9\avgcsrvx.exe
c:\programme\ATI Technologies\ATI.ACE\CLI.EXE
c:\windows\RTHDCPL.EXE
c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\AVG\AVG9\avgnsx.exe
c:\programme\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\programme\ATI Technologies\ATI.ACE\cli.exe
c:\programme\ATI Technologies\ATI.ACE\cli.exe
c:\programme\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-01-04 13:32:39 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-01-04 12:32
Vor Suchlauf: 12 Verzeichnis(se), 57.225.482.240 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 57.900.974.080 Bytes frei
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /TUTag=HO5DTL /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /noexecute=optin /fastdetect /TUTag=HO5DTL-BAK
- - End Of File - - 1FE7FB17BA01B8A742CFF70251FDBDB6
|
|
| Themen zu Firefox öffnet ständig neue Fenster und Internet Explorer dreht auch durch |
| 1.tmp, antivir, antivir guard, avg free, avgntflt.sys, avira, bho, bonjour, desktop, excel, firefox, flash player, google, gupdate, hijack, hijackthis, hkus\s-1-5-18, install.exe, internet explorer 8, logfile, malwarebytes' anti-malware, mozilla, mp3, msiexec.exe, pdf-datei, plug-in, problem, realtek, registry, security, security scan, server, software, sweetim, symantec, system, toolbars, vlc media player, windows, windows internet, windows internet explorer, windows live messenger, windows xp |
Hybrid-Darstellung
