Vorab Ich bin ein einfacher PC-Uuser“ bitte habt bei falschen Bezeichnungen Verständnis! ;-)

Mein Problem: Weder ANTIVIR noch Malwarebytes können geöffnet werden
Ich habe versucht mit einigen Tipps hier im Forum weiterzukommen -bin nun aber etwas hilflos.


„Bitdefender“ Online-Prüfung ergab nichts
CURE-IT läuft, Updatefunktion startet aber nicht.

Ich habe versucht die ersten Schritte abzuarbeiten. Ergebnis:

1. CG-Cleaner gestartet und laufen lassen. Die Version 2.27.1070 bietet allerdings teilweise andere „Klickboxen an als die Anleitung“

2. RSIT kann nicht vom Desktop gestartet werden. Fehlermeldung …. Ist keine zulässige Win32-Anwendung


3. MALERWAREBYTES lässt sich nicht öffnen. Ich habe HijackThis allein gestartet:



Logfile of HijackThis v1.99.1
Scan saved at 08:36:34, on 02.01.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Canon\CAL\CALMAIN.exe
C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\Programme\TOSHIBA\TouchPad\TPTray.exe
C:\Programme\TOSHIBA\Accessibility\FnKeyHook.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\TOSHIBA\Tvs\TvsTray.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\combit\amw\cmar02.exe
C:\Programme\combit\amw\tm.exe
C:\Programme\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programme\Antivirenprogramme\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**tp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PadTouch] C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Programme\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Programme\TOSHIBA\Accessibility\FnKeyHook.exe
O4 - HKLM\..\Run: [HWSetup] C:\Programme\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Programme\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Tvs] C:\Programme\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\WINDOWS\Program Files\\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: combit address pick-up.lnk = C:\Programme\combit\amw\cmar02.exe
O4 - Startup: time manager.lnk = C:\Programme\combit\amw\tm.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: address pick-up: Übernehmen in combit address manager (crm.dbf) - C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\combit\address pick-up\cmbtar1.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: eBay - {670C5F66-0866-4DD7-8A3F-1EDE62C2E8BB} - C:\Programme\Internet Explorer\Signup\ToshibaGotoEbay.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\programme\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) – h*p://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) – h**p://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) – h**p://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) – h**p://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) – h**p://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) – h**p://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) – h**p://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) – h**p://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146980851578
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) – h**p://fotomeyer.photo-druck.de/ImageUploader4.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) – h**p://www.pmr446.dnsalias.com/activex/AxisCamControl.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) – h**p://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) – h**p://photoservice.fujicolor.de/ips-opdata/operator/19780613/activex/IPSUploader4.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) – h**p://support.f-secure.com/ols/fscax.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) – h**p://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) – h**p://photoservice.fujicolor.de/ips-opdata/operator/19780613/activex/IPSUploader.cab
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\WINDOWS\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programme\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

Ich habe nun "online" laufen lassen.
Hier das Ergebnis (log.txt):

Logfile of random's system information tool 1.06 (written by random/random)
Run by **** at 2010-01-02 10:44:53
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 26 GB (34%) free of 76 GB
Total RAM: 1022 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:44:54, on 02.01.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Canon\CAL\CALMAIN.exe
C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\Programme\TOSHIBA\TouchPad\TPTray.exe
C:\Programme\TOSHIBA\Accessibility\FnKeyHook.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\TOSHIBA\Tvs\TvsTray.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\combit\amw\cmar02.exe
C:\Programme\combit\amw\tm.exe
C:\Programme\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KBQMGUE6\RSIT[1].exe
C:\Programme\trend micro\bernt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PadTouch] C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Programme\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TOSHIBA Accessibility] C:\Programme\TOSHIBA\Accessibility\FnKeyHook.exe
O4 - HKLM\..\Run: [HWSetup] C:\Programme\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Programme\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Tvs] C:\Programme\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\WINDOWS\Program Files\\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: combit address pick-up.lnk = C:\Programme\combit\amw\cmar02.exe
O4 - Startup: time manager.lnk = C:\Programme\combit\amw\tm.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: address pick-up: Übernehmen in combit address manager (crm.dbf) - C:\Dokumente und Einstellungen\bernt\Lokale Einstellungen\Anwendungsdaten\combit\address pick-up\cmbtar1.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: eBay - {670C5F66-0866-4DD7-8A3F-1EDE62C2E8BB} - C:\Programme\Internet Explorer\Signup\ToshibaGotoEbay.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) – h**p://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) – h**p://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) – h**p://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) – h**p://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) – h**p://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) – h**p://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) – h**p://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) – h**p://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146980851578
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) – h**p://fotomeyer.photo-druck.de/ImageUploader4.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) – h**p://www.pmr446.dnsalias.com/activex/AxisCamControl.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) – h**p://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) – h**p://photoservice.fujicolor.de/ips-opdata/operator/19780613/activex/IPSUploader4.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) – h**p//wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) – h**p://photoservice.fujicolor.de/ips-opdata/operator/19780613/activex/IPSUploader.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\WINDOWS\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programme\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

--
End of file - 11075 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\Norton Security Scan.job
C:\WINDOWS\tasks\Symantec NetDetect.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Programme\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-12-10 764912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\programme\google\googletoolbar1.dll [2007-11-27 2427968]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar mit Pop-Up-Blocker - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PadTouch"=C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe [2004-11-17 1077327]
"CeEKEY"=C:\Programme\TOSHIBA\E-KEY\CeEKey.exe [2005-01-21 675840]
"TPNF"=C:\Programme\TOSHIBA\TouchPad\TPTray.exe [2004-11-29 53248]
"TOSHIBA Accessibility"=C:\Programme\TOSHIBA\Accessibility\FnKeyHook.exe [2004-12-07 24576]
"HWSetup"=C:\Programme\TOSHIBA\TOSHIBA Applet\HWSetup.exe [2004-12-23 28672]
"SVPWUTIL"=C:\Programme\Toshiba\Windows Utilities\SVPWUTIL.exe [2005-02-25 65536]
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2005-01-14 122939]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-11-30 344064]
"Tvs"=C:\Programme\TOSHIBA\Tvs\TvsTray.exe [2004-11-12 73728]
"HP Software Update"=C:\Programme\HP\HP Software Update\HPWuSchd2.exe [2005-05-11 49152]
"Adobe Photo Downloader"=C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-23 57344]
"QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2009-01-05 413696]
"iTunesHelper"=C:\Programme\iTunes\iTunesHelper.exe [2009-04-02 342312]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"TkBellExe"=C:\WINDOWS\Program Files\\Common Files\Real\Update_OB\realsched.exe [2009-10-16 198160]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-30 429392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"TOSCDSPD"=C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-03-02 65536]
"swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-08-16 68856]
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
HP Image Zone Schnellstart.lnk - C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe

C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart
combit address pick-up.lnk - C:\Programme\combit\amw\cmar02.exe
time manager.lnk - C:\Programme\combit\amw\tm.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2004-11-30 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
"NoDispScrSavPage"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoBandCustomize"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Programme\TOSHIBA\ConfigFree\CFXFER.exe"="C:\Programme\TOSHIBA\ConfigFree\CFXFER.exe:*isabled:ConfigFree SUMMIT Engine"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*isabled:@xpsp2res.dll,-22019"
"C:\Programme\Messenger\msmsgs.exe"="C:\Programme\Messenger\msmsgs.exe:*isabled:Windows Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\wJQs.exe"="C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\wJQs.exe:*:Enabled:Browser"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.js - edit - C:\Programme\combit\amw\Script\editor\Scite.exe %1
.vbs - edit - C:\Programme\combit\amw\Script\editor\Scite.exe %1

======List of files/folders created in the last 1 months======

2010-01-02 10:41:47 ----D---- C:\rsit
2010-01-02 10:41:47 ----D---- C:\Programme\trend micro
2010-01-01 23:16:53 ----D---- C:\Programme\Spybot - Search & Destroy
2010-01-01 23:16:53 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-01-01 23:08:41 ----D---- C:\Programme\spybot
2010-01-01 22:40:14 ----D---- C:\WINDOWS\BDOSCAN8
2010-01-01 22:40:11 ----D---- C:\WINDOWS\LastGood
2010-01-01 22:37:49 ----D---- C:\Programme\NortonInstaller
2010-01-01 22:37:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NortonInstaller
2010-01-01 13:14:58 ----D---- C:\Programme\Avira
2010-01-01 13:14:58 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-12-31 14:15:56 ----A---- C:\WINDOWS\system32\krl32mainweq.dll
2009-12-31 14:12:46 ----A---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sysReserve.ini
2009-12-09 22:33:17 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2009-12-09 22:32:07 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2009-12-09 22:29:15 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2009-12-09 22:28:32 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2009-12-09 22:28:12 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$

======List of files/folders modified in the last 1 months======

2010-01-02 10:41:47 ----RD---- C:\Programme
2010-01-02 09:52:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-02 08:35:33 ----A---- C:\WINDOWS\hpbafd.ini
2010-01-02 08:19:58 ----D---- C:\WINDOWS
2010-01-02 08:10:48 ----D---- C:\Programme\CCleaner
2010-01-02 02:55:18 ----SD---- C:\WINDOWS\Tasks
2010-01-01 23:53:56 ----D---- C:\WINDOWS\Prefetch
2010-01-01 23:04:21 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-01-01 23:04:18 ----D---- C:\WINDOWS\system32\drivers
2010-01-01 22:40:17 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-01-01 22:40:14 ----HD---- C:\WINDOWS\inf
2010-01-01 22:32:20 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-01 22:28:43 ----D---- C:\WINDOWS\system32
2010-01-01 16:56:54 ----D---- C:\WINDOWS\Temp
2010-01-01 13:13:43 ----SHD---- C:\WINDOWS\Installer
2010-01-01 13:13:43 ----HD---- C:\Config.Msi
2010-01-01 13:13:43 ----D---- C:\WINDOWS\WinSxS
2010-01-01 10:50:25 ----A---- C:\WINDOWS\combit.ini
2009-12-31 23:25:25 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2009-12-26 14:05:41 ----D---- C:\WINDOWS\Minidump
2009-12-26 14:05:41 ----D---- C:\WINDOWS\Debug
2009-12-19 08:46:37 ----A---- C:\default.INI
2009-12-09 23:00:23 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-09 22:54:34 ----D---- C:\Programme\Internet Explorer
2009-12-09 22:33:22 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-09 22:29:27 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 meiudf;meiudf; C:\WINDOWS\System32\Drivers\meiudf.sys [2004-01-30 90480]
R1 SerTVOutCtlr;TOSHIBA Controls Driver -EPIOMngr; C:\WINDOWS\system32\drivers\EPIOMngr.sys [2004-07-30 6400]
R1 SrvcEKIOMngr;SrvcEKIOMngr; C:\WINDOWS\System32\Drivers\EKIoMngr.sys [2004-07-29 6400]
R1 SrvcSSIOMngr;SrvcSSIOMngr; C:\WINDOWS\System32\Drivers\SSIoMngr.sys [2004-07-29 6400]
R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-12-02 5627]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-12-02 23545]
R1 TPwSav;Common Driver; C:\WINDOWS\System32\Drivers\TPwSav.sys [2005-02-25 8704]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 ACEDRV07;ACEDRV07; \??\C:\WINDOWS\system32\drivers\ACEDRV07.sys []
R2 ACEDRV08;ACEDRV08; \??\C:\WINDOWS\system32\drivers\ACEDRV08.sys []
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2003-12-17 17005]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-11-25 56816]
R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-12-23 40544]
R2 irda;IrDA-Protokoll; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS-kompatibles Transportprotokoll; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;NWLink-NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-04 63232]
R2 NwlnkSpx;NWLink SPX/SPXII-Protokoll; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-04 55936]
R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2005-01-14 25883]
R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2005-01-14 34843]
R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2005-01-14 4123]
R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2005-01-14 2271]
R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2005-01-14 87706]
R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2005-01-14 15227]
R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2005-01-14 6363]
R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2005-01-14 99098]
R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2005-01-14 100603]
R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-10-28 1270572]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-27 2284864]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-05-08 101833]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-11-30 873984]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
R3 MEMSWEEP2;MEMSWEEP2; \??\C:\WINDOWS\system32\20.tmp []
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
R3 Rasirda;WAN-Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-06-28 69760]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-02-11 157056]
R3 Tvs;Toshiba Virtual Sound with SRS technologies; C:\WINDOWS\system32\DRIVERS\Tvs.sys [2005-01-07 29184]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Netzwerkverbindungstreiber für Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2004-10-29 3222784]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S1 StickyMesger;StickyMesger; \??\C:\Programme\TOSHIBA\Accessibility\StickyMesger.sys []
S2 ZPMODEMSYSNTDRVNT;ZPMODEMSYSNTDRVNT; \??\C:\WINDOWS\system32\drivers\zpmodemnt.sys []
S3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2004-12-22 393600]
S3 cpuz129;cpuz129; \??\C:\Programme\PC Wizard 2008\pcwiz32.sys []
S3 dot4;MS IEEE-1284.4-Treiber; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 dot4usb;Dot4USB-Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-18 23936]
S3 rtl8139;NT-Treiber für Realtek RTL8139(A/B/C)-basierten PCI-Fast Ethernet-Adapter; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 sffdisk;SFF-Speicherklassentreiber; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;SFF-Speicherprotokolltreiber für SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 SMCIRDA;SMSC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2004-06-16 46080]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\WINDOWS\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-11-30 425984]
R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CCALib8;Canon Camera Access Library 8; C:\Programme\Canon\CAL\CALMAIN.exe [2005-09-30 96341]
R2 CFSvcs;ConfigFree Service; C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe [2004-11-10 36864]
R2 DVD-RAM_Service;DVD-RAM_Service; C:\WINDOWS\system32\DVDRAMSV.exe [2003-05-23 106496]
R2 Irmon;Infrarotüberwachung; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-04-02 656168]
S2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
S2 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-27 183280]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Programme\NOS\bin\getPlus_HelperSvc.exe [2009-03-03 33176]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Hi,

sieht nach Rootkit aus.
C:\WINDOWS\system32\krl32mainweq.dll

Daher im abgesicherten Modus CF:

Combofix
Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen.

Ist gefährlich, da das Rootkit und CF sich öfter in den "Haaren" liegen (das System ist u. U. danach nicht mehr bootfähig)...!

chris

@Chris4You
Erst einmal: DANKE!!

Habe versucht COMBOFIX zu ++im abgesicherten Modus++ zu starten.
Der Start im abgesicherten Modus ist nicht möglich: Fehlermeldung und Rechner wird angehalten!
Was tun?

Hi,

Plan B:
Gmer:
http://www.trojaner-board.de/74908-anleitung-gmer-rootkit-scanner.html
Den Downloadlink findest Du links oben (http://www.gmer.net/#files), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein.

Den müssen wir aber zum Laufen bekommen, damit wir die Filenamen des Rootkits haben. Auch das ggf. im abgesicherten Modus probieren!

chris

@ chris4you:

So, ich habe GMER gestartet. Nach kurzer Zeit kam eine Warnung mit der Aufforderung das gesamte System zu scannen.
Das habe ich gemacht.
Hier das Ergebnis
Hinweis: Die im Originallog "rot markierten Zeilen" habe ich am Zeilenanfang mit "####" gekennzeichnet.

Viele Grüße!

PS
Leider habe ich aus Arbeitsgründen nicht ununterbrochen Zugriff auf den Rechner -daher die Abstände in meinen Reaktionen auf die Hilfe hier im Forum!



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-02 20:59:00
Windows 5.1.2600 Service Pack 3
Running: 9eu1llz2.exe; Driver: C:\DOKUME~1\bernt\LOKALE~1\Temp\kxrdqpow.sys


---- System - GMER 1.0.15 ----

Code 87079AD0 ZwEnumerateKey
Code 87079308 ZwFlushInstructionCache
Code 8707C2AE IofCallDriver
Code 8707EDD6 IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 8707C2B3
.text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 8707EDDB
PAGE ntoskrnl.exe!ZwFlushInstructionCache 8056E42A 5 Bytes JMP 8707930C
PAGE ntoskrnl.exe!ZwEnumerateKey 805735A4 5 Bytes JMP 87079AD4
init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xF6AE9ABF]
.text C:\WINDOWS\system32\drivers\ACEDRV07.sys section is writeable [0xB8E4B000, 0x328BA, 0xE8000020]
.pklstb C:\WINDOWS\system32\drivers\ACEDRV07.sys entry point in ".pklstb" section [0xB8E8F000]
.relo2 C:\WINDOWS\system32\drivers\ACEDRV07.sys unknown last section [0xB8EAB000, 0x8E, 0x42000040]
.text C:\WINDOWS\system32\drivers\ACEDRV08.sys section is writeable [0xB8DE9000, 0x328BA, 0xE8000020]
.pklstb C:\WINDOWS\system32\drivers\ACEDRV08.sys entry point in ".pklstb" section [0xB8E2D000]
.relo2 C:\WINDOWS\system32\drivers\ACEDRV08.sys unknown last section [0xB8E49000, 0x8E, 0x42000040]

---- User code sections - GMER 1.0.15 ----

.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4119541D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 4126D6EC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 4136441F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 41364351 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 413643BC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 41364222 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 41364284 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 41364482 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 413642E6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[2664] ole32.dll!OleLoadFromStream 774F9C85 5 Bytes JMP 413647A0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FindResourceW] 00CA0327
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SizeofResource] 00CA043F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadResource] 00CA03F9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] 00CA00F7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SizeofResource] 00CA043F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadResource] 00CA03F9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FindResourceExW] 00CA03B3
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FindResourceExA] 00CA036D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] 00CA00F7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SizeofResource] 00CA043F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FindResourceExW] 00CA03B3
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!EnumResourceNamesW] 00CA0CFF
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FormatMessageA] 00CA0485
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FindResourceW] 00CA0327
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadResource] 00CA03F9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FormatMessageW] 00CA04CB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] 00CA00F7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] 00CA00B1
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!CreateDialogParamW] 00CA09B7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DialogBoxParamW] 00CA0ACF
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadStringW] 00CA0557
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadImageW] 00CA066F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadCursorW] 00CA0813
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadIconW] 00CA06FB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor] 00CA0183
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadStringA] 00CA0511
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] 00CA01C9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DrawEdge] 00CA020F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadBitmapW] 00CA0787
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadMenuW] 00CA089F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadAcceleratorsW] 00CA05E3
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] 00CA00F7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FindResourceExW] 00CA03B3
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FormatMessageW] 00CA04CB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FindResourceA] 00CA02E1
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadResource] 00CA03F9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SizeofResource] 00CA043F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FormatMessageA] 00CA0485
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FormatMessageW] 00CA04CB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!EnumResourceNamesA] 00CA0CB9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!EnumResourceNamesW] 00CA0CFF
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SizeofResource] 00CA043F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadResource] 00CA03F9
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FindResourceA] 00CA02E1
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FormatMessageA] 00CA0485
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FormatMessageW] 00CA04CB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] 00CA00B1
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] 00CA00F7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FindResourceW] 00CA0327
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogIndirectParamA] 00CA09FD
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogIndirectParamW] 00CA0A43
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogParamA] 00CA0971
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogParamW] 00CA09B7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DialogBoxIndirectParamA] 00CA0B15
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamA] 00CA0A89
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamW] 00CA0ACF
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadAcceleratorsA] 00CA059D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadAcceleratorsW] 00CA05E3
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadBitmapA] 00CA0741
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadBitmapW] 00CA0787
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadCursorA] 00CA07CD
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadCursorW] 00CA0813
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadIconA] 00CA06B5
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadIconW] 00CA06FB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadImageA] 00CA0629
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor] 00CA0183
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadStringW] 00CA0557
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadImageW] 00CA066F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadMenuA] 00CA0859
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadMenuW] 00CA089F
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadStringA] 00CA0511
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 00CA013D
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] 00CA0025
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] 00CA006B
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] 00CA00F7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] 00CA00B1
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadIconW] 00CA06FB
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetSysColor] 00CA0183
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadCursorW] 00CA0813
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!CreateDialogParamW] 00CA09B7
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!DialogBoxParamW] 00CA0ACF
IAT C:\Programme\combit\amw\cmar02.exe[196] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadStringW] 00CA0557
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SizeofResource] 009E043F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FindResourceExW] 009E03B3
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!EnumResourceNamesW] 009E0CFF
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FormatMessageA] 009E0485
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FindResourceW] 009E0327
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadResource] 009E03F9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FormatMessageW] 009E04CB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] 009E00F7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] 009E00B1
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!CreateDialogParamW] 009E09B7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DialogBoxParamW] 009E0ACF
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadStringW] 009E0557
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadImageW] 009E066F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadCursorW] 009E0813
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadIconW] 009E06FB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor] 009E0183
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadStringA] 009E0511
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] 009E01C9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DrawEdge] 009E020F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadBitmapW] 009E0787
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadMenuW] 009E089F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!LoadAcceleratorsW] 009E05E3
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] 009E00F7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FindResourceExW] 009E03B3
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FormatMessageW] 009E04CB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FindResourceA] 009E02E1
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadResource] 009E03F9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SizeofResource] 009E043F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FormatMessageA] 009E0485
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FormatMessageW] 009E04CB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FindResourceW] 009E0327
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SizeofResource] 009E043F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadResource] 009E03F9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] 009E00F7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SizeofResource] 009E043F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadResource] 009E03F9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FindResourceExW] 009E03B3
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FindResourceExA] 009E036D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] 009E00F7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!EnumResourceNamesA] 009E0CB9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!EnumResourceNamesW] 009E0CFF
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SizeofResource] 009E043F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadResource] 009E03F9
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FindResourceA] 009E02E1
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FormatMessageA] 009E0485
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FormatMessageW] 009E04CB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] 009E00B1
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] 009E00F7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FindResourceW] 009E0327
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogIndirectParamA] 009E09FD
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogIndirectParamW] 009E0A43
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogParamA] 009E0971
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!CreateDialogParamW] 009E09B7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DialogBoxIndirectParamA] 009E0B15
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamA] 009E0A89
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamW] 009E0ACF
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadAcceleratorsA] 009E059D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadAcceleratorsW] 009E05E3
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadBitmapA] 009E0741
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadBitmapW] 009E0787
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadCursorA] 009E07CD
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadCursorW] 009E0813
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadIconA] 009E06B5
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadIconW] 009E06FB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadImageA] 009E0629
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor] 009E0183
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadStringW] 009E0557
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadImageW] 009E066F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadMenuA] 009E0859
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadMenuW] 009E089F
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!LoadStringA] 009E0511
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 009E013D
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] 009E0025
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] 009E006B
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] 009E00F7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] 009E00B1
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadIconW] 009E06FB
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!GetSysColor] 009E0183
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadCursorW] 009E0813
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!CreateDialogParamW] 009E09B7
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!DialogBoxParamW] 009E0ACF
IAT C:\Programme\combit\amw\tm.exe[204] @ C:\WINDOWS\system32\ole32.dll [USER32.dll!LoadStringW] 009E0557
IAT C:\Programme\Internet Explorer\iexplore.exe[2664] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Programme\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Udfs \UdfsCdRom tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Udfs \UdfsDisk tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- Modules - GMER 1.0.15 ----

########## Module \systemroot\system32\drivers\H8SRTnxelvrjnty.sys (*** hidden *** ) EE582000-EE59F000 (118784 bytes)

---- Services - GMER 1.0.15 ----

########### Service C:\WINDOWS\system32\drivers\H8SRTnxelvrjnty.sys (*** hidden *** ) [SYSTEM] H8SRTd.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTwtloneycbp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTduwtdtmsxv.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTrputvaqcxj.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRThtirbsklnm.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTwtloneycbp.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTduwtdtmsxv.dat
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTrputvaqcxj.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRThtirbsklnm.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTwtloneycbp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTduwtdtmsxv.dat
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTrputvaqcxj.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRThtirbsklnm.dll
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTnxelvrjnty.sys
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTwtloneycbp.dll
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTduwtdtmsxv.dat
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTrputvaqcxj.dll
Reg HKLM\SYSTEM\ControlSet004\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRThtirbsklnm.dll

---- Files - GMER 1.0.15 ----

File C:\Dokumente und Einstellungen\bernt\Lokale Einstellungen\Temp\H8SRT13ab.tmp 343040 bytes executable
File C:\Dokumente und Einstellungen\bernt\Lokale Einstellungen\Temp\h8srtmainqt.dll 16149 bytes
###########File C:\WINDOWS\system32\drivers\H8SRTnxelvrjnty.sys 40448 bytes executable <-- ROOTKIT !!!
File C:\WINDOWS\system32\H8SRTduwtdtmsxv.dat 202 bytes
File C:\WINDOWS\system32\H8SRTwtloneycbp.dll 23040 bytes executable
File C:\WINDOWS\Temp\H8SRT7b36.tmp 123 bytes
File C:\WINDOWS\Temp\H8SRTf76b.tmp 199 bytes
File C:\WINDOWS\Temp\H8SRTf9f0.tmp 202 bytes

---- EOF - GMER 1.0.15 ----