Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: ICQ: "Wie findest du mein neues Foto denn so ;D "

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 02.06.2010, 14:35   #1
n00b87
 
ICQ: "Wie findest du mein neues Foto denn so ;D " - Standard

ICQ: "Wie findest du mein neues Foto denn so ;D "



Hallo, habe im Prinzip das selbe Problem glaube ich, nur bei MSN, keine Ahnung, ob es da einen Unterschied gibt.
Allerdings meinte der Kontakt, von dem ich den Link bekommen habe, dass ich es zuerst geschickt habe. Hat es auch im Verlauf nachgeguckt und nochmal bestätigt, ich hab den Verlauf nicht gespeichert, konnte das also nicht überprüfen.
Kann man sich dieses Ding auch anders einfangen ? Denn eigentlich muss ich es ja dann zuerst gehabt haben, sehr merkwüridg jedenfalls.
Ich hatte nur den Link gesehen, und deswegen gedacht, er käme vom anderen Kontakt, und daraufhin die Datei dämlicherweise heruntergeladen. Die hab ich dann schnell wieder gelöscht, als ich gemerkt habe, dass etwas faul ist und auch noch son anderen Ordner, wo die Datei dann nochmal drin war. Aber das tut eh nichts zur Sache oder ?

Wie auch immer:
Hab den Vollscan durchgeführt mit Anti-Malware, hat nichts gefunden, hatte allerdings wie gesagt auch vorher schon etwas gelöscht.
Jetzt hab ich den Scan mit OTL gemacht und hier sind die beiden Protokolle.

OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 02.06.2010 13:53:23 - Run 1
OTL by OldTimer - Version 3.2.5.3     Folder = C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 389,00 Mb Available Physical Memory | 38,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 55,00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,26 Gb Total Space | 22,24 Gb Free Space | 59,69% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: COMPAQNC8000
Current User Name: Jan
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- c:\programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\TmNationsForever\TmForever.exe" = C:\Programme\TmNationsForever\TmForever.exe:*:Enabled:TmForever -- File not found
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\Sophos\Sophos Anti-Virus\SavMain.exe" = C:\Programme\Sophos\Sophos Anti-Virus\SavMain.exe:*:Disabled:Sophos Anti-Virus -- File not found
"C:\Programme\Avira\AntiVir PersonalEdition Classic\avcenter.exe" = C:\Programme\Avira\AntiVir PersonalEdition Classic\avcenter.exe:*:Enabled:Avira AntiVir Personal starten -- File not found
"C:\Programme\uTorrent\uTorrent.exe" = C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{1103112B-513D-4DEF-96B4-9889774E0118}" = Creative Zen Touch
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 20
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C271126-C295-4828-A901-5910AE0C258B}" = Cisco Systems VPN Client 5.0.03.0530
"{4CBD31CE-51DF-43C4-B3EC-7CCBAB0CD083}" = O2Micro MemoryCardBus Windows Driver
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{5C3DA2A1-03B2-44BD-B5AA-A44BD6E0C0C1}" = HP Integrated Wireless LAN W400-W500 Driver
"{5F64E152-51C1-47B4-BEA8-007D73C7460F}" = Cisco AnyConnect VPN Client
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{6773963F-6FF0-4A21-97C8-8DFF0EBCECAE}" = OpenOffice.org 2.3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{90535871-81B9-4D99-8A13-A7EE97F2D7FE}" = Bluetooth by hp
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD 4
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{DB358C5B-9397-4E19-BF2D-7439945F12B3}" = Reuters EcoWin Pro 6.0
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F16F258A-6300-4A1C-BC49-7929EFF455E2}" = TIPCIxx20
"2B77EDB2643AA62CA7DD23F4E52CA138F61AF7B8" = Windows Driver Package - Intel net  (02/25/2007 11.1.0.86)
"96000D180226FADA9E25B88EE87CC3CB407B10C8" = Windows Driver Package - Intel (w70n51) net  (07/13/2006 1.2.4.41)
"A5F682C869AF68EB8EDD49BDADFC08B7DF1C11C3" = Windows Driver Package - Intel (NETw4x32) net  (02/25/2007 11.1.0.86)
"AC3Filter_is1" = AC3Filter 1.62b
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"Audiograbber" = Audiograbber 1.83 SE 
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Broadcom 802.11b Network Adapter" = 广州网船(www.netship.cn) 802.11 Wireless LAN Adapter
"Creative Jukebox Driver" = Creative Jukebox Driver
"D16AA00FE65B9D2C6E0A57F54400303BF3259CC3" = Windows Driver Package - Intel (w29n51) net  (06/26/2006 9.0.4.17)
"D1E8C9A9258DD7BF813A3525430A4EB3576736EA" = Windows Driver Package - Intel net  (02/25/2007 11.1.0.86)
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"E2A9709B2AFB100688AF34A15AE3DA48516EBD52" = Windows Driver Package - Intel (NETw3x32) net  (07/26/2006 10.5.1.59)
"FC9E80E6E67400E836A009325C6E1CF5D77EFB1D" = Windows Driver Package - Intel (w29n51) net  (02/08/2007 9.0.4.33)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{4CBD31CE-51DF-43C4-B3EC-7CCBAB0CD083}" = O2Micro MemoryCardBus Windows Driver
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"InstallShield_{F16F258A-6300-4A1C-BC49-7929EFF455E2}" = Texas Instruments PCIxx20 drivers.
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PhotoScape" = PhotoScape
"SysInfo" = Creative-Systeminformationen
"VLC media player" = VLC media player 0.9.9
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 20.04.2010 05:43:16 | Computer Name = COMPAQNC8000 | Source = vpndownloader | ID = 50659329
Description = 
 
Error - 20.04.2010 05:43:16 | Computer Name = COMPAQNC8000 | Source = vpndownloader | ID = 50659329
Description = 
 
Error - 20.04.2010 05:43:16 | Computer Name = COMPAQNC8000 | Source = vpndownloader | ID = 50659329
Description = 
 
Error - 20.04.2010 05:43:16 | Computer Name = COMPAQNC8000 | Source = vpndownloader | ID = 50659329
Description = 
 
Error - 20.04.2010 05:43:16 | Computer Name = COMPAQNC8000 | Source = vpndownloader | ID = 50659329
Description = 
 
Error - 20.04.2010 05:43:17 | Computer Name = COMPAQNC8000 | Source = vpndownloader | ID = 50659329
Description = 
 
[ Cisco AnyConnect VPN Client Events ]
Error - 21.04.2010 13:25:50 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: CTunnelStateMgr::initiateTunnel  Return code: 0xFE1F000F  File:
 .\TunnelMgr.cpp  Line: 600  Description: SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE  callback
 
Error - 27.04.2010 04:17:48 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: AddRouteChange  Return code: 0xFE07000D  File: .\ChangeRouteHelper.cpp
Line:
 1279  Description: ROUTETABLE_ERROR_CREATEIPFORWARDENTRY_FAILED  
 
Error - 27.04.2010 04:17:48 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331669
Description = Failed Route change:   Action: AddRoute   Destination: 192.168.178.255

 Netmask: 255.255.255.255   Gateway: 137.226.100.1   Interface: 137.226.101.101   Metric:
 1
 
Error - 27.04.2010 04:17:48 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: AddRouteChange  Return code: 0xFE07000D  File: .\ChangeRouteHelper.cpp
Line:
 222  Description: ROUTETABLE_ERROR_CREATEIPFORWARDENTRY_FAILED  
 
Error - 27.04.2010 04:17:49 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: WSAGetOverlappedResult  Return code: 10054  File: .\IPC\SocketTransport.cpp
Line:
 1237  Description: Eine vorhandene Verbindung wurde vom Remotehost geschlossen.    
 
Error - 27.04.2010 04:17:49 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: WSARecv/WSARecvFrom  Return code: 10054  File: .\IPC\SocketTransport.cpp
Line:
 1238  Description: Eine vorhandene Verbindung wurde vom Remotehost geschlossen.    
 
Error - 27.04.2010 04:17:49 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: CSocketTransport::readSocket  Return code: 0xFE1F000F  File:
 .\TlsProtocol.cpp  Line: 712  Description: SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE  
 
Error - 27.04.2010 04:17:49 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: initiateTunnel  Return code: 0xFE1F000F  File: .\CdtpProtocol.cpp
Line:
 507  Description: SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE  
 
Error - 27.04.2010 04:17:49 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: ITunnelProtocol::initiateTunnel  Return code: 0xFE1F000F  File:
 .\TunnelStateMgr.cpp  Line: 1040  Description: SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE
callback
 
Error - 27.04.2010 04:17:49 | Computer Name = COMPAQNC8000 | Source = vpnagent | ID = 50331649
Description =   Function: CTunnelStateMgr::initiateTunnel  Return code: 0xFE1F000F  File:
 .\TunnelMgr.cpp  Line: 600  Description: SOCKETTRANSPORT_ERROR_TRANSPORT_FAILURE  callback
 
[ System Events ]
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 03:58:33 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 07:03:36 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 10:01:35 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 31.05.2010 10:01:37 | Computer Name = COMPAQNC8000 | Source = Cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
 
< End of report >
         
--- --- ---






OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 02.06.2010 13:53:23 - Run 1
OTL by OldTimer - Version 3.2.5.3     Folder = C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.023,00 Mb Total Physical Memory | 389,00 Mb Available Physical Memory | 38,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 55,00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,26 Gb Total Space | 22,24 Gb Free Space | 59,69% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: COMPAQNC8000
Current User Name: Jan
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Processes (SafeList) ==========
 
PRC - [2010.06.02 13:50:02 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Downloads\OTL.exe
PRC - [2010.04.29 12:19:18 | 001,090,952 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2010.04.16 18:36:42 | 000,026,480 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Contacts\wlcomm.exe
PRC - [2010.04.06 23:38:28 | 000,910,296 | ---- | M] (Mozilla Corporation) -- c:\Programme\Mozilla Firefox\firefox.exe
PRC - [2010.02.18 11:43:18 | 000,248,040 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.11.16 17:36:19 | 000,172,792 | ---- | M] (ICQ, LLC.) -- C:\Programme\ICQ6.5\ICQ.exe
PRC - [2009.08.28 20:42:54 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009.08.10 23:03:09 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.06.17 22:17:05 | 000,434,864 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2009.06.09 16:20:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.03.02 12:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2008.04.17 10:08:46 | 001,528,608 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004.12.02 18:23:34 | 000,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Programme\Creative\MediaSource\Detector\CTDetect.exe
PRC - [2004.10.14 09:11:10 | 001,388,544 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2004.09.23 12:41:54 | 000,860,160 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMax4.exe
PRC - [2004.06.02 17:48:22 | 000,565,309 | ---- | M] (WIDCOMM, Inc.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2004.06.02 17:46:52 | 001,249,364 | ---- | M] (WIDCOMM, Inc.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2002.09.20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2002.08.26 22:23:10 | 000,102,400 | ---- | M] () -- C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
PRC - [2001.12.20 00:21:06 | 000,196,608 | ---- | M] (HP) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.06.02 13:50:02 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Downloads\OTL.exe
MOD - [2008.04.14 04:21:06 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2009.08.28 20:42:54 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009.08.10 23:03:09 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.06.17 22:17:05 | 000,434,864 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2009.06.09 16:20:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.04.17 10:08:46 | 001,528,608 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2002.09.20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2009.12.08 13:56:28 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.06.17 22:02:02 | 000,020,152 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vpnva.sys -- (vpnva)
DRV - [2009.06.09 16:20:18 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.27 14:10:59 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.04.17 10:07:52 | 000,306,299 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2008.03.29 18:36:28 | 000,125,328 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007.02.08 14:51:16 | 002,209,408 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2007.01.18 18:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.08.02 22:09:00 | 000,674,560 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R)
DRV - [2006.01.19 09:18:52 | 000,424,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2005.09.15 00:49:52 | 000,468,768 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (WLAN_400_500_SERVICE)
DRV - [2005.04.19 10:03:26 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2004.08.03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004.06.03 12:10:00 | 000,071,596 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PfModNT.sys -- (PfModNT)
DRV - [2004.06.02 17:13:32 | 000,016,896 | ---- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2004.06.02 17:07:28 | 001,240,938 | ---- | M] (WIDCOMM, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2004.06.02 17:00:10 | 000,147,864 | ---- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2004.06.02 16:59:58 | 000,030,235 | ---- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2004.06.02 16:50:16 | 000,053,816 | ---- | M] (WIDCOMM, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2004.05.18 01:25:00 | 000,016,880 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctpdusb.sys -- (Jukebox3)
DRV - [2004.01.20 21:48:08 | 000,669,696 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2003.07.29 00:49:00 | 000,182,101 | ---- | M] (O2 Micro ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\o2mmb.sys -- (CONAN)
DRV - [2003.07.24 14:50:00 | 000,005,689 | ---- | M] (O2 Micro) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MbxStby.sys -- (MbxStby)
DRV - [2003.03.20 17:24:34 | 000,026,240 | ---- | M] (Winbond Electronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wbsd.sys -- (WBSD) Winbond Secure Digital Storage (SD/MMC)
DRV - [2003.02.17 13:22:24 | 000,170,880 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2001.08.18 05:35:52 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: c:\programme\Mozilla Firefox\components [2010.04.06 23:38:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: c:\programme\Mozilla Firefox\plugins [2010.04.17 11:59:19 | 000,000,000 | ---D | M]
 
[2008.09.24 16:54:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Extensions
[2010.06.01 20:18:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\2xlzhkth.default\extensions
[2010.01.11 18:42:01 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla\Firefox\Profiles\2xlzhkth.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.06.02 12:57:04 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.04.17 11:59:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2004.07.02 15:51:00 | 000,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Programme\Mozilla Firefox\components\np32asw.dll
[2004.07.02 15:51:00 | 000,327,904 | ---- | M] (Macromedia, Inc.) -- C:\Programme\Mozilla Firefox\plugins\np32asw.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.04.06 23:38:37 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.06 23:38:37 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.06 23:38:37 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.06 23:38:37 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.06 23:38:37 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001.08.18 21:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SoundMAX] C:\Programme\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [Creative Detector] C:\Programme\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [ICQ] C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (WIDCOMM, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{4C271126-C295-4828-A901-5910AE0C258B}\Icon3E5562ED7.ico ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 1
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab (HpProductDetection Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ecowin {6152AF4B-A2CE-4A83-A305-E2139D12F3E0} - C:\Programme\Gemeinsame Dateien\Vinga System\EWDBI2.dll (Reuters Inc.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\widimg {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\BTXPPanel.dll (WIDCOMM, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.09.27 09:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.01 22:04:07 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft
[2010.06.01 22:03:43 | 000,000,000 | ---D | C] -- C:\Programme\Windows Live SkyDrive
[2010.06.01 17:06:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Malwarebytes
[2010.06.01 17:05:52 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.06.01 17:05:49 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.06.01 17:05:49 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.01 17:05:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.06.01 17:03:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Desktop\backups
[2010.06.01 16:54:55 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2010.06.01 16:54:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2010.06.01 16:19:44 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\Jan\Desktop\HiJackThis204.exe
[2010.05.31 13:20:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Desktop\cdex_151
[2010.05.31 13:12:07 | 000,000,000 | ---D | C] -- C:\Programme\Audiograbber
[2010.05.30 15:19:54 | 000,246,784 | ---- | C] (SoftShape Development) -- C:\WINDOWS\System32\ActiveSkin.ocx
[2010.05.30 15:01:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Creative
[2010.05.30 14:53:45 | 000,071,596 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\PfModNT.sys
[2010.05.30 14:53:42 | 000,025,088 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTSVCCTL.EXE
[2010.05.30 14:45:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Creative
[2010.05.30 14:38:56 | 000,041,984 | ---- | C] (Creative Technology Ltd ) -- C:\WINDOWS\Ctregrun.exe
[2010.05.30 14:36:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages
[2010.05.30 14:35:18 | 000,385,109 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\ctjb2sp.dll
[2010.05.30 14:35:18 | 000,229,376 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTPmsMan.dll
[2010.05.30 14:35:18 | 000,200,704 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTPdeSrv.exe
[2010.05.30 14:35:18 | 000,143,360 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\CTPmsWma.dll
[2010.05.30 14:35:18 | 000,049,152 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\ctpde.dll
[2010.05.30 14:35:18 | 000,045,056 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\Jb4Inst.crl
[2010.05.30 14:35:18 | 000,032,768 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\PdePgHlp.dll
[2010.05.30 14:35:18 | 000,028,672 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\Jb4Inst.dll
[2010.05.30 14:35:18 | 000,020,480 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\ctjb2sp.crl
[2010.05.30 14:35:18 | 000,016,880 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\ctpdusb.sys
[2010.05.30 14:35:13 | 000,000,000 | ---D | C] -- C:\Programme\Creative
[2010.05.05 10:48:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Dev-Cpp
[2010.05.05 10:47:28 | 000,000,000 | ---D | C] -- C:\Dev-Cpp
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.02 12:50:43 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2010.06.02 12:50:15 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2010.06.02 12:50:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.06.02 12:49:33 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.06.02 12:49:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.06.01 23:12:18 | 000,000,046 | --S- | M] () -- C:\hda1
[2010.06.01 22:49:18 | 003,407,872 | -H-- | M] () -- C:\Dokumente und Einstellungen\Jan\NTUSER.DAT
[2010.06.01 22:49:18 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Jan\ntuser.ini
[2010.06.01 20:17:52 | 068,777,984 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Eigene Dateien\avira.iso
[2010.06.01 17:17:11 | 000,009,241 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\hijackthisnew
[2010.06.01 17:05:55 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.01 16:55:11 | 000,000,905 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\Spybot - Search & Destroy.lnk
[2010.06.01 16:19:49 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\Jan\Desktop\HiJackThis204.exe
[2010.05.31 13:20:24 | 001,923,290 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\cdex_151.zip
[2010.05.31 13:15:45 | 000,000,034 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2010.05.31 13:12:10 | 000,000,770 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Audiograbber 1.83.lnk
[2010.05.31 13:11:43 | 002,741,657 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\agsetup183se.exe
[2010.05.30 14:58:01 | 000,001,927 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Creative-Produktregistrierung.lnk
[2010.05.30 14:53:47 | 000,001,663 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Creative MediaSource Organizer.lnk
[2010.05.15 12:21:41 | 000,010,370 | ---- | M] () -- C:\Dokumente und Einstellungen\Jan\Desktop\SnXaq.png
[2010.05.12 12:19:58 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.06.01 23:12:18 | 000,000,046 | --S- | C] () -- C:\hda1
[2010.06.01 20:17:35 | 068,777,984 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Eigene Dateien\avira.iso
[2010.06.01 17:17:11 | 000,009,241 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\hijackthisnew
[2010.06.01 17:05:55 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.01 16:55:11 | 000,000,905 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\Spybot - Search & Destroy.lnk
[2010.05.31 13:20:16 | 001,923,290 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\cdex_151.zip
[2010.05.31 13:14:19 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2010.05.31 13:12:10 | 000,000,770 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Audiograbber 1.83.lnk
[2010.05.31 13:11:31 | 002,741,657 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\agsetup183se.exe
[2010.05.30 15:19:54 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2010.05.30 15:19:53 | 000,162,304 | ---- | C] () -- C:\UNWISE.EXE
[2010.05.30 14:53:46 | 000,001,663 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Creative MediaSource Organizer.lnk
[2010.05.30 14:38:58 | 000,001,927 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Creative-Produktregistrierung.lnk
[2010.05.30 14:35:18 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\PdeSrvps.dll
[2010.05.30 14:35:18 | 000,002,444 | ---- | C] () -- C:\WINDOWS\ctpdusb.uns
[2010.05.30 14:35:13 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2010.05.30 14:35:13 | 000,006,067 | ---- | C] () -- C:\WINDOWS\UNWISE.INI
[2010.05.15 12:21:39 | 000,010,370 | ---- | C] () -- C:\Dokumente und Einstellungen\Jan\Desktop\SnXaq.png
[2008.10.14 12:15:19 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2008.09.29 21:03:41 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008.09.11 18:04:21 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI
[2008.04.17 10:08:56 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2008.04.17 10:08:44 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2005.06.07 22:15:22 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2004.06.02 17:28:30 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2002.05.15 23:29:04 | 000,000,607 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2001.11.23 18:18:00 | 000,000,597 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[1997.07.11 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\Docobj.dll
< End of report >
         
--- --- ---

Hier noch der Malware-Log

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4161

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

01.06.2010 19:35:13
mbam-log-2010-06-01 (19-35-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 188952
Laufzeit: 1 Stunde(n), 48 Minute(n), 27 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Geändert von n00b87 (02.06.2010 um 14:44 Uhr)

Antwort

Themen zu ICQ: "Wie findest du mein neues Foto denn so ;D "
0x00000001, adblock, agere systems, audiograbber, avgntflt.sys, components, firefox 3.6.3, firefox.exe, location, malwarebytes' anti-malware, oldtimer, safer networking, saver, searchplugins, shell32.dll, vlc media player, windows internet, windows internet explorer, wireless lan



Ähnliche Themen: ICQ: "Wie findest du mein neues Foto denn so ;D "


  1. virus/trojaner über skype eingefangen "sie ist auf diesem foto?"
    Log-Analyse und Auswertung - 25.04.2013 (22)
  2. MSN/ICQ Virus (Hey, wie findest du das Foto?)
    Plagegeister aller Art und deren Bekämpfung - 18.07.2010 (7)
  3. ICQ Virus "Wie findest du das Bild?"
    Plagegeister aller Art und deren Bekämpfung - 23.06.2010 (9)
  4. ICQ spamt: "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 22.06.2010 (27)
  5. wie findest du das foto :D 2
    Plagegeister aller Art und deren Bekämpfung - 21.06.2010 (13)
  6. icq virus "wie findest du das bild"
    Plagegeister aller Art und deren Bekämpfung - 20.06.2010 (23)
  7. Icq Viru: "Wie findest du das Bild:D"
    Plagegeister aller Art und deren Bekämpfung - 20.06.2010 (6)
  8. "Wie findest du dieses Bild"
    Plagegeister aller Art und deren Bekämpfung - 15.06.2010 (1)
  9. ICQ-Virus, wie findest du das foto
    Plagegeister aller Art und deren Bekämpfung - 15.06.2010 (1)
  10. Msn/ICQ - Virus "Wie findest du dieses Bild" (winscdvn.exe)
    Plagegeister aller Art und deren Bekämpfung - 14.06.2010 (52)
  11. Der ICQ & MSN Virus: 'Wie findest du das Foto?'
    Plagegeister aller Art und deren Bekämpfung - 13.06.2010 (11)
  12. Virus "Wie findest du dieses Bild" (winscdvn.exe)
    Plagegeister aller Art und deren Bekämpfung - 13.06.2010 (1)
  13. ICQ Virus: "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 10.06.2010 (3)
  14. ICq Virus, wie findest du das foto
    Plagegeister aller Art und deren Bekämpfung - 10.06.2010 (7)
  15. Und wieder der ICQ & MSN Virus. 'Wie findest du das Foto?'
    Plagegeister aller Art und deren Bekämpfung - 10.06.2010 (9)
  16. ICQ spamt alle Kontakte zu... "Wie findest du mein neues Foto denn so ;D "
    Plagegeister aller Art und deren Bekämpfung - 01.06.2010 (4)
  17. Ewido findest "Spyware Minibug"
    Plagegeister aller Art und deren Bekämpfung - 14.11.2005 (4)

Zum Thema ICQ: "Wie findest du mein neues Foto denn so ;D " - Hallo, habe im Prinzip das selbe Problem glaube ich, nur bei MSN, keine Ahnung, ob es da einen Unterschied gibt. Allerdings meinte der Kontakt, von dem ich den Link bekommen - ICQ: "Wie findest du mein neues Foto denn so ;D "...
Archiv
Du betrachtest: ICQ: "Wie findest du mein neues Foto denn so ;D " auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.