Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Systemstörung in Windows 7 - langsamer Rechner und Norton außer Betrieb (https://www.trojaner-board.de/81118-systemstoerung-windows-7-langsamer-rechner-norton-ausser-betrieb.html)

Labbeduddel 02.01.2010 11:40
Systemstörung in Windows 7 - langsamer Rechner und Norton außer Betrieb
 
Hallo, bitte um Hilfe.

Durch irgendeinen Mis-Klick (obwohl ich eigentlich dachte, gut aufzupassen) habe ich mir wohl was eingefangen. Der Computer arbeitet extrem langsam und einige Programme (wie Norton oder AV Antivirus) lassen sich beispielsweise gar nicht mehr aufrufen. Im Task Manager tut sich manches, was ich nicht interpretieren kann.

Nun hab' ich Windows 7, und dafür ist lt. Chip HijackThis gar nicht kompatibel. Aber einen Logfile konnte ich dennoch erstellen. Vielleicht kann mir jemand einen heißen Tipp geben? Danke im Voraus!

Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:10, on 02.01.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\Program Files (x86)\ICQ6.5\ICQ.exe
C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe
C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\FreePDF_XP\fpassist.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\downloader.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.faz.net/s/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ShowBarObj Class - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Save Tube Video - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\SaveTubeVideo.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~2\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Global Startup: WISO Mein Sparbuch heute.lnk = C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Packard Bell Software Suite Service 1 (Service1) - Packard Bell Services - C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\PowerSave\HDPBSSS.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8614 bytes
verzweifelte Grüße vom Labbeduddel

Labbeduddel 02.01.2010 18:19
Keine Antwort - Keiner eine Idee? So kann's aber nicht bleiben, leider.

Ich bitte Euch alle noch einmal um Hilfe.

Grüße vom Labbeduddel

Labbeduddel 03.01.2010 23:30
Hallo zusammen. Ich hatte in diesem Forum schon öfter um Hilfe gebeten und immer erhalten. Dass sich gar keiner meldet, ist mir noch nicht passiert. Liegt das an Windows 7?

In meiner Verzweiflung habe ich erstmal alle Dateien gesichert (da könnte der Bösewicht natürlich dabei sein) und dann das MAM ausprobiert. Hier das entsprechende Logfile. War das nun was? Darf ich hoffen, clean zu sein?

Code:
Malwarebytes' Anti-Malware 1.43
Datenbank Version: 3479
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

03.01.2010 23:21:19
mbam-log-2010-01-03 (23-21-19).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 479500
Laufzeit: 1 hour(s), 13 minute(s), 22 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\minbho.showbarobj (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{27ba317e-7bbd-4ebe-a06a-47f076d9d6f7} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2574231f-9d6f-4b0e-9041-5dd7484564ad} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minbho.showbarobj.1 (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\kbbar.kbbarband (Adware.7FaSSt) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\kbbar.kbbarband.1 (Adware.7FaSSt) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.
Danke sehr für die Hilfe - falls sich jemand meldet.

Grüße vom Labbeduddel

Chris4You 04.01.2010 12:05
Hi,

das HJ-Log ist bis auf 2SaveTubeVideo" unauffällig, und dem ist ja schon MAM zu leibe gerückt...
Sicherheitshalber kannst Du das Verzeichnis "C:\Program Files (x86)\Save Tube Video Company" löschen...

Brauche mehr Infos, daher:
RSIT
Random's System Information Tool (RSIT) von random/random liest Systemdetails aus und erstellt ein aussagekräftiges Logfile.
* Lade Random's System Information Tool (RSIT) herunter (http://filepony.de/download-rsit/)
* speichere es auf Deinem Desktop.
* Starte mit Doppelklick die RSIT.exe.
* Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
* Wenn Du HijackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren.
* In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept".
* Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen.
* Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
* Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
* Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread.

Gmer:
http://www.trojaner-board.de/74908-a...t-scanner.html
Den Downloadlink findest Du links oben (http://www.gmer.net/#files), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte gmer und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein.

chris

Labbeduddel 04.01.2010 20:02
Vielen Dank Chris, für Deine Hilfe.

Hier das RSIT Logfile. Der Vorgang wurde mit der Fehlermeldung (weißnichtmehrdengenauenText) irgendwie "nicht definierte Variable -1 wurde angesprochen" beendet.

Code:
Logfile of random's system information tool 1.06 (written by random/random)
Run by K**n S***r at 2010-01-04 19:50:51
Microsoft Windows 7 Ultimate 
System drive C: has 167 GB (18%) free of 954 GB
Total RAM: 4095 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:51, on 04.01.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\Program Files (x86)\ICQ6.5\ICQ.exe
C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\Launcher.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe
C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\FreePDF_XP\fpassist.exe
C:\Users\K**n S***r\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\K**n S***r.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.faz.net/s/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ShowBarObj Class - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Save Tube Video - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\SaveTubeVideo.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~2\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [Packard Bell Software Suite] C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\Launcher.exe /run
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Global Startup: WISO Mein Sparbuch heute.lnk = C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Packard Bell Software Suite Service 1 (Service1) - Packard Bell Services - C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\PowerSave\HDPBSSS.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8799 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class - C:\PROGRA~2\ICQTOO~1\toolbaru.dll [2006-12-25 701952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2863E737-DD3F-4280-9AF8-E9E79C16F312}]
ShowBarObj Class - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll [2009-10-21 221184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll [2009-08-22 378736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\IPSBHO.DLL [2009-08-22 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2009-06-01 962808]
{F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - Save Tube Video - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\SaveTubeVideo.dll [2009-10-21 692224]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll [2009-08-22 378736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"BlackBerryAutoUpdate"=C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [2009-11-19 623960]
"SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"FreePDF Assistant"=C:\Program Files (x86)\FreePDF_XP\fpassist.exe [2009-09-05 385024]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"ICQ"=C:\PROGRA~2\ICQ6.5\ICQ.exe [2009-11-16 172792]
"Packard Bell Software Suite"=C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\Launcher.exe [2008-08-28 1934144]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
WISO Mein Sparbuch heute.lnk - C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SymEFA.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"NoActiveDesktopChanges"=
"ForceActiveDesktopOn"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\shar
GMER arbeitet eine Weile und meldet dann den Fehler "C:\Windows\system32\config\system: Das System kann die angegebene Datei nicht finden.

Und nun?

Chris4You 04.01.2010 20:21
Hi,

32 oder 64 Bit...
Das GMER nicht läuft ist ungut....
Versuche es mal im abgesicherten Modus zu starten (wenn es das bei Win7 gibt, da bin ich kein Spezialist für ;o)...

Bevor ich einen Schuß ins Blaue mit Avenger mache, probieren wir erstmal Dr. Web...
http://www.trojaner-board.de/59299-a...eb-cureit.html

Statt RSIT lass mal OTL laufen:

Systemscan mit OTL
Lade Dir bitte OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop

* Doppelklick auf die OTL.exe
* Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
* Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
* Unter Extra Registry, wähle bitte Use SafeList
* Klicke nun auf Run Scan links oben
* Wenn der Scan beendet wurde werden 2 Logfiles erstellt
* Poste die Logfiles hier in den Thread.

__________________

chris

Labbeduddel 04.01.2010 20:40
Nur damit ich hier nix falsches oder unvollständiges sage: Nach der Fehlermeldung fängt GMER trotzdem zu scannen an. Am Ende kommt die Meldung, dass er keine Manipulationen gefunden hat.

Und noch eins, die Viren, die MAM vorgeblich beseitigt hat, sind alle fröhlich wieder da. Ich habe jetzt - wie angeraten - das Verzeichnis "C:\Program Files (x86)\Save Tube Video Company" gelöscht. Das ist übrigens entweder gut getarnt, oder ich habe es mit dem System installiert. Es trägt dasselbe Datum (4.11.09) wie alle Systemdateien.

Ich probiere jetzt Dr. Web und berichte...

Chris4You 04.01.2010 21:01
Hi,

GMER ist für Win 7 noch nicht freigegeben...
Lass ihm nach Rootkits suchen und poste dann mal das Log...

chris

Labbeduddel 04.01.2010 21:20
Also Dr. Web hat seinen Schnellscan im abgesicherten Modus (ja, gibt's bei WIN 7 wie vorher bei XP) absolviert und keinen Virus oder sonstwas gefunden. Den vollständigen Scan spare ich mir für später auf. Jetzt also nochmal GMER und dann OTL.

Labbeduddel 04.01.2010 21:22
P.S.: Jedes zweite Mal, wenn ich versuche hochzufahren (normal oder abgesichert), kriege ich die Meldung, dass hochfahren leider nicht geht. Dann repariert WIN 7 mit seiner System-Wiederherstellung selbständig. Vermutlich beseitigt das erst einmal den Virus und er kommt erst später wieder. Vielleicht nach einer Zeit, oder wenn ich versuche, in's Internet zu gehen.

Fazit - hoffentlich finden die Scanner alles, was zu finden ist. Wollen mal sehen...

Labbeduddel 04.01.2010 22:24
Schwere Geburt - Absturz, aufgehängt, chkdsk, Systemwiederherstellung usw.

Hier der erste OTL-Log extras.txt:

Code:
OTL Extras logfile created on: 04.01.2010 22:04:06 - Run 1
OTL by OldTimer - Version 3.1.21.0    Folder = C:\Users\K*n S*r\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 75,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 162,55 Gb Free Space | 17,45% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: K*n2009
Current User Name: K*n S*r
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0611B3CC-B5DB-4B93-ACE4-97B8F938E6B7}" = 64 Bit HP CIO Components Installer
"{9EFC40E3-5F31-4F75-8445-286273F74D8E}" = Apple Mobile Device Support
"{A5F59952-475D-4DCC-BEAD-C216FC68E05C}" = iTunes
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{2EA45803-BEB7-46C4-9ADC-46A5F9E7BB77}" = GEAR driver installer for x86 and x64
"{46B70DEB-97B3-4E38-B746-EC16905E6A8F}" = WISO Sparbuch 2010
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom
"{AC76BA86-7AD7-1031-7B44-A92000000001}" = Adobe Reader 9.2 - Deutsch
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"BlackBerry_{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"CCleaner" = CCleaner
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"HijackThis" = HijackThis 2.0.2
"ICQToolbar" = ICQ Toolbar
"IsoBuster_is1" = IsoBuster 2.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.5.6)" = Mozilla Firefox (3.5.6)
"N360" = Norton 360
"Packard Bell Software Suite" = Packard Bell Software Suite
"PartyPoker" = PartyPoker
"SaveTubeVideo_is1" = SaveTubeVideo 2.9 (20091026)
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"StarBurn_is1" = StarBurn Version 12r10 (Build 0x20091021)
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

Labbeduddel 04.01.2010 22:25
und hier OTL.txt:

Code:
OTL logfile created on: 04.01.2010 22:04:06 - Run 1
OTL by OldTimer - Version 3.1.21.0    Folder = C:\Users\K*n S*r\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 75,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 162,55 Gb Free Space | 17,45% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: K*n2009
Current User Name: K*n S*r
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\K*n S*r\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\WISO\Sparbuch 2010\meinsparbuchheute.exe ()
PRC - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
PRC - C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\Launcher.exe (Packard Bell BV)
PRC - C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\PowerSave\HDPBSSS.exe (Packard Bell Services)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\K*n S*r\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (iPod Service) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WwanSvc) -- C:\Windows\SysNative\wwansvc.dll (Microsoft Corporation)
SRV:64bit: - (WbioSrvc) -- C:\Windows\SysNative\wbiosrvc.dll (Microsoft Corporation)
SRV:64bit: - (UmRdpService) -- C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (Power) -- C:\Windows\SysNative\umpo.dll (Microsoft Corporation)
SRV:64bit: - (Themes) -- C:\Windows\SysNative\themeservice.dll (Microsoft Corporation)
SRV:64bit: - (sppuinotify) -- C:\Windows\SysNative\sppuinotify.dll (Microsoft Corporation)
SRV:64bit: - (SensrSvc) -- C:\Windows\SysNative\sensrsvc.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) -- C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (PNRPsvc) -- C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation)
SRV:64bit: - (p2pimsvc) -- C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation)
SRV:64bit: - (HomeGroupProvider) -- C:\Windows\SysNative\provsvc.dll (Microsoft Corporation)
SRV:64bit: - (RpcEptMapper) -- C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation)
SRV:64bit: - (PNRPAutoReg) -- C:\Windows\SysNative\pnrpauto.dll (Microsoft Corporation)
SRV:64bit: - (HomeGroupListener) -- C:\Windows\SysNative\ListSvc.dll (Microsoft Corporation)
SRV:64bit: - (FontCache) -- C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (Dhcp) -- C:\Windows\SysNative\dhcpcore.dll (Microsoft Corporation)
SRV:64bit: - (defragsvc) -- C:\Windows\SysNative\defragsvc.dll (Microsoft Corporation)
SRV:64bit: - (CscService) -- C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (bthserv) -- C:\Windows\SysNative\bthserv.dll (Microsoft Corporation)
SRV:64bit: - (BDESVC) -- C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation)
SRV:64bit: - (AxInstSV) -- C:\Windows\SysNative\AxInstSv.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AppIDSvc) -- C:\Windows\SysNative\appidsvc.dll (Microsoft Corporation)
SRV:64bit: - (wbengine) -- C:\Windows\SysNative\wbengine.exe (Microsoft Corporation)
SRV:64bit: - (sppsvc) -- C:\Windows\SysNative\sppsvc.exe (Microsoft Corporation)
SRV:64bit: - (Fax) -- C:\Windows\SysNative\FXSSVC.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (N360) -- C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe (Symantec Corporation)
SRV - (VSS) -- C:\Windows\Vss [2009.07.14 04:20:14 | 00,000,000 | ---D | M]
SRV - (MSDTC) -- C:\Windows\SysWOW64\Msdtc [2009.07.14 04:20:14 | 00,000,000 | ---D | M]
SRV - (HomeGroupProvider) -- C:\Windows\SysWOW64\provsvc.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\SysWOW64\dhcpcore.dll (Microsoft Corporation)
SRV - (vds) -- C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (clr_optimization_v2.0.50727_64) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
SRV - (Bonjour Service) -- C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Service1) -- C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\PowerSave\HDPBSSS.exe (Packard Bell Services)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (acedrv08) -- C:\Windows\SysNative\drivers\acedrv08.sys ()
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (dc3d) MS Hardware Device Detection Driver (HID) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)
DRV:64bit: - (L1E) -- C:\Windows\SysNative\drivers\L1E62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (ccHP) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\cchpx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\SymEFA64.sys (Symantec Corporation)
DRV:64bit: - (BHDrvx64) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\BHDrvx64.sys (Symantec Corporation)
DRV:64bit: - (SYMTDI) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\symtdi.sys (Symantec Corporation)
DRV:64bit: - (SYMFW) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\symfw.sys (Symantec Corporation)
DRV:64bit: - (SYMNDISV) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\symndisv.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\Windows\SysNative\drivers\N360x64\0305020.00B\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SymIM) -- C:\Windows\SysNative\drivers\SymIMV.sys (Symantec Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (KSecPkg) -- C:\Windows\SysNative\drivers\ksecpkg.sys (Microsoft Corporation)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (hwpolicy) -- C:\Windows\SysNative\drivers\hwpolicy.sys (Microsoft Corporation)
DRV:64bit: - (FsDepends) -- C:\Windows\SysNative\drivers\fsdepends.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (WIMMount) -- C:\Windows\SysNative\drivers\wimmount.sys (Microsoft Corporation)
DRV:64bit: - (vhdmp) -- C:\Windows\SysNative\drivers\vhdmp.sys (Microsoft Corporation)
DRV:64bit: - (vmbus) -- C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (vdrvroot) -- C:\Windows\SysNative\drivers\vdrvroot.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) -- C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (rdyboost) -- C:\Windows\SysNative\drivers\rdyboost.sys (Microsoft Corporation)
DRV:64bit: - (pcw) -- C:\Windows\SysNative\drivers\pcw.sys (Microsoft Corporation)
DRV:64bit: - (CNG) -- C:\Windows\SysNative\drivers\cng.sys (Microsoft Corporation)
DRV:64bit: - (fvevol) -- C:\Windows\SysNative\drivers\fvevol.sys (Microsoft Corporation)
DRV:64bit: - (rdpbus) -- C:\Windows\SysNative\drivers\rdpbus.sys (Microsoft Corporation)
DRV:64bit: - (RDPREFMP) -- C:\Windows\SysNative\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\SysNative\drivers\agilevpn.sys (Microsoft Corporation)
DRV:64bit: - (WfpLwf) -- C:\Windows\SysNative\drivers\wfplwf.sys (Microsoft Corporation)
DRV:64bit: - (NdisCap) -- C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation)
DRV:64bit: - (vwifibus) -- C:\Windows\SysNative\drivers\vwifibus.sys (Microsoft Corporation)
DRV:64bit: - (1394ohci) -- C:\Windows\SysNative\drivers\1394ohci.sys (Microsoft Corporation)
DRV:64bit: - (HdAudAddService) -- C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation)
DRV:64bit: - (UmPass) -- C:\Windows\SysNative\drivers\umpass.sys (Microsoft Corporation)
DRV:64bit: - (mshidkmdf) -- C:\Windows\SysNative\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV:64bit: - (WudfPf) -- C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation)
DRV:64bit: - (MTConfig) -- C:\Windows\SysNative\drivers\MTConfig.sys (Microsoft Corporation)
DRV:64bit: - (CompositeBus) -- C:\Windows\SysNative\drivers\CompositeBus.sys (Microsoft Corporation)
DRV:64bit: - (Dot4Scan) -- C:\Windows\SysNative\drivers\Dot4Scan.sys (Microsoft Corporation)
DRV:64bit: - (Beep) -- C:\Windows\SysNative\drivers\beep.sys (Microsoft Corporation)
DRV:64bit: - (AppID) -- C:\Windows\SysNative\drivers\appid.sys (Microsoft Corporation)
DRV:64bit: - (scfilter) -- C:\Windows\SysNative\drivers\scfilter.sys (Microsoft Corporation)
DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) -- C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (discache) -- C:\Windows\SysNative\drivers\discache.sys (Microsoft Corporation)
DRV:64bit: - (HidBatt) -- C:\Windows\SysNative\drivers\hidbatt.sys (Microsoft Corporation)
DRV:64bit: - (CmBatt) -- C:\Windows\SysNative\drivers\CmBatt.sys (Microsoft Corporation)
DRV:64bit: - (AcpiPmi) -- C:\Windows\SysNative\drivers\acpipmi.sys (Microsoft Corporation)
DRV:64bit: - (CSC) -- C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (AmdPPM) -- C:\Windows\SysNative\drivers\amdppm.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (NuidFltr) -- C:\Windows\SysNative\drivers\nuidfltr.sys (Microsoft Corporation)
DRV:64bit: - (StarPortLite) StarPort Storage Controller (Lite) -- C:\Windows\SysNative\drivers\StarPortLite.sys (Rocket Division Software)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (RimVSerPort) -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys (Research in Motion Ltd)
DRV:64bit: - (RimUsb) -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100104.004\ex64.sys (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100104.004\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (acedrv08) -- C:\Windows\SysWOW64\acedrv08.dll ()
DRV - (CSC) -- C:\Windows\CSC [2009.11.04 21:05:23 | 00,000,000 | ---D | M]
DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20091217.002\IDSviA64.sys (Symantec Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NetBIOS) -- C:\Windows\SysWOW64\netbios.dll (Microsoft Corporation)
DRV - (mpsdrv) -- C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
DRV - (Tcpip) -- C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (NeroCd2k) -- C:\Windows\SysWOW64\drivers\NeroCD2k.sys (ahead Software GmbH)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = h**p://www.faz.net/s/homepage.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = h**p://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 E0 0C 64 8B 5D CA 01  [binary data]
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "h**p://www.faz.net/s/homepage.html"
FF - prefs.js..extensions.enabledItems: SearchToolbar@skywebsearch.com:1.0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2009.12.19 18:02:44 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2009.12.19 18:02:44 | 00,000,000 | ---D | M]
 
[2009.11.05 20:29:25 | 00,000,000 | ---D | M] -- C:\Users\K*n S*r\AppData\Roaming\mozilla\Extensions
[2009.11.05 21:06:03 | 00,000,000 | ---D | M] -- C:\Users\K*n S*r\AppData\Roaming\mozilla\Firefox\Profiles\msnozftx.default\extensions
[2010.01.01 11:39:30 | 00,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2009.08.24 20:25:19 | 00,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2009.08.24 20:25:19 | 00,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2009.08.24 20:25:19 | 00,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2009.08.24 20:25:19 | 00,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2009.08.24 20:25:19 | 00,000,801 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: (824 bytes) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll (IE Toolbar)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (ShowBarObj Class) - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll ()
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Save Tube Video) - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\SaveTubeVideo.dll (Save Tube Video Company)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [ICQ] C:\Programme (x86)\ICQ6.5\ICQ.exe File not found
O4 - HKCU..\Run: [Packard Bell Software Suite] C:\Program Files (x86)\Packard Bell\Packard Bell Software Suite\Launcher.exe (Packard Bell BV)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} h**p://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\h**p\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\h**p\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\h**ps\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\h**ps\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - Reg Error: Key error. File not found
O18 - Protocol\Handler\h**p\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\h**p\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\h**ps\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\h**ps\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\coIEPlg.dll (Symantec Corporation)
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - comfile [open] -- "%1" %* File not found
64bit: O35 - exefile [open] -- "%1" %* File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.01.04 21:50:11 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Users\K*n S*r\Desktop\OTL.exe
[2010.01.04 20:52:35 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\DoctorWeb
[2010.01.04 19:50:30 | 00,000,000 | ---D | C] -- C:\rsit
[2010.01.02 16:51:43 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.01.02 16:51:26 | 00,022,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.01.02 15:14:38 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\AppData\Roaming\Malwarebytes
[2010.01.02 15:14:24 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.01.02 15:14:22 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.01.02 11:26:50 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2009.12.30 12:32:32 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\Music
[2009.12.18 08:17:13 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\AppData\Local\FreePDF_XP
[2009.12.18 08:15:56 | 00,000,000 | ---D | C] -- C:\ProgramData\FreePDF
[2009.12.18 08:13:42 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\FreePDF_XP
[2009.12.18 08:13:22 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\gs
[2009.12.18 08:07:42 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\AppData\Local\Symantec
[2009.12.13 16:31:20 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\.jordan
[2009.12.12 18:00:40 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\AppData\Roaming\Buhl Data Service
[2009.12.12 17:58:58 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\AppData\Local\Buhl
[2009.12.12 17:58:05 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\WISO
[2009.12.12 17:57:49 | 00,000,000 | ---D | C] -- C:\ProgramData\Buhl Data Service GmbH
[2009.12.12 17:57:35 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\AppData\Local\Buhl Data Service
[2009.12.12 17:49:30 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\MSECache
[2009.12.10 08:09:32 | 00,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedsbs.dll
[2009.12.10 08:09:31 | 00,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedsbs.dll
[2009.12.06 16:19:25 | 00,000,000 | ---D | C] -- C:\Users\K*n S*r\Desktop\itunes 12923
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.01.04 22:07:47 | 01,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.01.04 22:07:47 | 00,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.01.04 22:07:47 | 00,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.01.04 22:07:47 | 00,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.01.04 22:07:47 | 00,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.01.04 22:07:31 | 00,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.01.04 22:07:30 | 00,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.01.04 22:02:21 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{664891e0-f974-11de-a460-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 22:02:21 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{664891e0-f974-11de-a460-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 22:02:21 | 00,065,536 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{664891e0-f974-11de-a460-00261826a28b}.TM.blf
[2010.01.04 22:02:18 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.01.04 22:02:15 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.01.04 22:02:11 | 32,205,78304 | -HS- | M] () -- C:\hiberfil.sys
[2010.01.04 21:52:24 | 01,287,183 | -H-- | M] () -- C:\Users\K*n S*r\AppData\Local\IconCache.db
[2010.01.04 21:47:23 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{49ee00ea-f972-11de-bb06-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 21:47:23 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{49ee00ea-f972-11de-bb06-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 21:47:22 | 00,065,536 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{49ee00ea-f972-11de-bb06-00261826a28b}.TM.blf
[2010.01.04 21:38:41 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{0b57e5e6-f971-11de-a45e-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 21:38:41 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{0b57e5e6-f971-11de-a45e-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 21:38:41 | 00,065,536 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{0b57e5e6-f971-11de-a45e-00261826a28b}.TM.blf
[2010.01.04 21:23:51 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{030830e1-f96f-11de-a42c-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 21:23:51 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{030830e1-f96f-11de-a42c-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 21:23:51 | 00,065,536 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{030830e1-f96f-11de-a42c-00261826a28b}.TM.blf
[2010.01.04 21:23:38 | 24,828,2698 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.01.04 21:22:38 | 02,359,296 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat
[2010.01.04 20:56:28 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Users\K*n S*r\Desktop\OTL.exe
[2010.01.04 20:17:03 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{b52f7661-f961-11de-b3e8-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 20:17:03 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{b52f7661-f961-11de-b3e8-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 20:17:03 | 00,065,536 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{b52f7661-f961-11de-b3e8-00261826a28b}.TM.blf
[2010.01.04 19:46:36 | 00,293,376 | ---- | M] () -- C:\Users\K*n S*r\Desktop\w71fg6o3.exe
[2010.01.04 19:45:14 | 00,781,909 | ---- | M] () -- C:\Users\K*n S*r\Desktop\RSIT.exe
[2010.01.04 19:40:17 | 00,006,688 | ---- | M] () -- C:\bootsqm.dat
[2010.01.03 23:22:15 | 00,027,648 | ---- | M] () -- C:\Users\K*n S*r\Desktop\Malwarebytes Logfile.doc
[2010.01.02 16:51:46 | 00,001,038 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.01.02 16:47:33 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{158b3a63-f7b6-11de-a441-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.02 16:47:33 | 00,524,288 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{158b3a63-f7b6-11de-a441-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.02 16:47:33 | 00,065,536 | -HS- | M] () -- C:\Users\K*n S*r\ntuser.dat{158b3a63-f7b6-11de-a441-00261826a28b}.TM.blf
[2009.12.30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2009.12.30 14:55:06 | 00,022,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2009.12.29 08:51:21 | 00,007,603 | ---- | M] () -- C:\Users\K*n S*r\AppData\Local\Resmon.ResmonCfg
[2009.12.12 18:03:04 | 00,000,460 | ---- | M] () -- C:\Windows\wiso.ini
[2009.12.12 18:00:03 | 00,002,149 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Sparbuch heute.lnk
[2009.12.12 18:00:02 | 00,002,068 | ---- | M] () -- C:\Users\Public\Desktop\WISO Sparbuch 2010.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.01.04 22:02:21 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{664891e0-f974-11de-a460-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 22:02:21 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{664891e0-f974-11de-a460-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 22:02:21 | 00,065,536 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{664891e0-f974-11de-a460-00261826a28b}.TM.blf
[2010.01.04 21:47:23 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{49ee00ea-f972-11de-bb06-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 21:47:23 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{49ee00ea-f972-11de-bb06-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 21:47:22 | 00,065,536 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{49ee00ea-f972-11de-bb06-00261826a28b}.TM.blf
[2010.01.04 21:38:41 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{0b57e5e6-f971-11de-a45e-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 21:38:41 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{0b57e5e6-f971-11de-a45e-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 21:38:41 | 00,065,536 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{0b57e5e6-f971-11de-a45e-00261826a28b}.TM.blf
[2010.01.04 21:23:51 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{030830e1-f96f-11de-a42c-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 21:23:51 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{030830e1-f96f-11de-a42c-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 21:23:51 | 00,065,536 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{030830e1-f96f-11de-a42c-00261826a28b}.TM.blf
[2010.01.04 19:49:54 | 00,781,909 | ---- | C] () -- C:\Users\K*n S*r\Desktop\RSIT.exe
[2010.01.04 19:49:54 | 00,293,376 | ---- | C] () -- C:\Users\K*n S*r\Desktop\w71fg6o3.exe
[2010.01.04 19:48:32 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{b52f7661-f961-11de-b3e8-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.04 19:48:32 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{b52f7661-f961-11de-b3e8-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.04 19:48:31 | 00,065,536 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{b52f7661-f961-11de-b3e8-00261826a28b}.TM.blf
[2010.01.04 19:40:17 | 00,006,688 | ---- | C] () -- C:\bootsqm.dat
[2010.01.03 23:22:15 | 00,027,648 | ---- | C] () -- C:\Users\K*n S*r\Desktop\Malwarebytes Logfile.doc
[2010.01.02 16:51:46 | 00,001,038 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.01.02 16:47:33 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{158b3a63-f7b6-11de-a441-00261826a28b}.TMContainer00000000000000000002.regtrans-ms
[2010.01.02 16:47:33 | 00,524,288 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{158b3a63-f7b6-11de-a441-00261826a28b}.TMContainer00000000000000000001.regtrans-ms
[2010.01.02 16:47:33 | 00,065,536 | -HS- | C] () -- C:\Users\K*n S*r\ntuser.dat{158b3a63-f7b6-11de-a441-00261826a28b}.TM.blf
[2009.12.18 08:13:42 | 00,119,152 | ---- | C] () -- C:\Windows\SysNative\redmon.hlp
[2009.12.18 08:13:42 | 00,087,040 | ---- | C] () -- C:\Windows\SysNative\redmonnt.dll
[2009.12.18 08:13:42 | 00,046,080 | ---- | C] () -- C:\Windows\SysNative\unredmon.exe
[2009.12.12 18:00:37 | 00,000,460 | ---- | C] () -- C:\Windows\wiso.ini
[2009.12.12 18:00:03 | 00,002,149 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Sparbuch heute.lnk
[2009.12.12 18:00:02 | 00,002,068 | ---- | C] () -- C:\Users\Public\Desktop\WISO Sparbuch 2010.lnk
[2009.11.23 07:38:07 | 00,007,603 | ---- | C] () -- C:\Users\K*n S*r\AppData\Local\Resmon.ResmonCfg
[2009.11.08 13:48:17 | 00,089,312 | ---- | C] () -- C:\Windows\SysWow64\acedrv08.dll
[2009.11.08 13:48:13 | 00,000,145 | ---- | C] () -- C:\Windows\Lilli.ini
[2009.11.08 13:48:13 | 00,000,000 | ---- | C] () -- C:\Windows\Lado.ini
[2009.11.05 21:37:45 | 00,000,385 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.11.05 21:33:15 | 00,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2009.11.05 00:40:43 | 00,001,746 | ---- | C] () -- C:\Windows\Language_trs.ini
[2009.11.04 23:55:44 | 00,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.07.14 00:42:10 | 00,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 00,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2003.02.20 17:53:42 | 00,005,702 | ---- | C] () -- C:\Windows\SysWow64\OUTLPERF.INI
< End of report >
Dr. Web Fullscan noch machen?

Gruß und Dank vom Labbeduddel

Labbeduddel 05.01.2010 09:54
Hier das Ergebnis des Dr. Web-Fullscans:

Code:
eMule44b-v16-webcache.exe\{app}\emule.exe;C:\$Recycle.Bin\S-1-5-21-2957578560-3958132288-733529207-1001\$RDTNZ8K\ADA-HAS - Dateien von zuhause\2005\eMule44b-v16-webcache;BackDoor.Emule.44;;
eMule44b-v16-webcache.exe;C:\$Recycle.Bin\S-1-5-21-2957578560-3958132288-733529207-1001\$RDTNZ8K\ADA-HAS - Dateien von zuhause\2005;Archiv enthält infizierte Objekte;Verschoben.;
eMule44b-v16-webcache.exe\{app}\emule.exe;C:\Dokumente und Einstellungen\k*n S*r\DoctorWeb\Quarantine\eMule44b-v16-webcache.exe;BackDoor.Emule.44;;
eMule44b-v16-webcache.exe;C:\Dokumente und Einstellungen\k*n S*r\DoctorWeb\Quarantine;Archiv enthält infizierte Objekte;Verschoben.;
eMule44b-v16-webcache.exe\{app}\emule.exe;C:\Dokumente und Einstellungen\k*n S*r\Documents\_Archiv ADA-HAS\ADA-HAS - Dateien von zuhause\2005\eMule44b-v16-web;BackDoor.Emule.44;;
eMule44b-v16-webcache.exe;C:\Dokumente und Einstellungen\k*n S*r\Documents\_Archiv ADA-HAS\ADA-HAS - Dateien von zuhause\2005;Archiv enthält infizierte Objekte;Verschoben.;
SmitfraudFix.exe\SmitfraudFix\Process.exe;C:\Dokumente und Einstellungen\k*n S*r\Downloads\SmitfraudFix.exe;Tool.Prockill;;
SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Dokumente und Einstellungen\k*n S*r\Downloads\SmitfraudFix.exe;Tool.ShutDown.14;;
SmitfraudFix.exe;C:\Dokumente und Einstellungen\k*n S*r\Downloads;Archiv enthält infizierte Objekte;Verschoben.;
Process.exe;C:\Dokumente und Einstellungen\k*n S*r\Downloads\SmitfraudFix;Tool.Prockill;;
restart.exe;C:\Dokumente und Einstellungen\k*n S*r\Downloads\SmitfraudFix;Tool.ShutDown.14;;
SmitfraudFix.exe\SmitfraudFix\Process.exe;C:\Sicherung alte ACER 80 GB Festplatte\Downloads\SmitfraudFix.exe;Tool.Prockill;;
SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Sicherung alte ACER 80 GB Festplatte\Downloads\SmitfraudFix.exe;Tool.ShutDown.14;;
SmitfraudFix.exe;C:\Sicherung alte ACER 80 GB Festplatte\Downloads;Archiv enthält infizierte Objekte;Verschoben.;
Process.exe;C:\Sicherung alte ACER 80 GB Festplatte\Downloads\SmitfraudFix;Tool.Prockill;;
restart.exe;C:\Sicherung alte ACER 80 GB Festplatte\Downloads\SmitfraudFix;Tool.ShutDown.14;;
Process.exe;C:\Users\k*n S*r\Downloads\SmitfraudFix;Tool.Prockill;;
restart.exe;C:\Users\k*n S*r\Downloads\SmitfraudFix;Tool.ShutDown.14;;
Answer (live).mp3;C:\Zusatzsicherung alter Dateien - wird nicht nochmals gesichert\S*n\s\Sarah Mc Lachlan\Afterglow Bonus Live EP;Modifikation von BAT.XPEH.144;Verschoben.;
Building A Mystery (live).mp3;C:\Zusatzsicherung alter Dateien - wird nicht nochmals gesichert\S*n\s\Sarah Mc Lachlan\Afterglow Bonus Live EP;Modifikation von BAT.XPEH.144;Verschoben.;
Dirty Little Secret (live).mp3;C:\Zusatzsicherung alter Dateien - wird nicht nochmals gesichert\S*n\s\Sarah Mc Lachlan\Afterglow Bonus Live EP;Modifikation von BAT.XPEH.144;Verschoben.;
Das Programm SmitfraudFix habe ich mal auf Empfehlung hier aus dem Forum heruntergeladen, dann aber seit Jahren nicht genutzt. Das kann eigentlich nicht das Problem sein.

Was nun?

Gruß und Dank vom Labbeduddel

Labbeduddel 05.01.2010 10:24
Eins noch - ich habe GMER noch einmal probiert. Es kommt dieselbe Fehlermeldung, danach macht er trotzdem den "Full Scan" und meldet, dass er nichts gefunden hat. Mir scheint, dass er dann auch kein Logfile speichert (hab keins gefunden).

ciao!

Labbeduddel 05.01.2010 10:35
Und hier der neue MAM-Bericht von heute morgen. Alles unverändert, wir sind noch nicht recht weiter gekommen:

Code:
Malwarebytes' Anti-Malware 1.43
Datenbank Version: 3479
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

05.01.2010 10:33:04
mbam-log-2010-01-05 (10-33-04).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 482639
Laufzeit: 1 hour(s), 10 minute(s), 11 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\minbho.showbarobj (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{27ba317e-7bbd-4ebe-a06a-47f076d9d6f7} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2574231f-9d6f-4b0e-9041-5dd7484564ad} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2863e737-dd3f-4280-9af8-e9e79c16f312} (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minbho.showbarobj.1 (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\kbbar.kbbarband (Adware.7FaSSt) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\kbbar.kbbarband.1 (Adware.7FaSSt) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll (Adware.SkyMediaPack) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.

Chris4You 05.01.2010 10:55
Hi,

das ist ein 64-Bit-System, da gibt es meines Wissens keinen Rootkit der drunter läuft, auch die meiste Malware hat da ein Problem, genau wie die meisten Bereinigungstools, daher wird das sehr schwierig werden...


Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:
  • Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“
    und suche folgende Datei/Dateien:
Code:
C:\Windows\SysWOW64\acedrv08.dll
C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
C:\Program Files (x86)\ICQToolbar\toolbaru.dll
C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\SaveTubeVideo.dll
C:\Programs\PartyGaming\PartyPoker\RunApp.exe
C:\Users\K*n S*r\Desktop\w71fg6o3.exe
C:\Windows\SysWOW64\wbem\vds.mof
C:\Windows\SysWow64\msjetoledb40.dll
  • Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)
  • Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.
  • Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Welche Prozesse im Taskmanager sind seltsam...?
Ist "Save Tube Video" wieder da?

chris

Labbeduddel 05.01.2010 18:30
Ich glaube, die Virustotal-Scans bringen alle nix. Hier einer nach dem anderen:

Datei acedrv08.dll

Code:
Antivirus        Version        letzte aktualisierung        Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Prevx        3.0        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 89312 bytes
MD5  : 14305f7451c6c8b8db354314efdb0776
SHA1  : d31709a82e7b0a398c2a73e481eb9103f06fc27b
SHA256: e51dd3c4f6327065a1b127c3999485004829c3c05e12960d08f3fe31da99ffec
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x38F9
timedatestamp.....: 0x4565C2E7 (Thu Nov 23 16:48:55 2006)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xBD54 0xC000 6.67 78459a2a4ceec480b51363b2cda1f0d2
.rdata 0xD000 0x1CF9 0x2000 5.20 5a89abf9d12c61fb86061851668e02d5
.data 0xF000 0x203140 0x1000 3.69 27a53e20708edce0ccc1de7d8f8709f1
.rsrc 0x213000 0xB0 0x1000 3.06 ebac935385099b99db0408d04e15d722
.reloc 0x214000 0x27AC 0x3000 2.76 aad3f2f169d88643b43cb1bbeeae55f2

( 1 imports )

> kernel32.dll: CloseHandle, DeviceIoControl, CreateFileA, GetProcAddress, GetModuleHandleA, WriteProcessMemory, GetCurrentProcess, GetCurrentThreadId, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetLastError, InterlockedDecrement, Sleep, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, WriteFile, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSection, VirtualAlloc, HeapReAlloc, RtlUnwind, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize

( 1 exports )

> repatch
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 1536:DGSNCoOILbG5+gyipXsxgFLMCiYVdtDWiM:qSNCoOIfAAP2dtu
PEiD  : -
RDS  : NSRL Reference Data Set
-
Datei ICQ Service.exe

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Prevx        3.0        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 222968 bytes
MD5...: f88e5dc5ca4c3f1aeb32169ab20d0b5a
SHA1..: 4169949f2bbf13551587304df3b887d100c80662
SHA256: a060c4230cac4b15642be5201f31bc07dc59161e8a2c61ceb373a80810b55e41
ssdeep: 3072:6mU9uPt6BHluXWGcQTfYmvmxTizzVQLrXlnmWpas5/HQWcLP39R7SA0kYa7
aob52:6mUE2lumGbJvETEzeLrXlmaK3GA5+oHg
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x11496
timedatestamp.....: 0x4a2429b6 (Mon Jun 01 19:19:18 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x26f6a 0x27000 6.64 ea25afd2ccd4e4f6625247cbd78e425f
.rdata 0x28000 0xb80e 0xba00 6.05 8031e4c028ca12c8561d031b03ab0f4e
.data 0x34000 0x38fc 0x1800 3.43 2c8624e361788487251cb6024c4aa91d
.rsrc 0x38000 0xbbc 0xc00 4.24 450117dc4c889314f0f66a7d18e16f9a

( 12 imports )
> urlmon.dll: URLDownloadToFileW
> WININET.dll: DeleteUrlCacheEntryW
> SETUPAPI.dll: SetupIterateCabinetW
> KERNEL32.dll: FreeLibrary, LoadLibraryExW, GetCommandLineW, ReleaseMutex, FindClose, FindNextFileW, RemoveDirectoryW, FindFirstFileW, WideCharToMultiByte, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, GetLocaleInfoW, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, CreateFileW, InitializeCriticalSectionAndSpinCount, LoadLibraryA, lstrcmpiW, InterlockedIncrement, GetCurrentThread, GetCurrentProcess, CloseHandle, GetModuleHandleW, GetProcAddress, InterlockedDecrement, DeleteCriticalSection, InitializeCriticalSection, RaiseException, Sleep, MoveFileExW, CreateDirectoryW, DeleteFileW, MoveFileW, GetModuleFileNameW, GetCurrentThreadId, lstrlenW, CreateEventW, WaitForSingleObject, LocalFree, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetLastError, lstrcpynW, SetEndOfFile, CreateFileA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetStringTypeW, GetStringTypeA, GetLocaleInfoA, SetFilePointer, ReadFile, FlushFileBuffers, VirtualAlloc, GetConsoleMode, GetConsoleCP, SetStdHandle, IsValidCodePage, GetOEMCP, GetACP, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, VirtualFree, HeapCreate, SetLastError, CreateMutexW, MultiByteToWideChar, CreateThread, GetStartupInfoW, RtlUnwind, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetSystemTimeAsFileTime, SetFileAttributesW, GetFileAttributesW, LCMapStringA, LCMapStringW, GetCPInfo, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree
> USER32.dll: GetMessageW, DispatchMessageW, PostThreadMessageW, FindWindowW, CharNextW, LoadStringW
> ADVAPI32.dll: ControlService, DeleteService, CreateServiceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, OpenThreadToken, OpenProcessToken, GetTokenInformation, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, IsValidSid, GetLengthSid, CopySid, RegDeleteValueW, RegDeleteKeyW, SetServiceStatus, RegisterEventSourceW, ReportEventW, DeregisterEventSource, OpenSCManagerW, OpenServiceW, CloseServiceHandle, RegOpenKeyExW, RegQueryInfoKeyW, RegEnumKeyExW, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegCloseKey, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetSecurityDescriptorSacl, SetSecurityInfo
> ole32.dll: CoRevokeClassObject, CoRegisterClassObject, CoTaskMemAlloc, CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree, StringFromGUID2, CoInitializeSecurity, CoInitialize, CoUninitialize
> SHELL32.dll: SHGetFolderPathW
> OLEAUT32.dll: -, -, -, -, -, -, -
> SHLWAPI.dll: PathAppendW
> msi.dll: -
> CRYPT32.dll: CertCompareCertificate, CertFreeCertificateContext

( 0 exports )
RDS...: NSRL Reference Data Set
-
sigcheck:
publisher....:
copyright....: Copyright 2007
product......: ICQIEUpdater Module
description..: ICQIEUpdater Module
original name: ICQ Service.EXE
internal name: ICQIEUpdater
file version.: 1, 0, 0, 1
comments.....: n/a
signers......: ICQ
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 8:20 PM 6/1/2009
verified.....: -
pdfid.: -
trid..: Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
Datei msjetoledb40.dll

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Prevx        3.0        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 364544 bytes
MD5...: 5a72f87f75a5ea7b46dc3ad87302fe00
SHA1..: 2c1f6f437277b3932cf32c700f13234e9cd0a1e7
SHA256: 2dae6fa1f162fe1f7235bae89b05e59cd6003e30385980c0513431d262dbb4e9
ssdeep: 6144:hJFY3BT1ai9WIgw+gQYzRqE9tiu8ROomnE:hJFY3BT1folFR/
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xa4a0
timedatestamp.....: 0x49246e49 (Wed Nov 19 19:51:37 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3eb77 0x3f000 6.50 ab239f1fe1ff4727c2792750eaba6b84
.rdata 0x40000 0x11ffc 0x12000 4.10 a48ab8fa217ec6a2502f5ce9da5cad8e
.data 0x52000 0x21b0 0x2000 4.85 1affea8e0b711c6954ed84d4248ea044
.rsrc 0x55000 0x6d8 0x1000 1.76 2f4e9ae76032d4f1cb0748b61b5634a5
.reloc 0x56000 0x3b54 0x4000 6.40 28def9cfa730a329b9c6a536b4117f9a

( 8 imports )
> ADVAPI32.dll: RegOpenKeyExW, RegOpenKeyExA, RegCloseKey
> KERNEL32.dll: MultiByteToWideChar, GetProcAddress, FreeLibrary, LoadLibraryExA, GetCurrentProcessId, TerminateProcess, GetCurrentProcess, WideCharToMultiByte, SetUnhandledExceptionFilter, GetLastError, GetSystemTimeAsFileTime, InterlockedExchange, Sleep, InterlockedCompareExchange, RtlUnwind, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, UnhandledExceptionFilter, InitializeCriticalSection
> msjet40.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> msjter40.dll: -, -, -, -
> msvcrt.dll: memcmp, _onexit, __dllonexit, __1type_info@@UAE@XZ, __CxxFrameHandler, _adjust_fdiv, rand, calloc, _ltow, time, srand, _amsg_exit, _terminate@@YAXXZ, _initterm, _XcptFilter, _vsnwprintf, _itow, realloc, malloc, free, memset, memcpy, __2@YAPAXI@Z, __3@YAXPAX@Z, _purecall, _wcsicmp
> ole32.dll: CoCreateInstance, CoGetMalloc, CoCreateGuid
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -
> USER32.dll: MoveWindow, GetDesktopWindow, GetWindowRect, GetParent, SetWindowTextA, SetWindowTextW, SetWindowLongA, SendMessageA, GetWindowTextA, GetWindowTextW, GetDlgItem, EndDialog, GetWindowLongA, DialogBoxParamA, GetSystemMetrics

( 5 exports )
DllCanUnloadNow, DllGetClassObject, DllMain, DllRegisterServer, DllUnregisterServer
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: DirectShow filter (43.0%)
Windows OCX File (26.3%)
Win64 Executable Generic (18.2%)
Win32 Executable MS Visual C++ (generic) (8.0%)
Win32 Executable Generic (1.8%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: Copyright (c) Microsoft Corp. 1997-1999
product......: Microsoft_ OLE DB Provider for Jet
description..: Microsoft OLE DB Provider for Jet
original name: MSJETOLEDB40.DLL
internal name: MSJETOLEDB40
file version.: 4.00.9756.0
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Labbeduddel 05.01.2010 18:34
Datei RunApp.exe

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Prevx        3.0        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 110592 bytes
MD5...: ac3ed9f87d8753783a0ecaf9c0d77069
SHA1..: 351ad1662801b5367b004a839f500a7b12bec2f2
SHA256: 5c4aa355aee75693deec22f0bed3056e848d64d07ae3449bedddd79403771feb
ssdeep: 1536:+PsFl4NTaK8T9QDgZhvc4+MtnKdtn/dmoebgs0rz3zGkSa:x4UDQQhx+K8t
ngoebVszjGX
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x27ee
timedatestamp.....: 0x43db2689 (Sat Jan 28 08:08:41 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xeb06 0xf000 6.46 c0b904bbb791e4b1fca44786a581fe21
.rdata 0x10000 0x4528 0x5000 4.36 ce7dfbeecc350aaf0e2e151ccb43c02a
.data 0x15000 0x4aa0 0x2000 2.15 9e11c41ee71fd32169695d8e17415b6c
.rsrc 0x1a000 0x30f8 0x4000 3.23 f0a55d859e468c4bdd5a521209c0e446

( 7 imports )
> KERNEL32.dll: RtlUnwind, GetStartupInfoA, GetCommandLineA, ExitProcess, TerminateProcess, HeapFree, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, GetACP, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, SetHandleCount, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, FlushFileBuffers, SetFilePointer, WriteFile, GetCurrentProcess, SetErrorMode, GetOEMCP, GetCPInfo, GetProcessVersion, GetLastError, WritePrivateProfileStringA, GlobalFlags, lstrcpynA, TlsGetValue, LocalReAlloc, TlsSetValue, EnterCriticalSection, GlobalReAlloc, LeaveCriticalSection, TlsFree, GlobalHandle, DeleteCriticalSection, TlsAlloc, InitializeCriticalSection, LocalAlloc, MulDiv, SetLastError, LoadLibraryA, FreeLibrary, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, lstrcpyA, GetModuleHandleA, GetProcAddress, LocalFree, MultiByteToWideChar, WideCharToMultiByte, lstrlenA, InterlockedDecrement, InterlockedIncrement, GlobalUnlock, GlobalFree, LockResource, FindResourceA, LoadResource, CloseHandle, GetModuleFileNameA, GlobalLock, GlobalAlloc, GlobalDeleteAtom, lstrcmpA, lstrcmpiA, GetCurrentThread, GetEnvironmentStringsW, GetCurrentThreadId
> USER32.dll: CopyRect, AdjustWindowRectEx, SetFocus, GetSysColor, MapWindowPoints, SendDlgItemMessageA, UpdateWindow, IsDialogMessageA, SetWindowTextA, ShowWindow, LoadStringA, DestroyMenu, ClientToScreen, GetDC, ReleaseDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, LoadCursorA, GetClassNameA, PtInRect, GetSysColorBrush, GetTopWindow, GetCapture, WinHelpA, wsprintfA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetWindowTextA, GetDlgCtrlID, DefWindowProcA, CreateWindowExA, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowLongA, SetWindowPos, RegisterWindowMessageA, GetWindowPlacement, GetWindowRect, EndDialog, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, DestroyWindow, GetDlgItem, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, MessageBoxA, SetCursor, PostQuitMessage, PostMessageA, EnableWindow, IsIconic, GetSystemMetrics, GetClientRect, DrawIcon, GetSystemMenu, AppendMenuA, SendMessageA, LoadIconA, SystemParametersInfoA, UnregisterClassA
> GDI32.dll: SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, DeleteDC, SetMapMode, GetDeviceCaps, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, DeleteObject, GetObjectA, SetBkColor, SetTextColor, GetClipBox, GetStockObject, SelectObject, RestoreDC, SaveDC, CreateBitmap
> WINSPOOL.DRV: DocumentPropertiesA, ClosePrinter, OpenPrinterA
> ADVAPI32.dll: RegSetValueExA, RegOpenKeyExA, RegCreateKeyExA, RegOpenKeyA, RegQueryValueExA, RegCloseKey
> SHELL32.dll: ShellExecuteA
> COMCTL32.dll: -

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....:
copyright....: Copyright (C) 2006
product......: RunApp Application
description..: RunApp MFC Application
original name: RunApp.EXE
internal name: RunApp
file version.: 1, 0, 0, 1
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Datei savetubevideo.dll

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Prevx        3.0        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 692224 bytes
MD5...: 103c16d9042a0a6c324f30b0ceec1b27
SHA1..: 7e7c9924c97005f238e78f99f4d20dab25ba4846
SHA256: 1e8bc6c6528468b8c7577d62ee91132084b460f92adb59cb01e2f7b2421db92d
ssdeep: 12288:dw6VzcFPoDd0IZfcBYr2b79TdbsUHgZ0g1V5i9o5khBhz8:dw65cFPoDd0
Idcf9Tdjis/z
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3aef2
timedatestamp.....: 0x4adebf43 (Wed Oct 21 07:58:59 2009)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x56b88 0x57000 6.70 072aaf96fc55d4eff65c463ec2208d00
.rdata 0x58000 0x16d72 0x17000 4.90 705971f6f07fcf3093b701f3a70a06f3
.data 0x6f000 0xc404 0x4000 4.29 e27f6b889f44f5274562fec7d9faf86a
.rsrc 0x7c000 0x2af1c 0x2b000 3.76 60bf5664c33fdb6f7662fdad004646b6
.reloc 0xa7000 0xa9ca 0xb000 4.92 456740981dae5968978d5e4b76af32bd

( 12 imports )
> SHLWAPI.dll: UrlUnescapeW, UrlEscapeW, PathFindExtensionW, PathFindFileNameW, PathIsUNCW, PathStripToRootW
> WININET.dll: DeleteUrlCacheEntryW, HttpOpenRequestW, InternetConnectW, HttpSendRequestW, InternetReadFile, InternetWriteFile, InternetSetFilePointer, InternetSetStatusCallbackW, InternetOpenW, InternetGetLastResponseInfoW, InternetCloseHandle, HttpQueryInfoW, InternetCrackUrlW, InternetCanonicalizeUrlW, InternetQueryDataAvailable
> KERNEL32.dll: ReadFile, WriteFile, SetFilePointer, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, DuplicateHandle, GetCurrentProcess, GetVolumeInformationW, GetFullPathNameW, WritePrivateProfileStringW, RtlUnwind, HeapFree, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, CreateDirectoryW, HeapAlloc, HeapReAlloc, GetSystemTimeAsFileTime, GetCommandLineA, GetProcessHeap, ExitThread, CreateThread, ExitProcess, HeapSize, SetStdHandle, GetFileType, HeapDestroy, GetThreadLocale, VirtualFree, VirtualAlloc, SetHandleCount, GetStdHandle, GetStartupInfoA, GetConsoleCP, GetConsoleMode, Sleep, GetCPInfo, GetACP, GetOEMCP, LCMapStringA, LCMapStringW, GetModuleFileNameA, GetTimeZoneInformation, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, GetStringTypeA, GetStringTypeW, CreateFileA, SetEnvironmentVariableA, GlobalFlags, SetErrorMode, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, GlobalReAlloc, TlsGetValue, GetCurrentProcessId, GetCurrentThread, ConvertDefaultLocale, EnumResourceLanguagesW, GetLocaleInfoW, CompareStringA, InterlockedExchange, LocalAlloc, SuspendThread, SetEvent, SetThreadPriority, GetFileTime, GetFileSize, CreateFileW, FindFirstFileW, FindClose, FileTimeToLocalFileTime, FileTimeToSystemTime, CreateEventW, GlobalAddAtomW, GlobalFindAtomW, GlobalDeleteAtom, CompareStringW, LoadLibraryA, lstrcmpW, GetVersionExA, FreeResource, GlobalFree, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageW, MulDiv, LocalFree, ExpandEnvironmentStringsW, CloseHandle, GetCurrentThreadId, OutputDebugStringW, lstrcpyW, GetSystemTime, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, LoadLibraryExW, lstrcmpiW, DeleteCriticalSection, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, RaiseException, lstrlenW, FreeLibrary, GetTempFileNameW, DeleteFileW, GetExitCodeThread, WaitForSingleObject, GetTempPathW, ResetEvent, ResumeThread, OutputDebugStringA, GetModuleFileNameW, SetLastError, LoadLibraryW, GetVersion, GetFileAttributesW, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetLastError, MultiByteToWideChar, FindResourceW, LoadResource, LockResource, SizeofResource, HeapCreate
> USER32.dll: CharUpperW, GetSysColorBrush, UnregisterClassW, GetWindowThreadProcessId, PostQuitMessage, DestroyMenu, GetMessageW, ValidateRect, GetCursorPos, WindowFromPoint, ShowWindow, MoveWindow, SetWindowTextW, IsDialogMessageW, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapW, ModifyMenuW, EnableMenuItem, CheckMenuItem, RegisterWindowMessageW, SendDlgItemMessageW, SendDlgItemMessageA, WinHelpW, GetCapture, SetWindowsHookExW, CallNextHookEx, GetClassLongW, GetClassNameW, SetPropW, GetPropW, RemovePropW, GetWindowTextLengthW, GetWindowTextW, GetForegroundWindow, GetLastActivePopup, GetTopWindow, GetMessageTime, GetMessagePos, PeekMessageW, MapWindowPoints, TrackPopupMenu, GetKeyState, SetForegroundWindow, UpdateWindow, GetMenu, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, AdjustWindowRectEx, PtInRect, SetWindowPlacement, GetDlgCtrlID, DefWindowProcW, CallWindowProcW, SetWindowLongW, SetWindowPos, SystemParametersInfoA, IsIconic, GetWindow, EndPaint, BeginPaint, GetDC, ClientToScreen, ScreenToClient, UnhookWindowsHookEx, GetDesktopWindow, GetActiveWindow, SetActiveWindow, CreateDialogIndirectParamW, DestroyWindow, IsWindow, GetWindowLongW, GetDlgItem, IsWindowEnabled, GetNextDlgTabItem, EndDialog, GetMenuState, GetMenuItemID, GetMenuItemCount, GetSubMenu, RedrawWindow, IsWindowVisible, AppendMenuW, CreatePopupMenu, TranslateMessage, DispatchMessageW, GetComboBoxInfo, KillTimer, SetFocus, GetFocus, SetTimer, CharNextW, CharLowerBuffW, GrayStringW, DrawTextExW, DrawTextW, TabbedTextOutW, ReleaseDC, GetWindowDC, GetClientRect, EqualRect, GetSysColor, DrawIconEx, GetSystemMetrics, SystemParametersInfoW, FrameRect, CopyRect, MessageBoxW, PostMessageW, LoadImageW, MessageBeep, LoadIconW, EnableWindow, GetParent, InvalidateRect, GetWindowRect, SendMessageW, DrawFocusRect, InflateRect, SetRectEmpty, LoadCursorW, SetCursor, GetWindowPlacement, UnregisterClassA
> GDI32.dll: ScaleWindowExtEx, SetWindowExtEx, CreateBitmap, DeleteDC, GetStockObject, CreateFontIndirectW, GetObjectW, SetWindowOrgEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, GetClipBox, SetMapMode, SetTextColor, SetBkMode, SetBkColor, RestoreDC, SaveDC, GetDeviceCaps, Escape, ExtTextOutW, TextOutW, RectVisible, PtVisible, BitBlt, CreateCompatibleBitmap, GetTextExtentPoint32W, CreateCompatibleDC, CreateSolidBrush, DeleteObject
> COMDLG32.dll: GetFileTitleW
> WINSPOOL.DRV: DocumentPropertiesW, OpenPrinterW, ClosePrinter
> ADVAPI32.dll: RegQueryValueW, RegEnumKeyW, RegEnumValueW, RegQueryValueExW, RegOpenKeyW, RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW
> SHELL32.dll: ShellExecuteExW, ShellExecuteW
> ole32.dll: CoUninitialize, CoInitialize, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, CoCreateInstance, StringFromGUID2, StringFromCLSID
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> urlmon.dll: URLDownloadToFileW

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
RDS...: NSRL Reference Data Set
-
sigcheck:
publisher....: Save Tube Video Company
copyright....: Copyright 2009
product......: Save Tube Video
description..: Save Tube Video
original name: SaveTubeVideo.dll
internal name: Save Tube Video
file version.: 1, 0, 0, 1
comments.....: Save Tube Video
signers......: -
signing date.: -
verified.....: Unsigned
pdfid.: -
trid..: DirectShow filter (43.0%)
Windows OCX File (26.3%)
Win64 Executable Generic (18.2%)
Win32 Executable MS Visual C++ (generic) (8.0%)
Win32 Executable Generic (1.8%)
Datei vds.mof

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Prevx        3.0        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 61056 bytes
MD5...: 4959ef1284f9eb9fed8da6963d74cac9
SHA1..: ac72210c49ac16507366063862a50531a6652172
SHA256: be5109a25b4bc4b01d6314be10a15d67b2d43590da4043da7a14073a414d11d5
ssdeep: 768:/mwLyFW8RCaIyJzpFdp/u2ER4ERImfVlSewdXUR9sLthSnu:60yJzUQeVsl
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
packers (F-Prot): Unicode
pdfid.: -
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
trid..: Text - UTF-16 (LE) encoded (64.4%)
MP3 audio (32.2%)
Lumena CEL bitmap (2.0%)
Corel Photo Paint (1.3%)
Datei w71fg6o3.exe (Dies ist übrigens RSIT unter einem Decknahmen)

Code:
Antivirus          Version          letzte aktualisierung          Ergebnis
a-squared        4.5.0.48        2010.01.05        -
AhnLab-V3        5.0.0.2        2010.01.05        -
AntiVir        7.9.1.122        2009.12.31        -
Antiy-AVL        2.0.3.7        2010.01.05        -
Authentium        5.2.0.5        2010.01.05        -
Avast        4.8.1351.0        2010.01.05        -
AVG        8.5.0.430        2010.01.04        -
BitDefender        7.2        2010.01.05        -
CAT-QuickHeal        10.00        2010.01.05        -
ClamAV        0.94.1        2010.01.05        -
Comodo        3476        2010.01.05        -
DrWeb        5.0.1.12222        2010.01.05        -
eSafe        7.0.17.0        2010.01.05        -
eTrust-Vet        35.1.7216        2010.01.05        -
F-Prot        4.5.1.85        2010.01.05        -
F-Secure        9.0.15370.0        2010.01.05        -
Fortinet        4.0.14.0        2010.01.05        -
GData        19        2010.01.05        -
Ikarus        T3.1.1.79.0        2010.01.05        -
Jiangmin        13.0.900        2010.01.05        -
K7AntiVirus        7.10.939        2010.01.05        -
Kaspersky        7.0.0.125        2010.01.05        -
McAfee        5852        2010.01.05        -
McAfee+Artemis        5852        2010.01.05        -
McAfee-GW-Edition        6.8.5        2010.01.05        -
Microsoft        1.5302        2010.01.05        -
NOD32        4745        2010.01.05        -
Norman        6.04.03        2010.01.05        -
nProtect        2009.1.8.0        2010.01.05        -
Panda        10.0.2.2        2010.01.05        -
PCTools        7.0.3.5        2010.01.05        -
Rising        22.29.01.04        2010.01.05        -
Sophos        4.49.0        2010.01.05        -
Sunbelt        3.2.1858.2        2010.01.05        -
Symantec        20091.2.0.41        2010.01.05        -
TheHacker        6.5.0.3.132        2010.01.05        -
TrendMicro        9.120.0.1004        2010.01.05        -
VBA32        3.12.12.1        2010.01.05        -
ViRobot        2010.1.5.2122        2010.01.05        -
VirusBuster        5.0.21.0        2010.01.05        -
weitere Informationen
File size: 293376 bytes
MD5...: f80f6e09e7f4bafe478ca0da6137e1e2
SHA1..: 719082766cf4f60c8bdaa2b2c9f6967ecbcf8722
SHA256: 682fd0d13d7caf4b17a1eb9bafa0a3c3598139bb3623d3f5fba3bfbd0a6d424a
ssdeep: 6144:Uwbg2xeuJgWM/S1tm/xCIoQPJVZCzw5bEPb3cV9iYpTkyTFHS2:Uw82IZWM
61tUXRd9IPb3cVZkyp/
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xb3f40
timedatestamp.....: 0x4b2763f0 (Tue Dec 15 10:24:48 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x6d000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x6e000 0x47000 0x46200 7.93 7b777c30b7f75e5eb654691bb1616dcb
.rsrc 0xb5000 0x2000 0x1400 3.38 710fb4291f153e98a3a03f3473b8bfd6

( 1 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess

( 0 exports )
RDS...: NSRL Reference Data Set
-
packers (F-Prot): UPX
packers (Kaspersky): PE_Patch.UPX, UPX, PE_Patch
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: 1, 0, 15, 15281
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
trid..: UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
pdfid.: -

Labbeduddel 05.01.2010 18:39
Zu Deinen weiteren Fragen:

Save Tube Video war tatsächlich wieder da. Ich führe das allerdings auf die automatische Systemwiederherstellung zurück, die zwischenzeitlich erforderlich war. Ich habe es wieder gelöscht und neu gestartet, und das Verzeichnis ist bisher nicht wieder da.

Im Task Manager war mir das nachfolgende Programm aufgefallen, das ständig wachsenden Speicher (über 100 MByte) belegt hat. Was es macht, ist mir nicht ganz klar. Kann aber sein - ist viel Musik auf dem Rechner.

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:

Ansonsten war auch ein svchost-Prozess sehr mächtig. Aktuell erlaubt mir der Rechner aber nicht, die Option "Prozesse aller Benutzer anzeigen", daher kann ich das Interessante nicht sehen oder abschreiben. Vielleicht klappt's in einer Stunde.

So weit von mir.

Gruß und Dank vom Labbeduddel

Chris4You 05.01.2010 19:07
Hi,

hast du ein Backup vom Rechner?
Auch Avenger hat keine Freigabe für win7 (und schon gar nicht für 64Bit), möchte es aber mal probieren...

So, habe Avenger in einer virtual maschine auf Win7 (allerdings 32 Bit) losgelassen, bisher läuft es noch ,o)

Falls Du das Risiko eingehen willst...

Also:
Anleitung Avenger (by swandog46)

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:

http://saved.im/mzi3ndg3nta0/aven.jpg

2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist.

Kopiere nun folgenden Text in das weiße Feld:
(bei -> "input script here")

Code:
Files to delete:
C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo\MinBHO.dll
C:\Program Files (x86)\ICQToolbar\toolbaru.dll

Folders to delete:
C:\Program Files (x86)\Save Tube Video Company\SaveTubeVideo
3.) Schliesse nun alle Programme (vorher notfalls abspeichern!) und Browser-Fenster, nach dem Ausführen des Avengers wird das System neu gestartet.

4.) Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet!

5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt
Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

chris

Labbeduddel 05.01.2010 19:23
Du meinst Backup für den Fall des Totalverlusts? Ja habe ich, das hat mich das ganze vergangene Wochenende gekostet ;)

Nochmal zum Task Manager:

svchost.exe / 167.440 k Arbeitsspeicher / "Hostprozess für Windows-Dienste"
SearchIndexer.exe / 59.032 k Arbeitsspeicher / "Microsoft Windows Search-Indexerstellung"
ccSvcHst.exe *32 / 48.572 k Arbeitsspeicher / "Symantec Service Framework"
wmpnetwk.exe / 35.080 k Arbeitsspeicher (wechselnd, bis über 100 MB) / "Windows Media Player Netzwerk"

Das sind die, die mir auffielen.

Gruß und Dank vom Labbeduddel

Chris4You 05.01.2010 19:49
Hi,

okay, dann schaue dir den vorangegangenen Post von mir noch mal an, da ist ein Avengerscript drin... Das bitte abfahren und das Log posten... Avenger wird endgültig mit zwei Sachen aufräumen und nach einem bestimmten Rootkit suchen...

Schauen wir mal ob wir Ausführungsbeschränkungen finden:
Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren)

Image File Execution Options

in edit und klicke "Ok".
Notepad wird sich oeffnen - poste den text

chris
Ps.: Die genannten Prozesse sind unkritisch, wobei die svchost natürlich auch zweckentfremdet von Malware benutzt werden kann (wie einige mehr Systemprozesse. Das ist genau der Trick, wie Malware sich an Firewall und Co "vorbeischmuggelt"...

Labbeduddel 05.01.2010 20:06
Tut mir Leid, aber es gibt keine Datei avenger.txt. Weder im Rootlaufwerk C:\, noch auf dem Desktop, noch irgendwo auf der Festplatte.

Das Programm lief an wie geplant. Nach dem Neustart ("yes") hat es sich aber nicht mehr bemerkbar gemacht.

Und nun??

Chris4You 05.01.2010 20:10
Hi,

eigentlich öffnet sich ein Editor mit dem Log von Avenger...
Das hat mit dem win7/32Bit zumindest funktioniert, auch die Anweisungen wurden abgearbeitet...

Und Du hast nichts neues (Treiber etc.) installiert?

Hast Du Avenger als Admin ausgeführt bzw. unter Adminrechten?

Sieht so aus, als ob wir uns eine Boot-CD basteln müssen und dann von aussen mal draufschauen.
Hast Du eine Ati-Graka im Rechner?

chris

Labbeduddel 05.01.2010 20:14
Vielleicht habe ich den Fehler gemacht, nicht (wie bei dem Oldtimer) die Option "als Administrator starten" zu wählen.

Kann ich den Avenger einfach nochmal starten?

Chris4You 05.01.2010 20:21
Hi,

ja. Suche dann mal wie angegeben mit Flekmann (siehe vorangegangenen Posts)...

chris

Labbeduddel 05.01.2010 20:37
Also, auch mit Administrator-Rechten stellte sich der Avenger tot.

Logfile von Flekman:

Code:
Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0

; Results at 05.01.2010 20:34:48 for strings:
;  'image file execution options'
; Strings excluded from search:
;  (None)
; Search in:
; Registry Keys  Registry Values  Registry Data 
; HKEY_LOCAL_MACHINE  HKEY_USERS 


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEInstal.exe]

; End Of The Log...
Gruß und Dank mal wieder vom Labbeduddel

Chris4You 05.01.2010 20:50
Hi,

auch nicht der Renner...
Hast Du schon eine Reparaturinstallation probiert?

chris

Labbeduddel 05.01.2010 21:10
Systemwiederherstellung auf den Stand 22.11.09. Das hätte ich längst machen sollen. Angeblich bleiben die persönlichen Daten unangetastet.

Nehmen wir mal an, das geht gut. Mit welchem Programm sichere ich dann ab, dass die Viren auch wirklich verschwunden sind?

Chris4You 05.01.2010 21:17
Hi,

ein Scanner der tatsächlich unter win7/64Bit läuft wäre Prevx zu nennen, der allerdings in der Free-Edition nichts beseitigt...
Zitat:
...
It is compatible with Windows 98, NT4, 2000, 2003, 2008, XP, Vista and even Windows 7. Both 32 bit and 64 bit versions are available.
...
Prevx:
http://www.prevx.com/freescan.asp
Falls das Tool was findet, nicht das Log posten sondern einen Screenshot des dann angezeigten Fensters...

chris

Labbeduddel 05.01.2010 22:02
Tool hat nix gefunden, das ist ja schon mal sehr erfreulich. Aber das hat im System nach installierten Viren gesucht (so mein Eindruck). Soll ich nochmal MAM laufen lassen? Norton wieder installieren ist zwar schön, aber das hat ja bisher auch nicht geholfen. Ich wäre gerne sicher, dass der Virus auf keiner internen oder externen Festplatte mehr schlummert.

Bisher schon mal vielen Dank für Deine große Mühe!

Chris4You 05.01.2010 22:09
Hi,

Vorschlag: Eine Virenlösung mit einem Guard und einen verhaltensbasierten Guard dazu...
z. B. Antivr (kostenlos) und dazu die kostenlose Version von Threadfire (http://www.threatfire.com/de/) (das gibt es auch für 64 bit win7)...

chris


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:42 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131