Trojaner-Board - "Malware Defense", Antivir und Systemwiederherstellung werden geblockt

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - "Malware Defense", Antivir und Systemwiederherstellung werden geblockt (https://www.trojaner-board.de/81401-malware-defense-antivir-systemwiederherstellung-geblockt.html)

Hallo Chris!

Erstmal DANKE für Deine rasche Antwort!! :)

Im sicheren Modus und unter meinem Benutzerkonto als auch unter Administrator (in den Logs "yyy") bin ich tatsächlich ohne aufhängerei reingekommen! Unter Administrator hatte es sich zuvor wieder aufgehängt, ka warum es nun wieder geht.

RSIT konnte ich nun ausführen, die Logs findest Du im Folgepost (zuviele Zeichen für einen ^^)

Probleme nun
Wollte GData (habe TotalCare2010 mit BootCD und AntiVirus 2010 ohne BootCD getestet) installieren zwecks Virencheck dann kam "The System administrator has set policies to prevent this installation" – obwohl ich als Admin eingeloggt bin! oO

Kaspersky hab ich ebenfalls erfolgslos getestet - nach der Suche nach neuen Updates kam „Installation wird vorbereitet“ dann schloss sich das Fenster und keine Spur von Kaspersky mehr auf dem Rechner ausser die runtergeladene Datei – warum auch immer.

Avast (mein vorhandener Scanner) habe ich geupdatet und zweimal einen kompletten Systemcheck gemacht . Konnte das Ergebnis leider nicht sehen da einmal der Screensaver hängen bleib und beim zweiten mal eine Website, die sich nach einiger Zeit seit von alleine aufzubauen versucht (scheitert am deaktivierten W-Lan) die Adresse lautet w*w.lux-software.com - evtl. ein Hinweis auf den Trojaner? Von allein ploppte da bisher nie was auf.

Nach Reboot zeigte Avast-Viren Container bzw Report folgendes an (das selbe wie bisher):

Initialisierung von Containerdateien
Reiter „Abbrechen“: Aktion wurde mit Fehlern beendet!
Reiter „Fehler-Report“: Programm kann nicht verwenden Container Client (null) --> Beschreibung: Virus Container Server läuft nicht RPC-Kommunikation fehlgeschlagen.
Reiter „Detailierte Informationen“: Programm versucht Laden aller Container-Dateien von folgendem Server (null). Aktion wurde mit Fehlern beendet.
(letzte Amtshandlung vor GMER daher letzter Forenbeitrag editiert)

Malwarebytes habe ich versucht zu installieren, sobald die Installation jedoch beendet wird, gibt’s keinen weiteren Fortschritt mehr – passiert nichts bzw. bleibt einfach stehen. Deinstallieren und Neuinstall habe ich einige male unter beiden Konten versucht, mit dem selben Ergebnis.
Update: Install hat geklappt, Programm lässt sich jedoch nicht öffnen.

Ein Backup vom befallenen Rechner habe ich leider nicht (ironischerweise stand genau DAS und der Kauf einer externen Sicherungsplatte für Ende der Woche auf dem Plan -.-)

Schreibe hier vom Laptop aus, welches sauber ist, hat allerdings Vista drauf, daher ka ob ich damit Boot CDs für XP machen kann?!
Kenn mich leider nicht soo gut aus, daher die ggf. dumme Frage - inwiefern wäre eine Boot CD hier von nutzen bzw. was könnte ich damit anstellen?

Mir scheint, dass speziell diese Malware noch nicht so lange im Umlauf ist, kann das sein?

So, hoffe das wären die Infos, mit denen Du was anfangen kannst :)

Merci!

Isabelle

P.S.: Nach dem Scan mit GMER kam folgende Meldung:

Warning!!!
GMER has found system modification caused by ROOTKIT activity!

RSIT (inkl. Hijackthis?!) hat funktioniert, hier die Ergebnisse:

RSIT log.txt

Code:

Logfile of random's system information tool 1.06 (written by random/random)

Run by yyy at 2010-01-19 02:52:36

Microsoft Windows XP Professional Service Pack 3

System drive C: has 117 GB (78%) free of 150 GB

Total RAM: 3071 MB (90% free)
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:52:46, on 19.01.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Safe mode with network support
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\ctfmon.exe

C:\AntiMalware\RSIT.exe

C:\Program Files\trend micro\yyy.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Aim] "C:\Program Files\AIM\aim.exe" /d locale=de-DE

O4 - HKCU\..\Run: [cls_pack.exe] C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Levelone Wireless Utility.lnk = C:\Program Files\LevelOne\Common\RaUI.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1226788575796

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226788481437

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Update Service (gupdate1c99f04e43d720c) (gupdate1c99f04e43d720c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
 

--

End of file - 8616 bytes
 

======Scheduled tasks folder======
 

C:\WINDOWS\tasks\Google Software Updater.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1ca5dbabead5a14.job

C:\WINDOWS\tasks\WGASetup.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}]

EWPBrowseObject Class - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll [2006-04-18 34304]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]

Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-04-08 668656]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2006-04-18 552960]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-11-25 15473664]

"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-11-25 69632]

"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-01-17 7286784]

"nwiz"=nwiz.exe /install []

"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-01-17 86016]

"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]

"UMonit"=C:\WINDOWS\system32\umonit.exe [2004-05-11 53248]

"Logitech Hardware Abstraction Layer"=C:\WINDOWS\KHALMNPR.EXE [2004-12-10 49152]

"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

"SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-09-30 155648]

"OpwareSE4"=C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [2006-03-21 69632]

"zBrowser Launcher"=C:\Program Files\Logitech\iTouch\iTouch.exe [2004-03-18 892928]

"CloneCDTray"=C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [2004-10-21 57344]

"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]

"TrueImageMonitor.exe"=C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2008-10-01 4365688]

"AcronisTimounterMonitor"=C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2008-10-01 962464]

"Acronis Scheduler2 Service"=C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2008-10-01 165144]

"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]

"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

"ISUSPM"=C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [2006-05-16 213936]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840]

"Aim"=C:\Program Files\AIM\aim.exe [2009-12-01 3951976]

"cls_pack.exe"=C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe [2010-01-18 712704]
 

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

Levelone Wireless Utility.lnk - C:\Program Files\LevelOne\Common\RaUI.exe

Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=1

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"

"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

"C:\Program Files\MSN BackUp\MSNBackup.exe"="C:\Program Files\MSN BackUp\MSNBackup.exe:*:Enabled:MSN BackUp"

"C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe"="C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe:*:Enabled:CrazyTalk"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"

"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"

"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"

"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"

"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

"C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AIM"
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
 

======List of files/folders created in the last 1 months======
 

2010-01-19 02:52:36 ----D---- C:\rsit

2010-01-19 02:50:40 ----D---- C:\WINDOWS\CSC

2010-01-19 02:45:55 ----D---- C:\Program Files\trend micro

2010-01-18 16:10:50 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2010-01-18 16:10:50 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2010-01-18 15:50:19 ----HD---- C:\WINDOWS\PIF

2010-01-18 15:41:51 ----A---- C:\WINDOWS\ntbtlog.txt

2010-01-18 15:18:53 ----D---- C:\Program Files\CCleaner

2010-01-18 15:17:32 ----D---- C:\AntiMalware

2010-01-18 06:59:15 ----D---- C:\Program Files\Malware Defense

2010-01-18 04:37:49 ----A---- C:\Documents and Settings\All Users\Application Data\sysReserve.ini

2010-01-18 03:11:08 ----D---- C:\Documents and Settings\yyy\Application Data\acccore

2010-01-18 03:10:40 ----D---- C:\Documents and Settings\All Users\Application Data\AIM

2010-01-18 03:10:34 ----D---- C:\Program Files\Common Files\Software Update Utility

2010-01-18 03:10:34 ----D---- C:\Program Files\AIM

2010-01-18 03:10:33 ----D---- C:\Program Files\Common Files\AOL

2010-01-13 06:19:45 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$

2010-01-13 06:19:37 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

2010-01-07 18:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$

2010-01-07 18:00:24 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$

2010-01-07 03:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$

2010-01-07 03:09:02 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$

2010-01-07 03:03:29 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$

2010-01-07 03:02:34 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$

2010-01-07 03:02:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$

2010-01-07 03:00:49 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
 

======List of files/folders modified in the last 1 months======
 

2010-01-19 02:50:40 ----D---- C:\WINDOWS

2010-01-19 02:46:02 ----D---- C:\WINDOWS\system32

2010-01-19 02:45:55 ----RD---- C:\Program Files

2010-01-19 02:28:18 ----D---- C:\Documents and Settings

2010-01-18 22:38:58 ----HD---- C:\WINDOWS\inf

2010-01-18 22:38:57 ----D---- C:\WINDOWS\system32\CatRoot2

2010-01-18 22:38:23 ----SD---- C:\WINDOWS\Tasks

2010-01-18 22:38:13 ----D---- C:\WINDOWS\Temp

2010-01-18 16:10:53 ----D---- C:\WINDOWS\system32\drivers

2010-01-18 15:41:41 ----D---- C:\WINDOWS\Debug

2010-01-18 03:12:27 ----D---- C:\Documents and Settings\yyy\Application Data\vlc

2010-01-18 03:10:34 ----D---- C:\Program Files\Common Files

2010-01-18 03:09:11 ----D---- C:\INSTALL

2010-01-18 00:25:19 ----D---- C:\Documents and Settings\yyy\Application Data\Adobe

2010-01-18 00:25:19 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe

2010-01-18 00:14:50 ----D---- C:\Program Files\Mozilla Firefox

2010-01-18 00:01:13 ----D---- C:\WINDOWS\system32\Lang

2010-01-17 07:29:49 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater

2010-01-13 06:24:47 ----D---- C:\WINDOWS\AppPatch

2010-01-13 06:20:28 ----SHD---- C:\WINDOWS\Installer

2010-01-13 06:20:28 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help

2010-01-13 06:19:47 ----RSHDC---- C:\WINDOWS\system32\dllcache

2010-01-13 06:19:44 ----HD---- C:\WINDOWS\$hf_mig$

2010-01-07 23:35:50 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-01-07 03:07:28 ----RSD---- C:\WINDOWS\Fonts

2010-01-07 03:07:23 ----D---- C:\Program Files\Common Files\Microsoft Shared

2010-01-07 03:07:00 ----D---- C:\Program Files\Microsoft Works

2010-01-07 03:05:10 ----A---- C:\WINDOWS\win.ini

2010-01-07 03:05:05 ----D---- C:\Program Files\Common Files\System

2010-01-07 03:03:18 ----D---- C:\WINDOWS\system32\en-us

2010-01-07 03:03:18 ----D---- C:\Program Files\Internet Explorer

2010-01-07 03:03:09 ----D---- C:\WINDOWS\ie7updates

2010-01-07 03:01:01 ----D---- C:\WINDOWS\WinSxS

2010-01-07 02:14:16 ----D---- C:\Program Files\ICQ6.5

2010-01-07 00:30:34 ----A---- C:\WINDOWS\NeroDigital.ini

2010-01-06 20:43:15 ----D---- C:\WINDOWS\Help

2010-01-06 16:43:13 ----D---- C:\Documents and Settings\yyy\Application Data\Skype

2010-01-06 16:40:43 ----D---- C:\Documents and Settings\yyy\Application Data\skypePM

2010-01-05 13:43:25 ----D---- C:\Program Files\Google

2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]

R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]

R2 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]

R3 fixustor;fixustor; C:\WINDOWS\system32\drivers\fixustor.sys [2004-05-11 6656]

R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]

R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]

R3 LCcfltr;Logitech USB Filter Driver; C:\WINDOWS\system32\drivers\lccfltr.sys [2004-03-03 14095]

R3 LHidKe;Logitech SetPoint HID Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidKE.Sys [2004-12-10 24704]

R3 LHidUsbK;Logitech SetPoint USB Receiver device driver; C:\WINDOWS\System32\Drivers\LHidUsbK.Sys [2004-12-10 36480]

R3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2004-12-10 68992]

R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]

R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]

R3 RT61;LevelOne WNC-0301 11g Wireless PCI Adapter Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2005-08-26 352768]

R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]

R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]

R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]

S1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]

S1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2004-10-14 4962]

S1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]

S1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]

S2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-11-15 20747]

S2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]

S2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]

S2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2004-07-21 9856]

S2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-04-23 44704]

S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]

S3 Asushwio;Asushwio; \??\C:\WINDOWS\system32\drivers\Asushwio.sys []

S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]

S3 camvid20;Philips ToUcam Camera; Video; C:\WINDOWS\system32\DRIVERS\camdrv21.sys [2001-08-17 223232]

S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]

S3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2004-08-31 26240]

S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-11-25 4064256]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]

S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]

S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]

S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]

S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-01-17 3530432]

S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]

S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]

S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]

S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]

S3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-03-30 230400]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

S2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2008-10-01 554264]

S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]

S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]

S2 gupdate1c99f04e43d720c;Google Update Service (gupdate1c99f04e43d720c); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-07 133104]

S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-08 183280]

S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]

S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-01-17 131139]

S2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-04-01 66872]

S2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-04-01 107832]

S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-11-18 68096]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]

S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
 

-----------------EOF-----------------

RSIT info.txt

Code:

info.txt logfile of random's system information tool 1.06 2010-01-19 02:52:48
 

======Uninstall list======
 

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

7-Zip 4.65-->"C:\Program Files\7-Zip\Uninstall.exe"

Acronis*True*Image*Home-->MsiExec.exe /X{37C8899D-FD70-481F-94AA-1F1B08765E22}

Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x7 

Adobe Reader 9.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A92000000001}

AIM 7-->C:\Program Files\AIM\uninst.exe

Amazon MP3-Downloader 1.0.5-->C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe

AsusUpdate-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\AsusUpdate\Uninst.isu"

avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup

Canon MP Navigator 3.0-->"C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini

Canon MP600 Benutzerregistrierung-->C:\Program Files\Canon\IJEREG\MP600\UNINST.EXE

Canon MP600-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600 /L0x0007

CCleaner-->"C:\Program Files\CCleaner\uninst.exe"

CDex extraction audio-->"C:\Program Files\CDex_170b2\uninstall.exe"

CloneCD-->"C:\Program Files\SlySoft\CloneCD\ccd-uninst.exe" /D="C:\Program Files\SlySoft\CloneCD"

CrazyTalk for Skype-->C:\Program Files\InstallShield Installation Information\{8865B208-4759-4308-8DB5-3C18D2F568E2}\setup.exe -runfromtemp -l0x0007 -removeonly /remove

Download Updater (AOL LLC)-->C:\Program Files\Common Files\Software Update Utility\uninstall.exe

Easy-WebPrint-->C:\WINDOWS\IsUn0407.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"

Free Audio CD Burner version 1.2-->"C:\Program Files\DVDVideoSoft\Free Audio CD Burner\unins000.exe"

Free YouTube to MP3 Converter version 3.2-->"C:\Program Files\DVDVideoSoft\Free YouTube to MP3 Converter\unins000.exe"

Genesys USB Mass Storage Device-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B4BF87C8-3EEC-4774-82A2-584F109187B1}\Setup.exe" 

Google Earth-->MsiExec.exe /X{C084BC61-E537-11DE-8616-005056806466}

Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Google Updater-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall

High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"

HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"

ICQ6.5-->"C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly

IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe

Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}

Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}

Last.fm 1.5.4.24567-->"C:\Program Files\Last.fm\unins000.exe"

LevelOne 11g Wireless LAN Card-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{39350A99-75A4-4FD5-8E68-37D4C92F73D2}\setup.exe" -l0x9  -removeonly

Logitech iTouch Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{036AA4D4-6D32-11D4-9875-00105ACE7734}\Setup.exe" -l0x7  UNINSTALL

Logitech SetPoint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x7  -removeonly

Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}

Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}

Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"

Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0407-0000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}

Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}

Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL

Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}

Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}

Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}

Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}

Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}

Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}

Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}

Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0410-0000-0000000FF1CE} /uninstall {322296D4-1EAE-4030-9FBC-D2787EB25FA2}

Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}

Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}

Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}

Mozilla Firefox (3.0.17)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

MSN BackUp 1.3.3-->C:\Program Files\MSN BackUp\uninst.exe

MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}

Nero 6 Ultra Edition-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI

PC Probe II-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F7338FA3-DAB5-49B2-900D-0AFB5760C166}\setup.exe" -l0x9 

PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u

Quake Live Mozilla Plugin-->MsiExec.exe /I{8CADD3F6-E808-4D48-893D-797B4849DE72}

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x7  -removeonly 

ScanSoft OmniPage SE 4.0-->MsiExec.exe /I{29D851C2-048C-4B5E-8D1F-25D473342BB5}

Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}

Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}

Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}

Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}

Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}

Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}

Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}

Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}

Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}

Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}

Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}

Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB974455)-->"C:\WINDOWS\ie7updates\KB974455-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB976325)-->"C:\WINDOWS\ie7updates\KB976325-IE7\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"

Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf

Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"

Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"

Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"

Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"

Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"

Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"

Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"

Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"

Security Update for Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"

Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}

Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}

Ulead GIF Animator Lite Edition 1.0-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ulead GIF Animator Lite Edition\GALE.isu"

Uninstall 1.0.0.1-->"C:\Program Files\Common Files\DVDVideoSoft\unins000.exe"

Unreal Tournament G.O.T.Y. Edition-->C:\UnrealTournament\System\Setup.exe uninstall "UnrealTournament"

Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""

Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}

Update for Outlook 2007 Junk Email Filter (kb977839)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C568005C-5FC6-4C81-A664-BD136610A931}

Update for Windows Internet Explorer 7 (KB976749)-->"C:\WINDOWS\ie7updates\KB976749-IE7\spuninst\spuninst.exe"

Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"

Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"

Update for Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"

Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"

Update for Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"

Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"

Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"

Update for Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"

Update for Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"

Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"

VLC media player 1.0.0-->C:\Program Files\VideoLAN\VLC\uninstall.exe

Winamp-->"C:\Program Files\Winamp\UninstWA.exe"

Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"

Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}

Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}

Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}

Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe

Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}

Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}

Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}

Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}

Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

WinRAR-->C:\Program Files\WinRAR\uninstall.exe

WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}

xp-AntiSpy 3.97-->C:\Program Files\xp-AntiSpy\Uninstall.exe
 

======Security center information======
 

AV: Malware Defense (outdated)

AV: avast! antivirus 4.8.1368 [VPS 100117-1]
 

======System event log======
 

Computer Name: xxx

Event Code: 1003

Message: Your computer was not able to renew its address from the network (from the

DHCP Server) for the Network Card with network address 00116B375180.  The following

error occurred: 

The operation was canceled by the user.

.

Your computer will continue to try and obtain an address on its own from

the network address (DHCP) server.
 

Record Number: 12306

Source Name: Dhcp

Time Written: 20091027151443.000000+060

Event Type: warning

User: 
 

Computer Name: xxx

Event Code: 6161

Message: The document Microsoft Word - Rhetorik Fragenkatolog SS2009.docx owned by yyy failed to print on printer Canon MP600 Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 1324664. Number of bytes printed: 45992. Total number of pages in the document: 17. Number of pages printed: 0. Client machine: \\xxx. Win32 error code returned by the print processor: 13 (0xd). 
 

Record Number: 12270

Source Name: Print

Time Written: 20091027054436.000000+060

Event Type: error

User: xxx\yyy
 

Computer Name: xxx

Event Code: 1003

Message: Your computer was not able to renew its address from the network (from the

DHCP Server) for the Network Card with network address 00116B375180.  The following

error occurred: 

The operation was canceled by the user.

.

Your computer will continue to try and obtain an address on its own from

the network address (DHCP) server.
 

Record Number: 12038

Source Name: Dhcp

Time Written: 20091025230656.000000+060

Event Type: warning

User: 
 

Computer Name: xxx

Event Code: 1003

Message: Your computer was not able to renew its address from the network (from the

DHCP Server) for the Network Card with network address 00116B375180.  The following

error occurred: 

The operation was canceled by the user.

.

Your computer will continue to try and obtain an address on its own from

the network address (DHCP) server.
 

Record Number: 12027

Source Name: Dhcp

Time Written: 20091025193435.000000+060

Event Type: warning

User: 
 

Computer Name: xxx

Event Code: 1003

Message: Your computer was not able to renew its address from the network (from the

DHCP Server) for the Network Card with network address 00116B375180.  The following

error occurred: 

The operation was canceled by the user.

.

Your computer will continue to try and obtain an address on its own from

the network address (DHCP) server.
 

Record Number: 12000

Source Name: Dhcp

Time Written: 20091025180647.000000+060

Event Type: warning

User: 
 

=====Application event log=====
 

Computer Name: xxx

Event Code: 20

Message: 

Record Number: 3966

Source Name: Google Update

Time Written: 20090430173750.000000+120

Event Type: error

User: NT AUTHORITY\SYSTEM
 

Computer Name: xxx

Event Code: 20

Message: 

Record Number: 3965

Source Name: Google Update

Time Written: 20090430164200.000000+120

Event Type: error

User: NT AUTHORITY\SYSTEM
 

Computer Name: xxx

Event Code: 20

Message: 

Record Number: 3956

Source Name: Google Update

Time Written: 20090427163229.000000+120

Event Type: error

User: NT AUTHORITY\SYSTEM
 

Computer Name: xxx

Event Code: 20

Message: 

Record Number: 3955

Source Name: Google Update

Time Written: 20090427153238.000000+120

Event Type: error

User: NT AUTHORITY\SYSTEM
 

Computer Name: xxx

Event Code: 20

Message: 

Record Number: 3903

Source Name: Google Update

Time Written: 20090425132411.000000+120

Event Type: error

User: NT AUTHORITY\SYSTEM
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=15

"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 7, GenuineIntel

"PROCESSOR_REVISION"=0407

"NUMBER_OF_PROCESSORS"=2

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"SAFEBOOT_OPTION"=NETWORK
 

-----------------EOF-----------------

GMER Log:

Code:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-01-19 21:52:23

Windows 5.1.2600 Service Pack 3

Running: txqp99fn.exe; Driver: C:\DOCUME~1\ADMINI~1.000\LOCALS~1\Temp\kxrdypow.sys
 
 

---- System - GMER 1.0.15 ----
 

Code            8A9DC960                                                                                                                                   ZwEnumerateKey

Code            8A9DC928                                                                                                                                   ZwFlushInstructionCache

Code            8AC06B16                                                                                                                                   IofCallDriver

Code            8ABBE836                                                                                                                                   IofCompleteRequest
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntoskrnl.exe!IofCallDriver                                                                                                                 804E13A7 5 Bytes  JMP 8AC06B1B 

.text           ntoskrnl.exe!IofCompleteRequest                                                                                                            804E17BD 5 Bytes  JMP 8ABBE83B 

PAGE            ntoskrnl.exe!ZwEnumerateKey                                                                                                                80578E14 5 Bytes  JMP 8A9DC964 

PAGE            ntoskrnl.exe!ZwFlushInstructionCache                                                                                                       80587BFB 5 Bytes  JMP 8A9DC92C 

init            C:\WINDOWS\system32\drivers\fixustor.sys                                                                                                   entry point in "init" section [0xF79BDFE6]
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Documents and Settings\Administrator.VALAFOR.000\Desktop\txqp99fn.exe[796] kernel32.dll!CreateProcessW                                  7C802336 5 Bytes  JMP 00CD000A 

.text           C:\WINDOWS\system32\services.exe[892] kernel32.dll!CreateProcessW                                                                          7C802336 5 Bytes  JMP 0087000A 

.text           C:\WINDOWS\system32\lsass.exe[904] kernel32.dll!CreateProcessW                                                                             7C802336 5 Bytes  JMP 0091000A 

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!DialogBoxParamW                                                           7E4247AB 5 Bytes  JMP 3E1DF4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!DialogBoxIndirectParamW                                                   7E432072 5 Bytes  JMP 3E352056 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!MessageBoxIndirectA                                                       7E43A082 5 Bytes  JMP 3E351FD7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!DialogBoxParamA                                                           7E43B144 5 Bytes  JMP 3E35201B C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!MessageBoxExW                                                             7E450838 5 Bytes  JMP 3E351F63 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!MessageBoxExA                                                             7E45085C 5 Bytes  JMP 3E351F9D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!DialogBoxIndirectParamA                                                   7E456D7D 5 Bytes  JMP 3E352091 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] USER32.dll!MessageBoxIndirectW                                                       7E4664D5 5 Bytes  JMP 3E2017EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] ole32.dll!OleLoadFromStream                                                          77529C85 5 Bytes  JMP 3E352253 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!HttpAddRequestHeadersA                                                   3D94632F 5 Bytes  JMP 00C8000A 

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!HttpOpenRequestA                                                         3D94AA7B 2 Bytes  JMP 00D7000A 

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!HttpOpenRequestA + 3                                                     3D94AA7E 2 Bytes  [42, C3] {INC EDX; RET }

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!InternetConnectA                                                         3D94B0D2 5 Bytes  JMP 00D9000A 

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!InternetConnectW                                                         3D94C2C0 5 Bytes  JMP 00D8000A 

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!HttpOpenRequestW                                                         3D94C49A 5 Bytes  JMP 00D6000A 

.text           C:\Program Files\Internet Explorer\iexplore.exe[1488] WININET.dll!HttpAddRequestHeadersW                                                   3D9AA4C5 5 Bytes  JMP 00D5000A 

.text           C:\WINDOWS\Explorer.EXE[1688] kernel32.dll!CreateProcessW                                                                                  7C802336 5 Bytes  JMP 00CE000A 

.text           C:\WINDOWS\system32\ctfmon.exe[1964] kernel32.dll!CreateProcessW                                                                           7C802336 5 Bytes  JMP 00B7000A 
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                                     tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                   aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                  aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                                     tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                                     sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                                     tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                                     sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                                     tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                                     sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                  aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                                aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                   tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
 

---- Modules - GMER 1.0.15 ----
 

Module          \systemroot\system32\drivers\H8SRTvyqqjixbir.sys (*** hidden *** )                                                                         BAAE6000-BAB03000 (118784 bytes)                                                                          

---- Processes - GMER 1.0.15 ----
 

Library         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [840]                          0x10000000                                                                                                

Library         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1144]                          0x00860000                                                                                                

Library         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1256]                          0x00860000                                                                                                

Library         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1288]                          0x00860000                                                                                                

Library         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1384]                          0x00860000                                                                                                

Library         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\iexplore.exe [1488]          0x00E00000                                                                                                
 

---- Services - GMER 1.0.15 ----
 

Service         C:\WINDOWS\system32\drivers\H8SRTvyqqjixbir.sys (*** hidden *** )                                                                          [SYSTEM] H8SRTd.sys                                                                                        <-- ROOTKIT !!!
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys                                                                                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start                                                                                    1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type                                                                                     1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath                                                                                \systemroot\system32\drivers\H8SRTvyqqjixbir.sys

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group                                                                                    file system

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules                                                                                  

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd                                                                           \\?\globalroot\systemroot\system32\drivers\H8SRTvyqqjixbir.sys

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc                                                                           \\?\globalroot\systemroot\system32\H8SRTmodpojnykp.dll

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr                                                                        \\?\globalroot\systemroot\system32\H8SRTuyvtjcxvkm.dat

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf                                                                        \\?\globalroot\systemroot\system32\H8SRTxxyuyrpjop.dll

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtmsg                                                                         \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll

Reg             HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr                                                                         \\?\globalroot\systemroot\system32\H8SRTuimxowpxub.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys (not active ControlSet)                                                                      

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start                                                                                        1

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type                                                                                         1

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath                                                                                    \systemroot\system32\drivers\H8SRTvyqqjixbir.sys

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group                                                                                        file system

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)                                                              

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd                                                                               \\?\globalroot\systemroot\system32\drivers\H8SRTvyqqjixbir.sys

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc                                                                               \\?\globalroot\systemroot\system32\H8SRTmodpojnykp.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr                                                                            \\?\globalroot\systemroot\system32\H8SRTuyvtjcxvkm.dat

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf                                                                            \\?\globalroot\systemroot\system32\H8SRTxxyuyrpjop.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtmsg                                                                             \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtbbr                                                                             \\?\globalroot\systemroot\system32\H8SRTuimxowpxub.dll
 

---- Files - GMER 1.0.15 ----
 

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temp\h8srtmainqt.dll                                                    16459 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\45IXI7OX\errorPageStrings[1]       850 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\ER45QFY5\dnserror[1]               0 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\ER45QFY5\down[2]                   3414 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\PF4JPBA7\ErrorPageTemplate[2]      2168 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\PF4JPBA7\background_gradient[1]    453 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\PF4JPBA7\tools[2]                  3560 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\QDC2TZN6\bullet[2]                 3169 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\QDC2TZN6\favcenter[1]              3366 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\QDC2TZN6\httpErrorPagesScripts[2]  7579 bytes

File            C:\Documents and Settings\Administrator.xxx.000\Local Settings\Temporary Internet Files\Content.IE5\QDC2TZN6\info_48[2]                6993 bytes

File            C:\Documents and Settings\yyy\Local Settings\Temp\h8srtmainqt.dll                                                                       16697 bytes

File            C:\WINDOWS\system32\drivers\H8SRTvyqqjixbir.sys                                                                                            40448 bytes executable                                                                                     <-- ROOTKIT !!!

File            C:\WINDOWS\system32\H8SRTbayxyidchu.dll                                                                                                    16896 bytes executable

File            C:\WINDOWS\system32\h8srtkrl32mainweq.dll                                                                                                  1063 bytes

File            C:\WINDOWS\system32\H8SRTmodpojnykp.dll                                                                                                    23552 bytes executable

File            C:\WINDOWS\system32\h8srtshsyst.dll                                                                                                        524 bytes

File            C:\WINDOWS\system32\H8SRTuimxowpxub.dll                                                                                                    40960 bytes executable

File            C:\WINDOWS\system32\H8SRTuyvtjcxvkm.dat                                                                                                    237 bytes

File            C:\WINDOWS\system32\H8SRTxxyuyrpjop.dll                                                                                                    40960 bytes executable

File            C:\WINDOWS\Temp\H8SRT82dd.tmp                                                                                                              237 bytes

File            C:\WINDOWS\Temp\H8SRT8723.tmp                                                                                                              40960 bytes executable

File            C:\WINDOWS\Temp\H8SRT8a4f.tmp                                                                                                              40960 bytes executable
 

---- EOF - GMER 1.0.15 ----

@sensurround:

Hi,
Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

C:\WINDOWS\system32\umonit.exe

C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Achtung: Da ist neben Malware Defence auch noch was neues drauf, was beim Beseitigen schon einige Rechner zerschossen hat!

Zuerst versucht ihr MAM zu installieren, dazu benennt es bereits im Downloaddialog auf
z.B. Test.exe um. Startet es nach der Installation nicht, wartet bis Avenger den
Rootkit "ausgeknippst" hat und lasst es dann sofort laufen (nach dem Update der Signaturen!)

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html
Falls MAM bereits installiert ist, weiter mit Avenger...

Also:
Anleitung Avenger (by swandog46)

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop (Alternativer Downloadlink: http://www.file-upload.net/download-..._le.exe.html):

http://saved.im/mzi3ndg3nta0/aven.jpg

2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist.

Kopiere nun folgenden Text in das weiße Feld:
(bei -> "input script here")

Code:

Drivers to delete:

H8SRTd.sys

 

Files to delete:

C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe

C:\WINDOWS\system32\h8srtkrl32mainweq.dllC:\WINDOWS\system32\H8SRTmodpojnykp.dll

C:\WINDOWS\system32\h8srtshsyst.dll

C:\WINDOWS\system32\H8SRTuimxowpxub.dll

C:\WINDOWS\system32\H8SRTuyvtjcxvkm.dat

C:\WINDOWS\system32\H8SRTxxyuyrpjop.dll

C:\WINDOWS\Temp\H8SRT82dd.tmp

C:\WINDOWS\Temp\H8SRT8723.tmp

C:\WINDOWS\Temp\H8SRT8a4f.tmp  
 

Folders to delete:

C:\DOCUME~1\yyy\LOCALS~1\Temp

C:\Program Files\Malware Defense

3.) Schliesse nun alle Programme (vorher notfalls abspeichern!) und Browser-Fenster, nach dem Ausführen des Avengers wird das System neu gestartet.

4.) Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet!

5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt
Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

Hijackthis, fixen:
öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten
Beim fixen müssen alle Programme geschlossen sein!
(Falls vorhanden, Teatimer von Spyboot wie folgt deaktivieren:
Modus-->Erweiterte Modus-->Ja-->Werkzeuge-->Resident-->dHäkchen entfernen aus der "Resident "TeaTimer" (Schutz aller Systemeinstellungen)->exit)

Code:

O4 - HKCU\..\Run: [cls_pack.exe] C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe

Zu MAM kommen wir noch:
Nun bitte sofort MAM starten, Fullscann und alles bereinigen lassen, Log posten:
Startet MAM immer noch nicht, in das Installationsverzeichnis von MAM wechseln und die EXE von MAM (mbam.exe)
auf z. B. test.exe umbenennen und durch Doppelklick starten. Nach Beendigung des Scanns (und MAM) nennt ihr sie
auf den ursprünglichen Namen (mbam.exe) zurück.

chris

Hi Chris!
Sorry für die späte Antwort, hab aufgrund Prüfungen an der Uni keine Zeit zum fixen gehabt. Folgendes hab ich vorhin hinbekommen:

1.Ordneroptionen wie bei Punnkt 1 umgestellt
2.Log von VirusTotal für umonit.exe:

Code:



https://www.virustotal.com/de/analisis/2e9cb310104f5b572310e7743e4db7a19cdebe38972618e3a824e5062b374315-1259605361
 

....
 
 

 Datei umonit.exe empfangen 2010.02.15 13:45:27 (UTC)

Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt

Ergebnis: 0/41 (0%)

Laden der Serverinformationen...

Ihre Datei wartet momentan auf Position: 4.

Geschätzte Startzeit ist zwischen 62 und 88 Sekunden.

Dieses Fenster bis zum Abschluss des Scans nicht schließen.

Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen.

Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut.

Ihre Datei wird momentan von VirusTotal überprüft,

Ergebnisse werden sofort nach der Generierung angezeigt.

Filter Filter

Drucken der Ergebnisse Drucken der Ergebnisse

Datei existiert nicht oder dessen Lebensdauer wurde überschritten

Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet.
 

SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist.

Email:         

        

Antivirus         Version         letzte aktualisierung         Ergebnis

a-squared        4.5.0.50        2010.02.15        -

AhnLab-V3        5.0.0.2        2010.02.15        -

AntiVir        7.9.1.170        2010.02.15        -

Antiy-AVL        2.0.3.7        2010.02.15        -

Authentium        5.2.0.5        2010.02.15        -

Avast        4.8.1351.0        2010.02.15        -

AVG        9.0.0.730        2010.02.15        -

BitDefender        7.2        2010.02.15        -

CAT-QuickHeal        10.00        2010.02.15        -

ClamAV        0.96.0.0-git        2010.02.15        -

Comodo        3944        2010.02.15        -

DrWeb        5.0.1.12222        2010.02.15        -

eSafe        7.0.17.0        2010.02.14        -

eTrust-Vet        35.2.7303        2010.02.15        -

F-Prot        4.5.1.85        2010.02.15        -

F-Secure        9.0.15370.0        2010.02.15        -

Fortinet        4.0.14.0        2010.02.15        -

GData        19        2010.02.15        -

Ikarus        T3.1.1.80.0        2010.02.15        -

Jiangmin        13.0.900        2010.02.15        -

K7AntiVirus        7.10.972        2010.02.12        -

Kaspersky        7.0.0.125        2010.02.15        -

McAfee        5892        2010.02.14        -

McAfee+Artemis        5892        2010.02.14        -

McAfee-GW-Edition        6.8.5        2010.02.15        -

Microsoft        1.5406        2010.02.15        -

NOD32        4867        2010.02.15        -

Norman        6.04.08        2010.02.15        -

nProtect        2009.1.8.0        2010.02.15        -

Panda        10.0.2.2        2010.02.14        -

PCTools        7.0.3.5        2010.02.15        -

Prevx        3.0        2010.02.15        -

Rising        22.34.01.03        2010.02.11        -

Sophos        4.50.0        2010.02.15        -

Sunbelt        5678        2010.02.15        -

Symantec        20091.2.0.41        2010.02.15        -

TheHacker        6.5.1.4.194        2010.02.15        -

TrendMicro        9.120.0.1004        2010.02.15        -

VBA32        3.12.12.2        2010.02.15        -

ViRobot        2010.2.13.2186        2010.02.13        -

VirusBuster        5.0.21.0        2010.02.15        -

weitere Informationen

File size: 53248 bytes

MD5...: 21704b5919e79397a345a0a817941bcf

SHA1..: bc238780f1cce335bb9378480da159eafbf00e40

SHA256: 2e9cb310104f5b572310e7743e4db7a19cdebe38972618e3a824e5062b374315

ssdeep: 768:wCWvtBRxqqEvTNIHgu5a/T2q/Dgp+Mz3JWN9o8uUWSWX:wdGRIAJ/T2qLgp+

Mz3Jco739X

PEiD..: -

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x67e0

timedatestamp.....: 0x40a065ee (Tue May 11 05:34:38 2004)

machinetype.......: 0x14c (I386)
 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x5c12 0x6000 6.10 c300189079229ce9378a7108039869c9

.rdata 0x7000 0x15c2 0x2000 3.94 f6c573d52b0d60c771595decf78af406

.data 0x9000 0x4c0 0x1000 1.63 37579b8192d2d73745d176bf9a9212a9

.rsrc 0xa000 0x2760 0x3000 2.95 1b92afbe94ab9de1a0fbb94c7289b2b3
 

( 10 imports )

> KERNEL32.dll: GetWindowsDirectoryA, GetModuleHandleA, MultiByteToWideChar, lstrlenW, LoadLibraryA, GetDiskFreeSpaceA, WaitForSingleObject, ResetEvent, GetStartupInfoA, GetProcAddress, lstrcpynA, lstrlenA, FreeLibrary, GetVersionExA, CreateFileA, GetSystemDirectoryA, OutputDebugStringA, GetLastError, CreateMutexA, CloseHandle, DeviceIoControl, CreateEventA

> USER32.dll: RegisterDeviceNotificationA, PostQuitMessage, PostMessageA, AppendMenuA, ModifyMenuA, KillTimer, LoadMenuA, GetSubMenu, SetForegroundWindow, GetParent, GetCursorPos, wsprintfA, EnableWindow, GetDesktopWindow, SetTimer

> ADVAPI32.dll: RegOpenKeyA, RegQueryValueExA, RegCloseKey, RegEnumKeyA, RegCreateKeyExA, RegSetValueExA

> SHELL32.dll: SHGetSpecialFolderLocation, Shell_NotifyIconA, SHGetFileInfoA, SHGetMalloc, SHGetDesktopFolder, SHChangeNotify

> SHLWAPI.dll: SHDeleteKeyA

> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -

> MSVCRT.dll: _setmbcp, _exit, _XcptFilter, _onexit, _acmdln, __getmainargs, _adjust_fdiv, _initterm, __setusermatherr, __set_app_type, __p__commode, __p__fmode, _controlfp, _except_handler3, exit, malloc, free, __dllonexit, __CxxFrameHandler, strstr, _strlwr, _strupr, strncat, sprintf, _purecall, fclose, strncpy, strncmp, strtoul, strchr, fgets, fopen

> CFGMGR32.dll: CM_Open_DevNode_Key, CM_Get_Sibling, CM_Get_Child, CM_Disable_DevNode, CM_Remove_SubTree, CM_Query_Remove_SubTree, CM_Get_Device_IDA

> SETUPAPI.dll: SetupFindFirstLineA, SetupOpenInfFileA, SetupDiSetDeviceRegistryPropertyA, SetupFindNextLine, SetupCloseInfFile, SetupGetStringFieldA, SetupDiCallClassInstaller, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyA, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, SetupDiSetClassInstallParamsA, SetupDiClassGuidsFromNameA
 

( 0 exports )

RDS...: NSRL Reference Data Set

-

pdfid.: -

trid..: Win64 Executable Generic (58.7%)

Win32 Executable MS Visual C++ (generic) (25.8%)

Win32 Executable Generic (5.8%)

Win32 Dynamic Link Library (generic) (5.2%)

Win32 Executable MS Visual FoxPro 7 (1.5%)

sigcheck:

publisher....: General

copyright....: Copyright (C) 2000-2004

product......: Gene USB Monitor

description..: Gene USB Monitor

original name: USBMonit.exe

internal name: USBMonitor

file version.: 1, 2, 9, 0

comments.....:

signers......: -

signing date.: -

verified.....: Unsigned

3.Als ich cls_pack.exe zum prüfen hochladen wollte, kam access denied, hab nach der Datei gesucht - es wurde nichts gefunden und den Temp-Ordner konnte ich ebenfalls nicht manuell öffnen da kein Zugriffsrecht.

4.Avenger Log:

Code:

Logfile of The Avenger Version 2.0, (c) by Swandog46

http://swandog46.geekstogo.com
 

Platform:  Windows XP
 

*******************
 

Script file opened successfully.

Script file read successfully.
 

Backups directory opened successfully at C:\Avenger
 

*******************
 

Beginning to process script file:
 

Rootkit scan active.

No rootkits found!
 
 

Error:  registry key "\Registry\Machine\System\CurrentControlSet\Services\H8SRTd.sys" not found!

Deletion of driver "H8SRTd.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe" not found!

Deletion of file "C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  could not open file "C:\WINDOWS\system32\h8srtkrl32mainweq.dllC:\WINDOWS\system32\H8SRTmodpojnykp.dll"

Deletion of file "C:\WINDOWS\system32\h8srtkrl32mainweq.dllC:\WINDOWS\system32\H8SRTmodpojnykp.dll" failed!

Status: 0xc0000033 (STATUS_OBJECT_NAME_INVALID)

  --> an object cannot have this name
 
 

Error:  file "C:\WINDOWS\system32\h8srtshsyst.dll" not found!

Deletion of file "C:\WINDOWS\system32\h8srtshsyst.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\system32\H8SRTuimxowpxub.dll" not found!

Deletion of file "C:\WINDOWS\system32\H8SRTuimxowpxub.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\system32\H8SRTuyvtjcxvkm.dat" not found!

Deletion of file "C:\WINDOWS\system32\H8SRTuyvtjcxvkm.dat" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\system32\H8SRTxxyuyrpjop.dll" not found!

Deletion of file "C:\WINDOWS\system32\H8SRTxxyuyrpjop.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\Temp\H8SRT82dd.tmp" not found!

Deletion of file "C:\WINDOWS\Temp\H8SRT82dd.tmp" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\Temp\H8SRT8723.tmp" not found!

Deletion of file "C:\WINDOWS\Temp\H8SRT8723.tmp" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Error:  file "C:\WINDOWS\Temp\H8SRT8a4f.tmp" not found!

Deletion of file "C:\WINDOWS\Temp\H8SRT8a4f.tmp" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 

Folder "C:\DOCUME~1\Blazin\LOCALS~1\Temp" deleted successfully.
 

Error:  folder "C:\Program Files\Malware Defense" not found!

Deletion of folder "C:\Program Files\Malware Defense" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

  --> the object does not exist
 
 

Completed script processing.
 

*******************
 

Finished!  Terminate.

5.MAM install hat geklappt, bei Hijackthis ergab sich jedoch das nächste Problem:

Code:

O4 - HKCU\..\Run: [cls_pack.exe] C:\DOCUME~1\yyy\LOCALS~1\Temp\cls_pack.exe

war garnicht in der Liste vorhanden, siehe Screenie:
http://i117.photobucket.com/albums/o57/blasmich/kein_cls_pack_da.jpg

Stattdessen stieß ich hier auf zwei Verdächtige, die ich zuvor als ich kurz im Normalen Windows Modus im Taskmanager unter Prozesse kurz gesehen hatte (bevor sich wieder alles aufhing):
http://i117.photobucket.com/albums/o57/blasmich/stattdessenverdaechtig.jpg

gefixt hab ich mit Avenger erstmal garnix.
MAM hab ich auch noch nicht angeschmissen, da ich net weiß ob das ohne Abschluss der bisher nicht korrekt durchgeführten Schritte gut/schlecht/nötig/wwi ist.

und nu?

Merci & VG
Isa

Hi,

das ist seltsam, der Rootkit ist verschwunden...?

Lass MAM mal von der Leine und danach bitte noch mal ein neues RSIT-Log und GMER-Log.

Die Dateien die Du meinst sind im Normalfall ungefährlich...

chris

Hi Chris!

Here we go again:

RSIT hat nur HijackThis gestartet, weiter kam nichts - warum auch immer oO

HijackThis-Log:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:01:51, on 25.03.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Safe mode with network support
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\Administrator.VALAFOR.000\Desktop\RSIT.exe

C:\Documents and Settings\Administrator.VALAFOR.000\Desktop\Administrator.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.rivalnetwork.cn/ac.php?aid=285&sid=new

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\umonit.exe

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Levelone Wireless Utility.lnk = C:\Program Files\LevelOne\Common\RaUI.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1226788575796

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226788481437

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Update Service (gupdate1c99f04e43d720c) (gupdate1c99f04e43d720c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
 

--

End of file - 8922 bytes

GMER-Log

Code:

GMER 1.0.15.15281 - hxxp://www.gmer.net

Rootkit scan 2010-03-25 15:00:52

Windows 5.1.2600 Service Pack 3

Running: sqbf898o.exe; Driver: C:\DOCUME~1\ADMINI~1.000\LOCALS~1\Temp\kxrdypow.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

init            C:\WINDOWS\system32\drivers\fixustor.sys                                       entry point in "init" section [0xF79BBFE6]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                         tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                       aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                      aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                         tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                         sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                         tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                         sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                         tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                         sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                      aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                    aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice  \FileSystem\Fastfat \Fat                                                       tdrpm139.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start                            1

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type                             1

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath                        \systemroot\system32\drivers\H8SRTvyqqjixbir.sys

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group                            file system

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd                   \\?\globalroot\systemroot\system32\drivers\H8SRTvyqqjixbir.sys

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc                   \\?\globalroot\systemroot\system32\H8SRTmodpojnykp.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr                \\?\globalroot\systemroot\system32\H8SRTuyvtjcxvkm.dat

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf                \\?\globalroot\systemroot\system32\H8SRTxxyuyrpjop.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtmsg                 \\?\globalroot\systemroot\system32\H8SRTbayxyidchu.dll

Reg             HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtbbr                 \\?\globalroot\systemroot\system32\H8SRTuimxowpxub.dll
 

---- EOF - GMER 1.0.15 ----

hoffe, du kannst auch diesmal damit was anfangen ;___;

VG Isa

Hi,

hah, sieh an, ein alter Bekannter...

Da ist TDSS auf dem Rechner, in einer der "letzten funktionierende Konfigurationen"...

Combofix
Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Antivierenlösung komplett auschalten und zwar so, dass sie sich auch nach einem Reboot NICHT einschaltet! Das ist ein Sicherheitsmaßnahme, normalerweise erledigt das CF selbst...

Achtung: In einigen wenigen Fällen kann es vorkommen, das der Rechner nicht mehr booten kann und Neuaufgesetzt werden muß!

Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen.

Als letztes dann bitte noch ein OSAM-Log...

OSAM
Prüft Programme/Treiber die gestartet werden online.
Folge den Anweisungen hier ( http://www.trojaner-board.de/84180-a...n-manager.html ) zur Erstellung eines Logs und poste das hier in Deinem Thread.

chris
Ps.: Was ist das für ein Prozess:
C:\Documents and Settings\Administrator.VALAFOR.000\Desktop\Administrator.exe

Bitte bei Virustotal.com prüfen lassen... Log posten....

hi chris,

analyse log der admin.exe datei:

Code:



 Datei Administrator.exe empfangen 2010.04.04 14:25:23 (UTC)

Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt

Ergebnis: 0/42 (0%)

Laden der Serverinformationen...

Ihre Datei wartet momentan auf Position: 1.

Geschätzte Startzeit ist zwischen 42 und 60 Sekunden.

Dieses Fenster bis zum Abschluss des Scans nicht schließen.

Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen.

Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut.

Ihre Datei wird momentan von VirusTotal überprüft,

Ergebnisse werden sofort nach der Generierung angezeigt.

Filter Filter

Drucken der Ergebnisse Drucken der Ergebnisse

Datei existiert nicht oder dessen Lebensdauer wurde überschritten

Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet.
 

SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist.

Email:         

        

Antivirus         Version         letzte aktualisierung         Ergebnis

a-squared        4.5.0.50        2010.04.04        -

AhnLab-V3        5.0.0.2        2010.04.03        -

AntiVir        7.10.6.24        2010.04.03        -

Antiy-AVL        2.0.3.7        2010.04.02        -

Authentium        5.2.0.5        2010.04.04        -

Avast        4.8.1351.0        2010.04.04        -

Avast5        5.0.332.0        2010.04.04        -

AVG        9.0.0.787        2010.04.04        -

BitDefender        7.2        2010.04.04        -

CAT-QuickHeal        10.00        2010.04.03        -

ClamAV        0.96.0.0-git        2010.04.03        -

Comodo        4497        2010.04.04        -

DrWeb        5.0.2.03300        2010.04.04        -

eSafe        7.0.17.0        2010.04.01        -

eTrust-Vet        35.2.7405        2010.04.02        -

F-Prot        4.5.1.85        2010.04.04        -

F-Secure        9.0.15370.0        2010.04.03        -

Fortinet        4.0.14.0        2010.04.04        -

GData        19        2010.04.04        -

Ikarus        T3.1.1.80.0        2010.04.04        -

Jiangmin        13.0.900        2010.04.04        -

K7AntiVirus        7.10.1004        2010.03.22        -

Kaspersky        7.0.0.125        2010.04.04        -

McAfee        5937        2010.03.31        -

McAfee+Artemis        5937        2010.03.31        -

McAfee-GW-Edition        6.8.5        2010.04.03        -

Microsoft        1.5605        2010.04.04        -

NOD32        4998        2010.04.04        -

Norman        6.04.10        2010.04.03        -

nProtect        2009.1.8.0        2010.04.04        -

Panda        10.0.2.2        2010.04.04        -

PCTools        7.0.3.5        2010.04.04        -

Prevx        3.0        2010.04.04        -

Rising        22.41.04.05        2010.04.02        -

Sophos        4.52.0        2010.04.04        -

Sunbelt        6136        2010.04.04        -

Symantec        20091.2.0.41        2010.04.04        -

TheHacker        6.5.2.0.252        2010.04.04        -

TrendMicro        9.120.0.1004        2010.04.04        -

VBA32        3.12.12.4        2010.04.02        -

ViRobot        2010.4.3.2259        2010.04.04        -

VirusBuster        5.0.27.0        2010.04.04        -

weitere Informationen

File size: 401720 bytes

MD5...: e8269245566be948f6a219135b434160

SHA1..: 1ac255b76ef692ea6c09d4840dcd28c67c5d6bfe

SHA256: 3c253bfd385c7f245f3c6131e58cbe22c0d03073a828b9938f923f00562d7c2d

ssdeep: 6144:KCjUfQ7DbE66sVHdkyUkEYn+nVewn+ob/xIytqi20dcUSGreicGGSzMZY:K

CjUSbEAVG95YnNsr2ytL2cc3Gr1

PEiD..: -

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x142830

timedatestamp.....: 0x466838c1 (Thu Jun 07 16:56:33 2007)

machinetype.......: 0x14c (I386)
 

( 3 sections )

name viradd virsiz rawdsiz ntrpy md5

UPX0 0x1000 0xfc000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

UPX1 0xfd000 0x46000 0x45a00 7.93 8764d7eac0301131e6c79e4aa30317bf

.rsrc 0x143000 0x1b000 0x1ae00 4.69 5f1a0873640fcdb4a281dbf91049814f
 

( 2 imports )

> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess

> MSVBVM60.DLL: -
 

( 0 exports )

RDS...: NSRL Reference Data Set

-

pdfid.: -

trid..: UPX compressed Win32 Executable (39.5%)

Win32 EXE Yoda's Crypter (34.3%)

Win32 Executable Generic (11.0%)

Win32 Dynamic Link Library (generic) (9.8%)

Generic Win/DOS Executable (2.5%)

packers (Kaspersky): PE_Patch.UPX, UPX

packers (F-Prot): UPX

sigcheck:

publisher....: Trend Micro Inc.

copyright....: (c) 2007 Trend Micro Inc

product......: HijackThis

description..: HijackThis

original name: HijackThis.exe

internal name: HijackThis

file version.: 2.00.0002

comments.....: n/a

signers......: Trend Micro, Inc.

VeriSign Class 3 Code Signing 2004 CA

Class 3 Public Primary Certification Authority

signing date.: 8:36 AM 6/28/2007

verified.....: -

bevor ich mit OSAM etc weiter mache, noch kurz ne frage - ich hab da ne platte im rechner auf der sehr wichtige daten sind, ich würde die gerne vom system trennen weil ich mords schiss habe, dass die daten darauf futsch gehen (war die sicherungsplatte die vor dem malwarebefall ersetzt werden sollte).
frage: kann ich das machen oder soll ichs lassen weil risiko gering und komplett prüfung absolut notwenig etc?

merci & frohes eier suchen ^^
isa

Hi,

wenn nur Daten auf der Platte sind ist es mit einem gewissen Restrisiko vertretbar die Platte vom System zu trennen und später genauer unter die Lupe zu nehmen...

Bitte CF-log und OSAM-Log posten (OASM ist ungefährliche, CF hat ein gewisses Risiko)...

chris

Sodele,

bei Combofix gabs ein Problem mit der Tatsache, dass ich Win im abgesichterten Modus betrieben hab (ansonsten würd sich alles aufhängen), dazu kam diese Meldung:
http://666kb.com/i/bi3ybfcvrfd1vcsjy.jpg

Hab das ganze mit YES bestätigt und im abgesicherten Modus rebootet, hoffe das war richtig.

Combofix Log:

Code:

ComboFix 10-04-04.01 - Administrator 05.04.2010  20:59:17.1.2 - x86 NETWORK

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1033.18.3071.2801 [GMT 2:00]

ausgeführt von:: c:\documents and settings\Administrator.VALAFOR.000\Desktop\ComboFix.exe

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\cleanup.exe

c:\documents and settings\All Users\Application Data\sysReserve.ini

C:\zip.exe
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-03-05 bis 2010-04-05  ))))))))))))))))))))))))))))))

.
 

2010-04-05 18:24 . 2010-04-05 18:24        --------        d-----w-        c:\documents and settings\LocalService\Local Settings\Application Data\Temp

2010-04-04 14:47 . 2010-04-04 14:47        --------        d-----w-        c:\documents and settings\Administrator.VALAFOR.000\Local Settings\Application Data\Last.fm

2010-04-04 14:46 . 2010-04-04 14:47        --------        d-----w-        c:\documents and settings\Administrator.VALAFOR.000\Application Data\Winamp
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-23 20:54 . 2009-03-07 09:12        --------        d-----w-        c:\documents and settings\All Users\Application Data\Google Updater

2010-02-15 18:28 . 2010-02-15 17:32        574        ----a-w-        C:\cleanup.bat

2010-02-15 18:28 . 2010-02-15 17:32        0        ----a-w-        C:\backup.reg

2010-02-15 17:42 . 2010-02-15 17:42        --------        d-----w-        c:\documents and settings\Administrator.VALAFOR.000\Application Data\Malwarebytes

2010-02-15 17:42 . 2010-01-18 15:10        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-02-15 17:42 . 2010-02-15 17:42        --------        d-----w-        c:\documents and settings\All Users\Application Data\Malwarebytes

2010-02-15 17:22 . 2010-02-15 17:21        --------        d-----w-        c:\documents and settings\Administrator.VALAFOR.000\Application Data\ICQ

2010-01-19 07:04 . 2010-01-19 07:04        552        ----a-w-        c:\windows\system32\d3d8caps.dat

2010-01-19 03:46 . 2010-01-19 03:46        69232        ----a-w-        c:\documents and settings\Administrator.VALAFOR.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-07 15:07 . 2010-02-15 17:42        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 15:07 . 2010-02-15 17:42        19160        ----a-w-        c:\windows\system32\drivers\mbam.sys

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2005-11-25 15473664]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-17 7286784]

"nwiz"="nwiz.exe" [2006-01-17 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-01-17 86016]

"UMonit"="c:\windows\system32\umonit.exe" [2004-05-11 53248]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 49152]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]

"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]

"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2004-10-21 57344]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2008-10-01 4365688]

"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2008-10-01 962464]

"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2008-10-01 165144]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 213936]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-18 113664]

Levelone Wireless Utility.lnk - c:\program files\LevelOne\Common\RaUI.exe [2008-11-16 585728]

Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-11-16 434176]
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\MSN BackUp\\MSNBackup.exe"=

"c:\\Program Files\\Reallusion\\CrazyTalk for Skype\\CT4Skype.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\NetMeeting\\conf.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\ICQ6.5\\ICQ.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
 

R0 mv614x;mv614x;c:\windows\system32\drivers\mv614x.sys [15.11.2008 23:49 34432]

R0 tdrpman139;Acronis Try&Decide and Restore Points filter (build 139);c:\windows\system32\drivers\tdrpm139.sys [23.04.2009 12:50 967168]

R3 fixustor;fixustor;c:\windows\system32\drivers\fixustor.sys [16.11.2008 00:40 6656]

S2 gupdate1c99f04e43d720c;Google Update Service (gupdate1c99f04e43d720c);c:\program files\Google\Update\GoogleUpdate.exe [07.03.2009 11:12 133104]

S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [15.11.2008 23:46 5824]

S3 camvid20;Philips ToUcam Camera; Video;c:\windows\system32\drivers\camdrv21.sys [11.12.2008 22:48 223232]

S4 Pdpddu;Pdpddu; [x]

.

Inhalt des "geplante Tasks" Ordners
 

2010-04-05 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-07 20:15]
 

2009-11-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ca5dbabead5a14.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-07 09:12]
 

2010-01-18 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-03-31 21:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Connection Wizard,ShellNext = hxxp://www.rivalnetwork.cn/ac.php?aid=285&sid=new

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Administrator.VALAFOR.000\Application Data\Mozilla\Firefox\Profiles\s6vgz03a.default\

FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-04-05 21:01

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  UMonit = c:\windows\system32\umonit.exe?USB\Vid_08???Pid_00f2?????:??6&PID27C8???B\?O???????????????????????????w?:??????????????l??????|p??|????m??|d??w?????????:??B$?|???w???w*?,??:?????????????????????????????????w????????????????????T???~?????????????????????? 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

Zeit der Fertigstellung: 2010-04-05  21:03:02

ComboFix-quarantined-files.txt  2010-04-05 19:03
 

Vor Suchlauf: 112.037.720.064 bytes free

Nach Suchlauf: 112.036.446.208 bytes free
 

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
 

- - End Of File - - 31A33F985C7DBFCD6BC8BBE2954FF1F1

OSAM Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:18:49 on 05.04.2010
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.16945
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"GoogleUpdateTaskMachineCore1ca5dbabead5a14.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"WGASetup.job" - "Microsoft Corporation" - C:\WINDOWS\system32\KB905474\wgasetup.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Acronis Snapshots Manager (Build 380)" (snapman380) - "Acronis" - C:\WINDOWS\System32\DRIVERS\snman380.sys

"Acronis True Image Backup Archive Explorer" (timounter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\timntr.sys

"Acronis True Image FS Filter" (tifsfilter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tifsfilt.sys

"Acronis Try&Decide and Restore Points filter (build 139)" (tdrpman139) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tdrpm139.sys

"AEGIS Protocol (IEEE 802.1x) v3.4.3.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"AsIO" (AsIO) - ? - C:\WINDOWS\System32\drivers\AsIO.sys  (File found, but it contains no detailed information)

"Asushwio" (Asushwio) - ? - C:\WINDOWS\system32\drivers\Asushwio.sys  (File found, but it contains no detailed information)

"catchme" (catchme) - ? - C:\DOCUME~1\ADMINI~1.000\LOCALS~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\ElbyCDFL.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys

"fixustor" (fixustor) - "Genesys Logic" - C:\WINDOWS\System32\drivers\fixustor.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"LevelOne WNC-0301 11g Wireless PCI Adapter Driver" (RT61) - "Ralink Technology Inc." - C:\WINDOWS\System32\DRIVERS\RT61.sys

"mv614x" (mv614x) - ? - C:\WINDOWS\System32\DRIVERS\mv614x.sys  (File found, but it contains no detailed information)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{C539A15A-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Context Menu Extension" - "Acronis" - C:\Program Files\Acronis\TrueImageHome\tishell.dll

{C539A15B-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Extension" - "Acronis" - C:\Program Files\Acronis\TrueImageHome\tishell.dll

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{42071714-76d4-11d1-8b24-00a0c9068ff3} "Display Panning CPL Extension" - ? - deskpan.dll  (File not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Encryption Context Menu" - ? -   (File not found | COM-object registry key not found)

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "Malware Defense extension" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell extensions for file compression" - ? -   (File not found | COM-object registry key not found)

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

{5AE58FCF-6F6A-49B2-B064-02492C66E3F4} "MUCatalogWebControl Class" - "Microsoft Corporation" - C:\WINDOWS\system32\MicrosoftUpdateCatalogWebControl.dll / hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1226788575796

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

"ICQ6" - "ICQ, LLC." - C:\Program Files\ICQ6.5\ICQ.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} "EWPBrowseObject Class" - ? - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %AllUsersProfile%\Start Menu\Programs\Startup )-----

"Adobe Gamma Loader.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini

"Levelone Wireless Utility.lnk" - "Digital Data Communications Co., Ltd." - C:\Program Files\LevelOne\Common\RaUI.exe  (Shortcut exists | File exists)

"Logitech SetPoint.lnk" - "Logitech Inc." - C:\Program Files\Logitech\SetPoint\SetPoint.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Documents and Settings\Administrator.VALAFOR.000\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Acronis Scheduler2 Service" - "Acronis" - "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"

"AcronisTimounterMonitor" - "Acronis" - C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"CloneCDTray" - "SlySoft, Inc." - "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

"ISUSPM" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler

"Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe

"nwiz" - "NVIDIA Corporation" - nwiz.exe /install

"OpwareSE4" - "ScanSoft, Inc." - "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

"SSBkgdUpdate" - "Scansoft, Inc." - "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe"

"TrueImageMonitor.exe" - "Acronis" - C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

"UMonit" - "General" - C:\WINDOWS\system32\umonit.exe

"WinampAgent" - ? - "C:\Program Files\Winamp\winampa.exe"  (File found, but it contains no detailed information)

"zBrowser Launcher" - "Logitech Inc." - C:\Program Files\Logitech\iTouch\iTouch.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Acronis Scheduler2 Service" (AcrSch2Svc) - "Acronis" - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

"Adobe LM Service" (Adobe LM Service) - ? - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate1c99f04e43d720c)" (gupdate1c99f04e43d720c) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jqs.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"PnkBstrB" (PnkBstrB) - ? - C:\WINDOWS\system32\PnkBstrB.exe  (File found, but it contains no detailed information)

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

und nu? :dummguck:

Hi,

gibt auch nicht viel her, ein paar Datein sind zu untersuchen, JAVA solltest Du unbedingt mal updaten...

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

c:\windows\system32\umonit.exe

C:\WINDOWS\System32\DRIVERS\mv614x.sys

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Du schreibst das ausser im abgesicherten Modus alles Abstürzt, was genau macht der Rechner zur Zeit?

chris

Hatte wegen Combofix Avast deinstalliert (@abgesichertem Modus weil ich den nicht deaktivieren konnte) und eben die neue Version versucht zu installen, was (logischerweise?) nicht ging, dann Win normal gestartet und siehe da - nichts hängt sich auf, alles läuft!

Avast scannt eben die Platte, gerademal 25% überprüft und schon 5 infizierte Dateien gefunden. Nur so zur Info. Virustotal-Analyse und Java-Update will ich danach machen, hoffe das geht ok.

Sag an, ob ich die Analyse machen soll, BEVOR ich infizierte Dateien, die Avast gefunden hat/finden wird, lösche.

vg isa

http://666kb.com/i/bi50hmtzwykw0hn6j.jpg
das hat Avast ausgespuckt, angeblich wurden alle gefundenen dateien erfolgreich gelöscht.
scan eben nochmal das ganze system durch und lass danach mal MAM drübergucken.
wär ja zu schön, wenns so schnell ginge :O

So, Avast hat beim zweiten Durchlauf nichts mehr gefunden, MAM dagegen schon:

MAM Log:

Code:

Malwarebytes' Anti-Malware 1.44

Database version: 3510

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13
 

07.04.2010 00:57:29

mbam-log-2010-04-07 (00-57-29).txt
 

Scan type: Full Scan (A:\|C:\|D:\|)

Objects scanned: 224067

Time elapsed: 1 hour(s), 3 minute(s), 45 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 7
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

(No malicious items detected)
 

Registry Keys Infected:

(No malicious items detected)
 

Registry Values Infected:

(No malicious items detected)
 

Registry Data Items Infected:

(No malicious items detected)
 

Folders Infected:

(No malicious items detected)
 

Files Infected:

C:\Qoobox\Quarantine\C\cleanup.exe.vir (Trojan.Banker) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6E4C1043-53FB-4F7A-B3FC-5213F4BC7FDB}\RP121\A0028656.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6E4C1043-53FB-4F7A-B3FC-5213F4BC7FDB}\RP121\A0028721.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6E4C1043-53FB-4F7A-B3FC-5213F4BC7FDB}\RP121\A0028790.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6E4C1043-53FB-4F7A-B3FC-5213F4BC7FDB}\RP121\A0028859.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6E4C1043-53FB-4F7A-B3FC-5213F4BC7FDB}\RP121\A0028953.exe (Trojan.Banker) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{6E4C1043-53FB-4F7A-B3FC-5213F4BC7FDB}\RP121\A0028990.sys (Malware.Trace) -> Quarantined and deleted successfully.

Virustotal Log von umonit. exe:

Code:

Datei umonit.exe empfangen 2010.04.06 23:15:30 (UTC)

Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt

Ergebnis: 0/39 (0%)

Laden der Serverinformationen...

Ihre Datei wartet momentan auf Position: ___.

Geschätzte Startzeit ist zwischen ___ und ___ .

Dieses Fenster bis zum Abschluss des Scans nicht schließen.

Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen.

Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut.

Ihre Datei wird momentan von VirusTotal überprüft,

Ergebnisse werden sofort nach der Generierung angezeigt.

Filter Filter

Drucken der Ergebnisse Drucken der Ergebnisse

Datei existiert nicht oder dessen Lebensdauer wurde überschritten

Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet.
 

SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist.

Email:
 

Antivirus Version letzte aktualisierung Ergebnis

a-squared 4.5.0.50 2010.04.07 -

AhnLab-V3 5.0.0.2 2010.04.06 -

AntiVir 7.10.6.31 2010.04.06 -

Antiy-AVL 2.0.3.7 2010.04.06 -

Authentium 5.2.0.5 2010.04.06 -

Avast 4.8.1351.0 2010.04.06 -

Avast5 5.0.332.0 2010.04.06 -

AVG 9.0.0.787 2010.04.06 -

BitDefender 7.2 2010.04.07 -

CAT-QuickHeal 10.00 2010.04.06 -

ClamAV 0.96.0.3-git 2010.04.07 -

Comodo 4522 2010.04.07 -

DrWeb 5.0.2.03300 2010.04.07 -

eSafe 7.0.17.0 2010.04.06 -

eTrust-Vet 35.2.7411 2010.04.06 -

F-Prot 4.5.1.85 2010.04.06 -

F-Secure 9.0.15370.0 2010.04.07 -

Fortinet 4.0.14.0 2010.04.06 -

GData 19 2010.04.07 -

Ikarus T3.1.1.80.0 2010.04.06 -

Jiangmin 13.0.900 2010.04.06 -

Kaspersky 7.0.0.125 2010.04.07 -

McAfee-GW-Edition 6.8.5 2010.04.06 -

Microsoft 1.5605 2010.04.06 -

NOD32 5005 2010.04.06 -

Norman 6.04.11 2010.04.06 -

nProtect 2009.1.8.0 2010.04.06 -

Panda 10.0.2.2 2010.04.06 -

PCTools 7.0.3.5 2010.04.06 -

Prevx 3.0 2010.04.07 -

Rising 22.42.01.04 2010.04.06 -

Sophos 4.52.0 2010.04.06 -

Sunbelt 6145 2010.04.07 -

Symantec 20091.2.0.41 2010.04.07 -

TheHacker 6.5.2.0.256 2010.04.07 -

TrendMicro 9.120.0.1004 2010.04.06 -

VBA32 3.12.12.4 2010.04.05 -

ViRobot 2010.4.6.2263 2010.04.06 -

VirusBuster 5.0.27.0 2010.04.06 -

weitere Informationen

File size: 53248 bytes

MD5...: 21704b5919e79397a345a0a817941bcf

SHA1..: bc238780f1cce335bb9378480da159eafbf00e40

SHA256: 2e9cb310104f5b572310e7743e4db7a19cdebe38972618e3a824e5062b374315

ssdeep: 768:wCWvtBRxqqEvTNIHgu5a/T2q/Dgp+Mz3JWN9o8uUWSWX:wdGRIAJ/T2qLgp+

Mz3Jco739X

PEiD..: -

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x67e0

timedatestamp.....: 0x40a065ee (Tue May 11 05:34:38 2004)

machinetype.......: 0x14c (I386)
 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x5c12 0x6000 6.10 c300189079229ce9378a7108039869c9

.rdata 0x7000 0x15c2 0x2000 3.94 f6c573d52b0d60c771595decf78af406

.data 0x9000 0x4c0 0x1000 1.63 37579b8192d2d73745d176bf9a9212a9

.rsrc 0xa000 0x2760 0x3000 2.95 1b92afbe94ab9de1a0fbb94c7289b2b3
 

( 10 imports )

> KERNEL32.dll: GetWindowsDirectoryA, GetModuleHandleA, MultiByteToWideChar, lstrlenW, LoadLibraryA, GetDiskFreeSpaceA, WaitForSingleObject, ResetEvent, GetStartupInfoA, GetProcAddress, lstrcpynA, lstrlenA, FreeLibrary, GetVersionExA, CreateFileA, GetSystemDirectoryA, OutputDebugStringA, GetLastError, CreateMutexA, CloseHandle, DeviceIoControl, CreateEventA

> USER32.dll: RegisterDeviceNotificationA, PostQuitMessage, PostMessageA, AppendMenuA, ModifyMenuA, KillTimer, LoadMenuA, GetSubMenu, SetForegroundWindow, GetParent, GetCursorPos, wsprintfA, EnableWindow, GetDesktopWindow, SetTimer

> ADVAPI32.dll: RegOpenKeyA, RegQueryValueExA, RegCloseKey, RegEnumKeyA, RegCreateKeyExA, RegSetValueExA

> SHELL32.dll: SHGetSpecialFolderLocation, Shell_NotifyIconA, SHGetFileInfoA, SHGetMalloc, SHGetDesktopFolder, SHChangeNotify

> SHLWAPI.dll: SHDeleteKeyA

> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -

> MSVCRT.dll: _setmbcp, _exit, _XcptFilter, _onexit, _acmdln, __getmainargs, _adjust_fdiv, _initterm, __setusermatherr, __set_app_type, __p__commode, __p__fmode, _controlfp, _except_handler3, exit, malloc, free, __dllonexit, __CxxFrameHandler, strstr, _strlwr, _strupr, strncat, sprintf, _purecall, fclose, strncpy, strncmp, strtoul, strchr, fgets, fopen

> CFGMGR32.dll: CM_Open_DevNode_Key, CM_Get_Sibling, CM_Get_Child, CM_Disable_DevNode, CM_Remove_SubTree, CM_Query_Remove_SubTree, CM_Get_Device_IDA

> SETUPAPI.dll: SetupFindFirstLineA, SetupOpenInfFileA, SetupDiSetDeviceRegistryPropertyA, SetupFindNextLine, SetupCloseInfFile, SetupGetStringFieldA, SetupDiCallClassInstaller, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyA, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, SetupDiSetClassInstallParamsA, SetupDiClassGuidsFromNameA
 

( 0 exports )

RDS...: NSRL Reference Data Set

-

pdfid.: -

trid..: Win64 Executable Generic (58.7%)

Win32 Executable MS Visual C++ (generic) (25.8%)

Win32 Executable Generic (5.8%)

Win32 Dynamic Link Library (generic) (5.2%)

Win32 Executable MS Visual FoxPro 7 (1.5%)

sigcheck:

publisher....: General

copyright....: Copyright (C) 2000-2004

product......: Gene USB Monitor

description..: Gene USB Monitor

original name: USBMonit.exe

internal name: USBMonitor

file version.: 1, 2, 9, 0

comments.....:

signers......: -

signing date.: -

verified.....: Unsigned

mv614x. sys Log:

Code:

Datei mv614x.sys empfangen 2010.04.06 23:17:41 (UTC)

Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt

Ergebnis: 0/39 (0%)

Laden der Serverinformationen...

Ihre Datei wartet momentan auf Position: 3.

Geschätzte Startzeit ist zwischen 56 und 80 Sekunden.

Dieses Fenster bis zum Abschluss des Scans nicht schließen.

Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen.

Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut.

Ihre Datei wird momentan von VirusTotal überprüft,

Ergebnisse werden sofort nach der Generierung angezeigt.

Filter Filter

Drucken der Ergebnisse Drucken der Ergebnisse

Datei existiert nicht oder dessen Lebensdauer wurde überschritten

Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet.
 

SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist.

Email:
 

Antivirus Version letzte aktualisierung Ergebnis

a-squared 4.5.0.50 2010.04.07 -

AhnLab-V3 5.0.0.2 2010.04.06 -

AntiVir 7.10.6.31 2010.04.06 -

Antiy-AVL 2.0.3.7 2010.04.06 -

Authentium 5.2.0.5 2010.04.06 -

Avast 4.8.1351.0 2010.04.06 -

Avast5 5.0.332.0 2010.04.06 -

AVG 9.0.0.787 2010.04.06 -

BitDefender 7.2 2010.04.07 -

CAT-QuickHeal 10.00 2010.04.06 -

ClamAV 0.96.0.3-git 2010.04.07 -

Comodo 4522 2010.04.07 -

DrWeb 5.0.2.03300 2010.04.07 -

eSafe 7.0.17.0 2010.04.06 -

eTrust-Vet 35.2.7411 2010.04.06 -

F-Prot 4.5.1.85 2010.04.06 -

F-Secure 9.0.15370.0 2010.04.07 -

Fortinet 4.0.14.0 2010.04.06 -

GData 19 2010.04.07 -

Ikarus T3.1.1.80.0 2010.04.06 -

Jiangmin 13.0.900 2010.04.06 -

Kaspersky 7.0.0.125 2010.04.07 -

McAfee-GW-Edition 6.8.5 2010.04.06 -

Microsoft 1.5605 2010.04.06 -

NOD32 5005 2010.04.06 -

Norman 6.04.11 2010.04.06 -

nProtect 2009.1.8.0 2010.04.06 -

Panda 10.0.2.2 2010.04.06 -

PCTools 7.0.3.5 2010.04.06 -

Prevx 3.0 2010.04.07 -

Rising 22.42.01.04 2010.04.06 -

Sophos 4.52.0 2010.04.06 -

Sunbelt 6145 2010.04.07 -

Symantec 20091.2.0.41 2010.04.07 -

TheHacker 6.5.2.0.256 2010.04.07 -

TrendMicro 9.120.0.1004 2010.04.06 -

VBA32 3.12.12.4 2010.04.05 -

ViRobot 2010.4.6.2263 2010.04.06 -

VirusBuster 5.0.27.0 2010.04.06 -

weitere Informationen

File size: 34432 bytes

MD5...: 6eb1d27590d4bc040f105d2bf35a6c4f

SHA1..: 03097283b36b95f1a26b753e3a9f660b781442b3

SHA256: 10299b2b641507150d2345fa9ef848a641dc8c725ee345fba6ed9e3fe56ed34b

ssdeep: 384:etbnCjQ9qe4xAr76n2afYGHVo8IIWGbMJ87Dv4SnV5IsxguJ+bjjkSpr18Y9

z2uu:ObjId72KYGarGbD3zxFSXkm36uzWp

PEiD..: -

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x1e4c

timedatestamp.....: 0x43be4a31 (Fri Jan 06 10:45:05 2006)

machinetype.......: 0x14c (I386)
 

( 5 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x480 0x70b6 0x7100 6.47 ed628aec8b39ea6ac37e23f90f9825ed

.rdata 0x7580 0xd2 0x100 3.98 f71f1541decac389cb51e1a3b8283975

.data 0x7680 0xb4a 0xb80 2.58 9bedb397890874fa4946611da865bb24

INIT 0x8200 0x2b0 0x300 4.42 18fe36328ad766c34fd74c05fafd25ad

.reloc 0x8500 0x11c 0x180 4.05 345c84dae170a1528a2d0cebfe2adc52
 

( 1 imports )

> SCSIPORT.SYS: ScsiPortNotification, ScsiPortGetBusData, ScsiPortLogError, ScsiPortGetPhysicalAddress, ScsiPortGetUncachedExtension, ScsiPortStallExecution, ScsiPortReadPortBufferUshort, ScsiPortWritePortUchar, ScsiPortReadPortUchar, ScsiPortReadRegisterUlong, ScsiPortWriteRegisterUlong, ScsiPortMoveMemory, ScsiPortFreeDeviceBase, ScsiPortGetDeviceBase, ScsiPortValidateRange, ScsiPortCompleteRequest, ScsiPortInitialize, ScsiPortReadPortUshort, ScsiPortWritePortUlong, ScsiPortReadPortUlong, ScsiPortWritePortBufferUshort
 

( 0 exports )

RDS...: NSRL Reference Data Set

-

pdfid.: -

trid..: Clipper DOS Executable (33.3%)

Generic Win/DOS Executable (33.0%)

DOS Executable Generic (33.0%)

VXD Driver (0.5%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)

sigcheck:

publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

hoffe, ich krieg jetzt keine schelte :balla: