Trojaner-Board - Trojan.Win32.Blackbird.exe

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Trojan.Win32.Blackbird.exe (https://www.trojaner-board.de/52144-trojan-win32-blackbird-exe.html)

tnowacki

06.05.2008 13:24

Trojan.Win32.Blackbird.exe

Guten Tag,
seit einigen Tagen habe ich o.g. Trojaner bei mir auf dem Desktop. Neben ihm erscheinen einige andere .exe-Dateien, diese habe ich aber ausgeblendet. (Weiß nicht mehr warum...) und weiß nicht mehr, wie ich sie wieder einblenden kann.
Ich besitze Vista Home Premium.
Sonderbar ist auch, dass mein Avast in Ordnern Viren entdeckt, die ich gar nicht finden kann... :balla:

Hier mein hijack:

Code:

Logfile of HijackThis v1.99.1

Scan saved at 14:19:36, on 06.05.2008

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\WTablet\TabUserW.exe

C:\ProgramData\hmzovatq\xkpapszm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

H:\Program Files\Adobe\Adobe Fireworks CS3\Fireworks.exe

E:\FREEDO~1\fdm.exe

C:\Windows\explorer.exe

C:\Users\***\Documents\hijackthis_199\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://***.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://alice.aol.de

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common 
 

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - H:\Program Files\Adobe\/Adobe Contribute 
 

CS3/contributeieplugin.dll

O2 - BHO: (no name) - {6237B16D-70F2-4D04-ADD7-6ADAF1FE9617} - C:\Windows\system32\tuvVNExY.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common 
 

Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - H:\Program 
 

Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program 
 

Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - H:\Program Files\Adobe\/Adobe Contribute 
 

CS3/contributeieplugin.dll

O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program 
 

Files\MySearch\bar\1.bin\S4BAR.DLL

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: wxdbpfvo - {C3169036-557E-45E1-840F-C845DC406C55} - C:\Windows\wxdbpfvo.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Adobe\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\wvUOFwTN.dll,#1

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\***\AppData\Local\Temp\iifedaYP.dll,#1

O8 - Extra context menu item: Alles mit FDM herunterladen - file://E:\Free Download Manager\dlall.htm

O8 - Extra context menu item: An vorhandenes PDF anfügen - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://H:\Program 
 

Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://E:\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Datei mit FDM herunterladen - file://E:\Free Download Manager\dllink.htm

O8 - Extra context menu item: In Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0
 

\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Videos mit FDM herunterladen - file://E:\Free Download Manager\dlfvideo.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program 
 

Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11
 

\REFIEBAR.DLL

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://***.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?
 

http://***.ebay.de/ (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O11 - Options group: [INTERNATIONAL] International*

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - Gopher Prefix: 

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O21 - SSODL: qadovnel - {8F3489AD-D1EB-4F4E-AD58-A047FAFD89AC} - C:\Windows\qadovnel.dll

O23 - Service: Adobe Version Cue CS3 {de_DE}  (Adobe Version Cue CS3) - Unknown owner - C:\Program Files\Common 
 

Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device 
 

Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4
 

\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file 
 

missing)

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec 
 

Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: dev5_ap1 - Unknown owner - C:\phpdev5\apache\Apache.exe" --ntservice (file missing)

O23 - Service: dev5_ap2 - Unknown owner - C:\phpdev5\apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision 
 

Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common 
 

Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file 
 

missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file 
 

missing)

O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power 
 

Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba 
 

Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead 
 

Systems\DVD\ULCDRSvr.exe

O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %
 

ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Vielen Dank im Vorraus!

myrtille

06.05.2008 13:32

Hi,

lade dir bitte Smitfraudfix herunter und verfahre entsprechend der Anleitung "Suche".
Poste das erstellte Log hier.

Stelle anschließend sicher, dass alle Dateien sichtbar sind und suche folgende Datei:

Zitat:

C:\ProgramData\hmzovatq\xkpapszm.exe

und lade diese bei Virustotal hoch. Poste das komplette Ergebnis sowie einen Link zum Ergebnis von Virustotal, dann bitte hier.

lg myrtille

tnowacki

06.05.2008 14:51

Hier der Smitfraudfix:

Code:

SmitFraudFix v2.319
 

Scan done at 15:46:20,26, 06.05.2008

Run from C:\Program Files\Mozilla Firefox\SmitfraudFix

OS: Microsoft Windows [Version 6.0.6000] - Windows_NT

The filesystem type is NTFS

Fix run in normal mode
 

»»»»»»»»»»»»»»»»»»»»»»»» Process
 

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\agrsmsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\Tablet.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\WTablet\TabUserW.exe

C:\Windows\system32\Tablet.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\SYSTEM32\WISPTIS.EXE

H:\Program Files\Adobe\Adobe Fireworks CS3\Fireworks.exe

C:\Windows\explorer.exe

C:\Program Files\OpenOffice.org 2.2\program\soffice.exe

C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\SearchFilterHost.exe

E:\FREEDO~1\fdm.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\wbem\wmiprvse.exe
 

»»»»»»»»»»»»»»»»»»»»»»»» hosts
 
 

»»»»»»»»»»»»»»»»»»»»»»»» \
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows
 

C:\Windows\qadovnel.dll FOUND !

C:\Windows\xbaqktfv.exe FOUND !
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Admin
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Admin\Application Data
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Admin\FAVORI~1
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Desktop
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 
 

C:\Program Files\akl\ FOUND !
 

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

 

 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

!!!Attention, following keys are not inevitably infected!!!
 

IEDFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

!!!Attention, following keys are not inevitably infected!!!
 

VACFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 

[!] Suspicious: wxdbpfvo.dll

Toolbar: wxdbpfvo - {C3169036-557E-45E1-840F-C845DC406C55}

TypeLib: {D95C697F-D985-4AB1-92B5-40DF04BBE322}

Interface: {FC1E1AC3-3303-4BC5-913C-735D8B393FAD}

Classe: wxdbpfvo.bmva

Classe: wxdbpfvo.ToolBar.1
 

[!] Suspicious: qadovnel.dll

SSODL: qadovnel - {8F3489AD-D1EB-4F4E-AD58-A047FAFD89AC}
 
 

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

!!!Attention, following keys are not inevitably infected!!!
 

404Fix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, following keys are not inevitably infected!!!
 

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll
 
 

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs

!!!Attention, following keys are not inevitably infected!!!
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=""

"LoadAppInit_DLLs"=dword:00000000
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon

!!!Attention, following keys are not inevitably infected!!!
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Userinit"="C:\\Windows\\system32\\userinit.exe,"
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Rustock
 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» DNS
 

Description: Intel(R) PRO/Wireless 3945ABG Network Connection

DNS Server Search Order: 192.168.178.1
 

HKLM\SYSTEM\CCS\Services\Tcpip\..\{45AF0DFF-A4DB-4ED7-B45A-AC87677CEF8B}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{BB3C56FD-70C6-4395-A07B-3AC4BCBB48D1}: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{45AF0DFF-A4DB-4ED7-B45A-AC87677CEF8B}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{BB3C56FD-70C6-4395-A07B-3AC4BCBB48D1}: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS2\Services\Tcpip\..\{45AF0DFF-A4DB-4ED7-B45A-AC87677CEF8B}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS2\Services\Tcpip\..\{BB3C56FD-70C6-4395-A07B-3AC4BCBB48D1}: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.178.1
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
 
 

»»»»»»»»»»»»»»»»»»»»»»»» End

Und hier der Virustotal:

Code:

MD5:          28e1eb9110e24fe9abe70496c1892753

First received:         2008.04.30 20:59:54 (CET)

Datum         2008.04.30 20:59:54 (CET) [>5D]

Ergebnisse         10/32

Permalink:         analisis/4eef82b9025e0070a8f5c15a4624ae25

VirusTotal - Kostenloser online Viren- und Malwarescanner - Neu analysieren

myrtille

06.05.2008 15:01

Kannst du mir bitte mal noch die Virenmeldungen von Avast posten?

Mich würde interessieren wo was gefunden wird.

lg myrtille

tnowacki

06.05.2008 15:03

Zitat:

Zitat von myrtille (Beitrag 336852)

Kannst du mir bitte mal noch die Virenmeldungen von Avast posten?

Mich würde interessieren wo was gefunden wird.

lg myrtille

Code:

01.05.2008 10:11:48        ***        1424        Sign of "Win32:Agent-LTS [Trj]" has been found in "c:\windows\bdkpfxqw.dll" file.  

01.05.2008 11:12:26        SYSTEM        1640        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\ysolgoxj.dll" file.  

01.05.2008 11:12:54        SYSTEM        1640        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Windows\System32\tuvVNExY.dll" file.  

01.05.2008 11:13:01        SYSTEM        1640        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Windows\System32\tuvVNExY.dll" file.  

01.05.2008 11:13:18        ***        6064        Sign of "Win32:TratBHO [Trj]" has been found in "c:\windows\system32\tuvvnexy.dll" file.  

01.05.2008 11:18:38        SYSTEM        1640        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Windows\System32\tuvVNExY.dll" file.  

01.05.2008 11:19:01        SYSTEM        1640        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Windows\System32\tuvVNExY.dll" file.  

01.05.2008 11:41:59        ***        1076        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Documents and Settings\***\AppData\Local\Temp\yayvTNFX.dll" file.  

01.05.2008 12:06:22        SYSTEM        1656        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\awturRji.dll" file.  

01.05.2008 13:06:25        SYSTEM        1656        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\khfETnkh.dll" file.  

01.05.2008 14:06:24        SYSTEM        1656        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\qoMeBuUk.dll" file.  

01.05.2008 15:06:24        SYSTEM        1656        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\mlJYrstq.dll" file.  

04.05.2008 19:19:29        SYSTEM        1620        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\khfCUNGv.dll" file.  

04.05.2008 20:19:28        SYSTEM        1620        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\efcDUmmM.dll" file.  

04.05.2008 21:19:28        SYSTEM        1620        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\jkKDtqRH.dll" file.  

05.05.2008 14:21:13        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\mlJaBsSJ.dll" file.  

05.05.2008 15:21:14        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\opnonoli.dll" file.  

05.05.2008 16:21:15        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\xxyyxwuu.dll" file.  

05.05.2008 19:50:37        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\vtUnnomM.dll" file.  

05.05.2008 20:50:37        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\mlJApOGW.dll" file.  

06.05.2008 13:37:17        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\iifdbCSm.dll" file.  

06.05.2008 14:37:18        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\hgGvvwUK.dll" file.  

06.05.2008 15:18:16        SYSTEM        1636        Sign of "Win32:Tiny-II [Trj]" has been found in "C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\STKYD2GL\xyyzdhuzz[1].htm" file.  

06.05.2008 15:19:42        SYSTEM        1636        Sign of "Win32:Tiny-II [Trj]" has been found in "C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A298A6LH\xyyzdhuzz[1].htm" file.  

06.05.2008 15:37:18        SYSTEM        1636        Sign of "Win32:TratBHO [Trj]" has been found in "C:\Users\***\AppData\Local\Temp\urqQhFxU.dll" file.

myrtille

06.05.2008 15:07

Hehe, nein, das meinte ich nicht. :D
Du schriebst:

Zitat:

Sonderbar ist auch, dass mein Avast in Ordnern Viren entdeckt, die ich gar nicht finden kann

Wie heißen die OrdnerDateien denn?

lg myrtille

tnowacki

06.05.2008 15:12

Zitat:

Zitat von myrtille (Beitrag 336855)

Hehe, nein, das meinte ich nicht. :D
Du schriebst:

Wie heißen die OrdnerDateien denn?

lg myrtille

Die Ordner kann ich jetzt finden - Sie waren versteckt und nicht angezeigt :daumenhoch
und das, was ich vorher gepostet habe, waren alle Meldungen, die ich bekam.

myrtille

06.05.2008 15:14

Ok, hab dein Edit gesehen

tnowacki

06.05.2008 15:16

Zitat:

Zitat von myrtille (Beitrag 336858)

Ich würde trotzdem gern wissen, wie diese Ordner und Dateien heißen :D
Ansonsten kann ich dir auhc nicht sagen ob und wie man sie löscht.

lg myrtille

Siehe bitte 4 Posts vorher... Da stehen alle Virenmeldungen drin.
edit: myrtille war schneller :D

myrtille

06.05.2008 15:30

Hi,
dann arbeite bitte mal den 2. Schritt (Bereinigung) von Smitfraudfix ab und erstelle danach ein Log mit Malwarebytes

Smitfraudfix wird nicht alles entfernen, aber das gröbste sollte dann bereinigt sein.

lg myrtille

tnowacki

06.05.2008 18:49

Zitat:

Zitat von myrtille (Beitrag 336861)

Soooo...
Hier die Ergebnisse:

Code:

Malwarebytes' Anti-Malware 1.09

Database version: 507
 

Scan type: Full Scan (C:\|)

Objects scanned: 295916

Time elapsed: 1 hour(s), 20 minute(s), 16 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 2

Registry Keys Infected: 5

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 7

Files Infected: 20
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.
 

Registry Keys Infected:

HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\mwc (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
 

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> No action taken.
 

Registry Data Items Infected:

(No malicious items detected)
 

Folders Infected:

C:\Windows\mslagent (Adware.EGDAccess) -> No action taken.

C:\Program Files\MySearch (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
 

Files Infected:

C:\Windows\mslagent\2_mslagent.dll (Adware.EGDAccess) -> No action taken.

C:\Windows\mslagent\mslagent.exe (Adware.EGDAccess) -> No action taken.

C:\Windows\mslagent\uninstall.exe (Adware.EGDAccess) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\NPMYSRCH.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4FFXTBR.JAR (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4FFXTBR.MANIFEST (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4NTSTBR.JAR (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4NTSTBR.MANIFEST (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\000356F5 (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\00035D3C (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\000361CE.bmp (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\000364E9.bmp (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\History\search2 (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> No action taken.

C:\Users\***\AppData\Local\Temp\byXQJBTj.dll (Malware.Trace) -> No action taken.

C:\Windows\System32\vbsys2.dll (Trojan.Clicker) -> No action taken.

C:\Windows\System32\awtoolb.dll (Trojan.Vundo) -> No action taken.

myrtille

06.05.2008 18:56

Hi,
poste bitte auch den Inhalt der Datei C:\Rapport.txt. :)

Lass außerdem die von Malwarebytes gefundenen Einträge löschen.

Erstelle bitte außerdem noch ein neues Hijackthislogfile.

lg myrtille

tnowacki

06.05.2008 19:08

Zitat:

Zitat von myrtille (Beitrag 336883)

Code:

Logfile of HijackThis v1.99.1

Scan saved at 20:06:12, on 06.05.2008

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\WTablet\TabUserW.exe

C:\ProgramData\hmzovatq\xkpapszm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\ProgramData\nfwspjcq\tofqzalu.exe

E:\Adobe\Reader\reader_sl.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Users\***\Documents\hijackthis_199\HijackThis.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://***.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://alice.aol.de

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: (no name) - {6237B16D-70F2-4D04-ADD7-6ADAF1FE9617} - C:\Windows\system32\tuvVNExY.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Adobe\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\wvUOFwTN.dll,#1

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\***\AppData\Local\Temp\fccYsppn.dll,#1

O4 - HKCU\..\Run: [nfwspjcq] C:\ProgramData\nfwspjcq\tofqzalu.exe

O8 - Extra context menu item: Alles mit FDM herunterladen - file://E:\Free Download Manager\dlall.htm

O8 - Extra context menu item: An vorhandenes PDF anfügen - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://E:\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Datei mit FDM herunterladen - file://E:\Free Download Manager\dllink.htm

O8 - Extra context menu item: In Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Videos mit FDM herunterladen - file://E:\Free Download Manager\dlfvideo.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://***.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?http://***.ebay.de/ (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O11 - Options group: [INTERNATIONAL] International*

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - Gopher Prefix: 

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe Version Cue CS3 {de_DE}  (Adobe Version Cue CS3) - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: dev5_ap1 - Unknown owner - C:\phpdev5\apache\Apache.exe" --ntservice (file missing)

O23 - Service: dev5_ap2 - Unknown owner - C:\phpdev5\apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Was meinst du mit rapport.txt? Und 4 Dateien konnte MWB nicht löschen - die genauen Daten habe ich aus Versehen weggeklickt :(
Aaaaa, rapport:

Code:

SmitFraudFix v2.319
 

Scan done at 16:40:30,68, 06.05.2008

Run from C:\Users\tnowacki\SmitfraudFix

OS: Microsoft Windows [Version 6.0.6000] - Windows_NT

The filesystem type is NTFS

Fix run in normal mode
 

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix

!!!Attention, following keys are not inevitably infected!!!
 

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll
 

»»»»»»»»»»»»»»»»»»»»»»»» Killing process
 
 

»»»»»»»»»»»»»»»»»»»»»»»» hosts
 
 

127.0.0.1       localhost

::1             localhost
 

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
 

VACFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri

C:\Windows\wxdbpfvo.dll deleted.

C:\Windows\qadovnel.dll deleted.
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
 

S!Ri's WS2Fix: LSP not Found.
 

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
 

GenericRenosFix by S!Ri
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
 

C:\Windows\xbaqktfv.exe Deleted

C:\Program Files\akl\ Deleted
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
 

IEDFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
 

404Fix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 

»»»»»»»»»»»»»»»»»»»»»»»» DNS
 

Description: Intel(R) PRO/Wireless 3945ABG Network Connection

DNS Server Search Order: 192.168.178.1
 

HKLM\SYSTEM\CCS\Services\Tcpip\..\{45AF0DFF-A4DB-4ED7-B45A-AC87677CEF8B}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{BB3C56FD-70C6-4395-A07B-3AC4BCBB48D1}: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{45AF0DFF-A4DB-4ED7-B45A-AC87677CEF8B}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{BB3C56FD-70C6-4395-A07B-3AC4BCBB48D1}: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS2\Services\Tcpip\..\{45AF0DFF-A4DB-4ED7-B45A-AC87677CEF8B}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS2\Services\Tcpip\..\{BB3C56FD-70C6-4395-A07B-3AC4BCBB48D1}: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.178.1

HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.178.1
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System

!!!Attention, following keys are not inevitably infected!!!
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

tnowacki

06.05.2008 19:55

Hiilfe!
jetzt kommt noch eine Meldung, dass ich mit Spyware verseucht bin! :schrei::balla::balla::(:balla:

myrtille

06.05.2008 20:40

Ja, wie gesagt Smitfraudfix hat nicht alles entfernt.
Daher machen wir hiermit weiter:

Deaktiviere bitte zuerst die UAC, dies geht mit: Start -> Ausführen -> msconfig -> Enter -> Tools -> Benutzrkontenstrg. deaktivieren -> starten.
Ansonsten kann Avenger nicht korrekt funktionieren.

1.) Lade dir das Tool Avenger, speichere es auf dem Desktop und starte es.
2.) Klicke nun auf die Option „Input Script manually“ -> klicke jetzt auf die Lupe und kopiere folgenden Text rein:

Code:

Folders to delete: 

C:\ProgramData\hmzovatq

C:\ProgramData\nfwspjcq
 

Files to delete:

C:\Windows\system32\wvUOFwTN.dll

C:\Users\***\AppData\Local\Temp\fccYsppn.dll
 

Registry values to delete:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run|MSServer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run|nfwspjcq

3.) Klicke nun auf die „grüne Ampel“, das Script fängt an zu arbeiten.
4.) Danach das System unverzüglich neu starten lassen
5.) Poste den Inhalt der C:\avenger.txt Datei.

Die *** bitte durch deinen Benutzernamen ersetzen
Bitte nicht vergessen, nach dem Neustart UAC wieder zu aktivieren :)
Dazu bitte auch ein neues Hijackthislogfile.

lg myrtille

tnowacki

07.05.2008 15:47

Zitat:

Zitat von myrtille (Beitrag 336910)

Code:

Folders to delete: 

C:\ProgramData\hmzovatq

C:\ProgramData\nfwspjcq
 

Files to delete:

C:\Windows\system32\wvUOFwTN.dll

C:\Users\***\AppData\Local\Temp\fccYsppn.dll
 

Registry values to delete:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run|MSServer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run|nfwspjcq

Irgendwie funz dieses Avenger nicht.... und was meinst du mit Lupe?
Es kommt folgende Meldung:
Error! Invalid script.

Sunny

07.05.2008 15:51

Zitat:

Zitat von tnowacki (Beitrag 337014)

Irgendwie funz dieses Avenger nicht.... und was meinst du mit Lupe?
Es kommt folgende Meldung:
Error! Invalid script.

Versuch es einfach nochmal, wenn nötig sogar 2 bis 3mal..
Wenn es dann noch nicht funktioniert, dann melde dich hier wieder. :)

myrtille

07.05.2008 16:01

@tnowacki
Sorry habe dir leider eine veraltete Anleitung gegeben... die Lupe gibt es nicht mehr.
Die aktuelle Version hat diese nicht mehr, die Anleitung wäre da eher:

Anleitung Avenger (by swandog46)

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:

http://swandog46.geekstogo.com/res/images/avenger.jpg

2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist.

Kopiere nun folgenden Text in das weiße Feld: (bei -> "input script here")

Code:

Folders to delete: 

C:\ProgramData\hmzovatq

C:\ProgramData\nfwspjcq
 

Files to delete:

C:\Windows\system32\wvUOFwTN.dll

C:\Users\***\AppData\Local\Temp\fccYsppn.dll
 

Registry values to delete:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | MSServer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | nfwspjcq

3.) Schliesse nun alle Programme (vorher notfalls abspeichern!) und Browser-Fenster, nach dem ausführen des Avengers wird das System neu gestartet.

4.) Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet!

5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt
Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

In der Hoffnung, dass das jetzt besser klappt ;)

lg myrtille

tnowacki

07.05.2008 16:09

Geht immer noch nicht :mad:
Komt danach noch sowas wie "a valid script must begin with a command directive.

myrtille

07.05.2008 16:13

Poste mir bitte mal den Inhalt, den du einfügst.

EDIT: Hast du ne 64bitversion?

lg myrtille

tnowacki

07.05.2008 16:22

Nö. 32. Sonst würde es ja nicht TROJAN. WIN32.... heißen ;)

Code:

Folders to delete: 

C:\ProgramData\hmzovatq

C:\ProgramData\nfwspjcq
 

Files to delete:

C:\Windows\system32\wvUOFwTN.dll

C:\Users\***\AppData\Local\Temp\fccYsppn.dll
 

Registry values to delete:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | MSServer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run | nfwspjcq

statt *** der Name natürlich...

myrtille

07.05.2008 17:28

Ok, das Log ist richtig so.
Versuch es bitte noch 2-3 Mal, Avenger hat manchmal schluckauf, das klappt nicht immer auf Anhieb.

lg myrtille

tnowacki

07.05.2008 20:39

Klappt immer noch nicht :mad::mad::mad::mad::koch::koch:

myrtille

07.05.2008 21:09

Ok, seltsam.
Dann alternativ programm, arbeite bitte Folgendes ab:

ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen.

lg myrtille

tnowacki

08.05.2008 16:43

Hier der Log von ComboFix:

Code:

ComboFix 08-05-07.1 - Admin 2008-05-08 17:19:50.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.1.1031.18.1165 [GMT 2:00]

ausgeführt von:: C:\Users\***\Desktop\ComboFix.exe

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

C:\Program Files\Inet Delivery

C:\Program Files\Inet Delivery\inetdl.exe

C:\Program Files\Inet Delivery\intdel.exe

C:\Users\***\Desktop\EditorFKWP2.0.exe

C:\Users\***\Desktop\filemanagerclient.exe

C:\Users\***\Desktop\fkwp1.5.exe

C:\Users\***\Desktop\fkwp2.0.exe

C:\Users\***\Desktop\fwebd.exe

C:\Users\***\Desktop\FWebdEditor.exe

C:\Users\***\Desktop\Trojan.Win32.BlackBird.exe

C:\Windows\a.bat

C:\Windows\base64.tmp

C:\Windows\bdn.com

C:\Windows\FVProtect.exe

C:\Windows\iTunesMusic.exe

C:\Windows\mslagent

C:\Windows\mslagent\2_mslagent.dll

C:\Windows\mslagent\mslagent.exe

C:\Windows\mslagent\uninstall.exe

C:\Windows\mssecu.exe

C:\Windows\system32\bsva-egihsg52.exe

C:\Windows\system32\emesx.dll

C:\Windows\system32\qoMeFyxw.dll

C:\Windows\system32\smp

C:\Windows\system32\smp\msrc.exe

C:\Windows\system32\uywkqxoq.ini

C:\Windows\system32\wvUmjHAs.dll

C:\Windows\system32\wvUOFwTN.dll

C:\Windows\System32\YxENVvut.ini

C:\Windows\System32\YxENVvut.ini2

C:\Windows\userconfig9x.dll

C:\Windows\Web\def.htm

C:\Windows\winsystem.exe

C:\Windows\zip1.tmp

C:\Windows\zip2.tmp

C:\Windows\zip3.tmp

C:\Windows\zipped.tmp
 

.

(((((((((((((((((((((((   Dateien erstellt von 2008-04-08 bis 2008-05-08  ))))))))))))))))))))))))))))))

.
 

Keine neuen Dateien erstellt in diesem Zeitraum
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-08 15:06        ---------        d-----w        C:\Users\***\AppData\Roaming\OpenOffice.org2

2008-05-08 14:56        39,865        ----a-w        C:\Users\***\pms2.zip

2008-05-08 14:49        ---------        d-----w        C:\Users\***\AppData\Roaming\WTablet

2008-05-08 14:31        ---------        d-----w        C:\Program Files\CCleaner

2008-05-08 14:23        2,751,368        ----a-w        C:\Users\***\ccsetup206.exe

2008-05-07 14:17        725,212        ----a-w        C:\Users\***\avenger.zip

2008-05-06 18:52        193,229        ----a-w        C:\Users\***\PCAntispyware_Installer.exe

2008-05-06 18:03        ---------        d-----w        C:\ProgramData\nfwspjcq

2008-05-06 18:01        ---------        d-----w        C:\Users\***\AppData\Roaming\Free Download Manager

2008-05-06 17:29        ---------        d-----w        C:\Users\Admin\AppData\Roaming\MyPhoneExplorer

2008-05-06 17:29        ---------        d-----w        C:\Users\Admin\AppData\Roaming\AD ON Multimedia

2008-05-06 17:27        3,346,598        ----a-w        C:\Users\***\MyPhoneExplorer_Setup_1.6.7.exe

2008-05-06 16:16        ---------        d-----w        C:\Users\***\AppData\Roaming\Malwarebytes

2008-05-06 16:13        ---------        d-----w        C:\Users\Admin\AppData\Roaming\Malwarebytes

2008-05-06 16:13        ---------        d-----w        C:\ProgramData\Malwarebytes

2008-05-06 16:13        ---------        d-----w        C:\Program Files\Malwarebytes' Anti-Malware

2008-05-06 15:54        1,505,568        ----a-w        C:\Users\***\mbam-setup.exe

2008-05-06 14:41        6,580        ----a-w        C:\Windows\System32\tmp.reg

2008-05-06 13:45        1,389,662        ----a-w        C:\Users\***\SmitfraudFix.exe

2008-05-06 13:11        ---------        d-----w        C:\Program Files\SmartDraw 2008

2008-05-04 18:28        ---------        d-----w        C:\Program Files\Sony Ericsson

2008-05-04 10:31        ---------        d-----w        C:\Users\Admin\AppData\Roaming\WTablet

2008-05-02 19:20        ---------        d-----w        C:\Users\***\AppData\Roaming\DNA

2008-05-02 11:32        ---------        d-----w        C:\Program Files\Tablet

2008-05-02 11:30        ---------        d-----w        C:\ProgramData\AppData

2008-05-01 08:14        ---------        d-----w        C:\Program Files\Windows Mail

2008-05-01 07:58        ---------        d-----w        C:\Program Files\Alwil Software

2008-05-01 07:51        ---------        d-----w        C:\ProgramData\Avira

2008-04-30 18:12        ---------        d-----w        C:\ProgramData\hmzovatq

2008-04-30 15:09        ---------        d-----w        C:\Program Files\Free FLV Converter

2008-04-30 13:16        83,028        ----a-w        C:\Users\***\AppData\Roaming\nvModes.dat

2008-04-28 06:03        82,944        ----a-w        C:\Windows\System32\IEDFix.exe

2008-04-28 06:03        82,944        ----a-w        C:\Windows\System32\404Fix.exe

2008-04-27 09:06        ---------        d-----w        C:\Program Files\Trymedia

2008-04-27 07:09        ---------        d-----w        C:\Users\***\AppData\Roaming\Software Informer

2008-04-26 19:39        ---------        d-----w        C:\Users\***\AppData\Roaming\BitTorrent

2008-04-26 19:05        ---------        d-----w        C:\Users\***\AppData\Roaming\GHISLER

2008-04-26 18:56        ---------        d-----w        C:\ProgramData\FreeDownloadManager.ORG

2008-04-26 08:55        ---------        d-----w        C:\Program Files\PowerISO

2008-04-25 13:29        ---------        d-----w        C:\ProgramData\Test Drive Unlimited

2008-04-24 06:10        86,528        ----a-w        C:\Windows\System32\VACFix.exe

2008-04-15 08:56        ---------        d-----w        C:\Users\***\AppData\Roaming\SmartDraw

2008-04-13 12:19        ---------        d-----w        C:\Users\***\AppData\Roaming\FileZilla

2008-04-13 08:33        ---------        d-----w        C:\Program Files\FileZilla FTP Client

2008-04-09 15:05        ---------        d-----w        C:\Program Files\Free Windows Registry Cleaner

2008-04-08 18:14        ---------        d-----w        C:\Program Files\RegCleaner

2008-04-08 17:16        ---------        d-----w        C:\Program Files\Common Files\L&H

2008-04-08 17:11        ---------        d--h--w        C:\Program Files\InstallShield Installation Information

2008-04-08 17:11        ---------        d-----w        C:\Program Files\Microsoft Reader

2008-04-07 13:39        ---------        d-----w        C:\Users\***\AppData\Roaming\DynaGeo

2008-04-06 09:48        ---------        d-----w        C:\Program Files\MyPlayCity.com

2008-04-06 09:26        ---------        d-----w        C:\ProgramData\BOONTY

2008-04-06 09:26        ---------        d-----w        C:\Program Files\Common Files\BOONTY Shared

2008-04-06 09:18        ---------        d-----w        C:\Program Files\ArtMoney

2008-04-05 20:38        ---------        d-----w        C:\Program Files\Infogrames

2008-04-05 18:47        ---------        d-----w        C:\Program Files\A.F.7 Merge your files 1.3

2008-03-29 19:13        ---------        d-----w        C:\Users\***\AppData\Roaming\FrostWire

2008-03-29 18:21        ---------        d-----w        C:\ProgramData\WinZip

2008-03-29 17:32        50,768        ----a-w        C:\Windows\system32\drivers\aswMonFlt.sys

2008-03-27 17:46        ---------        d-----w        C:\Program Files\Gothic III

2008-03-26 16:23        43,520        ----a-w        C:\Windows\System32\CmdLineExt03.dll

2008-03-25 17:44        ---------        d-----w        C:\Program Files\AVIConverter

2008-03-19 15:41        ---------        d-----w        C:\Users\***\AppData\Roaming\gtk-2.0

2008-03-17 14:38        ---------        d-----w        C:\Program Files\Maschinenschreiben Deluxe

2008-03-17 11:31        ---------        d-----w        C:\Program Files\iTunes

2008-03-17 11:17        ---------        d-----w        C:\Program Files\Vista OS X

2008-03-17 10:58        ---------        d-----w        C:\Program Files\CodeGazer

2008-03-16 11:37        ---------        d-----w        C:\Program Files\Risk

2008-03-16 11:07        ---------        d-----w        C:\Users\***\AppData\Roaming\Azureus

2008-03-16 10:56        ---------        d-----w        C:\Program Files\Java

2008-03-16 10:40        ---------        d-----w        C:\ProgramData\eMule

2008-03-16 08:22        ---------        d-----w        C:\Program Files\DNA

2008-03-15 19:24        ---------        d-----w        C:\Program Files\AskSBar

2008-03-15 19:21        ---------        d-----w        C:\Users\***\AppData\Roaming\LimeWire

2008-03-14 06:04        46,652        ----a-w        C:\Windows\system32\drivers\scdemu.sys

2008-03-11 12:46        ---------        d-----w        C:\Program Files\Common Files\Symantec Shared

2008-03-11 12:45        ---------        d-----w        C:\ProgramData\Symantec

2008-03-10 17:14        ---------        d-----w        C:\Program Files\EA GAMES

2008-02-29 04:16        2,027,008        ----a-w        C:\Windows\System32\win32k.sys

2008-02-21 04:43        826,368        ----a-w        C:\Windows\System32\wininet.dll

2008-02-21 04:43        56,320        ----a-w        C:\Windows\System32\iesetup.dll

2008-02-21 04:43        52,736        ----a-w        C:\Windows\AppPatch\iebrshim.dll

2008-02-21 04:43        296,448        ----a-w        C:\Windows\System32\gdi32.dll

2008-02-21 04:43        26,624        ----a-w        C:\Windows\System32\ieUnatt.exe

2008-02-14 18:27        194,560        ----a-w        C:\Windows\System32\WebClnt.dll

2008-02-14 14:29        7,168        ----a-w        C:\Windows\System32\f3ahvoas.dll

2008-02-14 14:29        613,888        ----a-w        C:\Windows\System32\wpd_ci.dll

2008-02-14 14:29        6,656        ----a-w        C:\Windows\System32\kbd106n.dll

2008-02-14 14:29        558,080        ----a-w        C:\Windows\System32\oleaut32.dll

2008-02-14 14:29        35,328        ----a-w        C:\Windows\System32\dispci.dll

2008-02-14 14:29        260,096        ----a-w        C:\Windows\System32\dpx.dll

2008-02-14 14:29        224,824        ----a-w        C:\Windows\System32\clfs.sys

2008-02-14 14:29        221,696        ----a-w        C:\Windows\System32\umpnpmgr.dll

2008-02-14 14:29        19,456        ----a-w        C:\Windows\System32\cfgmgr32.dll

2008-02-14 14:29        12,800        ----a-w        C:\Windows\System32\batt.dll

2008-02-14 14:29        101,888        ----a-w        C:\Windows\System32\drvinst.exe

2008-02-14 14:29        1,585,664        ----a-w        C:\Windows\System32\setupapi.dll

2008-02-14 14:25        3,504,696        ----a-w        C:\Windows\System32\ntkrnlpa.exe

2008-02-14 14:25        3,470,392        ----a-w        C:\Windows\System32\ntoskrnl.exe

2008-02-14 14:24        24,064        ----a-w        C:\Windows\System32\netcfg.exe

2008-01-01 13:15        16,384        --sha-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-01-01 13:15        32,768        --sha-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-01-01 13:15        16,384        --sha-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.
 

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6237B16D-70F2-4D04-ADD7-6ADAF1FE9617}]

                        C:\Windows\system32\tuvVNExY.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL" [2008-03-15 21:24 267592]
 

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-03-15 21:24 267592]
 

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-13 04:02 1232896]

"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]

"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 11:29 413696]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-04-15 12:48 1006264]

"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-14 20:07 411768]

"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2006-12-07 17:49 55416]

"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe" [2006-12-14 20:09 493688]

"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]

"RtHDVCpl"="RtHDVCpl.exe" [2006-11-07 15:50 3772416 C:\Windows\RtHDVCpl.exe]

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-13 16:42 554640]

"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:35 176128]

"Acrobat Assistant 8.0"="H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [ ]

"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]

"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 13:45 75304]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-06 18:56 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-06 18:56 8493600]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-06 18:56 81920]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]

"Adobe Reader Speed Launcher"="E:\Adobe\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"LogonHoursAction"= 2 (0x2)

"DontDisplayLogonHoursWarnings"= 1 (0x1)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"jUEaiEOHPm"= C:\ProgramData\hmzovatq\xkpapszm.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{42EE9134-CB88-4003-B1E6-237774E43D0D}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"TCP Query User{2C35729F-B9CB-4B0C-999E-3DEA763D9F61}C:\\program files\\team17\\worms 3d\\bin\\worms3d.exe"= UDP:C:\program files\team17\worms 3d\bin\worms3d.exe:worms3d

"UDP Query User{3D20A34F-9184-4CE9-99D6-AB7BDCE2A952}C:\\program files\\team17\\worms 3d\\bin\\worms3d.exe"= TCP:C:\program files\team17\worms 3d\bin\worms3d.exe:worms3d

"{E064E23E-953E-4FC2-9D0B-8AF0E1F49C4D}"= UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4

"{73EB12D5-8924-47AF-8EE9-A9098A69A5AC}"= TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4

"TCP Query User{CC9F9FC9-4146-4F0A-B49D-208A397466F2}C:\\scol\\usmwin.exe"= UDP:C:\scol\usmwin.exe:UsmWin

"UDP Query User{9CD095D7-AF99-45B9-801E-5FEB091F2701}C:\\scol\\usmwin.exe"= TCP:C:\scol\usmwin.exe:UsmWin

"TCP Query User{545140D6-49B1-4C7C-9E6D-3D7D7468C8D8}C:\\program files\\ascaron entertainment\\sacred\\sacred.exe"= UDP:C:\program files\ascaron entertainment\sacred\sacred.exe:Sacred

"UDP Query User{144FCD72-6DD6-4BF5-A5CD-C8B9D302E866}C:\\program files\\ascaron entertainment\\sacred\\sacred.exe"= TCP:C:\program files\ascaron entertainment\sacred\sacred.exe:Sacred

"TCP Query User{2A9125B3-84A8-479A-BD82-ED3A5F005710}E:\\testdrive unlimited\\testdriveunlimited.exe"= UDP:E:\testdrive unlimited\testdriveunlimited.exe:Test Drive Unlimited

"UDP Query User{2D6BBF45-719D-4525-8AF9-BC0AE3FC8611}E:\\testdrive unlimited\\testdriveunlimited.exe"= TCP:E:\testdrive unlimited\testdriveunlimited.exe:Test Drive Unlimited

"TCP Query User{4AF7F1CC-1365-479A-95B9-81B56FBCF353}E:\\vgigant\\vgigant.exe"= UDP:E:\vgigant\vgigant.exe:MFC-Anwendung default

"UDP Query User{9675689C-1230-4A6B-A272-9A2485B202C1}E:\\vgigant\\vgigant.exe"= TCP:E:\vgigant\vgigant.exe:MFC-Anwendung default

"{7728616D-19DA-4C28-8DF9-34C32C2EE5A2}"= UDP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe

"{74228402-2C31-41F1-BAAD-B3997CEC5CD3}"= TCP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe

"{FF33614A-DEB3-4589-9F35-20522EB5D3EF}"= UDP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

"{E895D9C2-1785-430A-B2D4-508B9D25EAD0}"= TCP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

"{8FCB0657-64DC-485A-AECD-F6F6DE6575B2}"= UDP:3703:Adobe Version Cue CS3 Server

"{F019B9DE-88EF-4F56-8D5D-4CC40F53C293}"= UDP:3704:Adobe Version Cue CS3 Server

"{952B5BE3-7A6F-44CD-A749-0867AC6F6533}"= UDP:50900:Adobe Version Cue CS3 Server

"{DF247C40-0A4E-4827-8E1C-858792C08A62}"= UDP:50901:Adobe Version Cue CS3 Server

"{BCD39D22-AD93-4B4F-83BC-D70287B6836A}"= UDP:C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server

"{59B3DE7E-888A-413D-AD52-135A85B9DDBE}"= TCP:C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server

"{E74A2C0F-626C-4B1F-B7DA-520DEB670C1A}"= UDP:C:\Program Files\DNA\btdna.exe:DNA

"{97211BB8-0349-4E4A-BCA2-74A6F22D05F4}"= TCP:C:\Program Files\DNA\btdna.exe:DNA

"{FD02D60B-93B1-450E-93FC-A17CAB211202}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{1D9FD9B3-FB72-4B50-9CA4-3DCF6737754C}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{AE9EE46E-86FC-40C0-B694-F288BF4A44EE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{E48CA54E-FAAA-45C3-8104-54E13980EC72}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{BCE3AE7D-B148-4A15-AB0A-69129EB7529B}"= UDP:H:\ITUNES\iTunes.exe:iTunes

"{19975A38-2231-460E-B691-66DCF091A0B7}"= TCP:H:\ITUNES\iTunes.exe:iTunes

"TCP Query User{25832DDA-52DD-43F3-BD70-175789D9B1BC}C:\\program files\\frostwire\\frostwire.exe"= UDP:C:\program files\frostwire\frostwire.exe:FrostWire

"UDP Query User{30F6EE18-35FF-4CC1-83E3-C3DF70971670}C:\\program files\\frostwire\\frostwire.exe"= TCP:C:\program files\frostwire\frostwire.exe:FrostWire

"TCP Query User{9651BD12-553B-4AEF-8153-0AAE9B1927CB}E:\\emule\\emule.exe"= UDP:E:\emule\emule.exe:eMule

"UDP Query User{E7FD6214-2CE9-436C-9DCF-CA9E28B8E756}E:\\emule\\emule.exe"= TCP:E:\emule\emule.exe:eMule

"TCP Query User{D33C38F8-E4A4-4062-B765-0D8D90A2C2E2}E:\\azureus\\azureus.exe"= UDP:E:\azureus\azureus.exe:Azureus

"UDP Query User{E60032C4-687B-4DC9-B1EA-B7AB16C89F89}E:\\azureus\\azureus.exe"= TCP:E:\azureus\azureus.exe:Azureus

"{0918C51F-4C50-422B-8623-B1CD641B1112}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{74066FAD-AE15-4D8B-A039-31AFCDD30FB2}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{18BB9978-FF06-407D-A365-E61C299F489E}"= UDP:H:\BitTorrent\bittorrent.exe:BitTorrent

"{D94F5E3D-4418-4964-8827-AF238A3A9A3E}"= TCP:H:\BitTorrent\bittorrent.exe:BitTorrent

"TCP Query User{84A7B4DA-59C0-4113-8B4C-DF072C677498}C:\\phpdev5\\apache2\\bin\\apache.exe"= UDP:C:\phpdev5\apache2\bin\apache.exe:Apache HTTP Server

"UDP Query User{B4C9F87F-9BD7-46CC-BD8A-8781F4569AE8}C:\\phpdev5\\apache2\\bin\\apache.exe"= TCP:C:\phpdev5\apache2\bin\apache.exe:Apache HTTP Server

"TCP Query User{2B178FEC-F2BA-4181-A2C3-4300FA9E3A52}C:\\phpdev5\\mysql\\bin\\mysqld-nt.exe"= UDP:C:\phpdev5\mysql\bin\mysqld-nt.exe:mysqld-nt

"UDP Query User{DB89CC75-BD3A-4FB2-9245-02CF3B47AF39}C:\\phpdev5\\mysql\\bin\\mysqld-nt.exe"= TCP:C:\phpdev5\mysql\bin\mysqld-nt.exe:mysqld-nt

"{5A7380FD-07D8-4816-86AD-2980C80DCC03}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

"{E9B14BDE-BAD4-4349-93DC-04C5C2CFFDC2}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

"TCP Query User{0A23A62B-2AFC-4DB8-BA99-3AC4981D82A1}C:\\users\\***\\xampp\\mysql\\bin\\mysqld.exe"= UDP:C:\users\***\xampp\mysql\bin\mysqld.exe:mysqld.exe

"UDP Query User{1BFBC6AD-4523-4729-8994-6B3418DE7607}C:\\users\\***\\xampp\\mysql\\bin\\mysqld.exe"= TCP:C:\users\***\xampp\mysql\bin\mysqld.exe:mysqld.exe

"TCP Query User{84AA94BC-3B20-4446-B2EB-EFA3C3293946}C:\\users\\***\\xampp\\apache\\bin\\apache.exe"= UDP:C:\users\***\xampp\apache\bin\apache.exe:apache.exe

"UDP Query User{AF597100-DEA4-42AD-BE04-01FB09E7FA25}C:\\users\\***\\xampp\\apache\\bin\\apache.exe"= TCP:C:\users\***\xampp\apache\bin\apache.exe:apache.exe

"TCP Query User{D9629B20-3AB8-45DB-BE7C-38436E6525CA}E:\\program files\\global star software\\airport tycoon 3\\at3.exe"= UDP:E:\program files\global star software\airport tycoon 3\at3.exe:at3

"UDP Query User{6514A8F1-7520-446B-89D3-E6185CAEC77F}E:\\program files\\global star software\\airport tycoon 3\\at3.exe"= TCP:E:\program files\global star software\airport tycoon 3\at3.exe:at3

"TCP Query User{024C16F0-5DB0-4CFE-9809-BAF9FACD6B82}E:\\program files\\airport tycoon 3\\at3.exe"= UDP:E:\program files\airport tycoon 3\at3.exe:at3

"UDP Query User{2DA6C647-6016-4EFC-AF4B-FA0D0E255335}E:\\program files\\airport tycoon 3\\at3.exe"= TCP:E:\program files\airport tycoon 3\at3.exe:at3
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
 

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]

R1 uigxrdr;uigxrdr;C:\Windows\system32\DRIVERS\uigxrdr.sys [2008-02-05 11:26]

R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-05-17 23:45]

R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2006-10-31 23:40]

R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-19 23:11]

R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]

S2 dev5_ap1;dev5_ap1;"C:\phpdev5\apache\Apache.exe" --ntservice []

S2 dev5_ap2;dev5_ap2;"C:\phpdev5\apache2\bin\Apache.exe" -k runservice []

S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" [2008-04-06 11:26]

S3 tosrfec;Bluetooth ACPI;C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 17:32]

S3 wacommousefilter;Wacom Mouse Filter Driver;C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11:12]

S3 wampapache;wampapache;"H:\wamp\apache2\bin\Apache.exe" -k runservice []

S3 wampmysqld;wampmysqld;H:\wamp\mysql\bin\mysqld-nt.exe []

S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]

S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]
 

.

Inhalt des "geplante Tasks" Ordners

"2008-05-08 14:49:51 C:\Windows\Tasks\SDMsgUpdate (TE).job"

- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://***.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X

"2008-05-08 15:20:20 C:\Windows\Tasks\User_Feed_Synchronization-{D9B30BB4-63C0-47D4-A444-A174F9308500}.job"

- C:\Windows\system32\msfeedssync.exe

.

**************************************************************************
 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://***.gmer.net

Rootkit scan 2008-05-08 17:22:53

Windows 6.0.6000  NTFS
 

Scanne versteckte Prozesse...
 

Scanne versteckte Autostart Einträge...
 

Scanne versteckte Dateien...
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

Zeit der Fertigstellung: 2008-05-08 17:24:47

ComboFix-quarantined-files.txt  2008-05-08 15:24:04
 

      Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.

      Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.
 

306        --- E O F ---        2008-05-07 13:12:52

myrtille

08.05.2008 16:46

Hi,
da war ja noch einiges :D
Ich poste dir nachher ein Log um den Rest zu entfernen, das kann aber erst gegen 8 Uhr sein.

Hast du dir Boonty Games installiert? Willst du es behalten, oder sollen wir das mitlöschen?

lg myrtille

tnowacki

08.05.2008 17:03

Hier nochmal ein Hijack:

Code:

Logfile of HijackThis v1.99.1

Scan saved at 18:01, on 2008-05-08

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\WTablet\TabUserW.exe

C:\ProgramData\hmzovatq\xkpapszm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\ProgramData\nfwspjcq\tofqzalu.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\rundll32.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Windows\Explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Alwil Software\Avast4\ashSimpl.exe

C:\Users\***\Documents\hijackthis_199\HijackThis.exe

C:\ProgramData\nfwspjcq\tofqzalu.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://***.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (file missing)

O2 - BHO: (no name) - {6237B16D-70F2-4D04-ADD7-6ADAF1FE9617} - C:\Windows\system32\tuvVNExY.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (file missing)

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Adobe\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [nfwspjcq] C:\ProgramData\nfwspjcq\tofqzalu.exe

O4 - HKCU\..\Run: [5cf5f10c] rundll32.exe "C:\Users\***\AppData\Local\Temp\eivktfdf.dll",b

O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\***\AppData\Local\Temp\wvUNEvWO.dll,#1

O8 - Extra context menu item: Alles mit FDM herunterladen - file://E:\Free Download Manager\dlall.htm

O8 - Extra context menu item: An vorhandenes PDF anfügen - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://E:\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Datei mit FDM herunterladen - file://E:\Free Download Manager\dllink.htm

O8 - Extra context menu item: In Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Videos mit FDM herunterladen - file://E:\Free Download Manager\dlfvideo.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://***.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?http://***.ebay.de/ (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O11 - Options group: [INTERNATIONAL] International*

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - Gopher Prefix: 

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe Version Cue CS3 {de_DE}  (Adobe Version Cue CS3) - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: dev5_ap1 - Unknown owner - C:\phpdev5\apache\Apache.exe" --ntservice (file missing)

O23 - Service: dev5_ap2 - Unknown owner - C:\phpdev5\apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Boonty Games? Was ist das?

tnowacki

08.05.2008 19:24

Zitat:

Ich poste dir nachher ein Log um den Rest zu entfernen, das kann aber erst gegen 8 Uhr sein

Es ist jetzt 8:30.
edit: nicht böse ^^

myrtille

08.05.2008 19:34

Ey, super.
Ich war bis eben auf Arbeit,wär auch lieber früher heimgegangen, das kannst du mir glauben.Aber irgendwie muss ich ja auch überleben, und bin her gekommen bevor ich zu Abendessen.

Da ist es absolut motivierend sowas hier zu lesen. :koch:

tnowacki

08.05.2008 19:39

Tschuldige... hab das smiley vergessen :(

myrtille

08.05.2008 20:22

Hi,
also du bist schon mordsmäßig infiziert. Ich würd über eine Neuinstallation nachdenken.
Zumal du offensichtlich schon länger infiziert bist.

Wenn du das nicht willst, nimm Folgendes vor:

kopiere den blauen Text in deinen Editor

Folder::
C:\Users\***\pms2.zip
C:\Users\***\PCAntispyware_Installer.exe
C:\ProgramData\nfwspjcq
C:\Program Files\SmartDraw 2008
C:\ProgramData\hmzovatq
C:\Program Files\Trymedia
C:\ProgramData\Test Drive Unlimited
C:\ProgramData\BOONTY
C:\Program Files\Common Files\BOONTY Shared
C:\Program Files\AskSBar

File::
C:\Windows\system32\tuvVNExY.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6237B16D-70F2-4D04-ADD7-6ADAF1FE9617}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= -
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= -
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"jUEaiEOHPm"= -

drivers::
Boonty Games
Speichere den Text als CFScript
Ziehe die Datei CFScript auf ComboFix.exe
Wenn alles gutgeht erscheint ein Fenster Type 1 to continue, or 2 to abort. Wähle 1 aus und bestätige mit <enter>
Warte bitte ab bis Combofix fertig gearbeitet hat.
Poste das erstellte Log dann hier

+ neues Hijackthislog + einen neuen Scan mit Malwarebytes

Ich bin dann erstmal essen
lg myrtille

tnowacki

08.05.2008 20:44

Ich habe auch schon über eine Neuinstallation gedacht. Zum Glück mache ich regelmäßig Backups von meinen pers. Dateien. :)

myrtille

08.05.2008 21:00

Soweit ich das von hier beurteilen kann, hast du keinen Backdoor auf deinem Rechner, allerdings eine MENGE Crapware/Adware und Spyware.
Zumindest bei einigen dieser Gesellen handelt es sich eindeutig um neue Varianten, die von den Fixtools derzeit noch nicht richtig erkannt werden und die vor allem in Ordnern liegen, die bisher von vielen Tools nicht näher beachtet wurden.
Daher ist eine Bereinigung komplizierter, aber nicht unmöglich.

Zugezogen hast du dir das meiste mE über Spiele (myplaycity, boonty, freebla, blubblub. Guck einfach mal die Ordner in C:\Programme durch: Welche hast du installiert, welchse sind "erschienen") und vor allem über P2P.
Ich will dir hier keinen Vortrag über legale/illegale Downloads halten, da ich nicht weiß was du runterlädst.
Allerdings sollte dir klar sein dass wahrscheinlich weit über die Hälfte des Angebots bei P2P Viren & Schlimmeres sind. Ich würde dir alleine deswegen raten davon Abstand zu nehmen.

EDIT: Auf Wunsch eines einzelnen Herren, erstell bitte noch ein Hijackthislogfile mit dem aktuellen Hijackthis: Bitte hier runterladen. Version 2.0.2
Danke :)

lg myrtille

tnowacki

09.05.2008 13:20

Zitat:

Zitat von myrtille (Beitrag 337246)

Ich habe ein paar Spiele, aber allesamt legal erworben!
eMule brauchte ich nur, weil mein Freund dort eine Datei für ein Referat gelagert hatte!
Aber es beruhigt mich, dass ich keinen Backdoor habe :)

myrtille

09.05.2008 14:00

Hehe, ich hab nie gesagt, dass du etwas Illegales getan hast, ganz im Gegenteil.
Ich denke du hast das Pech gehabt dir Spiele zu installieren, deren Programmierer/Vertreiber es nicht allzugenau mit der Legalität nehmen, gerade Boonty hat einen sehr mäßigen Ruf und installiert sich gern mal ungemeldet mit anderen Spielen mit.
@P2P
Ich sags ja nur. :p
Dort ist es auf jedenfall am einfachsten sich solche Späße zuzuziehen.

Wie willst du jetzt weitervorgehen?
lg myrtille

tnowacki

09.05.2008 14:22

Als erstes werde ich dieses ComboFix nochmal laufen lassen und hjt reinstellen, dann muss ich auf dein Urteil zählen :heilig:

tnowacki

09.05.2008 20:27

Aaaaalso: Nach 3 Stunden allerlei Logs hier die BErichte:
zuerst der HJT:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:21, on 2008-05-09

Platform: Windows Vista  (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\WTablet\TabUserW.exe

C:\ProgramData\hmzovatq\xkpapszm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\ProgramData\nfwspjcq\tofqzalu.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (file missing)

O2 - BHO: (no name) - {6237B16D-70F2-4D04-ADD7-6ADAF1FE9617} - C:\Windows\system32\tuvVNExY.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (file missing)

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Adobe\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKLM\..\Policies\Explorer\Run: [jUEaiEOHPm] C:\ProgramData\hmzovatq\xkpapszm.exe

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (User '***')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [MSServer] rundll32.exe C:\Users\***\AppData\Local\Temp\qoMdBUMc.dll,#1 (User '***')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [rohnjspn] C:\ProgramData\rohnjspn\qridwtob.exe (User '***')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [cmds] rundll32.exe C:\Users\***\AppData\Local\Temp\rqRHawuU.dll,c (User '***')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://***.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?http://***.ebay.de/ (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - Gopher Prefix: 

O23 - Service: Adobe Version Cue CS3 {de_DE}  (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: dev5_ap1 - Unknown owner - C:\phpdev5\apache\Apache.exe (file missing)

O23 - Service: dev5_ap2 - Apache Software Foundation - C:\phpdev5\apache2\bin\Apache.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe (file missing)

O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe (file missing)
 

--

End of file - 10644 bytes

Dann der ComboFix:

Code:

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{42EE9134-CB88-4003-B1E6-237774E43D0D}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"TCP Query User{2C35729F-B9CB-4B0C-999E-3DEA763D9F61}C:\\program files\\team17\\worms 3d\\bin\\worms3d.exe"= UDP:C:\program files\team17\worms 3d\bin\worms3d.exe:worms3d

"UDP Query User{3D20A34F-9184-4CE9-99D6-AB7BDCE2A952}C:\\program files\\team17\\worms 3d\\bin\\worms3d.exe"= TCP:C:\program files\team17\worms 3d\bin\worms3d.exe:worms3d

"{E064E23E-953E-4FC2-9D0B-8AF0E1F49C4D}"= UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4

"{73EB12D5-8924-47AF-8EE9-A9098A69A5AC}"= TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4

"TCP Query User{CC9F9FC9-4146-4F0A-B49D-208A397466F2}C:\\scol\\usmwin.exe"= UDP:C:\scol\usmwin.exe:UsmWin

"UDP Query User{9CD095D7-AF99-45B9-801E-5FEB091F2701}C:\\scol\\usmwin.exe"= TCP:C:\scol\usmwin.exe:UsmWin

"TCP Query User{545140D6-49B1-4C7C-9E6D-3D7D7468C8D8}C:\\program files\\ascaron entertainment\\sacred\\sacred.exe"= UDP:C:\program files\ascaron entertainment\sacred\sacred.exe:Sacred

"UDP Query User{144FCD72-6DD6-4BF5-A5CD-C8B9D302E866}C:\\program files\\ascaron entertainment\\sacred\\sacred.exe"= TCP:C:\program files\ascaron entertainment\sacred\sacred.exe:Sacred

"TCP Query User{2A9125B3-84A8-479A-BD82-ED3A5F005710}E:\\testdrive unlimited\\testdriveunlimited.exe"= UDP:E:\testdrive unlimited\testdriveunlimited.exe:Test Drive Unlimited

"UDP Query User{2D6BBF45-719D-4525-8AF9-BC0AE3FC8611}E:\\testdrive unlimited\\testdriveunlimited.exe"= TCP:E:\testdrive unlimited\testdriveunlimited.exe:Test Drive Unlimited

"TCP Query User{4AF7F1CC-1365-479A-95B9-81B56FBCF353}E:\\vgigant\\vgigant.exe"= UDP:E:\vgigant\vgigant.exe:MFC-Anwendung default

"UDP Query User{9675689C-1230-4A6B-A272-9A2485B202C1}E:\\vgigant\\vgigant.exe"= TCP:E:\vgigant\vgigant.exe:MFC-Anwendung default

"{7728616D-19DA-4C28-8DF9-34C32C2EE5A2}"= UDP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe

"{74228402-2C31-41F1-BAAD-B3997CEC5CD3}"= TCP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe

"{FF33614A-DEB3-4589-9F35-20522EB5D3EF}"= UDP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

"{E895D9C2-1785-430A-B2D4-508B9D25EAD0}"= TCP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

"{8FCB0657-64DC-485A-AECD-F6F6DE6575B2}"= UDP:3703:Adobe Version Cue CS3 Server

"{F019B9DE-88EF-4F56-8D5D-4CC40F53C293}"= UDP:3704:Adobe Version Cue CS3 Server

"{952B5BE3-7A6F-44CD-A749-0867AC6F6533}"= UDP:50900:Adobe Version Cue CS3 Server

"{DF247C40-0A4E-4827-8E1C-858792C08A62}"= UDP:50901:Adobe Version Cue CS3 Server

"{BCD39D22-AD93-4B4F-83BC-D70287B6836A}"= UDP:C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server

"{59B3DE7E-888A-413D-AD52-135A85B9DDBE}"= TCP:C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server

"{E74A2C0F-626C-4B1F-B7DA-520DEB670C1A}"= UDP:C:\Program Files\DNA\btdna.exe:DNA

"{97211BB8-0349-4E4A-BCA2-74A6F22D05F4}"= TCP:C:\Program Files\DNA\btdna.exe:DNA

"{FD02D60B-93B1-450E-93FC-A17CAB211202}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{1D9FD9B3-FB72-4B50-9CA4-3DCF6737754C}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{AE9EE46E-86FC-40C0-B694-F288BF4A44EE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{E48CA54E-FAAA-45C3-8104-54E13980EC72}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{BCE3AE7D-B148-4A15-AB0A-69129EB7529B}"= UDP:H:\ITUNES\iTunes.exe:iTunes

"{19975A38-2231-460E-B691-66DCF091A0B7}"= TCP:H:\ITUNES\iTunes.exe:iTunes

"TCP Query User{25832DDA-52DD-43F3-BD70-175789D9B1BC}C:\\program files\\frostwire\\frostwire.exe"= UDP:C:\program files\frostwire\frostwire.exe:FrostWire

"UDP Query User{30F6EE18-35FF-4CC1-83E3-C3DF70971670}C:\\program files\\frostwire\\frostwire.exe"= TCP:C:\program files\frostwire\frostwire.exe:FrostWire

"TCP Query User{9651BD12-553B-4AEF-8153-0AAE9B1927CB}E:\\emule\\emule.exe"= UDP:E:\emule\emule.exe:eMule

"UDP Query User{E7FD6214-2CE9-436C-9DCF-CA9E28B8E756}E:\\emule\\emule.exe"= TCP:E:\emule\emule.exe:eMule

"TCP Query User{D33C38F8-E4A4-4062-B765-0D8D90A2C2E2}E:\\azureus\\azureus.exe"= UDP:E:\azureus\azureus.exe:Azureus

"UDP Query User{E60032C4-687B-4DC9-B1EA-B7AB16C89F89}E:\\azureus\\azureus.exe"= TCP:E:\azureus\azureus.exe:Azureus

"{0918C51F-4C50-422B-8623-B1CD641B1112}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{74066FAD-AE15-4D8B-A039-31AFCDD30FB2}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{18BB9978-FF06-407D-A365-E61C299F489E}"= UDP:H:\BitTorrent\bittorrent.exe:BitTorrent

"{D94F5E3D-4418-4964-8827-AF238A3A9A3E}"= TCP:H:\BitTorrent\bittorrent.exe:BitTorrent

"TCP Query User{84A7B4DA-59C0-4113-8B4C-DF072C677498}C:\\phpdev5\\apache2\\bin\\apache.exe"= UDP:C:\phpdev5\apache2\bin\apache.exe:Apache HTTP Server

"UDP Query User{B4C9F87F-9BD7-46CC-BD8A-8781F4569AE8}C:\\phpdev5\\apache2\\bin\\apache.exe"= TCP:C:\phpdev5\apache2\bin\apache.exe:Apache HTTP Server

"TCP Query User{2B178FEC-F2BA-4181-A2C3-4300FA9E3A52}C:\\phpdev5\\mysql\\bin\\mysqld-nt.exe"= UDP:C:\phpdev5\mysql\bin\mysqld-nt.exe:mysqld-nt

"UDP Query User{DB89CC75-BD3A-4FB2-9245-02CF3B47AF39}C:\\phpdev5\\mysql\\bin\\mysqld-nt.exe"= TCP:C:\phpdev5\mysql\bin\mysqld-nt.exe:mysqld-nt

"{5A7380FD-07D8-4816-86AD-2980C80DCC03}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

"{E9B14BDE-BAD4-4349-93DC-04C5C2CFFDC2}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

"TCP Query User{0A23A62B-2AFC-4DB8-BA99-3AC4981D82A1}C:\\users\\***\\xampp\\mysql\\bin\\mysqld.exe"= UDP:C:\users\***\xampp\mysql\bin\mysqld.exe:mysqld.exe

"UDP Query User{1BFBC6AD-4523-4729-8994-6B3418DE7607}C:\\users\\***\\xampp\\mysql\\bin\\mysqld.exe"= TCP:C:\users\***\xampp\mysql\bin\mysqld.exe:mysqld.exe

"TCP Query User{84AA94BC-3B20-4446-B2EB-EFA3C3293946}C:\\users\\***\\xampp\\apache\\bin\\apache.exe"= UDP:C:\users\***\xampp\apache\bin\apache.exe:apache.exe

"UDP Query User{AF597100-DEA4-42AD-BE04-01FB09E7FA25}C:\\users\\***\\xampp\\apache\\bin\\apache.exe"= TCP:C:\users\***\xampp\apache\bin\apache.exe:apache.exe

"TCP Query User{D9629B20-3AB8-45DB-BE7C-38436E6525CA}E:\\program files\\global star software\\airport tycoon 3\\at3.exe"= UDP:E:\program files\global star software\airport tycoon 3\at3.exe:at3

"UDP Query User{6514A8F1-7520-446B-89D3-E6185CAEC77F}E:\\program files\\global star software\\airport tycoon 3\\at3.exe"= TCP:E:\program files\global star software\airport tycoon 3\at3.exe:at3

"TCP Query User{024C16F0-5DB0-4CFE-9809-BAF9FACD6B82}E:\\program files\\airport tycoon 3\\at3.exe"= UDP:E:\program files\airport tycoon 3\at3.exe:at3

"UDP Query User{2DA6C647-6016-4EFC-AF4B-FA0D0E255335}E:\\program files\\airport tycoon 3\\at3.exe"= TCP:E:\program files\airport tycoon 3\at3.exe:at3
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
 

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]

R1 uigxrdr;uigxrdr;C:\Windows\system32\DRIVERS\uigxrdr.sys [2008-02-05 11:26]

R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-05-17 23:45]

R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2006-10-31 23:40]

R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-19 23:11]

R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]

S2 dev5_ap1;dev5_ap1;"C:\phpdev5\apache\Apache.exe" --ntservice []

S2 dev5_ap2;dev5_ap2;"C:\phpdev5\apache2\bin\Apache.exe" -k runservice []

S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" []

S3 tosrfec;Bluetooth ACPI;C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 17:32]

S3 wacommousefilter;Wacom Mouse Filter Driver;C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11:12]

S3 wampapache;wampapache;"H:\wamp\apache2\bin\Apache.exe" -k runservice []

S3 wampmysqld;wampmysqld;H:\wamp\mysql\bin\mysqld-nt.exe []

S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]

S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]
 

.

Inhalt des "geplante Tasks" Ordners

"2008-05-09 13:42:17 C:\Windows\Tasks\SDMsgUpdate (TE).job"

- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://***.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X

"2008-05-09 14:00:25 C:\Windows\Tasks\User_Feed_Synchronization-{D9B30BB4-63C0-47D4-A444-A174F9308500}.job"

- C:\Windows\system32\msfeedssync.exe

.

**************************************************************************
 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://***.gmer.net

Rootkit scan 2008-05-09 16:07:43

Windows 6.0.6000  NTFS
 

Scanne versteckte Prozesse...
 

Scanne versteckte Autostart Einträge...
 

Scanne versteckte Dateien...
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

Zeit der Fertigstellung: 2008-05-09 16:15:21

ComboFix-quarantined-files.txt  2008-05-09 14:15:16

ComboFix2.txt  2008-05-08 15:24:48
 

      Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.

      Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.
 

1252        --- E O F ---        2008-05-09 12:16:25

Und zuletzt der Malwarebytes:

Code:

Malwarebytes' Anti-Malware 1.09

Database version: 507
 

Scan type: Full Scan (C:\|)

Objects scanned: 287258

Time elapsed: 1 hour(s), 4 minute(s), 52 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 2

Registry Keys Infected: 4

Registry Values Infected: 3

Registry Data Items Infected: 0

Folders Infected: 6

Files Infected: 17
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.
 

Registry Keys Infected:

HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\mwc (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
 

Registry Values Infected:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> No action taken.
 

Registry Data Items Infected:

(No malicious items detected)
 

Folders Infected:

C:\Program Files\MySearch (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
 

Files Infected:

C:\Program Files\MySearch\bar\1.bin\NPMYSRCH.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4FFXTBR.JAR (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4FFXTBR.MANIFEST (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4NTSTBR.JAR (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4NTSTBR.MANIFEST (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\1.bin\S4PLUGIN.DLL (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\000356F5 (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\000361CE.bmp (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\000364E9.bmp (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\History\search2 (Adware.MyWebSearch) -> No action taken.

C:\Program Files\MySearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> No action taken.

C:\Users\***\AppData\Local\Temp\vtUnomjk.dll (Malware.Trace) -> No action taken.

C:\Users\***\AppData\Local\Temp\rqRHawuU.dll (Malware.Trace) -> No action taken.

C:\Windows\System32\vbsys2.dll (Trojan.Clicker) -> No action taken.

C:\Windows\System32\awtoolb.dll (Trojan.Vundo) -> No action taken.

Ich werde daraus nicht schlau :crazy:

myrtille

09.05.2008 20:30

Hi,
beim Combofixlog fehlt der wichtige, obere teil.
Poste den bitte noch.

Ansonsten kann ich nicht viel tun. :p

lg myrtille

tnowacki

09.05.2008 20:32

Ok, HIER (der ganze nochmal :):

Code:

ComboFix 08-05-07.1 - Admin 2008-05-09 16:04:33.5 - NTFSx86

Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.1.1031.18.1000 [GMT 2:00]

ausgeführt von:: C:\Users\***\Desktop\ComboFix.exe

Command switches used :: C:\Users\***\Desktop\CFScript.txt

 * Neuer Wiederherstellungspunkt wurde erstellt
 

FILE ::

C:\Windows\system32\tuvVNExY.dll

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\Users\***\PCAntispyware_Installer.exe\

C:\Users\***\pms2.zip\

.

---- Previous Run -------

.

C:\Program Files\AskSBar

C:\Program Files\Common Files\BOONTY Shared

C:\Program Files\SmartDraw 2008

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Booch\_Booch Callback Diagram_12.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Booch\_Booch Interaction Model - Grocery_13.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Booch\_Booch Object Model - Lemonade Stand_14.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Booch\_Booch State Diagram - 1_15.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Booch\_Booch State Diagram - 2_16.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Catalysis\_Framework Model_18.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Catalysis\_Pre and Postcondition snapsohts_19.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Catalysis\_Registration System_20.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Catalysis\Blank Catalysis Diagram_17.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_ABC Analysis_21.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Course Registration_2_24.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Course Registration_23.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Fulfillment & Replenishment_25.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Generic DFD_26.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Insurance Claims_27.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Online Order System_28.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Quiz Software_29.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Warehouse Cycle Count_30.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\_Warehouse Flow Receiving_31.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Data Flow\Blank Data Flow Diagram_22.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Database Diagrams\_Database Diagram_33.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Database Diagrams\_Databases_34.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Database Diagrams\_Relational Databases_35.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Database Diagrams\_Shared Database_36.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Deployment Diagrams\_Deployment - 1_38.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Deployment Diagrams\_Deployment - 2_39.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Deployment Diagrams\_Deployment - 3_40.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Deployment Diagrams\_Deployment - 4_41.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Deployment Diagrams\_Deployment Diagram Flowchart_42.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Deployment Diagrams\_Order Processing Flowchart_43.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\_Banking Transaction_44.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\_Corporate_46.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\_Department Relationships_47.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\_Hospital Billing System_48.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\_Internet Sales Model_49.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\_Testing Software Database_50.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Entity Relationship Diagrams\Blank Entity Relationship Diagram_45.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Fusion\Blank Fusion Diagram_1.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Awareness of System_51.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Axiological Analysis Diagram_52.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Basketball Game (Finite State Machine)_53.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Context-Game Assessment Views_58.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Context Analysis Systems_55.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Context Boundary Identifiers_56.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Context Influence Mapping_57.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Contexts of Interaction_59.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Figuration Analysis Diagrams_60.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Game Design - 1 (Finite State Machine)_61.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Game Design - 2 (Finite State Machine)_62.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Game Design - 3 (Finite State Machine)_63.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Game Design_64.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Game Tool Icons_65.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Hermeneutic Analysis Paradigm_66.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Heuristics Matrix_67.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Input_68.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_More Transition & Node Analysis Subsystem_69.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Node-Event Relation Diagram_71.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Node Context Schema_70.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Paths Analysis_72.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Player Card_73.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Puzzle Game (Finite State Machine)_74.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Story Board Standard Schema_75.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Transition & Node Analysis Subsystem_76.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Transition Path Analysis_77.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\_Transitions_78.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Game Design\Blank Game Design Diagram_54.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Jackson System Development\Blank JSD Diagram_2.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Jacobson Use Cases\Blank JUC Diagram_3.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Nassi-Shneiderman\_Nassi-Shneiderman - Customer Order_85.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Nassi-Shneiderman\_Nassi-Shneiderman - Withdrawal_86.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Nassi-Shneiderman\_Nassi-Shneiderman Diagram_87.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Nassi-Shneiderman\Blank Nassi-Shneiderman Diagram_84.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\OOSA\_Alarm Clock Diagram_88.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\OOSA\_Substates_90.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\OOSA\_Web Application_91.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\OOSA\Blank OOSA Diagram_89.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_COM Diagram_93.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_COM Server Diagram_94.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Fusion Object Interaction Graph_95.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Fusion Sequence Diagram_96.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Jacobson's OOSE_98.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Jacobson Use Cases_97.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_JSP Diagram - Lunch_99.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_JSP Diagram_100.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Petri Nets - Place & Transition Systems_101.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Petri Nets - Transfer Protocol_102.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Shlaer-Mellor Class Diagram_103.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Shlaer-Mellor Domain Chart_104.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Other Software Diagrams\_Spiral Model - Boehm Model_105.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Petri Nets\Blank Petri Nets_4.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\ROOM\_ROOM Chart_107.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\ROOM\_ROOM Structural Diagram_108.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\ROOM\Blank ROOM Diagram_106.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Rumbaugh\_OMT - Rental Video Store Example_110.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Rumbaugh\_Rumbaugh Diagram - 1_111.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Rumbaugh\Blank Rumbaugh Diagram_109.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Spiral Model\_Spiral Model - 1_113.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Spiral Model\_Spiral Model - 2_114.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Spiral Model\Blank Spiral Diagram_112.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM - Correspondence Diagram_116.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM - Entity Life History_117.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM - Generic Data Flow Diagram _118.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM - Logical Data Model_119.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM Diagram - Aggregation_120.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM Diagram - Composition_121.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM Diagram - Hierarchy_122.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM Diagram - World View_123.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\_SSADM Diagram_124.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\SSADM\Blank SSADM Diagram_115.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Alarm Clock_125.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_ATM Usage_126.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Cell Phone Book_127.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Class Enrollment Diagram_128.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Component Diagram_129.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_CPU Execution_130.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Credit Card Processing_131.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Database to Browser Communication_132.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Databases_133.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Domain Name Manager_134.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Email Connection_135.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Email Encryption_136.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Email Form_137.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Employment Chart_138.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Encapsulation_139.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_General Compiler_140.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_HTML Page_141.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Library System_142.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Log On Scenario_143.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Logon Scenario_144.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Order Processing - 1_145.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Order Processing - 2_146.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Orders_147.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Parse Tree_148.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Pay at Pump_149.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Phone Answering System_150.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Remodeling_151.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Shopping Cart_152.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Simple Model_153.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Substates_154.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_TCP IP Layout_155.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Web Application - 1_156.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Web Application - 2_157.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Web Application Diagram_158.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Web Server Connections_159.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Web Site_160.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\UML - Examples\_Web Transactions_161.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Yourdon Coad\_Rental Video Store Example_163.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Yourdon Coad\_Yourdon Coad Example_164.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Software Design\Yourdon Coad\Blank Yourdon Coad Diagram_162.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Bathroom\_Bathroom Wall - 1_1.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Bathroom\_Bathroom Wall - 2_2.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Bathroom\_Bathroom Wall - 3_3.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Blank Walls\Blank Wall_4.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Cabinet\_Cabinet - 1_5.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Cabinet\_Cabinet - 2_6.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Cabinet\_Cabinet - 3_7.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Closet\_Closet - 1_8.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Closet\_Closet - 2_9.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Closet\_Closet - 3_10.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Entertainment Center\_Entertainment Unit - 1_11.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Entertainment Center\_Entertainment Unit - 2_12.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Entertainment Center\_Entertainment Unit - 3_13.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Garage\_Garage - 1_14.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Garage\_Garage - 2_15.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Garage\_Garage - 3_16.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Kitchen\_Kitchen Cabinets - 1_17.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Kitchen\_Kitchen Cabinets - 2_18.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Kitchen\_Kitchen Cabinets - 3_19.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Laundry\_Laundry Room - 1_20.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Laundry\_Laundry Room - 2_21.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Storage Design\Laundry\_Laundry Room - 3_22.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Blank Timelines\Timeline by Hour_1.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Blank Timelines\Timeline by Month_2.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Blank Timelines\Timeline by Week_3.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Blank Timelines\Timeline by Year_4.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Billing Schedule_5.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Corporate Timeline_6.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_FDA Approval_7.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_History Timeline - America_8.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_History Timeline - Company_9.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Human Genome_10.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Landscaping_11.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Meeting Timeline_12.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Personal Timeline - Officer_13.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Police Report_14.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Security Rounds_15.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Supply Schedule_16.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Suspect Sightings_17.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Suspect Timeline - Dirty Bomb_18.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Trial Timeline - Burglary_19.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Timelines\Examples\_Work Schedule_20.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Annotation\Blank Web Page_1.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Buy Cart_5.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Company - 1_6.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Company - 2_7.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Company - 3_8.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Encyclopedia Article_10.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Enterprise_11.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_News - 1_13.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_News - 2_14.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Nonprofit Organization_15.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Online Store - 1_16.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Online Store - 2_17.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Personal Page_18.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Photo Gallery_19.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Photo_20.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Portfolio_21.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Recent Announcements_22.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Survey - 1_23.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Survey - 2_24.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_Web Forum_25.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\_What's News_26.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Page Layouts\Blank Blank Web Page Layout_4.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Site Maps\_Personal Site_28.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Site Maps\_Software Product Website Map_29.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Site Maps\_Web Services_30.sdt

C:\Program Files\SmartDraw 2008\Templates\2008\Web Design\Web Site Maps\Blank Mind Map_27.sdt

C:\Program Files\SmartDraw 2008\Templates\Icons\Accident Reconstruction.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Accounting & Finance.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Accounting.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Anatomy & Physiology.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Brainstorming.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Calendars.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Case Planning Tools.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Case Planning.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Cause & Effect.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Certificates.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Charts.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Crime Scene Investigation.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Crime Scene Reconstruction.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Crime Scenes.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Decision Trees.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Education.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Engineering.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Estate Planning & Inheritance.png

tnowacki

09.05.2008 20:36

Und Teil 2:

Code:

C:\Program Files\SmartDraw 2008\Templates\Icons\Estate Planning Tools.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Event Planning.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Family Research.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Family Trees.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Floor Plans.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Flowcharts.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Flyers.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Forms.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Free Collections.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Gantt Charts.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Genealogy.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Home Remodeling.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Human Resources.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Information Technology.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Injury Claims.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Landscape Design.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Landscape Plans.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Landscaping.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Law Enforcement Tools.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Management.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Maps.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Marketing Charts.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Marketing.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Medical Examination.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Medical Processes & Procedures.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Medical Processes.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Mind Maps.png

C:\Program Files\SmartDraw 2008\Templates\Icons\My Templates.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Network Design.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Office & Building Planning.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Org Charts.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Patient Care & Education.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Patient Care.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Personal Injury.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Process Design.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Project Management.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Quality Management.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Research & Development.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Retail & Planograms.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Retail Planning.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Sales & Marketing.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Sales.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Science & Math.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Simple Diagrams.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Software Design.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Software Development.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Storage Design.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Timelines.png

C:\Program Files\SmartDraw 2008\Templates\Icons\Web Design.png

C:\Program Files\SmartDraw 2008\Tooltips\Accident_Reconstruction.htm

C:\Program Files\SmartDraw 2008\Tooltips\Accounting.htm

C:\Program Files\SmartDraw 2008\Tooltips\Accounting_Finance.htm

C:\Program Files\SmartDraw 2008\Tooltips\Administration.htm

C:\Program Files\SmartDraw 2008\Tooltips\Anatomy_Physiology.htm

C:\Program Files\SmartDraw 2008\Tooltips\Brainstorming.htm

C:\Program Files\SmartDraw 2008\Tooltips\Calendars.htm

C:\Program Files\SmartDraw 2008\Tooltips\Calendars_Planners.htm

C:\Program Files\SmartDraw 2008\Tooltips\Case_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Case_Planning_Calendars.htm

C:\Program Files\SmartDraw 2008\Tooltips\Case_Planning_Family_Law.htm

C:\Program Files\SmartDraw 2008\Tooltips\Case_Planning_Project_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Case_Planning_Timelines.htm

C:\Program Files\SmartDraw 2008\Tooltips\Cause_Effect.htm

C:\Program Files\SmartDraw 2008\Tooltips\Certificates.htm

C:\Program Files\SmartDraw 2008\Tooltips\Charts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Corporate_Flowcharts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Corporate_Org_Charts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Crime_Scenes.htm

C:\Program Files\SmartDraw 2008\Tooltips\Decision_Trees.htm

C:\Program Files\SmartDraw 2008\Tooltips\Education.htm

C:\Program Files\SmartDraw 2008\Tooltips\Engineering.htm

C:\Program Files\SmartDraw 2008\Tooltips\Estate_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Estate_Planning_Inheritance.htm

C:\Program Files\SmartDraw 2008\Tooltips\Event_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Facility_Management.htm

C:\Program Files\SmartDraw 2008\Tooltips\Family_Research.htm

C:\Program Files\SmartDraw 2008\Tooltips\Family_Trees.htm

C:\Program Files\SmartDraw 2008\Tooltips\Floor_Plans.htm

C:\Program Files\SmartDraw 2008\Tooltips\Flowchart.htm

C:\Program Files\SmartDraw 2008\Tooltips\Flowcharts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Flyers.htm

C:\Program Files\SmartDraw 2008\Tooltips\Forms.htm

C:\Program Files\SmartDraw 2008\Tooltips\Gantt_Charts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Genealogy.htm

C:\Program Files\SmartDraw 2008\Tooltips\Geneology.htm

C:\Program Files\SmartDraw 2008\Tooltips\Genogram_Ecomap.htm

C:\Program Files\SmartDraw 2008\Tooltips\gradient_tooltip.png

C:\Program Files\SmartDraw 2008\Tooltips\Home_Design.htm

C:\Program Files\SmartDraw 2008\Tooltips\Home_Remodeling.htm

C:\Program Files\SmartDraw 2008\Tooltips\Human_Resources.htm

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_ChageLine.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_ClipboardPasteMenu.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_DataLabels.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_DataLabes.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Direction.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Distribute.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Drawing Area_Add Shape.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Drawing Area_Arrow.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Drawing Area_Draw Line.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Drawing Area_Zoom Menu.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Exposure_Brightness.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Exposure_Contrast.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Flip.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Font_Font Color.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Font_Font Menu.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Font_Font Size.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_GridSnaps.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_HorizontalLabels.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Insert Table_Columns.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Insert Table_Insert Table.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Insert Table_Rows.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Insert_Chart.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Insert_More.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Insert_Table.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_InsertColumns Menu.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_InsertRow Menu.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_LineSpacing.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Page Setup_Layers.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Page Setup_Margins.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Page Setup_Orientation.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Page Style_Background.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Page Style_Theme.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Paragraph_Bullets.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Picture Size_Crop.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Rows and Columns_Delete.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Rulers and Grid_Grid.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_RulerScale.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_ScaleMax.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_ScaleMin.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_SelectObject.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Layout_Group.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Layout_Make Same.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Layout_Rotate.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Properties_Change Shape.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Properties_Shape Properties Dialog.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Style_Effects.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Style_Fill.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape Style_Line.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Shape_Align.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_SmartPanel_Accident Diagram.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_SpaceEvenly.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_Table Style_Quick Table Styles.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_TextAlign Menu.BMP

C:\Program Files\SmartDraw 2008\Tooltips\Images\TT_VerticalLabels.bmp

C:\Program Files\SmartDraw 2008\Tooltips\Information_Technology.htm

C:\Program Files\SmartDraw 2008\Tooltips\IP_Patents_Engineering.htm

C:\Program Files\SmartDraw 2008\Tooltips\IP_Patents_IT.htm

C:\Program Files\SmartDraw 2008\Tooltips\IP_Patents_Science.htm

C:\Program Files\SmartDraw 2008\Tooltips\IP_Patents_Software.htm

C:\Program Files\SmartDraw 2008\Tooltips\Landscape_Design.htm

C:\Program Files\SmartDraw 2008\Tooltips\Landscape_Plans.htm

C:\Program Files\SmartDraw 2008\Tooltips\Maps.htm

C:\Program Files\SmartDraw 2008\Tooltips\Marketing.htm

C:\Program Files\SmartDraw 2008\Tooltips\Marketing_Charts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Medical_Malpractice_Injury.htm

C:\Program Files\SmartDraw 2008\Tooltips\Medical_Processes.htm

C:\Program Files\SmartDraw 2008\Tooltips\Mind_Maps.htm

C:\Program Files\SmartDraw 2008\Tooltips\My_Favorites.htm

C:\Program Files\SmartDraw 2008\Tooltips\My_SmartDraw_Documents.htm

C:\Program Files\SmartDraw 2008\Tooltips\My_Templates.htm

C:\Program Files\SmartDraw 2008\Tooltips\Network_Design.htm

C:\Program Files\SmartDraw 2008\Tooltips\Office_Building_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Office_Business_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Office_Facility_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Org_Charts.htm

C:\Program Files\SmartDraw 2008\Tooltips\Patient_Care.htm

C:\Program Files\SmartDraw 2008\Tooltips\Patient_Care_Education.htm

C:\Program Files\SmartDraw 2008\Tooltips\Patient_Education.htm

C:\Program Files\SmartDraw 2008\Tooltips\Personal_Injury.htm

C:\Program Files\SmartDraw 2008\Tooltips\Practice_Management_Forms.htm

C:\Program Files\SmartDraw 2008\Tooltips\Process_Design.htm

C:\Program Files\SmartDraw 2008\Tooltips\Processes_Procedures.htm

C:\Program Files\SmartDraw 2008\Tooltips\Project_Management.htm

C:\Program Files\SmartDraw 2008\Tooltips\Project_Manegment.htm

C:\Program Files\SmartDraw 2008\Tooltips\Quality_Management.htm

C:\Program Files\SmartDraw 2008\Tooltips\Quality_Manegement.htm

C:\Program Files\SmartDraw 2008\Tooltips\Real_Estate_Building_Plans.htm

C:\Program Files\SmartDraw 2008\Tooltips\Real_Estate_Maps.htm

C:\Program Files\SmartDraw 2008\Tooltips\Research_Development.htm

C:\Program Files\SmartDraw 2008\Tooltips\Retail_Planning.htm

C:\Program Files\SmartDraw 2008\Tooltips\Retail_Planograms.htm

C:\Program Files\SmartDraw 2008\Tooltips\Sales.htm

C:\Program Files\SmartDraw 2008\Tooltips\Sales_Marketing.htm

C:\Program Files\SmartDraw 2008\Tooltips\Schedules_Timelines.htm

C:\Program Files\SmartDraw 2008\Tooltips\Science_Math.htm

C:\Program Files\SmartDraw 2008\Tooltips\Search_Results.htm

C:\Program Files\SmartDraw 2008\Tooltips\Simple_Diagrams.htm

C:\Program Files\SmartDraw 2008\Tooltips\SmartDrawToolTips.INI

C:\Program Files\SmartDraw 2008\Tooltips\Software_Design.htm

C:\Program Files\SmartDraw 2008\Tooltips\Software_Development.htm

C:\Program Files\SmartDraw 2008\Tooltips\Storage_Design.htm

C:\Program Files\SmartDraw 2008\Tooltips\Timelines.htm

C:\Program Files\SmartDraw 2008\Tooltips\tooltip.css

C:\Program Files\SmartDraw 2008\Tooltips\tooltipgradient.png

C:\Program Files\SmartDraw 2008\Tooltips\TT_Accident_AddSymbols.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Accident_Lines.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Accident_Markings.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Accident_Roadway.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Accident_Symbols.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Accident_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_BP.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_BR.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Line.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Logo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_MOT.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Object.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Photo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Step.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_SubTopic.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Symbol.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Symbols.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Add_Topic.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddAncestor.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddAssistant.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddAttachments.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddCabinets.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddCatagory.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddCause.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddChild.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddCircle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddComponent.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddConnections.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddDecision.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddDecor.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddDescendents.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddDetail.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddDoors.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddFamilyMember.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddInterval.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddLane.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddManager.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddParent.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddPartner_Left.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddPartner_Right.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddPeriod.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddPerson.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddProcess.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddProduct.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddRacks.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddRelationships.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddRoadMarkings.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddRoadMarkings.htm.bak

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddRoadway.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddSeries.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddShape.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddShape_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddShelf.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddStep.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddTeam.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddTeam_Members.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddUnknown.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AddWindows.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignObjects.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignText_BottomLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignText_BottomRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignText_MiddleLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignText_MiddleRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignText_TopLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AlignText_TopRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ApplicationMenu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_AutoFill.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Axes.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_BackButton.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Bottom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_BottomLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_BottomRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Bump.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Flat.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Left.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Right.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Smooth.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_Top.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_TopLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Bevel_TopRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_BranchStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_BringFront.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_BrowseDocs.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_BrowseSymbols.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Calendar_AddEvent.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Calendar_Format.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Calendar_GoTo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Calendar_Holidays.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Calendar_SetMonth.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Calendar_SetYear.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CastShadow_Offset.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CastShadow_Size.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Center_On_Page.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Certificate_Color.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Certificate_Logo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Certificate_Photo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Certificate_Symbol.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Certificate_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeBorder.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeCabinetStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeColors.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeFinish.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeHeight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeLine.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeShape.htm

tnowacki

09.05.2008 20:37

Teil 3:

Code:

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChangeWidth.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartStyle_ImageFill.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Bar.hrm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Bar.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Line.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Linear.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Linier.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_More.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Pie.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChartType_Stacked.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ChooseYear.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardCopy.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardCut.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardFormatPainter.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardPaste..htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardPaste.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardPasteMenu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClipboardSelect.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Close_Document.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ClosePrintPreview.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CloseSmartDraw.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CloseSmartHelp.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CloseTemplateScreen.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_ChartData.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_ChartLabels.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_ChartType.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Clipboard.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Data.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Exposure.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_FindReplace.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Font.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_GetImages.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Insert.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_InsertChart.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_InsertTable.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Layout.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_PageSetup.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_PageStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Paragraph.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_PictureSize.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_PositionSize

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_PositionSize.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_QuickStyles.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_RowsColumns.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_RulersGrid.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_ShapeLayout.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_ShapeProperties.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_ShapeStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_TableStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Collapsed_Tools.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ConnectionPoints.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ConvertToTable.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ConvertToText.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_AddArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_AddBuilding.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_AddRoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_ChangeArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_ChangeRoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_Door_Window.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_FillArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_Object.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_CrimeScene_SizeRoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Crop.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Custom_FontSize.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Custom_Size.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DataLabels.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Delete_Block.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Delete_RowsColumns.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Delete_RowsColumns_Panel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Delete_TeamMember.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Delete_Topic.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DeleteCause.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DeleteColumn.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DeleteDetail.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DeletePerson.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DeleteRow.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_Background.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_Background_Panel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_QuickStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_QuickStyle_Down.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_QuickStyle_More.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_Quickstyle_Up.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Design_Theme.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DesignBackground.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DesignEffects.HTM

C:\Program Files\SmartDraw 2008\Tooltips\TT_DesignEffects.HTML

C:\Program Files\SmartDraw 2008\Tooltips\TT_DesignTheme.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Diagram_List.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Direction.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Distribute_RowsColumns.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Draw_Line_Drop_List.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Draw_Shape_List.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Draw_Shapes.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DrawArc.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DrawingArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DrawLine.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DrawSegLine.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Drawwall.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Duplicate.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_DynamicText.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_eco_ChangeBox.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Edit_Map.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EditRedo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EditUndo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EE_Arrowheads.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EE_Hops.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EE_Lines.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EE_Symbols.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_EE_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Effects.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Effects_Drop_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Email.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Employee_Above.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Employee_Below.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Employee_Left.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Employee_Right.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportEPS.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportExcel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportIllustrator.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportJPEG.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportPDF.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportPNG.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportPowerPoint.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportTIFF.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportVisio.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportWord.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportWordPerfect.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportXPS.HTM

C:\Program Files\SmartDraw 2008\Tooltips\TT_ExportXPS.HTML

C:\Program Files\SmartDraw 2008\Tooltips\TT_FileEmail.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FileNew.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FileOpen.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FilePDF.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FileSave.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Fill_Drop_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FillShape.htm

:\Program Files\SmartDraw 2008\Tooltips\TT_Find_Symbol.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Find_Symbol.HTML

C:\Program Files\SmartDraw 2008\Tooltips\TT_FindText.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flip_Object.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flip_Outcome.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flip_SubTopics.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flip_SubTopics.htm.bak

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flip_TeamMembers.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlipHoriz.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlipVert.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Floor_AddFurniture.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Floor_AddRoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Floor_ChangeRoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Floor_Doors_Windows.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Floor_SizeRoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flow_AddBottom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flow_AddLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flow_AddRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flow_AddTop.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlowChart_Arrowheads.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlowChart_Hops.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlowChart_Lines.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlowChart_Shapes.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FlowChart_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Flyers_ChangeColors.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Font.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_FontSize.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Form_AddBlock.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Form_Columns.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Form_Logos.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Form_Rows.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Form_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gantt_Add.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gantt_End.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gantt_Format.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gantt_Start.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gloss_Color.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gloss_Hard.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Gloss_Soft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Glow_Color.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Glow_Size.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Graph_ImageFill.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Graph_OpenLib.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Graph_SolidFill.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Grid.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_GridSnaps.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_GroupObjects.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Help_About.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Help_Buy_Product.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Help_Licenses.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Help_TechSupport.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Help_Update_Prodcut.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Help_UserGuide.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_HideRulers.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_HorizontalLabels.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Images_FromCamera.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Images_OpenPicture.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Images_PictureFolder.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Images_WebImages.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Import.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Excel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Map.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_MSGraph.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Other.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Outcome.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Prism.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Question.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Row.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_Symbol.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Insert_WebPage.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertAbove.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertBelow.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertBullets.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertChart_Clipboard.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertChart_File.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertChart_New.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertColumn.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertColumn_Panel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertEquation.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertHyperlink.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertPicture.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertRow.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertRow_Panel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertTable.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_InsertTable_Defined.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_JoinCells.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_JoinParents.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Landscape_AddArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Landscape_AddPlants.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Landscape_ChangeArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Landscape_FillArea.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Layers.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Legend.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Line_ArrowHeads.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Line_Tool_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Line_Tool_Panel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_LineProp.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_LineStyle_Drop_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Maps_AddLegend.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Maps_AddRegion.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Maps_ColorRegion.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Ancestry.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Arrange.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Descendant.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Document.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Edit.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Export.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Page.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Table.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_More_Text.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_MoreEcomap.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_MoreFlowchart.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_MoreGenogram.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_MoreOrgCommands.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_New.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_OLE_Links.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_OLE_Object.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Open_HTML_Help.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Open_SmartHelp.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_OpenFormDesign.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_OpenImage.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_OpenSmartHelp.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_AddBoxes.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_AddSibling.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_AddSpouse.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_Advanced.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_ChangeBox.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_ChangeLayout.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Org_Dir_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PageSetup.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PanZoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PasteExcel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PasteHyperlink.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PastePPT.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PasteSpecial.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PasteWord.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Photo_ChangeColors.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_ChangePic.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_Crop.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_Edit.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_Exposure_Brightness.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_Exposure_Contrast.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_GetImages.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_PanDown.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_PanImage.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_PanLeft.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_PanRight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_PanUp.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_SelectZoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_ZoomImage.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_ZoomIn.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_ZoomOut.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Picture_ZoomSlider.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PieData.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Plano_AddLegend.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Plano_AddProduct.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Plano_AddShelf.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PLano_ChangeColors.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Plano_SizeRack.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Print.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_PrintPreview.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ProjChart_End.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ProjChart_Format.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ProjChart_Milestone.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ProjChart_Start.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ProjChart_Task.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Quadrant.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_QuickStyle_DropGallery.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Reflection_Size.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Reflection_Skew.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Remove_SeriesCategory.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Remove_Task.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_RemoveStep.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ReplaceText.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ReturnButton.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Rotate.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_RulerDivisions.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_RulerScale.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SameBoth.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SameHeight.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SameSize.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SameWidth.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SaveAs.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SaveAsTemplate.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ScaleMax.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ScaleMin.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Scroll.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SearchSymbols.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SelectMultiple.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SelectObject.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SelectObject_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SelectShape_List.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SelectTemplate.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SendBack.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetEnd.htm

tnowacki

09.05.2008 20:38

Teil 4:

Code:

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetGrid.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetLayers.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetMargins.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetOrientation.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetOrientation_Landscape.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetOrientation_Portrait.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetRulers.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SetStart.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Shadow_Slider.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Shape_Properties.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ShapeOutline.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ShapePanel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ShowData.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ShowDimensions.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ShowGrid.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_ShowGuides.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SizeWall.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SpaceEvenly.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SplitCell.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Storage_AddCabinets.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Storage_AddShelf.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Storage_ChangeFinish.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Storage_SizeWall.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Swimlane_AddLane

C:\Program Files\SmartDraw 2008\Tooltips\TT_Swimlane_AddLane.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Swimlane_RemoveLane

C:\Program Files\SmartDraw 2008\Tooltips\TT_Swimlane_RemoveLane.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Switch_RowsColumns.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_SYMBOL_SHOWLIBMENU.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TableInsert.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TableStyle.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_EraserTool.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_HideInk.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_HighlighterTool.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_LineThickness.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_PenColor.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_PenTool.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_SelectLasso.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Tablet_StartInk.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TEXT_Color_Drop_List.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Text_LineSpaceing.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Text_Subscript.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Text_Superscript.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Text_TextEffects.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextAlign.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextAlign_Center.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextBold.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextColor.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextEditing.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextEntry.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextItalic.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextTool.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TextUnderline.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Timeline_Add.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Timeline_End.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Timeline_Start.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_TrimToShape.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_UseSnaps.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_VerticalLables.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Zoom.htm

C:\Program Files\SmartDraw 2008\Tooltips\TT_Zoom_Menu.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTEditRedo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTEditUndo.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTFileEmail.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTFileNew.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTFileOpen.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTFilePDF.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTFileSave.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTPasteExcel.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTPastePPT.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTPasteWord.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTPrint.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTTextAlign.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTTextBold.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTTextColor.htm

C:\Program Files\SmartDraw 2008\Tooltips\TTTextItalic.htm

C:\Program Files\SmartDraw 2008\Tooltips\Web_Design.htm

C:\Program Files\Trymedia

C:\Program Files\Trymedia\ActiveMark\data\{3A23CBAD-24E0-B70F-5502-F363371C4C16}

C:\Program Files\Trymedia\ActiveMark\data\{833122DA-A3DF-BFB0-618D-FF89D177D1B1}

C:\Program Files\Trymedia\ActiveMark\data\{DC513A1D-B891-FD83-7D77-4B15DB3F8265}

C:\Program Files\Trymedia\ActiveMark\data\{F3BEFCBE-5D12-F436-F712-8BA31727FEE0}

C:\ProgramData\BOONTY

C:\ProgramData\BOONTY\Licenses\B4F6F000.dat

C:\ProgramData\hmzovatq

C:\ProgramData\hmzovatq\xkpapszm.exe

C:\ProgramData\nfwspjcq

C:\ProgramData\nfwspjcq\tofqzalu.exe

C:\ProgramData\Test Drive Unlimited

C:\ProgramData\Test Drive Unlimited\BuddyCache.dat

C:\ProgramData\Test Drive Unlimited\CDKey.txt

C:\ProgramData\Test Drive Unlimited\radial.cdb

C:\Users\***\PCAntispyware_Installer.exe\

C:\Users\***\pms2.zip\
 

.

(((((((((((((((((((((((   Dateien erstellt von 2008-04-09 bis 2008-05-09  ))))))))))))))))))))))))))))))

.
 

Keine neuen Dateien erstellt in diesem Zeitraum
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-05-09 13:43        ---------        d-----w        C:\Users\***\AppData\Roaming\OpenOffice.org2

2008-05-09 13:42        ---------        d-----w        C:\Users\***\AppData\Roaming\WTablet

2008-05-09 12:21        ---------        d-----w        C:\Program Files\Trend Micro

2008-05-09 12:20        812,344        ----a-w        C:\Users\***\HJTInstall.exe

2008-05-09 12:11        ---------        d-----w        C:\ProgramData\rohnjspn

2008-05-08 19:12        4,707,798        ----a-w        C:\Users\***\66969_sony-ericsson--usb-treiber--grisu59964.exe

2008-05-08 19:12        ---------        d-----w        C:\Program Files\Sony Ericsson USB

2008-05-08 19:05        ---------        d-----w        C:\Program Files\Sony Ericsson

2008-05-08 18:54        ---------        d-----w        C:\Users\***\AppData\Roaming\MyPhoneExplorer

2008-05-08 14:56        39,865        ----a-w        C:\Users\***\pms2.zip

2008-05-08 14:31        ---------        d-----w        C:\Program Files\CCleaner

2008-05-08 14:23        2,751,368        ----a-w        C:\Users\***\ccsetup206.exe

2008-05-07 14:17        725,212        ----a-w        C:\Users\***\avenger.zip

2008-05-06 18:52        193,229        ----a-w        C:\Users\***\PCAntispyware_Installer.exe

2008-05-06 18:01        ---------        d-----w        C:\Users\***\AppData\Roaming\Free Download Manager

2008-05-06 17:29        ---------        d-----w        C:\Users\Admin\AppData\Roaming\MyPhoneExplorer

2008-05-06 17:29        ---------        d-----w        C:\Users\Admin\AppData\Roaming\AD ON Multimedia

2008-05-06 17:27        3,346,598        ----a-w        C:\Users\***\MyPhoneExplorer_Setup_1.6.7.exe

2008-05-06 16:16        ---------        d-----w        C:\Users\***\AppData\Roaming\Malwarebytes

2008-05-06 16:13        ---------        d-----w        C:\Users\Admin\AppData\Roaming\Malwarebytes

2008-05-06 16:13        ---------        d-----w        C:\ProgramData\Malwarebytes

2008-05-06 16:13        ---------        d-----w        C:\Program Files\Malwarebytes' Anti-Malware

2008-05-06 15:54        1,505,568        ----a-w        C:\Users\***\mbam-setup.exe

2008-05-06 14:41        6,580        ----a-w        C:\Windows\System32\tmp.reg

2008-05-06 13:45        1,389,662        ----a-w        C:\Users\***\SmitfraudFix.exe

2008-05-04 10:31        ---------        d-----w        C:\Users\Admin\AppData\Roaming\WTablet

2008-05-02 19:20        ---------        d-----w        C:\Users\***\AppData\Roaming\DNA

2008-05-02 11:32        ---------        d-----w        C:\Program Files\Tablet

2008-05-02 11:30        ---------        d-----w        C:\ProgramData\AppData

2008-05-01 08:14        ---------        d-----w        C:\Program Files\Windows Mail

2008-05-01 07:58        ---------        d-----w        C:\Program Files\Alwil Software

2008-05-01 07:51        ---------        d-----w        C:\ProgramData\Avira

2008-04-30 15:09        ---------        d-----w        C:\Program Files\Free FLV Converter

2008-04-30 13:16        83,028        ----a-w        C:\Users\***\AppData\Roaming\nvModes.dat

2008-04-28 06:03        82,944        ----a-w        C:\Windows\System32\IEDFix.exe

2008-04-28 06:03        82,944        ----a-w        C:\Windows\System32\404Fix.exe

2008-04-27 07:09        ---------        d-----w        C:\Users\***\AppData\Roaming\Software Informer

2008-04-26 19:39        ---------        d-----w        C:\Users\***\AppData\Roaming\BitTorrent

2008-04-26 19:05        ---------        d-----w        C:\Users\***\AppData\Roaming\GHISLER

2008-04-26 18:56        ---------        d-----w        C:\ProgramData\FreeDownloadManager.ORG

2008-04-26 08:55        ---------        d-----w        C:\Program Files\PowerISO

2008-04-24 06:10        86,528        ----a-w        C:\Windows\System32\VACFix.exe

2008-04-15 08:56        ---------        d-----w        C:\Users\***\AppData\Roaming\SmartDraw

2008-04-13 12:19        ---------        d-----w        C:\Users\***\AppData\Roaming\FileZilla

2008-04-13 08:33        ---------        d-----w        C:\Program Files\FileZilla FTP Client

2008-04-09 15:05        ---------        d-----w        C:\Program Files\Free Windows Registry Cleaner

2008-04-08 18:14        ---------        d-----w        C:\Program Files\RegCleaner

2008-04-08 17:16        ---------        d-----w        C:\Program Files\Common Files\L&H

2008-04-08 17:11        ---------        d--h--w        C:\Program Files\InstallShield Installation Information

2008-04-08 17:11        ---------        d-----w        C:\Program Files\Microsoft Reader

2008-04-07 13:39        ---------        d-----w        C:\Users\***\AppData\Roaming\DynaGeo

2008-04-06 09:48        ---------        d-----w        C:\Program Files\MyPlayCity.com

2008-04-06 09:18        ---------        d-----w        C:\Program Files\ArtMoney

2008-04-05 20:38        ---------        d-----w        C:\Program Files\Infogrames

2008-04-05 18:47        ---------        d-----w        C:\Program Files\A.F.7 Merge your files 1.3

2008-03-29 19:13        ---------        d-----w        C:\Users\***\AppData\Roaming\FrostWire

2008-03-29 18:21        ---------        d-----w        C:\ProgramData\WinZip

2008-03-29 17:32        50,768        ----a-w        C:\Windows\system32\drivers\aswMonFlt.sys

2008-03-27 17:46        ---------        d-----w        C:\Program Files\Gothic III

2008-03-26 16:23        43,520        ----a-w        C:\Windows\System32\CmdLineExt03.dll

2008-03-25 17:44        ---------        d-----w        C:\Program Files\AVIConverter

2008-03-19 15:41        ---------        d-----w        C:\Users\***\AppData\Roaming\gtk-2.0

2008-03-17 14:38        ---------        d-----w        C:\Program Files\Maschinenschreiben Deluxe

2008-03-17 11:31        ---------        d-----w        C:\Program Files\iTunes

2008-03-17 11:17        ---------        d-----w        C:\Program Files\Vista OS X

2008-03-17 10:58        ---------        d-----w        C:\Program Files\CodeGazer

2008-03-16 11:37        ---------        d-----w        C:\Program Files\Risk

2008-03-16 11:07        ---------        d-----w        C:\Users\***\AppData\Roaming\Azureus

2008-03-16 10:56        ---------        d-----w        C:\Program Files\Java

2008-03-16 10:40        ---------        d-----w        C:\ProgramData\eMule

2008-03-16 08:22        ---------        d-----w        C:\Program Files\DNA

2008-03-15 19:21        ---------        d-----w        C:\Users\***\AppData\Roaming\LimeWire

2008-03-14 06:04        46,652        ----a-w        C:\Windows\system32\drivers\scdemu.sys

2008-03-11 12:46        ---------        d-----w        C:\Program Files\Common Files\Symantec Shared

2008-03-11 12:45        ---------        d-----w        C:\ProgramData\Symantec

2008-03-10 17:14        ---------        d-----w        C:\Program Files\EA GAMES

2008-02-29 04:16        2,027,008        ----a-w        C:\Windows\System32\win32k.sys

2008-02-21 04:43        826,368        ----a-w        C:\Windows\System32\wininet.dll

2008-02-21 04:43        56,320        ----a-w        C:\Windows\System32\iesetup.dll

2008-02-21 04:43        52,736        ----a-w        C:\Windows\AppPatch\iebrshim.dll

2008-02-21 04:43        296,448        ----a-w        C:\Windows\System32\gdi32.dll

2008-02-21 04:43        26,624        ----a-w        C:\Windows\System32\ieUnatt.exe

2008-02-14 18:27        194,560        ----a-w        C:\Windows\System32\WebClnt.dll

2008-02-14 14:29        7,168        ----a-w        C:\Windows\System32\f3ahvoas.dll

2008-02-14 14:29        613,888        ----a-w        C:\Windows\System32\wpd_ci.dll

2008-02-14 14:29        6,656        ----a-w        C:\Windows\System32\kbd106n.dll

2008-02-14 14:29        558,080        ----a-w        C:\Windows\System32\oleaut32.dll

2008-02-14 14:29        35,328        ----a-w        C:\Windows\System32\dispci.dll

2008-02-14 14:29        260,096        ----a-w        C:\Windows\System32\dpx.dll

2008-02-14 14:29        224,824        ----a-w        C:\Windows\System32\clfs.sys

2008-02-14 14:29        221,696        ----a-w        C:\Windows\System32\umpnpmgr.dll

2008-02-14 14:29        19,456        ----a-w        C:\Windows\System32\cfgmgr32.dll

2008-02-14 14:29        12,800        ----a-w        C:\Windows\System32\batt.dll

2008-02-14 14:29        101,888        ----a-w        C:\Windows\System32\drvinst.exe

2008-02-14 14:29        1,585,664        ----a-w        C:\Windows\System32\setupapi.dll

2008-02-14 14:25        3,504,696        ----a-w        C:\Windows\System32\ntkrnlpa.exe

2008-02-14 14:25        3,470,392        ----a-w        C:\Windows\System32\ntoskrnl.exe

2008-02-14 14:24        24,064        ----a-w        C:\Windows\System32\netcfg.exe

2008-02-14 14:24        22,016        ----a-w        C:\Windows\System32\netiougc.exe

2008-02-14 14:24        167,424        ----a-w        C:\Windows\System32\tcpipcfg.dll

2008-01-01 13:15        16,384        --sha-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

2008-01-01 13:15        32,768        --sha-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

2008-01-01 13:15        16,384        --sha-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

.
 

(((((((((((((((((((((((((((((   snapshot_2008-05-09_15.37.20.31   )))))))))))))))))))))))))))))))))))))))))

.

- 2008-04-19 19:45:58        295,606        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe

+ 2008-05-09 13:57:34        295,606        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe

- 2008-04-19 19:45:59        295,606        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_3D.exe

+ 2008-05-09 13:57:35        295,606        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_3D.exe

- 2008-04-19 19:45:59        295,606        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_Standard.exe

+ 2008-05-09 13:57:35        295,606        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_Standard.exe

- 2008-04-19 19:45:59        25,214        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Distiller.exe

+ 2008-05-09 13:57:35        25,214        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Distiller.exe

- 2008-04-19 19:45:59        7,278        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_ELEMENTS_DT.exe

+ 2008-05-09 13:57:35        7,278        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_ELEMENTS_DT.exe

- 2008-04-19 19:45:58        23,558        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe

+ 2008-05-09 13:57:33        23,558        ----a-r        C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe

- 2008-05-09 13:33:36        262,144        ----a-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat

+ 2008-05-09 14:03:51        262,144        ----a-w        C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat

.

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-13 04:02 1232896]

"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]

"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 11:29 413696]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-04-15 12:48 1006264]

"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-14 20:07 411768]

"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2006-12-07 17:49 55416]

"SmoothView"="C:\Program Files\Toshiba\SmoothView\SmoothView.exe"

tnowacki

09.05.2008 20:41

Letzendlich Teil 5 der Combofix:

Code:

[2006-12-14 20:09 493688]

"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 18:27 530552]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 14:50 815104]

"RtHDVCpl"="RtHDVCpl.exe" [2006-11-07 15:50 3772416 C:\Windows\RtHDVCpl.exe]

"topi"="C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2006-12-15 18:11 577536]

"Toshiba Registration"="C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-13 16:42 554640]

"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:35 176128]

"Acrobat Assistant 8.0"="H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [ ]

"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]

"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 13:45 75304]

"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-06 18:56 86016]

"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-06 18:56 8493600]

"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-06 18:56 81920]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]

"Adobe Reader Speed Launcher"="E:\Adobe\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"LogonHoursAction"= 2 (0x2)

"DontDisplayLogonHoursWarnings"= 1 (0x1)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"jUEaiEOHPm"= C:\ProgramData\hmzovatq\xkpapszm.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{42EE9134-CB88-4003-B1E6-237774E43D0D}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)

"TCP Query User{2C35729F-B9CB-4B0C-999E-3DEA763D9F61}C:\\program files\\team17\\worms 3d\\bin\\worms3d.exe"= UDP:C:\program files\team17\worms 3d\bin\worms3d.exe:worms3d

"UDP Query User{3D20A34F-9184-4CE9-99D6-AB7BDCE2A952}C:\\program files\\team17\\worms 3d\\bin\\worms3d.exe"= TCP:C:\program files\team17\worms 3d\bin\worms3d.exe:worms3d

"{E064E23E-953E-4FC2-9D0B-8AF0E1F49C4D}"= UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4

"{73EB12D5-8924-47AF-8EE9-A9098A69A5AC}"= TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4

"TCP Query User{CC9F9FC9-4146-4F0A-B49D-208A397466F2}C:\\scol\\usmwin.exe"= UDP:C:\scol\usmwin.exe:UsmWin

"UDP Query User{9CD095D7-AF99-45B9-801E-5FEB091F2701}C:\\scol\\usmwin.exe"= TCP:C:\scol\usmwin.exe:UsmWin

"TCP Query User{545140D6-49B1-4C7C-9E6D-3D7D7468C8D8}C:\\program files\\ascaron entertainment\\sacred\\sacred.exe"= UDP:C:\program files\ascaron entertainment\sacred\sacred.exe:Sacred

"UDP Query User{144FCD72-6DD6-4BF5-A5CD-C8B9D302E866}C:\\program files\\ascaron entertainment\\sacred\\sacred.exe"= TCP:C:\program files\ascaron entertainment\sacred\sacred.exe:Sacred

"TCP Query User{2A9125B3-84A8-479A-BD82-ED3A5F005710}E:\\testdrive unlimited\\testdriveunlimited.exe"= UDP:E:\testdrive unlimited\testdriveunlimited.exe:Test Drive Unlimited

"UDP Query User{2D6BBF45-719D-4525-8AF9-BC0AE3FC8611}E:\\testdrive unlimited\\testdriveunlimited.exe"= TCP:E:\testdrive unlimited\testdriveunlimited.exe:Test Drive Unlimited

"TCP Query User{4AF7F1CC-1365-479A-95B9-81B56FBCF353}E:\\vgigant\\vgigant.exe"= UDP:E:\vgigant\vgigant.exe:MFC-Anwendung default

"UDP Query User{9675689C-1230-4A6B-A272-9A2485B202C1}E:\\vgigant\\vgigant.exe"= TCP:E:\vgigant\vgigant.exe:MFC-Anwendung default

"{7728616D-19DA-4C28-8DF9-34C32C2EE5A2}"= UDP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe

"{74228402-2C31-41F1-BAAD-B3997CEC5CD3}"= TCP:C:\Program Files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe

"{FF33614A-DEB3-4589-9F35-20522EB5D3EF}"= UDP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

"{E895D9C2-1785-430A-B2D4-508B9D25EAD0}"= TCP:C:\Program Files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe

"{8FCB0657-64DC-485A-AECD-F6F6DE6575B2}"= UDP:3703:Adobe Version Cue CS3 Server

"{F019B9DE-88EF-4F56-8D5D-4CC40F53C293}"= UDP:3704:Adobe Version Cue CS3 Server

"{952B5BE3-7A6F-44CD-A749-0867AC6F6533}"= UDP:50900:Adobe Version Cue CS3 Server

"{DF247C40-0A4E-4827-8E1C-858792C08A62}"= UDP:50901:Adobe Version Cue CS3 Server

"{BCD39D22-AD93-4B4F-83BC-D70287B6836A}"= UDP:C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server

"{59B3DE7E-888A-413D-AD52-135A85B9DDBE}"= TCP:C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server

"{E74A2C0F-626C-4B1F-B7DA-520DEB670C1A}"= UDP:C:\Program Files\DNA\btdna.exe:DNA

"{97211BB8-0349-4E4A-BCA2-74A6F22D05F4}"= TCP:C:\Program Files\DNA\btdna.exe:DNA

"{FD02D60B-93B1-450E-93FC-A17CAB211202}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{1D9FD9B3-FB72-4B50-9CA4-3DCF6737754C}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent

"{AE9EE46E-86FC-40C0-B694-F288BF4A44EE}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{E48CA54E-FAAA-45C3-8104-54E13980EC72}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour

"{BCE3AE7D-B148-4A15-AB0A-69129EB7529B}"= UDP:H:\ITUNES\iTunes.exe:iTunes

"{19975A38-2231-460E-B691-66DCF091A0B7}"= TCP:H:\ITUNES\iTunes.exe:iTunes

"TCP Query User{25832DDA-52DD-43F3-BD70-175789D9B1BC}C:\\program files\\frostwire\\frostwire.exe"= UDP:C:\program files\frostwire\frostwire.exe:FrostWire

"UDP Query User{30F6EE18-35FF-4CC1-83E3-C3DF70971670}C:\\program files\\frostwire\\frostwire.exe"= TCP:C:\program files\frostwire\frostwire.exe:FrostWire

"TCP Query User{9651BD12-553B-4AEF-8153-0AAE9B1927CB}E:\\emule\\emule.exe"= UDP:E:\emule\emule.exe:eMule

"UDP Query User{E7FD6214-2CE9-436C-9DCF-CA9E28B8E756}E:\\emule\\emule.exe"= TCP:E:\emule\emule.exe:eMule

"TCP Query User{D33C38F8-E4A4-4062-B765-0D8D90A2C2E2}E:\\azureus\\azureus.exe"= UDP:E:\azureus\azureus.exe:Azureus

"UDP Query User{E60032C4-687B-4DC9-B1EA-B7AB16C89F89}E:\\azureus\\azureus.exe"= TCP:E:\azureus\azureus.exe:Azureus

"{0918C51F-4C50-422B-8623-B1CD641B1112}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{74066FAD-AE15-4D8B-A039-31AFCDD30FB2}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

"{18BB9978-FF06-407D-A365-E61C299F489E}"= UDP:H:\BitTorrent\bittorrent.exe:BitTorrent

"{D94F5E3D-4418-4964-8827-AF238A3A9A3E}"= TCP:H:\BitTorrent\bittorrent.exe:BitTorrent

"TCP Query User{84A7B4DA-59C0-4113-8B4C-DF072C677498}C:\\phpdev5\\apache2\\bin\\apache.exe"= UDP:C:\phpdev5\apache2\bin\apache.exe:Apache HTTP Server

"UDP Query User{B4C9F87F-9BD7-46CC-BD8A-8781F4569AE8}C:\\phpdev5\\apache2\\bin\\apache.exe"= TCP:C:\phpdev5\apache2\bin\apache.exe:Apache HTTP Server

"TCP Query User{2B178FEC-F2BA-4181-A2C3-4300FA9E3A52}C:\\phpdev5\\mysql\\bin\\mysqld-nt.exe"= UDP:C:\phpdev5\mysql\bin\mysqld-nt.exe:mysqld-nt

"UDP Query User{DB89CC75-BD3A-4FB2-9245-02CF3B47AF39}C:\\phpdev5\\mysql\\bin\\mysqld-nt.exe"= TCP:C:\phpdev5\mysql\bin\mysqld-nt.exe:mysqld-nt

"{5A7380FD-07D8-4816-86AD-2980C80DCC03}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

"{E9B14BDE-BAD4-4349-93DC-04C5C2CFFDC2}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent

"TCP Query User{0A23A62B-2AFC-4DB8-BA99-3AC4981D82A1}C:\\users\\***\\xampp\\mysql\\bin\\mysqld.exe"= UDP:C:\users\***\xampp\mysql\bin\mysqld.exe:mysqld.exe

"UDP Query User{1BFBC6AD-4523-4729-8994-6B3418DE7607}C:\\users\\***\\xampp\\mysql\\bin\\mysqld.exe"= TCP:C:\users\***\xampp\mysql\bin\mysqld.exe:mysqld.exe

"TCP Query User{84AA94BC-3B20-4446-B2EB-EFA3C3293946}C:\\users\\***\\xampp\\apache\\bin\\apache.exe"= UDP:C:\users\***\xampp\apache\bin\apache.exe:apache.exe

"UDP Query User{AF597100-DEA4-42AD-BE04-01FB09E7FA25}C:\\users\\***\\xampp\\apache\\bin\\apache.exe"= TCP:C:\users\***\xampp\apache\bin\apache.exe:apache.exe

"TCP Query User{D9629B20-3AB8-45DB-BE7C-38436E6525CA}E:\\program files\\global star software\\airport tycoon 3\\at3.exe"= UDP:E:\program files\global star software\airport tycoon 3\at3.exe:at3

"UDP Query User{6514A8F1-7520-446B-89D3-E6185CAEC77F}E:\\program files\\global star software\\airport tycoon 3\\at3.exe"= TCP:E:\program files\global star software\airport tycoon 3\at3.exe:at3

"TCP Query User{024C16F0-5DB0-4CFE-9809-BAF9FACD6B82}E:\\program files\\airport tycoon 3\\at3.exe"= UDP:E:\program files\airport tycoon 3\at3.exe:at3

"UDP Query User{2DA6C647-6016-4EFC-AF4B-FA0D0E255335}E:\\program files\\airport tycoon 3\\at3.exe"= TCP:E:\program files\airport tycoon 3\at3.exe:at3
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]

"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
 

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31]

R1 uigxrdr;uigxrdr;C:\Windows\system32\DRIVERS\uigxrdr.sys [2008-02-05 11:26]

R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32]

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2007-05-17 23:45]

R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2006-10-31 23:40]

R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-19 23:11]

R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 12:50]

S2 dev5_ap1;dev5_ap1;"C:\phpdev5\apache\Apache.exe" --ntservice []

S2 dev5_ap2;dev5_ap2;"C:\phpdev5\apache2\bin\Apache.exe" -k runservice []

S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" []

S3 tosrfec;Bluetooth ACPI;C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 17:32]

S3 wacommousefilter;Wacom Mouse Filter Driver;C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11:12]

S3 wampapache;wampapache;"H:\wamp\apache2\bin\Apache.exe" -k runservice []

S3 wampmysqld;wampmysqld;H:\wamp\mysql\bin\mysqld-nt.exe []

S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 19:50]

S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 19:41]
 

.

Inhalt des "geplante Tasks" Ordners

"2008-05-09 13:42:17 C:\Windows\Tasks\SDMsgUpdate (TE).job"

- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exeW-PTE -V900 -SSDU.ini -A -Mhttp://www.smartdraw.com/msgs/messagecheck.aspx -D0 -T -N -X

"2008-05-09 14:00:25 C:\Windows\Tasks\User_Feed_Synchronization-{D9B30BB4-63C0-47D4-A444-A174F9308500}.job"

- C:\Windows\system32\msfeedssync.exe

.

**************************************************************************
 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-09 16:07:43

Windows 6.0.6000  NTFS
 

Scanne versteckte Prozesse...
 

Scanne versteckte Autostart Einträge...
 

Scanne versteckte Dateien...
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

Zeit der Fertigstellung: 2008-05-09 16:15:21

ComboFix-quarantined-files.txt  2008-05-09 14:15:16

ComboFix2.txt  2008-05-08 15:24:48
 

      Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.

      Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.
 

1252        --- E O F ---        2008-05-09 12:16:25

myrtille

09.05.2008 21:18

Hi,

das hats leider nicht so gebracht. Versuche es bitte mit folgendem Skript noch einmal:

Code:

Killall::
 

Folder::

C:\Users\***\pms2.zip

C:\Users\***\PCAntispyware_Installer.exe

C:\ProgramData\nfwspjcq

C:\Program Files\SmartDraw 2008

C:\ProgramData\hmzovatq

C:\Program Files\Trymedia

C:\ProgramData\Test Drive Unlimited

C:\ProgramData\BOONTY

C:\Program Files\Common Files\BOONTY Shared

C:\Program Files\AskSBar
 

File::

C:\Windows\system32\tuvVNExY.dll
 
 

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6237B16D-70F2-4D04-ADD7-6ADAF1FE9617}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

"jUEaiEOHPm"=-
 

drivers::

Boonty Games

lg myrtille

tnowacki

10.05.2008 09:16

hmm.... ComboFix startet; und dann nach einer Minute krieg ich einen PC-Neustart...

myrtille

10.05.2008 09:46

Ja, Combofix startet den Rechner neu, wenn er Datein nicht im laufenden Betrieb löschen kann.

Poste bitte das Logfile (C:\combofix.txt) und ein neues Hijackthislog

lg myrtille

tnowacki

10.05.2008 10:56

Da ist bloß keine Combofix.txt !?

myrtille

10.05.2008 13:27

Bitte poste ein Hijackthislog mit dem aktuellen Hijackthisversion und deaktiviere bei Avast das Selfdefense-Modul während des Scans.
(Einstellungen ->Troubleshooting->Haken bei "disable avast! Selfdefensemodule" setzen.)

Versuche dann nochmal das Script auf Combofix zu ziehen. Ich vermute, dass avast! Combofix beim arbeiten gestört hat.

lg myrtille

tnowacki

10.05.2008 13:43

Zitat:

Zitat von myrtille (Beitrag 337489)

Wodenn? In der Taskleiste ist mein Avast-Icon weg...
Btw, ich bin die nächste Woche nicht da :heulen:

myrtille

10.05.2008 13:48

Poste bitte mal nen Hijackthislogfile.

tnowacki

10.05.2008 13:49

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:21, on 2008-05-09

Platform: Windows Vista  (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\WTablet\TabUserW.exe

C:\ProgramData\hmzovatq\xkpapszm.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\ProgramData\nfwspjcq\tofqzalu.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (file missing)

O2 - BHO: (no name) - {6237B16D-70F2-4D04-ADD7-6ADAF1FE9617} - C:\Windows\system32\tuvVNExY.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdm2.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (file missing)

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - H:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (file missing)

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Adobe\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

O4 - HKLM\..\Policies\Explorer\Run: [jUEaiEOHPm] C:\ProgramData\hmzovatq\xkpapszm.exe

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (User '***')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [MSServer] rundll32.exe C:\Users\***\AppData\Local\Temp\qoMdBUMc.dll,#1 (User '***')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [rohnjspn] C:\ProgramData\rohnjspn\qridwtob.exe (User '***')

O4 - HKUS\S-1-5-21-684671415-945393766-703186041-1000\..\Run: [cmds] rundll32.exe C:\Users\***\AppData\Local\Temp\rqRHawuU.dll,c (User '***')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://***.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?http://***.ebay.de/ (file missing)

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O13 - Gopher Prefix: 

O23 - Service: Adobe Version Cue CS3 {de_DE}  (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: dev5_ap1 - Unknown owner - C:\phpdev5\apache\Apache.exe (file missing)

O23 - Service: dev5_ap2 - Apache Software Foundation - C:\phpdev5\apache2\bin\Apache.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: wampapache - Unknown owner - H:\wamp\apache2\bin\Apache.exe (file missing)

O23 - Service: wampmysqld - Unknown owner - H:\wamp\mysql\bin\mysqld-nt.exe (file missing)
 

--

End of file - 10644 bytes

myrtille

10.05.2008 13:55

Hi,

ok, avast läuft derzeit nicht.
Navigiere im Explorer mal zur folgenden Datei: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

und führe diese aus, dann sollte Avast gestartet werden.

lg myrtille

tnowacki

10.05.2008 13:57

Aber ein "Troubleshooting" konnte ich nicht finden!?

myrtille

10.05.2008 14:02

Das sollte der unterste Punkt sein.
Wie heißen denn die verschiedenen Menüpunkte?

lg myrtille

tnowacki

10.05.2008 14:04

Bei mir heißts Fehlererkennung..
SO, ich muss los.
Vielen Dank für die Hilfe, wir werden uns in einer Woche wiedersehen.

myrtille

10.05.2008 14:09

Ok :)

Tut mir Leid, dass das hier jetzt so langwierig ist.
Vista ist in Hinsicht auf Befälle und Bereinigung immernoch eine etwas komplizierte Sache.

Bis dann,
lg myrtille

Alle Zeitangaben in WEZ +1. Es ist jetzt 07:43 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131