Trojaner-Board - TR/Dropper.Gen

Hi,

also erstmal, ich hab keinen Plan ;) Hab mir aber vorher en Teil der anderen Threads zu dem Thema durchgelesen und die angegebenen Tips durchgeführt. Daher hier auch gleich die Logfiles von Hijack, Combofix und Silentrunner. CCleaner hab ich auch schon durchgeführt.

Wäre echt toll wenn ihr mir weiterhelfen könntet, denn ich kann kaum noch normal surfen -.- thx in advance!!

Logfile of Trend Micro HijackThis v2.0.2

Code:

Scan saved at 09:28:05, on 11.07.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\Google\Gmail Notifier\gnotify.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Last.fm\LastFM.exe

D:\Programme\Firefox\firefox.exe

D:\Downloads\This.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://freakcamp.net/

O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\tbu5F\toolbaru.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Programme\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\RunServices: [Microsoft Windows Express] windowslogonb.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [Veoh] "C:\Programme\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201275632744

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
 

--

End of file - 4370 bytes

ComboFix

Code:

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\visit.exe
 

.

(((((((((((((((((((((((   Dateien erstellt von 2009-06-11 bis 2009-07-11  ))))))))))))))))))))))))))))))

.
 

2009-07-11 07:36 . 2009-07-11 07:36        --------        d-----w-        c:\programme\CCleaner

2009-07-07 17:56 . 2009-07-07 17:56        --------        d-----w-        c:\programme\Gemeinsame Dateien\DirectX

2009-07-07 12:34 . 2009-07-07 12:34        --------        d-----w-        C:\AeriaGames

2009-07-03 16:17 . 2009-07-07 09:21        --------        d-----w-        c:\programme\Warzone 2100

2009-07-03 07:57 . 2009-07-03 16:17        413696        ----a-w-        c:\windows\system32\wrap_oal.dll

2009-07-03 07:57 . 2009-07-03 16:17        110592        ----a-w-        c:\windows\system32\OpenAL32.dll

2009-07-03 07:57 . 2009-07-03 07:57        --------        d-----w-        c:\programme\OpenAL

2009-07-03 07:32 . 2009-07-03 07:32        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spring

2009-07-03 07:32 . 2009-07-03 07:32        --------        d-----w-        c:\dokumente und einstellungen\Kandel\Anwendungsdaten\springsettings

2009-07-03 07:30 . 2009-07-03 07:42        --------        d-----w-        c:\programme\Spring

2009-06-25 14:35 . 2009-07-02 23:26        --------        d-----w-        c:\programme\Bos Wars

2009-06-19 11:28 . 2009-06-01 20:36        3184128        ----a-w-        c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Mozilla\Firefox\Profiles\zw00pasd.Standard-Benutzer\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\SSS.dll

2009-06-19 11:28 . 2009-04-23 10:47        28672        ----a-w-        c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Mozilla\Firefox\Profiles\zw00pasd.Standard-Benutzer\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll

2009-06-19 11:28 . 2009-03-19 21:57        40960        ----a-w-        c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Mozilla\Firefox\Profiles\zw00pasd.Standard-Benutzer\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fireshot-install.exe

2009-06-19 11:28 . 2009-03-19 21:46        102400        ----a-w-        c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Mozilla\Firefox\Profiles\zw00pasd.Standard-Benutzer\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\FSAddin.dll

2009-06-18 21:14 . 2009-06-17 20:41        409978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aescript.dll

2009-06-18 21:14 . 2009-05-15 20:36        127347        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aescn.dll

2009-06-18 21:14 . 2009-04-30 20:44        106868        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aevdf.dll

2009-06-18 21:14 . 2009-05-27 20:37        401783        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aepack.dll

2009-06-18 21:14 . 2008-11-15 17:48        438645        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aerdl.dll

2009-06-18 21:14 . 2009-06-17 20:41        196987        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aeoffice.dll

2009-06-18 21:14 . 2009-06-17 20:41        1798520        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aeheur.dll

2009-06-18 21:14 . 2009-06-13 21:12        205174        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aehelp.dll

2009-06-18 21:14 . 2009-06-09 20:43        348532        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aegen.dll

2009-06-18 21:14 . 2008-10-15 21:03        393588        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aeemu.dll

2009-06-18 21:14 . 2009-05-27 20:37        180599        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aecore.dll

2009-06-18 21:14 . 2008-10-15 21:03        53618        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a3aa5ec\validationdir\aebb.dll

2009-06-11 20:39 . 2009-06-11 20:39        205174        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\ave2\aehelp.dll
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-11 07:34 . 2008-02-27 10:05        --------        d-----w-        c:\programme\Metin2_Germany

2009-07-10 20:40 . 2006-03-28 00:37        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic

2009-06-11 20:41 . 2009-06-11 20:41        409978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aescript.dll

2009-06-11 20:41 . 2009-06-11 20:41        409978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\ave2\aescript.dll

2009-06-11 20:41 . 2009-06-11 20:41        1786232        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aeheur.dll

2009-06-11 20:41 . 2009-06-11 20:41        1786232        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\ave2\aeheur.dll

2009-06-11 20:39 . 2009-06-11 20:41        205174        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aehelp.dll

2009-06-09 20:43 . 2009-06-11 20:41        348532        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aegen.dll

2009-06-08 13:50 . 2005-09-27 15:10        --------        d-----w-        c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Skype

2009-05-27 20:37 . 2006-03-28 00:42        45400        ----a-w-        c:\windows\system32\drivers\avgntdd.sys

2009-05-27 20:37 . 2006-03-28 00:42        22360        ----a-w-        c:\windows\system32\drivers\avgntmgr.sys

2009-05-27 20:37 . 2007-04-20 12:41        75096        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2009-05-27 20:37 . 2009-06-11 20:41        401783        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aepack.dll

2009-05-27 20:37 . 2009-06-11 20:41        180599        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aecore.dll

2009-05-20 09:59 . 2008-04-21 14:19        --------        d-----w-        c:\programme\Last.fm

2009-05-20 09:58 . 2008-04-21 14:20        683801        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Last.fm\Client\UninstWMP\unins000.exe

2009-05-20 09:58 . 2009-05-20 09:58        --------        d-----w-        c:\programme\Winamp

2009-05-20 09:58 . 2008-04-21 14:20        683801        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Last.fm\Client\UninstWA\unins000.exe

2009-05-15 20:36 . 2009-05-26 21:10        389497        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a1c52ff\validationdir\aescript.dll

2009-05-15 20:36 . 2009-06-11 20:41        127347        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aescn.dll

2009-05-15 20:36 . 2009-05-26 21:10        127347        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a1c52ff\validationdir\aescn.dll

2009-05-15 20:36 . 2009-05-26 21:10        1761655        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a1c52ff\validationdir\aeheur.dll

2009-05-15 20:36 . 2009-05-26 21:10        348532        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a1c52ff\validationdir\aegen.dll

2009-05-10 20:38 . 2009-05-26 21:10        397686        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a1c52ff\validationdir\aepack.dll

2009-05-08 20:46 . 2009-05-08 20:46        385401        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\validationdir\aescript.dll

2009-05-08 20:46 . 2009-05-08 20:46        385401        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\ave2\aescript.dll

2009-05-08 20:46 . 2009-05-08 20:46        397686        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\validationdir\aepack.dll

2009-05-08 20:46 . 2009-05-08 20:46        397686        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\ave2\aepack.dll

2009-05-08 20:46 . 2009-05-08 20:46        1757559        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\validationdir\aeheur.dll

2009-05-08 20:46 . 2009-05-08 20:46        1757559        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\ave2\aeheur.dll

2009-05-08 20:46 . 2009-05-08 20:46        348531        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\validationdir\aegen.dll

2009-05-08 20:46 . 2009-05-08 20:46        348531        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\ave2\aegen.dll

2009-04-30 20:44 . 2009-06-11 20:41        106868        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a316b46\validationdir\aevdf.dll

2009-04-30 20:44 . 2009-05-26 21:10        106868        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a1c52ff\validationdir\aevdf.dll

2009-04-30 20:44 . 2009-05-08 20:46        106868        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a0497c8\validationdir\aevdf.dll

2009-04-25 21:17 . 2009-04-25 21:17        1737080        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_49f37407\validationdir\aeheur.dll

2009-04-15 16:31 . 2009-04-24 21:18        176500        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_49f22284\validationdir\aecore.dll

2009-04-14 14:09 . 2008-09-16 12:55        5069312        ----a-w-        c:\windows\system32\drivers\RtkHDAud.sys

2007-04-16 15:53 . 2004-08-03 22:57        156089        --sha-r-        c:\windows\system32\jtmliwy.dll

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"Veoh"="c:\programme\Veoh Networks\Veoh\VeohClient.exe" [2008-09-26 3660848]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\programme\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-31 1622016]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2009-04-10 17879552]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"updateMgr"=c:\programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

"Skype"="c:\programme\Skype\Phone\Skype.exe" /nosplash /minimized
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"AudioDeck"=c:\programme\VIA\VIAudioi\SBADeck\ADeck.exe 1

"QuickTime Task"="c:\programme\QuickTime\qttask.exe" -atboottime

"Microsoft Windows Express"=windowslogonb.exe

"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_03\bin\jusched.exe"

"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot

"SmartSync - ScheduleSync"=c:\progra~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]

"Microsoft Windows Express"=windowslogonb.exe
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"d:\\Programme\\Firefox\\firefox.exe"=

"c:\\Programme\\FTP-Commander Standard 7.0 (FreeWare)\\Ftpnavi.exe"=

"c:\\Programme\\Metin2_Germany\\metin2.bin"=

"c:\\Programme\\Zattoo\\zattood.exe"=

"c:\\Programme\\Zattoo\\Zattoo1.exe"=

"c:\\Programme\\Veoh Networks\\Veoh\\VeohClient.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"4770:TCP"= 4770:TCP:fwizgdkf
 

R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [28.03.2006 02:42 22360]

R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [28.03.2006 02:42 45400]

R3 CLEDX;Team H2O CLEDX service;c:\windows\system32\drivers\cledx.sys [05.07.2005 18:00 33792]

S2 plovyolxt;bwqupil;c:\windows\system32\svchost.exe -k netsvcs [04.08.2004 00:58 14336]

S2 sbfkb;Update Installer;c:\windows\system32\svchost.exe -k netsvcs [04.08.2004 00:58 14336]

S3 als4k;Avance Audio Miniport Driver (WDM);c:\windows\system32\drivers\als4000.sys [25.01.2008 16:55 28919]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [05.05.2009 04:19 1684736]

S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [05.04.2009 19:40 4352]

S3 BELKIN;Belkin Wireless G USB Network Adapter;c:\windows\system32\drivers\BLKWGU.sys [28.03.2009 19:00 238848]

S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [05.04.2009 19:40 265088]

S3 ikcfdegb;ikcfdegb;\??\c:\windows\system32\02D.tmp --> c:\windows\system32\02D.tmp [?]

S3 Messsiltl;Messsiltl; [x]

S3 NETFWDSL;AVM FRITZ!web DSL PPP;c:\windows\system32\DRIVERS\NETFWDSL.SYS --> c:\windows\system32\DRIVERS\NETFWDSL.SYS [?]

S3 siusbmod;siusbmod;c:\windows\system32\drivers\siusbmod.sys [23.12.2007 14:56 27008]
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

sbfkb

plovyolxt

.

Inhalt des "geplante Tasks" Ordners
 

2009-07-10 c:\windows\Tasks\1-Klick-Wartung.job

- c:\programme\TuneUp Utilities 2007\SystemOptimizer.exe [2006-11-23 15:46]

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

Notify-WgaLogon - (no file)
 
 

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://freakcamp.net/

mWindow Title = 

IE: Nach Microsoft &Excel exportieren - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Mozilla\Firefox\Profiles\zw00pasd.Standard-Benutzer\

FF - prefs.js: browser.startup.homepage - hxxp://audiomassive.de/blog/

FF - component: c:\dokumente und einstellungen\Kandel\Anwendungsdaten\Mozilla\Firefox\Profiles\zw00pasd.Standard-Benutzer\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll

FF - plugin: c:\programme\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll

FF - plugin: d:\programme\Firefox\plugins\npvlc.dll

FF - HiddenExtension: Java Console: No Registry Reference - d:\programme\Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-11 09:48

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************
 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ikcfdegb]

"ImagePath"="\??\c:\windows\system32\02D.tmp"
 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\plovyolxt]

"ServiceDll"="c:\windows\system32\jtmliwy.dll"

--
 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sbfkb]

"ServiceDll"="c:\windows\system32\jtmliwy.dll"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A54AE6D9-1146-03FB-2857897F111C6A4F}\{DD8CECF2-78C0-CF9A-49F4FAE856227A78}\{638B8461-7EC5-D2C3-C076811FCCFACE61}*]

"SE4K5INHHR1EDZYY15BVZC6TKG1"=hex:01,00,01,00,00,00,00,00,7e,c3,c3,8e,86,b4,21,

   5e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{CE901474-3557-00BE-0B74D16C6C9B8223}\{8B1B0984-A0E2-36AE-AE0ABC7DD3EE1D9C}\{C1D3D6EB-516B-0CD4-D732D0B608CDF1EA}*]

"SE4K5INHHR1EDZYY15BVZC6TKG1"=hex:01,00,01,00,00,00,00,00,7e,c3,c3,8e,86,b4,21,

   5e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F9E7FB8A-7FC0-F5C6-C2C005BCC6E52A75}\{38D64012-6403-EA81-41E60280EAB79558}\{8D4E630B-001F-4733-DF87B943421629E7}*]

"SE4K5INHHR1EDZYY15BVZC6TKG1"=hex:01,00,01,00,00,00,00,00,7e,c3,c3,8e,86,b4,21,

   5e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

.

Zeit der Fertigstellung: 2009-07-11  9:49

ComboFix-quarantined-files.txt  2009-07-11 07:49
 

Vor Suchlauf: 8 Verzeichnis(se), 10.302.214.144 Bytes frei

Nach Suchlauf: 8 Verzeichnis(se), 13.717.151.744 Bytes frei
 

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
 

198

SilentRunner:

Code:

"Silent Runners.vbs", revision 59, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"
 
 

Startup items buried in registry:

---------------------------------
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

"Veoh" = ""C:\Programme\Veoh Networks\Veoh\VeohClient.exe" /VeohHide" ["Veoh Networks"]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = "C:\Programme\Google\Gmail Notifier\gnotify.exe" ["Google Inc."]

"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]

"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]

"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{055FD26D-3A88-4e15-963D-DC8493744B1D}\(Default) = "XTTBPos00"

  -> {HKLM...CLSID} = "XTTBPos00 Class"

                   \InProcServer32\(Default) = "C:\Programme\ICQToolbar\tbu5F\toolbaru.dll" ["IE Toolbar"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "SSVHelper Class"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"

  -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"

                   \InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"

  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programme\WinRAR\rarext.dll" [null data]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "D:\Programme\Microsoft Office\OFFICE11\msohev.dll" [MS]

"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"

  -> {HKLM...CLSID} = "RealOne Player Context Menu Class"

                   \InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

"{EE75AC21-B24F-11d3-BA80-00C0CA16AA37}" = "BenQ-Siemens Device"

  -> {HKLM...CLSID} = "BenQ-Siemens Device"

                   \InProcServer32\(Default) = "C:\Programme\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]

"{EE75AC22-B24F-11d3-BA80-00C0CA16AA37}" = "BenQ-Siemens Device ContextMenuHandler"

  -> {HKLM...CLSID} = "BenQ-Siemens Device ContextMenuHandler"

                   \InProcServer32\(Default) = "C:\Programme\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]

"{EE75AC23-B24F-11d3-BA80-00C0CA16AA37}" = "BenQ-Siemens Device PropertySheetHandlers"

  -> {HKLM...CLSID} = "BenQ-Siemens Device PropertySheetHandler"

                   \InProcServer32\(Default) = "C:\Programme\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]

"{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension"

  -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"

                   \InProcServer32\(Default) = "C:\Programme\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"]

"{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension"

  -> {HKLM...CLSID} = "TuneUp Theme Extension"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\uxtuneup.dll" ["TuneUp Software GmbH"]

"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"

  -> {HKLM...CLSID} = "Desktop Explorer"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]

"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"

  -> {HKLM...CLSID} = "DesktopContext Class"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"

  -> {HKLM...CLSID} = "NVIDIA CPL Extension"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"

  -> {HKLM...CLSID} = "nView Desktop Context Menu"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
 

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]
 

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"

  -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"

                   \InProcServer32\(Default) = "C:\Programme\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programme\WinRAR\rarext.dll" [null data]

WS_FTP\(Default) = "{797F3885-5429-11D4-8823-0050DA59922B}"

  -> {HKLM...CLSID} = "RtClkCtxMenu Class"

                   \InProcServer32\(Default) = "C:\Programme\Ipswitch\WS_FTP Professional\wsftpsi.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]
 

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}"

  -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension"

                   \InProcServer32\(Default) = "C:\Programme\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programme\WinRAR\rarext.dll" [null data]
 

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "D:\Programme\WinRAR\rarext.dll" [null data]

WS_FTP\(Default) = "{797F3885-5429-11D4-8823-0050DA59922B}"

  -> {HKLM...CLSID} = "RtClkCtxMenu Class"

                   \InProcServer32\(Default) = "C:\Programme\Ipswitch\WS_FTP Professional\wsftpsi.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]
 
 

Default executables:

--------------------
 

<<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile"
 
 

Group Policies {GPedit.msc branch and setting}:

-----------------------------------------------
 

Note: detected settings may not have any effect.
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
 

"ClearRecentDocsOnExit" = (REG_DWORD) dword:0x00000001

{unrecognized setting}
 

"NoDrives" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
 

"NoDrives" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
 

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Shutdown: Allow system to be shut down without having to log on}
 

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Devices: Allow undock without having to log on}
 

"DisableRegistryTools" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 
 

Active Desktop and Wallpaper:

-----------------------------
 

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
 

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\WINDOWS\Firefox Wallpaper.bmp"
 
 

Windows Portable Device AutoPlay Handlers

-----------------------------------------
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\
 

BlankCDHandler\

"Provider" = "@D:\Programme\Nero\nero\APHandler.dll,-101"

"InvokeProgID" = "APHandler.Handler.1"

"InvokeVerb" = "BlankCD"

HKLM\SOFTWARE\Classes\APHandler.Handler.1\shell\BlankCD\command\(Default) = "D:\Programme\Nero\nero\nero.exe /BlankCD" ["Ahead Software AG Karlsbad Germany Phone: ++49-7248-911-800 Fax: ++49-7248-911-888 e-mail: info@nero.com"]
 

CDAudioHandler\

"Provider" = "@D:\Programme\Nero\nero\APHandler.dll,-101"

"InvokeProgID" = "APHandler.Handler.1"

"InvokeVerb" = "CDAudio"

HKLM\SOFTWARE\Classes\APHandler.Handler.1\shell\CDAudio\command\(Default) = "D:\Programme\Nero\nero\nero.exe /CDAudio" ["Ahead Software AG Karlsbad Germany Phone: ++49-7248-911-800 Fax: ++49-7248-911-888 e-mail: info@nero.com"]
 

RPCDBurningOnArrival\

"Provider" = "RealPlayer"

"InvokeProgID" = "RealPlayer.CDBurn.6"

"InvokeVerb" = "open"

HKLM\SOFTWARE\Classes\RealPlayer.CDBurn.6\shell\open\command\(Default) = "C:\Programme\Real\RealPlayer\RealPlay.exe /burn "%1"" ["RealNetworks, Inc."]
 

RPDeviceOnArrival\

"Provider" = "RealPlayer"

"ProgID" = "RealPlayer.HWEventHandler"

HKLM\SOFTWARE\Classes\RealPlayer.HWEventHandler\CLSID\(Default) = "{67E76F1D-BDE2-4052-913C-2752366192D2}"

  -> {HKLM...CLSID} = "RealNetworks Scheduler"

                   \LocalServer32\(Default) = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -autoplay" ["RealNetworks, Inc."]
 

RPPlayCDAudioOnArrival\

"Provider" = "RealPlayer"

"InvokeProgID" = "RealPlayer.AudioCD.6"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\RealPlayer.AudioCD.6\shell\play\command\(Default) = "C:\Programme\Real\RealPlayer\RealPlay.exe  /play %1 " ["RealNetworks, Inc."]
 

RPPlayDVDMovieOnArrival\

"Provider" = "RealPlayer"

"InvokeProgID" = "RealPlayer.DVD.6"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\RealPlayer.DVD.6\shell\play\command\(Default) = "C:\Programme\Real\RealPlayer\RealPlay.exe  /dvd %1 " ["RealNetworks, Inc."]
 

RPPlayMediaOnArrival\

"Provider" = "RealPlayer"

"InvokeProgID" = "RealPlayer.AutoPlay.6"

"InvokeVerb" = "open"

HKLM\SOFTWARE\Classes\RealPlayer.AutoPlay.6\shell\open\command\(Default) = "C:\Programme\Real\RealPlayer\RealPlay.exe /autoplay "%1"" ["RealNetworks, Inc."]
 

VLCPlayCDAudioOnArrival\

"Provider" = "VideoLAN VLC media player"

"InvokeProgID" = "VLC.CDAudio"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --one-instance-when-started-from-file cdda:%1" ["VideoLAN Team"]
 

VLCPlayDVDMovieOnArrival\

"Provider" = "VideoLAN VLC media player"

"InvokeProgID" = "VLC.DVDMovie"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --one-instance-when-started-from-file dvd:%1" ["VideoLAN Team"]
 
 

Enabled Scheduled Tasks:

------------------------
 

"1-Klick-Wartung" -> launches: "C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]
 
 

Winsock2 Service Provider DLLs:

-------------------------------
 

Namespace Service Providers
 

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
 

Transport Service Providers
 

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 21
 
 

Toolbars, Explorer Bars, Extensions:

------------------------------------
 

Toolbars
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\

"{D0943516-5076-4020-A3B5-AEFAF26AB263}" = "Veoh Video Finder"

  -> {HKLM...CLSID} = "Veoh Browser Plug-in"

                   \InProcServer32\(Default) = "C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll" ["Veoh Networks Inc"]
 

Explorer Bars
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
 

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Recherchieren"

Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]

InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS]
 

Extensions (Tools menu items, main toolbar menu buttons)
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Konsole"

"CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}"

  -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]

  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."]
 

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\

"ButtonText" = "Recherchieren"
 

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\

"ButtonText" = "ICQ Lite"

"MenuText" = "ICQ Lite"

"Exec" = "C:\Programme\ICQLite\ICQLite.exe" [file not found]
 
 

Miscellaneous IE Hijack Points

------------------------------
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\

<<H>> "TuneUp" = "file://C|/Dokumente und Einstellungen/All Users/Anwendungsdaten/TuneUp Software/Common/base.css" [file not found]
 
 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------
 

AntiVir PersonalEdition Classic Guard, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"]

AntiVir PersonalEdition Classic Planer, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]

NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]

TuneUp Designerweiterung, UxTuneUp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"]}

Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]
 
 

Print Monitors:

---------------
 

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\

Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
 
 

---------- (launch time: 2009-07-11 10:38:28)

<<!>>: Suspicious data at a malware launch point.

<<H>>: Suspicious data at a browser hijack point.
 

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

  launch it from a command prompt or a shortcut with the -all parameter.

+ The search for DESKTOP.INI DLL launch points on all local fixed drives

  took 63 seconds.

---------- (total run time: 106 seconds)