Trojaner-Board - Rechner läuft im System sehr langsam Daselbe im Netz.

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Rechner läuft im System sehr langsam Daselbe im Netz. (https://www.trojaner-board.de/99686-rechner-laeuft-system-sehr-langsam-daselbe-netz.html)

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

File::

C:\WINNT\system32\MSTask.exe

C:\WINNT\System32\drivers\cfuejwni.sys

C:\WINNT\system32\drivers\sglfb.sys

C:\WINNT\system32\drivers\tga.sys
 

Driver::

gdbdyrc

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Bitte mal den Avenger anwenden:

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:

http://mitglied.lycos.de/efunction/tb123/avenger.png

3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

Code:

Files to delete:

c:\dokumente und einstellungen\NetworkService.NT-AUTORITÄT.000\Lokale Einstellungen\Anwendungsdaten\d3d9caps.tmp
 

Folders to delete:

c:\windows\system32\logs

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net - Ihr kostenloser File Hoster! hochladen und hier verlinken

Das habe ich gemacht,leider habe ich den Neustart verpasst,da ich mir notiert habe was auf dem Bildschirm stand:

Systemfiles is infected!!Attempting to restore
C: \Winnt\system32Drivers\Volsnap.sys

Das Pogramm aktuallisierte sich selbst lief dann nochmal durch und erstellte diese Logfile.(Dabei hatte ich das Internet noch an)

Combofix Logfile:

Code:

ComboFix 11-05-31.01 - Paulsen 31.05.2011  22:23:15.2.1 - x86

Microsoft Windows 2000 Professional  5.0.2195.4.1252.49.1031.18.383.127 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Paulsen\Desktop\cofi.exe.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Paulsen\Desktop\CFScript.txt

.

FILE ::

"c:\winnt\System32\drivers\cfuejwni.sys"

"c:\winnt\system32\drivers\sglfb.sys"

"c:\winnt\system32\drivers\tga.sys"

"c:\winnt\system32\MSTask.exe"

.

        /wow section - STAGE 10

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\cofi.exe

c:\cofi.exe\023.dat

c:\cofi.exe\AllDrivesFolders

c:\cofi.exe\APISvc

c:\cofi.exe\AppData.folder.dat

c:\cofi.exe\asp.str

c:\cofi.exe\Assoc.cmd

c:\cofi.exe\ATTRIB.cfxxe

c:\cofi.exe\av.cmd

c:\cofi.exe\av.vbs

c:\cofi.exe\badclsid

c:\cofi.exe\BadClsidFiles00

c:\cofi.exe\BHO.dat

c:\cofi.exe\BHOFiles.dat

c:\cofi.exe\BHOQuery.dat

c:\cofi.exe\BitsPath

c:\cofi.exe\BitsStr

c:\cofi.exe\Boot-Rk.cmd

c:\cofi.exe\Boot.bat

c:\cofi.exe\BootDrv.vbs

c:\cofi.exe\c.mrk

c:\cofi.exe\Cache.folder.dat

c:\cofi.exe\Catch-sub.cmd

c:\cofi.exe\catch_E.dat

c:\cofi.exe\catch_k.dat

c:\cofi.exe\catchme.cfxxe

c:\cofi.exe\Catchme.tmp

c:\cofi.exe\CCS.bat

c:\cofi.exe\CF17350.cfxxe

c:\cofi.exe\cfdummy

c:\cofi.exe\cfrun

c:\cofi.exe\CHCP.bat

c:\cofi.exe\ClistB.dat

c:\cofi.exe\clsid.dat

c:\cofi.exe\clsid.hiv

c:\cofi.exe\ClsidDumped

c:\cofi.exe\ClsidFiles

c:\cofi.exe\ComboFix-Download.cfxxe

c:\cofi.exe\ComboFix.tmp

c:\cofi.exe\ComboFix.txt

c:\cofi.exe\ConEnv.sed

c:\cofi.exe\Creg.dat

c:\cofi.exe\CregB.dat

c:\cofi.exe\CregC.cmd

c:\cofi.exe\CregC.dat

c:\cofi.exe\CSCRIPT.cfxxe

c:\cofi.exe\CSet.cmd

c:\cofi.exe\d-del4AV.dat

c:\cofi.exe\dd.cfxxe

c:\cofi.exe\ddsDo.sed

c:\cofi.exe\DelClsid.bat

c:\cofi.exe\delclsid00

c:\cofi.exe\DisclaimED.dat

c:\cofi.exe\dll_whitelist.dat

c:\cofi.exe\dnd.dat

c:\cofi.exe\dollar_log.dat

c:\cofi.exe\DPF.str

c:\cofi.exe\drev.dat

c:\cofi.exe\Drive.folder.dat

c:\cofi.exe\DriveFile.dat

c:\cofi.exe\DrivesB.dat

c:\cofi.exe\DrvRun.vbs

c:\cofi.exe\DTime.bat

c:\cofi.exe\dumphive.cfxxe

c:\cofi.exe\embedded.sed

c:\cofi.exe\Env.sed

c:\cofi.exe\ERDNT.e_e

c:\cofi.exe\ERDNTDOS.LOC

c:\cofi.exe\ERDNTWIN.LOC

c:\cofi.exe\ErrTrap1

c:\cofi.exe\ErrTrap10

c:\cofi.exe\ERUNT.cfxxe

c:\cofi.exe\erunt.dat

c:\cofi.exe\ERUNT.LOC

c:\cofi.exe\Exe.reg

c:\cofi.exe\extract.cfxxe

c:\cofi.exe\f_system

c:\cofi.exe\F3m.mrk

c:\cofi.exe\FavFolderD.dat

c:\cofi.exe\FdsvOK

c:\cofi.exe\ffdefstr.dll

c:\cofi.exe\FFPolicyB

c:\cofi.exe\FileKill.cfxxe

c:\cofi.exe\files.pif

c:\cofi.exe\Fin.dat

c:\cofi.exe\FIND3M.bat

c:\cofi.exe\FIXLSP.bat

c:\cofi.exe\FKMGen.cmd

c:\cofi.exe\ForeignWht

c:\cofi.exe\FPluginsB

c:\cofi.exe\Gateway

c:\cofi.exe\grep.cfxxe

c:\cofi.exe\gsar.cfxxe

c:\cofi.exe\handle.cfxxe

c:\cofi.exe\HDCntrl01

c:\cofi.exe\HDPEInfo.cfxxe

c:\cofi.exe\hidec.cfxxe

c:\cofi.exe\history.bat

c:\cofi.exe\History.folder.dat

c:\cofi.exe\iexplore.exe

c:\cofi.exe\image001.gif

c:\cofi.exe\Imefile.dat

c:\cofi.exe\katch.cmd

c:\cofi.exe\kmd.dat

c:\cofi.exe\L_Beep00

c:\cofi.exe\Lang.bat

c:\cofi.exe\LatestVer

c:\cofi.exe\LegacyFull

c:\cofi.exe\LegacyNoSvc

c:\cofi.exe\lnkread.vbs

c:\cofi.exe\LocalAppData.folder.dat

c:\cofi.exe\LocalService.dat

c:\cofi.exe\LocalServiceNetworkRestricted.dat

c:\cofi.exe\LocalSettings.folder.dat

c:\cofi.exe\LocalSystemNetworkRestricted.dat

c:\cofi.exe\Look.dat

c:\cofi.exe\LSPDone

c:\cofi.exe\mbr.cfxxe

c:\cofi.exe\mbr.chk

c:\cofi.exe\md5sum.pif

c:\cofi.exe\Mirrors

c:\cofi.exe\MissingFiles.dat

c:\cofi.exe\Modules

c:\cofi.exe\MoveIt.bat

c:\cofi.exe\mtee.cfxxe

c:\cofi.exe\MtPt00

c:\cofi.exe\Music.folder.dat

c:\cofi.exe\MWindows.dat

c:\cofi.exe\mynul.dat

c:\cofi.exe\N_\1237

c:\cofi.exe\N_\3229

c:\cofi.exe\N_\32744

c:\cofi.exe\N_\7402

c:\cofi.exe\ncmd.com

c:\cofi.exe\ND_.bat

c:\cofi.exe\ND_64.bat

c:\cofi.exe\ND_Legits

c:\cofi.exe\ND_Legits_QooBox

c:\cofi.exe\ndis_combofix.dat

c:\cofi.exe\ndis_log.dat

c:\cofi.exe\NetHood.folder.dat

c:\cofi.exe\netsvc.bad.dat

c:\cofi.exe\netsvc.dat

c:\cofi.exe\NetworkService.dat

c:\cofi.exe\NirCmd.cfxxe

c:\cofi.exe\NircmdB.exe

c:\cofi.exe\NirCmdC.cfxxe

c:\cofi.exe\NIRKMD.cfxxe

c:\cofi.exe\NlsLanguageDefault

c:\cofi.exe\NoX2del

c:\cofi.exe\NT-OS.cmd

c:\cofi.exe\NULL

c:\cofi.exe\OriO4Files.dat

c:\cofi.exe\OriO4FilesB.dat

c:\cofi.exe\Orphans.dat

c:\cofi.exe\OsId.txt

c:\cofi.exe\OSid.vbs

c:\cofi.exe\OsVer

c:\cofi.exe\patched.af

c:\cofi.exe\PathSearch

c:\cofi.exe\Paulsen.user.cf

c:\cofi.exe\pausep.cfxxe

c:\cofi.exe\pend.txt

c:\cofi.exe\pev.cfxxe

c:\cofi.exe\pevb.cfxxe

c:\cofi.exe\Pictures.folder.dat

c:\cofi.exe\PING.cfxxe

c:\cofi.exe\Policies.dat

c:\cofi.exe\powp.dat

c:\cofi.exe\PreDIR

c:\cofi.exe\Prep.inf

c:\cofi.exe\PrintHood.folder.dat

c:\cofi.exe\Profiles.Folder.dat

c:\cofi.exe\Profiles.Folder.folder.dat

c:\cofi.exe\progfile.dat

c:\cofi.exe\Purity.dat

c:\cofi.exe\PV.cfxxe

c:\cofi.exe\pv.com

c:\cofi.exe\Q_Clsids

c:\cofi.exe\rar_sfx.cmd

c:\cofi.exe\raw_enum.dat

c:\cofi.exe\rawreg.dat

c:\cofi.exe\RCLink.dat

c:\cofi.exe\RcRdyList

c:\cofi.exe\RcVer00

c:\cofi.exe\Recent.folder.dat

c:\cofi.exe\REGDACL.sed

c:\cofi.exe\RegDo.sed

c:\cofi.exe\region.dat

c:\cofi.exe\RegLocks.txt

c:\cofi.exe\RegRun01

c:\cofi.exe\REGT.cfxxe

c:\cofi.exe\remdir00

c:\cofi.exe\RenVDel.dat

c:\cofi.exe\RenVSuspect

c:\cofi.exe\Resident.txt

c:\cofi.exe\Rkey.cmd

c:\cofi.exe\rmbr.cfxxe

c:\cofi.exe\rogues.dat

c:\cofi.exe\ROUTE.cfxxe

c:\cofi.exe\run.sed

c:\cofi.exe\run2.sed

c:\cofi.exe\Rust.str

c:\cofi.exe\s0rt.cfxxe

c:\cofi.exe\safeboot.dat

c:\cofi.exe\safeboot.def.dat

c:\cofi.exe\safeboot.def.W2K.dat

c:\cofi.exe\safeboot00

c:\cofi.exe\sed.cfxxe

c:\cofi.exe\SendTo.folder.dat

c:\cofi.exe\ServiceFiles.dat

c:\cofi.exe\SetEnvmt.bat

c:\cofi.exe\SetPath.bat

c:\cofi.exe\setpath.cfxxe

c:\cofi.exe\setpath_N.cmd

c:\cofi.exe\SF.exe

c:\cofi.exe\sfx.cmd

c:\cofi.exe\SigChkMissing.dat

c:\cofi.exe\snapshot.00.dat

c:\cofi.exe\SnapShot.02.dat

c:\cofi.exe\srizbi.md5

c:\cofi.exe\Start_dat

c:\cofi.exe\StartUp.folder.dat

c:\cofi.exe\SuspectB_netsvc.dat

c:\cofi.exe\suspectSvc.dat

c:\cofi.exe\svc_wht.dat

c:\cofi.exe\SvcCovered

c:\cofi.exe\SvcDiff

c:\cofi.exe\SvcDrv.vbs

c:\cofi.exe\SvcDump

c:\cofi.exe\SvcDumpB

c:\cofi.exe\SvcDumpFull

c:\cofi.exe\SvcFull

c:\cofi.exe\svchost.dat

c:\cofi.exe\svchost.vista.x64.dat

c:\cofi.exe\svclist.dat

c:\cofi.exe\SvcTarget.dat

c:\cofi.exe\SvcTempAa

c:\cofi.exe\swreg.cfxxe

c:\cofi.exe\swsc.cfxxe

c:\cofi.exe\swxcacls.cfxxe

c:\cofi.exe\sys_enum.dat

c:\cofi.exe\SysPath.dat

c:\cofi.exe\System.dump

c:\cofi.exe\system_ini.dat

c:\cofi.exe\tail.cfxxe

c:\cofi.exe\temp2000

c:\cofi.exe\temp4000

c:\cofi.exe\time_.dat

c:\cofi.exe\toolbar.sed

c:\cofi.exe\unhand.dat

c:\cofi.exe\Unhandled.dat

c:\cofi.exe\Update-CF.cmd

c:\cofi.exe\UploadThese

c:\cofi.exe\V-FilesB.dat

c:\cofi.exe\v-tmp.dat

c:\cofi.exe\v_str.dat

c:\cofi.exe\v_wht.dat

c:\cofi.exe\VerCF.bat

c:\cofi.exe\version.txt

c:\cofi.exe\VikPev00

c:\cofi.exe\Vikpev01

c:\cofi.exe\VInfo2

c:\cofi.exe\Vipev.dat

c:\cofi.exe\vistaMcode.dat

c:\cofi.exe\Volsnap.sys.ND_

c:\cofi.exe\vRun_DLL

c:\cofi.exe\vun.dat

c:\cofi.exe\W2K.mac

c:\cofi.exe\w7Mcode.dat

c:\cofi.exe\whiteAll.dat

c:\cofi.exe\Wmi_rem.vbs

c:\cofi.exe\WrgNameDLL

c:\cofi.exe\xpmcode.dat

c:\cofi.exe\XPSBoot.reg

c:\cofi.exe\zDomain.dat

c:\cofi.exe\zip.cfxxe

c:\cofi.exe\Zlob01

.

---- Vorheriger Suchlauf -------

.

c:\programme\Mozilla Firefox\components\npclntax.xpt

c:\winnt\Web\default.htt

.

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_gdbdyrc

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-28 bis 2011-05-31  ))))))))))))))))))))))))))))))

.

.

2011-05-31 20:17 . 2011-05-31 20:19        --------        d-----w-        C:\cofi.exe28752c

2011-05-31 19:26 . 2011-05-31 19:26        553        ----a-w-        C:\backup.reg

2011-05-31 19:26 . 2011-05-31 19:26        61440        ----a-w-        c:\winnt\system32\drivers\ncxaif.sys

2011-05-30 19:51 . 2011-05-30 19:51        61440        ----a-w-        c:\winnt\system32\drivers\ycbq.sys

2011-05-30 15:34 . 2011-05-30 15:41        --------        d-----w-        C:\ComboFix

2011-05-30 14:57 . 2011-05-30 14:57        --------        d-----w-        C:\_OTL

2011-05-30 10:02 . 2011-05-30 10:13        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Canon

2011-05-30 10:00 . 2003-06-19 19:05        12592        -c--a-w-        c:\winnt\system32\dllcache\usbscan.sys

2011-05-30 10:00 . 2003-06-19 19:05        12592        ----a-w-        c:\winnt\system32\drivers\usbscan.sys

2011-05-30 09:53 . 2002-11-20 13:15        729088        ----a-w-        c:\winnt\system32\CNQA1209.DLL

2011-05-30 09:53 . 2002-11-20 11:42        507904        ----a-w-        c:\winnt\system32\CNQL1209.DLL

2011-05-30 09:53 . 2002-11-15 08:15        40960        ----a-w-        c:\winnt\system32\CNQU83.DLL

2011-05-30 09:53 . 2002-05-24 01:04        389180        ----a-w-        c:\winnt\system32\UCS32P.DLL

2011-05-29 21:02 . 2011-05-29 21:02        --------        d-----w-        C:\PerfLogs

2011-05-29 17:39 . 2011-05-29 17:39        --------        d-----w-        c:\winnt\Profiles

2011-05-29 17:39 . 2011-05-29 17:39        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\InterTrust

2011-05-29 17:21 . 2011-05-30 09:53        --------        d-----w-        C:\CanoScan

2011-05-29 15:34 . 1999-12-07 22:59        148752        -c--a-w-        c:\winnt\system32\dllcache\gfototwn.dll

2011-05-29 15:34 . 1999-12-07 22:59        148752        ----a-w-        c:\winnt\system32\gFotoTwn.dll

2011-05-29 15:34 . 1999-12-07 22:59        74000        -c--a-w-        c:\winnt\system32\dllcache\fnfilter.dll

2011-05-29 15:34 . 1999-12-07 22:59        74000        ----a-w-        c:\winnt\system32\fnfilter.dll

2011-05-29 15:34 . 1999-12-07 21:19        6896        -c--a-w-        c:\winnt\system32\dllcache\serscan.sys

2011-05-29 15:34 . 1999-12-07 21:19        6896        ----a-w-        c:\winnt\system32\drivers\serscan.sys

2011-05-29 15:34 . 1999-12-07 22:58        24848        -c--a-w-        c:\winnt\system32\dllcache\cnusd.dll

2011-05-29 15:34 . 1999-12-07 22:58        24848        ----a-w-        c:\winnt\system32\cnusd.dll

2011-05-29 13:57 . 2011-05-29 13:57        --------        d-----w-        C:\Program Files

2011-05-29 13:57 . 2000-06-22 11:02        44544        ----a-w-        c:\programme\Internet Explorer\PLUGINS\NPIPRT32.DLL

2011-05-29 13:55 . 2011-05-29 13:55        --------        d-----w-        c:\programme\EPSON

2011-05-28 17:54 . 2011-05-28 17:54        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Avira

2011-05-28 08:32 . 2011-04-01 15:07        73584        ----a-w-        c:\winnt\system32\drivers\avgntflt.sys

2011-05-28 08:32 . 2011-04-01 15:07        132800        ----a-w-        c:\winnt\system32\drivers\avipbb.sys

2011-05-28 08:32 . 2010-06-17 13:27        64488        ----a-w-        c:\winnt\system32\drivers\avgntdd.sys

2011-05-28 08:32 . 2010-06-17 13:27        18520        ----a-w-        c:\winnt\system32\drivers\avgntmgr.sys

2011-05-28 08:32 . 2011-05-28 08:32        --------        dc----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2011-05-28 08:32 . 2011-05-28 08:32        --------        d-----w-        c:\programme\Avira

2011-05-27 20:20 . 2011-05-27 20:20        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Malwarebytes

2011-05-27 20:20 . 2010-12-20 16:09        38224        ----a-w-        c:\winnt\system32\drivers\mbamswissarmy.sys

2011-05-27 20:19 . 2011-05-27 20:19        --------        dc----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-05-27 20:19 . 2011-05-27 20:20        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-05-27 20:19 . 2010-12-20 16:08        19288        ----a-w-        c:\winnt\system32\drivers\mbam.sys

2011-05-27 19:21 . 2011-05-29 17:39        --------        d-----w-        c:\winnt\system32\Adobe

2011-05-24 19:54 . 2011-05-24 19:54        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\QuickScan

2011-05-24 18:59 . 2011-05-24 18:59        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype

2011-05-24 18:59 . 2011-05-24 18:59        --------        d-----r-        c:\programme\Skype

2011-05-16 18:06 . 2011-05-16 18:06        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\FreeFLVConverter

2011-05-16 17:28 . 2006-10-17 20:29        487479        ----a-w-        c:\winnt\system32\SkinMagic.dll

2011-05-16 16:57 . 2011-05-16 16:57        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\AnvSoft

2011-05-16 16:56 . 2010-03-19 06:23        686592        ----a-w-        c:\programme\Mozilla Firefox\plugins\npmieze.dll

2011-05-16 16:56 . 2011-05-16 18:01        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Gutscheinmieze

2011-05-15 21:54 . 2011-05-16 17:03        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\vlc

2011-05-15 21:40 . 2011-05-15 21:40        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java

2011-05-15 21:39 . 2011-04-14 03:08        472808        ----a-w-        c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll

2011-05-15 21:39 . 2011-04-14 03:07        472808        ----a-w-        c:\winnt\system32\deployJava1.dll

2011-05-15 21:39 . 2011-04-14 00:40        73728        ----a-w-        c:\winnt\system32\javacpl.cpl

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-20 17:15 . 2008-12-25 19:44        307200        ----a-w-        c:\winnt\system32\TubeFinder.exe

2007-03-30 13:38 . 2007-03-30 13:38        77160        ----a-w-        c:\programme\DSETUP.dll

2007-03-30 13:38 . 2007-03-30 13:38        503144        ----a-w-        c:\programme\DXSETUP.exe

2007-03-30 13:38 . 2007-03-30 13:38        1673576        ----a-w-        c:\programme\dsetup32.dll

2008-09-16 00:12 . 2008-09-16 00:12        479232        ----a-w-        c:\programme\mozilla firefox\plugins\msvcm80.dll

2008-09-16 00:12 . 2008-09-16 00:12        548864        ----a-w-        c:\programme\mozilla firefox\plugins\msvcp80.dll

2008-09-16 00:12 . 2008-09-16 00:12        626688        ----a-w-        c:\programme\mozilla firefox\plugins\msvcr80.dll

2011-05-26 18:12 . 2011-05-26 18:12        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

.

[-] 2002-11-26 17:03 . 36678803A8030EE9A771935CFC1848BD . 52224 . . [ERROR: 0x0] . . c:\winnt\system32\mspmsnsv.dll

.

[-] 2004-07-09 03:27 . 0E51BD586D186F61A9E4453DB8AEC774 . 1703936 . . [ERROR: 0x0] . . c:\winnt\system32\d3d9.dll

.

c:\winnt\System32\comres.dll ... Fehlt !!

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Picasa Media Detector"="c:\programme\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2006-03-09 7561216]

"Synchronization Manager"="mobsync.exe" [2003-06-19 112400]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-01-07 253672]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

.

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

EPSON Status Monitor 3 Environment Check 2.lnk - c:\winnt\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2011-5-29 127488]

Microsoft Office.lnk - c:\programme\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders        msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Omnipage

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]

c:\programme\Picasa2\PicasaMediaDetector [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

2001-07-03 11:26        753664        ------w-        c:\programme\ahead\InCD\InCD.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]

2001-07-09 09:50        155648        ----a-w-        c:\winnt\system32\NeroCheck.exe

.

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [28.05.2011 10:33 136360]

R2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\winnt\system32\drivers\npf_devolo.sys [13.05.2008 16:00 35840]

R3 openhci;Microsoft USB-Open Host-Controllertreiber;c:\winnt\system32\drivers\openhci.sys [03.09.2006 18:00 24784]

S3 Slnt7554;USB Soft Modem Driver;c:\winnt\system32\drivers\slnt7554.sys [19.03.2006 17:00 210488]

.

.

------- Zusätzlicher Suchlauf -------

.

uDefault_Search_URL = hxxp://www.google.com/ie

uStart Page = hxxp://www.google.de/

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Add animation to IncrediMail Style Box - c:\programme\IncrediMail\bin\resources\WebMenuImg.htm

IE: Save YouTube Video as MP3

LSP: %SystemRoot%\system32\msafd.dll

TCP: DhcpNameServer = 192.168.2.1

DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab

DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll

FF - ProfilePath - c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Mozilla\Firefox\Profiles\1s8cc649.default\

FF - prefs.js: browser.search.selectedEngine - foxsearch

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=

FF - prefs.js: network.proxy.type - 0

FF - user.js: browser.search.selectedEngine - foxsearch

FF - user.js: browser.search.order.1 - foxsearch

FF - user.js: browser.search.defaultenginename - foxsearch

FF - user.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=

FF - user.js: privacy.item.cookies - false

FF - user.js: privacy.sanitize.promptOnSanitize - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-31 22:38

Windows 5.0.2195 Service Pack 4 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Iomega Activity Disk2]

"ImagePath"="\"\""

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1715567821-436374069-1708537768-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3BA82B31-2D0A-40B2-DAC9-4639D0DBC214}*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"iaakfccdphifpllboj"=hex:6b,61,6f,69,67,61,67,69,66,67,64,65,66,6c,66,70,61,68,

   68,62,68,67,00,00

"hakncdhohnoenhie"=hex:6b,61,6f,69,64,61,6c,68,6d,6b,6a,6c,69,63,62,68,64,6f,

   6f,6a,61,6e,00,00

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(184)

c:\winnt\system32\wzcdlg.dll

c:\winnt\system32\WZCSAPI.DLL

c:\winnt\system32\msv1_0.dll

.

- - - - - - - > 'lsass.exe'(248)

c:\winnt\system32\mpr.dll

.

- - - - - - - > 'explorer.exe'(1084)

c:\winnt\system32\SHDOCVW.DLL

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\winnt\System32\cisvc.exe

c:\winnt\System32\CTSvcCDA.exe

c:\programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\winnt\System32\nvsvc32.exe

c:\winnt\system32\regsvc.exe

c:\winnt\system32\MSTask.exe

c:\winnt\system32\stisvc.exe

c:\winnt\System32\WBEM\WinMgmt.exe

c:\winnt\system32\mspmspsv.exe

c:\winnt\system32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

c:\winnt\System32\cidaemon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-31  22:43:30 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-31 20:43

ComboFix2.txt  2011-05-30 16:07

.

Vor Suchlauf: 6.509.514.752 Bytes frei

Nach Suchlauf: 6.458.085.376 Bytes frei

.

- - End Of File - - B2A48A6B631136FF0D17CC7A84F12DD9

--- --- ---

Ich befürchte dein System ist im Eimer.

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

GMER Logfile:

Code:

GMER 1.0.15.15640 - GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-31 23:25:50

Windows 5.0.2195 Service Pack 4 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-2 Maxtor_2B020H1 rev.WAH21PB0

Running: 7svv5y7u.exe; Driver: C:\DOKUME~1\Paulsen\LOKALE~1\Temp\ufpyqaow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            82424BC6                                                                                                                            ZwCreateKey

SSDT            82424BBC                                                                                                                            ZwCreateThread

SSDT            82424BCB                                                                                                                            ZwDeleteKey

SSDT            82424BD5                                                                                                                            ZwDeleteValueKey

SSDT            82424BDA                                                                                                                            ZwLoadKey

SSDT            82424BA8                                                                                                                            ZwOpenProcess

SSDT            82424BAD                                                                                                                            ZwOpenThread

SSDT            82424BE4                                                                                                                            ZwReplaceKey

SSDT            82424BDF                                                                                                                            ZwRestoreKey

SSDT            82424BD0                                                                                                                            ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               Combo-Fix.sys                                                                                                                       Das System kann die angegebene Datei nicht finden. !

.text           C:\WINNT\System32\DRIVERS\nv4_mini.sys                                                                                              section is writeable [0xBFAF5380, 0x21F24D, 0xE8000020]

?               C:\cofi.exe26068c\catchme.sys                                                                                                       Das System kann die angegebene Datei nicht finden. !
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\explorer.exe [KERNEL32.DLL!CreateProcessW]                                                   [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\explorer.exe [KERNEL32.DLL!LoadLibraryW]                                                     [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\explorer.exe [KERNEL32.DLL!GetProcAddress]                                                   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\explorer.exe [KERNEL32.DLL!FreeLibrary]                                                      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\explorer.exe [KERNEL32.DLL!LoadLibraryA]                                                     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryExW]                                          [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessA]                                          [4AD84AE3] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessW]                                          [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryW]                                            [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!FreeLibrary]                                             [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryA]                                            [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!GetProcAddress]                                          [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW]                                              [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary]                                               [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]                                            [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA]                                              [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryExW]                                             [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryA]                                               [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!FreeLibrary]                                                [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!GetProcAddress]                                             [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryW]                                               [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                                            [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!CreateProcessW]                                            [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]                                              [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]                                              [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                                            [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!FreeLibrary]                                               [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExA]                                           [760B78DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExW]                                           [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryW]                                             [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessA]                                           [4AD84AE3] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessW]                                           [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]                                            [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA]                                              [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary]                                               [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessA]                                            [4AD84AE3] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessW]                                            [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]                                           [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!CreateProcessW]                                           [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]                                             [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!GetProcAddress]                                             [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryA]                                               [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!FreeLibrary]                                                [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryW]                                               [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryExW]                                             [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!CreateProcessW]                                             [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!LoadLibraryW]                                            [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!GetProcAddress]                                          [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!FreeLibrary]                                             [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW]                                             [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!FreeLibrary]                                               [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!LoadLibraryA]                                              [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!GetProcAddress]                                            [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryW]                                             [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryExW]                                           [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!CreateProcessW]                                           [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryW]                                             [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                                           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA]                                             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]                                           [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA]                                           [760B78DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\explorer.exe[1084] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary]                                              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                            fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Services - GMER 1.0.15 ----
 

Service         C:\WINNT\system32\MSTask.exe? (*** hidden *** )                                                                                     [AUTO] Schedule                                                                                     <-- ROOTKIT !!!
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout                                                  15

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                                                     10000

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                                                                   yes

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                                                                  

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout                                                  90

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota                                                    10000

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs                                                 1

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3BA82B31-2D0A-40B2-DAC9-4639D0DBC214}                     

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3BA82B31-2D0A-40B2-DAC9-4639D0DBC214}@iaakfccdphifpllboj  0x6B 0x61 0x6F 0x69 ...

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3BA82B31-2D0A-40B2-DAC9-4639D0DBC214}@hakncdhohnoenhie    0x6B 0x61 0x6F 0x69 ...
 

---- EOF - GMER 1.0.15 ----

--- --- ---

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 23:32:29 on 31.05.2011
 

OS: Windows 2000 Professional Service Pack 4 (Build 2195)

Default Browser: Mozilla Corporation Firefox 4.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"CTDetect.cpl" - "Creative Technology Ltd." - C:\WINNT\system32\CTDetect.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINNT\system32\javacpl.cpl

"joy.cpl" - "Microsoft Corporation" - C:\WINNT\system32\joy.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINNT\system32\nvtuicpl.cpl

"slcpappl.cpl" - ? - C:\WINNT\system32\slcpappl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINNT\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINNT\System32\DRIVERS\avipbb.sys

"Bluetooth Audio Service" (BlueletAudio) - ? - C:\WINNT\System32\DRIVERS\blueletaudio.sys  (File not found)

"Bluetooth HID Enumerator" (BTHidEnum) - ? - C:\WINNT\System32\Drivers\vbtenum.sys  (File not found)

"Bluetooth HID Manager Service" (BTHidMgr) - ? - C:\WINNT\System32\Drivers\BTHidMgr.sys  (File not found)

"Bluetooth PAN Network Adapter" (BT) - ? - C:\WINNT\System32\DRIVERS\btnetdrv.sys  (File not found)

"Bluetooth SCO Audio Service" (BlueletSCOAudio) - ? - C:\WINNT\System32\DRIVERS\BlueletSCOAudio.sys  (File not found)

"Bluetooth USB For Bluetooth Service" (Btcsrusb) - ? - C:\WINNT\System32\Drivers\btcusb.sys  (File not found)

"Bluetooth VComm Manager Service" (VcommMgr) - ? - C:\WINNT\System32\Drivers\VcommMgr.sys  (File not found)

"catchme" (catchme) - ? - C:\cofi.exe26068c\catchme.sys  (File not found)

"Cdr4_2K" (Cdr4_2K) - "Sonic Solutions" - C:\WINNT\system32\drivers\Cdr4_2K.sys

"Cdralw2k" (Cdralw2k) - "Sonic Solutions" - C:\WINNT\system32\drivers\Cdralw2k.sys

"cdrbsvsd" (cdrbsvsd) - "B.H.A Corporation" - C:\WINNT\system32\drivers\cdrbsvsd.sys

"Changer" (Changer) - ? - C:\WINNT\system32\drivers\Changer.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINNT\system32\drivers\lbrtfdc.sys  (File not found)

"mbr" (mbr) - ? - C:\DOKUME~1\Paulsen\LOKALE~1\Temp\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"Mtlmnt5" (Mtlmnt5) - " " - C:\WINNT\System32\DRIVERS\Mtlmnt5.sys

"Mtlstrm" (Mtlstrm) - " " - C:\WINNT\System32\DRIVERS\Mtlstrm.sys

"NetGroup Packet Filter Driver (devolo)" (NPF_devolo) - "CACE Technologies" - C:\WINNT\system32\drivers\npf_devolo.sys

"NtMtlFax" (NtMtlFax) - " " - C:\WINNT\System32\DRIVERS\NtMtlFax.sys

"nv" (nv) - "NVIDIA Corporation" - C:\WINNT\System32\DRIVERS\nv4_mini.sys

"PCIDump" (PCIDump) - ? - C:\WINNT\system32\drivers\PCIDump.sys  (File not found)

"PfModNT" (PfModNT) - "Creative Technology Ltd." - C:\WINNT\System32\PfModNT.sys

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINNT\System32\Drivers\PxHelp20.sys

"recagent" (RecAgent) - " " - C:\WINNT\System32\DRIVERS\RecAgent.sys

"SecDrv" (SecDrv) - "Macrovision Europe Ltd" - C:\WINNT\system32\drivers\SECDRV.SYS

"sglfb" (sglfb) - ? - C:\WINNT\system32\drivers\sglfb.sys  (File not found)

"SlNtHal" (SlNtHal) - " " - C:\WINNT\System32\DRIVERS\Slnthal.sys

"SlWdmSup" (SlWdmSup) - "Vireo Software" - C:\WINNT\System32\DRIVERS\SlWdmSup.sys

"Sony Digital Imaging Video2" (sonypvs1) - "Sony Corporation" - C:\WINNT\System32\DRIVERS\sonypvs1.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINNT\System32\DRIVERS\ssmdrv.sys

"tga" (tga) - ? - C:\WINNT\system32\drivers\tga.sys  (File not found)

"ufpyqaow" (ufpyqaow) - ? - C:\DOKUME~1\Paulsen\LOKALE~1\Temp\ufpyqaow.sys  (Hidden registry entry, rootkit activity | File not found)

"USB Soft Modem Driver" (Slnt7554) - "   " - C:\WINNT\System32\DRIVERS\slnt7554.sys

"viaide" (viaide) - "VIA Technologies, Inc." - C:\WINNT\System32\DRIVERS\viaide.sys

"Virtual Serial port driver" (VComm) - ? - C:\WINNT\System32\DRIVERS\VComm.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} "CRLUpdate" - "Microsoft Corporation" - %SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -   (File not found | COM-object registry key not found)

{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5} "dBpowerAMP Music Converter" - ? -   (File not found | COM-object registry key not found)

{FED7043D-346A-414D-ACD7-550D052499A7} "dBpowerAMP Music Converter 1" - ? -   (File not found | COM-object registry key not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINNT\System32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINNT\System32\nvshell.dll

{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINNT\System32\nvshell.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL

{4ADF8C01-0AC7-4403-888C-012E6EA2F67E} "S2PCISE.S2PCISE" - ? - mscoree.dll  (File not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell-Erweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{DBD8E168-244D-448C-9922-25508950D1DC} "Ulead UDF Driver" - ? -   (File not found | COM-object registry key not found)

{8FF88D27-7BD0-11D1-BFB7-00AA00262A11} "WinAceContext Menu (Add) Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll

{8FF88D21-7BD0-11D1-BFB7-00AA00262A11} "WinAceContext Menu Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll

{8FF88D25-7BD0-11D1-BFB7-00AA00262A11} "WinAceDrag-Drop Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll

{8FF88D23-7BD0-11D1-BFB7-00AA00262A11} "WinAceProperty Sheet Extension" - "e-merge GmbH" - C:\Programme\WinAce\arcext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

<binary data> "Yahoo! Toolbar mit Pop-Up-Blocker" - ? -   (File not found | COM-object registry key not found)

<binary data> "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" - ? -   (File not found | COM-object registry key not found)

<binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)

<binary data> "{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}" - ? -   (File not found | COM-object registry key not found)

<binary data> "{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} "CSEQueryObject Object" - "MyHeritage Ltd." - C:\WINNT\Downloaded Program Files\SearchEngineQuery.dll / hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll

DirectAnimation Java Classes "DirectAnimation Java Classes" - ? -   (File not found | COM-object registry key not found) / file://C:\WINNT\Java\classes\dajava.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? -   (File not found | COM-object registry key not found) / file://C:\WINNT\Java\classes\xmldso.cab

{5AE58FCF-6F6A-49B2-B064-02492C66E3F4} "MUCatalogWebControl Class" - "Microsoft Corporation" - C:\WINNT\system32\MicrosoftUpdateCatalogWebControl.dll / hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1238789717601

{6E718D87-6909-4FCE-92D4-EDCB2F725727} "Navigram Control" - "Navigram" - C:\Programme\Navigram\NavigramEngine\navigram.ocx / hxxp://www.navigram.com/engine/v911/Navigram.cab

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINNT\system32\LegitCheckControl.DLL / hxxp://go.microsoft.com/fwlink/?linkid=39204

{9F1C11AA-197B-4942-BA54-47A8489BB47F} "{9F1C11AA-197B-4942-BA54-47A8489BB47F}" - ? -   (File not found | COM-object registry key not found) / hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38952.4579166667

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} "{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"EPSON Status Monitor 3 Environment Check 2.lnk" - "SEIKO EPSON CORPORATION" - C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE  (Shortcut exists | File exists)

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"Desktop.ini" - ? - C:\Dokumente und Einstellungen\Paulsen\Startmenü\Programme\Autostart\Desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Picasa Media Detector" - "Google Inc." - C:\Programme\Picasa2\PicasaMediaDetector.exe

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Creative Service for CDROM Access" (Creative Service for CDROM Access) - "Creative Technology Ltd" - C:\WINNT\System32\CTSvcCDA.exe

"Dienst für Seriennummern der tragbaren Medien" (WmdmPmSN) - "Microsoft Corporation" - C:\WINNT\system32\mspmsnsv.dll

"EPSON Printer Status Agent2" (EPSONStatusAgent2) - "SEIKO EPSON CORPORATION" - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe

"Google Updater Service" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINNT\System32\nvsvc32.exe

"WMDM PMSP Service" (WMDM PMSP Service) - "Microsoft Corporation" - C:\WINNT\system32\mspmspsv.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 2000 Professional
Windows Information: Service Pack 4 (build 2195)
Logical Drives Mask: 0x0000007d

WARNING: Unsupported Windows version! Results may not be accurate!
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\G: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)

Size Device Name MBR Status
--------------------------------------------
19 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
465 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: BA373E253A547E7961690195D7139348FF3523E2

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 2000 Professional
Windows Information: Service Pack 4 (build 2195)
Logical Drives Mask: 0x0000007d

Kernel Drivers (total 102):
0x80400000 \WINNT\System32\ntoskrnl.exe
0x80062000 \WINNT\System32\hal.dll
0xEB810000 \WINNT\System32\BOOTVID.dll
0xBFFD8000 ACPI.sys
0xEB9C8000 \WINNT\System32\DRIVERS\WMILIB.SYS
0xEB400000 pci.sys
0xEB410000 isapnp.sys
0xEB9C9000 pciide.sys
0xEB680000 \WINNT\System32\DRIVERS\PCIIDEX.SYS
0xEB688000 MountMgr.sys
0xBFFBB000 ftdisk.sys
0xEB900000 Diskperf.sys
0xEB902000 dmload.sys
0xBFF99000 dmio.sys
0xEB814000 PartMgr.sys
0xEB904000 viaide.sys
0xBFF83000 atapi.sys
0xEB690000 disk.sys
0xEB420000 \WINNT\System32\DRIVERS\CLASSPNP.SYS
0xBFF61000 fltmgr.sys
0xEB430000 PxHelp20.sys
0xBFF4F000 KSecDD.sys
0xBFED1000 Ntfs.sys
0xBFEA7000 NDIS.sys
0xEB440000 Combo-Fix.sys
0xEB698000 viaagp1.sys
0xBFE91000 Mup.sys
0xEB470000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xBFAF5000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xEB890000 \SystemRoot\System32\Drivers\cdrbsvsd.SYS
0xEB6B0000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xEB9DB000 \SystemRoot\System32\Drivers\Cdralw2k.SYS
0xEB6D0000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xEB6B8000 \SystemRoot\System32\DRIVERS\uhcd.sys
0xBFA35000 \SystemRoot\system32\drivers\ks.sys
0xBFA10000 \SystemRoot\system32\drivers\portcls.sys
0xBFA55000 \SystemRoot\system32\drivers\sbpci.sys
0xEB708000 \SystemRoot\System32\DRIVERS\openhci.sys
0xEB720000 \SystemRoot\System32\DRIVERS\fdc.sys
0xEB480000 \SystemRoot\System32\DRIVERS\serial.sys
0xEB8A0000 \SystemRoot\System32\DRIVERS\serenum.sys
0xEB738000 \SystemRoot\System32\DRIVERS\parport.sys
0xEB490000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xEB748000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xEB758000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xEB9EB000 \SystemRoot\System32\DRIVERS\audstub.sys
0xEB4A0000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xEB8AC000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xBF9F9000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xEB8BC000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xEB4B0000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xEB778000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xEB788000 \SystemRoot\System32\DRIVERS\raspti.sys
0xEB4C0000 \SystemRoot\System32\DRIVERS\parallel.sys
0xEB9F5000 \SystemRoot\System32\DRIVERS\swenum.sys
0xBF9CE000 \SystemRoot\System32\DRIVERS\update.sys
0xEB4D0000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xEB8C8000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xEB7A8000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xEB500000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xEB7C0000 \SystemRoot\System32\Drivers\EFS.SYS
0xEB7D0000 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
0xEB90C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xEBA05000 \SystemRoot\System32\Drivers\Null.SYS
0xEBA07000 \SystemRoot\System32\Drivers\Beep.SYS
0xEB8E8000 \SystemRoot\System32\drivers\vga.sys
0xEBA0A000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xEB7F0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xEB510000 \SystemRoot\System32\Drivers\Npfs.SYS
0xEB914000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xBE95F000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xEB520000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xEB6A0000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xBE90C000 \SystemRoot\System32\DRIVERS\netbt.sys
0xEB530000 \SystemRoot\System32\DRIVERS\netbios.sys
0xBE8E2000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xBE86A000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xBE84B000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xEB918000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xBE800000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xEBA39000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBE7EA000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xA0000000 \??\C:\WINNT\system32\win32k.sys
0xBE281000 \SystemRoot\System32\nv4_disp.dll
0xBDCD6000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xBDC90000 \SystemRoot\System32\drivers\afd.sys
0xEB95A000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xBDBB6000 \SystemRoot\system32\drivers\wdmaud.sys
0xBE64A000 \SystemRoot\system32\drivers\sysaudio.sys
0xBE6DA000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBE68A000 \SystemRoot\System32\Drivers\Fips.SYS
0xBDB26000 \SystemRoot\system32\drivers\npf_devolo.sys
0xBD973000 \SystemRoot\System32\DRIVERS\srv.sys
0xEB992000 \??\C:\WINNT\System32\PfModNT.sys
0xBD9D1000 \??\C:\WINNT\system32\drivers\SECDRV.SYS
0xBD4EC000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xBD348000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xEB6E8000 \??\C:\cofi.exe26068c\catchme.sys
0xBB9E2000 \??\C:\DOKUME~1\Paulsen\LOKALE~1\Temp\ufpyqaow.sys
0xBB9BD000 \SystemRoot\system32\drivers\kmixer.sys
0xEB7E0000 \SystemRoot\System32\DRIVERS\RTL8139.SYS
0x77880000 \WINNT\system32\NTDLL.DLL

Processes (total 33):
0 System Idle Process
8 System
164 \SystemRoot\System32\smss.exe
188 CSRSS.EXE
184 \??\C:\WINNT\system32\winlogon.exe
236 C:\WINNT\system32\services.exe
248 C:\WINNT\system32\lsass.exe
432 C:\WINNT\system32\svchost.exe
456 C:\WINNT\system32\spoolsv.exe
484 C:\Programme\Avira\AntiVir Desktop\sched.exe
500 C:\Programme\Avira\AntiVir Desktop\avguard.exe
512 C:\WINNT\System32\cisvc.exe
532 C:\WINNT\System32\CTSvcCDA.exe
556 C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
580 C:\WINNT\System32\svchost.exe
616 C:\Programme\Java\jre6\bin\jqs.exe
728 C:\WINNT\System32\nvsvc32.exe
788 C:\WINNT\system32\regsvc.exe
804 C:\WINNT\system32\MSTask.exe
836 C:\WINNT\system32\stisvc.exe
892 C:\WINNT\System32\WBEM\WinMgmt.exe
944 C:\WINNT\system32\mspmspsv.exe
956 C:\WINNT\system32\svchost.exe
1316 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
1328 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
1336 C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
1344 C:\Programme\Picasa2\PicasaMediaDetector.exe
1404 C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
304 C:\WINNT\System32\cidaemon.exe
1084 C:\WINNT\explorer.exe
1520 C:\Programme\Mozilla Firefox\firefox.exe
1564 C:\WINNT\explorer.exe
1676 C:\Dokumente und Einstellungen\Paulsen\Desktop\MBRCheck.exe

WARNING: Unsupported Windows version! Results may not be accurate!
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\G: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive0 Model Number: Maxtor2B020H1, Rev: WAH21PB0
PhysicalDrive1 Model Number: HitachiHDS721050CLA362, Rev:

Size Device Name MBR Status
--------------------------------------------
19 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
465 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: BA373E253A547E7961690195D7139348FF3523E2

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Wir müssen nochmal mit Combofix ran. Bitte die alte cofi löschen und neu runterladen, dann gehts wieder weiter:

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

KILLALL::
 

Rootkit::

c:\winnt\system32\MSTask.exe

c:\winnt\system32\drivers\ncxaif.sys

c:\winnt\system32\drivers\ycbq.sys
 

File::

c:\winnt\system32\MSTask.exe

c:\winnt\system32\drivers\ncxaif.sys

c:\winnt\system32\drivers\ycbq.sys
 

Registry::

[-HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Iomega Activity Disk2]
 

Regnull::

[HKEY_USERS\S-1-5-21-1715567821-436374069-1708537768-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3BA82B31-2D0A-40B2-DAC9-4639D0DBC214}*]
 

Dirlook::

c:\winnt\Profiles

Combofix Logfile:

Code:

ComboFix 11-06-01.01 - Paulsen 01.06.2011  17:54:44.4.1 - x86

Microsoft Windows 2000 Professional  5.0.2195.4.1252.49.1031.18.383.93 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Paulsen\Desktop\cofi.exe.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Paulsen\Desktop\CFScript.txt

.

FILE ::

"c:\winnt\system32\drivers\ncxaif.sys"

"c:\winnt\system32\drivers\ycbq.sys"

"c:\winnt\system32\MSTask.exe"

.

        /wow section - STAGE 10

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\cofi.exe

c:\cofi.exe\023.dat

c:\cofi.exe\AllDrivesFolders

c:\cofi.exe\APISvc

c:\cofi.exe\AppData.folder.dat

c:\cofi.exe\asp.str

c:\cofi.exe\Assoc.cmd

c:\cofi.exe\ATTRIB.cfxxe

c:\cofi.exe\av.cmd

c:\cofi.exe\av.vbs

c:\cofi.exe\badclsid

c:\cofi.exe\BadClsidFiles00

c:\cofi.exe\BHO.dat

c:\cofi.exe\BHOFiles.dat

c:\cofi.exe\BHOQuery.dat

c:\cofi.exe\BitsPath

c:\cofi.exe\BitsStr

c:\cofi.exe\Boot-Rk.cmd

c:\cofi.exe\Boot.bat

c:\cofi.exe\BootDrv.vbs

c:\cofi.exe\c.mrk

c:\cofi.exe\Cache.folder.dat

c:\cofi.exe\Catch-sub.cmd

c:\cofi.exe\catch_k.dat

c:\cofi.exe\catchme.cfxxe

c:\cofi.exe\Catchme.tmp

c:\cofi.exe\CCS.bat

c:\cofi.exe\CF22124.cfxxe

c:\cofi.exe\cfdummy

c:\cofi.exe\cfrun

c:\cofi.exe\CHCP.bat

c:\cofi.exe\ClistB.dat

c:\cofi.exe\clsid.dat

c:\cofi.exe\clsid.hiv

c:\cofi.exe\ClsidDumped

c:\cofi.exe\ClsidFiles

c:\cofi.exe\ComboFix-Download.cfxxe

c:\cofi.exe\ComboFix.tmp

c:\cofi.exe\ComboFix.txt

c:\cofi.exe\ConEnv.sed

c:\cofi.exe\Creg.dat

c:\cofi.exe\CregB.dat

c:\cofi.exe\CregC.cmd

c:\cofi.exe\CregC.dat

c:\cofi.exe\CSCRIPT.cfxxe

c:\cofi.exe\CSet.cmd

c:\cofi.exe\d-del4AV.dat

c:\cofi.exe\dd.cfxxe

c:\cofi.exe\ddsDo.sed

c:\cofi.exe\del00

c:\cofi.exe\DelClsid.bat

c:\cofi.exe\delclsid00

c:\cofi.exe\DisclaimED.dat

c:\cofi.exe\dll_whitelist.dat

c:\cofi.exe\dnd.dat

c:\cofi.exe\dollar_log.dat

c:\cofi.exe\DPF.str

c:\cofi.exe\drev_.dat

c:\cofi.exe\drev_F.dat

c:\cofi.exe\Drive.folder.dat

c:\cofi.exe\DriveFile.dat

c:\cofi.exe\DrivesB.dat

c:\cofi.exe\DrvRun.vbs

c:\cofi.exe\DTime.bat

c:\cofi.exe\dumphive.cfxxe

c:\cofi.exe\embedded.sed

c:\cofi.exe\Env.sed

c:\cofi.exe\ERDNT.e_e

c:\cofi.exe\ERDNTDOS.LOC

c:\cofi.exe\ERDNTWIN.LOC

c:\cofi.exe\ErrTrap1

c:\cofi.exe\ErrTrap10

c:\cofi.exe\ERUNT.cfxxe

c:\cofi.exe\erunt.dat

c:\cofi.exe\ERUNT.LOC

c:\cofi.exe\Exe.reg

c:\cofi.exe\extract.cfxxe

c:\cofi.exe\f_system

c:\cofi.exe\F3m.mrk

c:\cofi.exe\FavFolderD.dat

c:\cofi.exe\FdsvOK

c:\cofi.exe\ffdefstr.dll

c:\cofi.exe\FFPolicyB

c:\cofi.exe\FileKill.cfxxe

c:\cofi.exe\files.pif

c:\cofi.exe\Fin.dat

c:\cofi.exe\FIND3M.bat

c:\cofi.exe\FIXLSP.bat

c:\cofi.exe\FKMGen.cmd

c:\cofi.exe\ForeignWht

c:\cofi.exe\FPluginsB

c:\cofi.exe\Gateway

c:\cofi.exe\grep.cfxxe

c:\cofi.exe\gsar.cfxxe

c:\cofi.exe\handle.cfxxe

c:\cofi.exe\HDCntrl01

c:\cofi.exe\HDPEInfo.cfxxe

c:\cofi.exe\hidec.cfxxe

c:\cofi.exe\history.bat

c:\cofi.exe\History.folder.dat

c:\cofi.exe\iexplore.exe

c:\cofi.exe\image001.gif

c:\cofi.exe\Imefile.dat

c:\cofi.exe\katch.cmd

c:\cofi.exe\kmd.dat

c:\cofi.exe\L_Beep00

c:\cofi.exe\Lang.bat

c:\cofi.exe\LegacyFull

c:\cofi.exe\LegacyNoSvc

c:\cofi.exe\lnkread.vbs

c:\cofi.exe\LocalAppData.folder.dat

c:\cofi.exe\LocalService.dat

c:\cofi.exe\LocalServiceNetworkRestricted.dat

c:\cofi.exe\LocalSettings.folder.dat

c:\cofi.exe\LocalSystemNetworkRestricted.dat

c:\cofi.exe\Look.dat

c:\cofi.exe\LSPDone

c:\cofi.exe\mbr.cfxxe

c:\cofi.exe\mbr.chk

c:\cofi.exe\md5sum.pif

c:\cofi.exe\MissingFiles.dat

c:\cofi.exe\Modules

c:\cofi.exe\MoveIt.bat

c:\cofi.exe\MSnew.dat

c:\cofi.exe\mtee.cfxxe

c:\cofi.exe\MtPt00

c:\cofi.exe\Music.folder.dat

c:\cofi.exe\MWindows.dat

c:\cofi.exe\mynul.dat

c:\cofi.exe\N_\15082

c:\cofi.exe\N_\23288

c:\cofi.exe\N_\23594

c:\cofi.exe\N_\4103

c:\cofi.exe\ncmd.com

c:\cofi.exe\ND_.bat

c:\cofi.exe\ND_64.bat

c:\cofi.exe\ND_Legits

c:\cofi.exe\ND_Legits_QooBox

c:\cofi.exe\ndis_combofix.dat

c:\cofi.exe\ndis_log.dat

c:\cofi.exe\NetHood.folder.dat

c:\cofi.exe\netsvc.bad.dat

c:\cofi.exe\netsvc.dat

c:\cofi.exe\NetworkService.dat

c:\cofi.exe\NirCmd.cfxxe

c:\cofi.exe\NircmdB.exe

c:\cofi.exe\NirCmdC.cfxxe

c:\cofi.exe\NIRKMD.cfxxe

c:\cofi.exe\NlsLanguageDefault

c:\cofi.exe\NoX2del

c:\cofi.exe\NT-OS.cmd

c:\cofi.exe\NULL

c:\cofi.exe\OriO4Files.dat

c:\cofi.exe\OriO4FilesB.dat

c:\cofi.exe\Orphans.dat

c:\cofi.exe\OsId.txt

c:\cofi.exe\OSid.vbs

c:\cofi.exe\OsVer

c:\cofi.exe\patched.af

c:\cofi.exe\PathSearch

c:\cofi.exe\Paulsen.user.cf

c:\cofi.exe\pausep.cfxxe

c:\cofi.exe\pend.txt

c:\cofi.exe\pev.cfxxe

c:\cofi.exe\pevb.cfxxe

c:\cofi.exe\Pictures.folder.dat

c:\cofi.exe\PING.cfxxe

c:\cofi.exe\Policies.dat

c:\cofi.exe\powp.dat

c:\cofi.exe\PreDIR

c:\cofi.exe\Prep.inf

c:\cofi.exe\PrintHood.folder.dat

c:\cofi.exe\Profiles.Folder.dat

c:\cofi.exe\Profiles.Folder.folder.dat

c:\cofi.exe\progfile.dat

c:\cofi.exe\Purity.dat

c:\cofi.exe\PV.cfxxe

c:\cofi.exe\pv.com

c:\cofi.exe\Q_Clsids

c:\cofi.exe\rar_sfx.cmd

c:\cofi.exe\raw_enum.dat

c:\cofi.exe\rawreg.dat

c:\cofi.exe\RCLink.dat

c:\cofi.exe\RcRdyList

c:\cofi.exe\RcVer00

c:\cofi.exe\Recent.folder.dat

c:\cofi.exe\REGDACL.sed

c:\cofi.exe\RegDo.sed

c:\cofi.exe\region.dat

c:\cofi.exe\RegLocks.txt

c:\cofi.exe\RegRun01

c:\cofi.exe\REGT.cfxxe

c:\cofi.exe\remdir00

c:\cofi.exe\RenVDel.dat

c:\cofi.exe\RenVSuspect

c:\cofi.exe\Resident.txt

c:\cofi.exe\Rkey.cmd

c:\cofi.exe\rmbr.cfxxe

c:\cofi.exe\rogues.dat

c:\cofi.exe\ROUTE.cfxxe

c:\cofi.exe\run.sed

c:\cofi.exe\run2.sed

c:\cofi.exe\Rust.str

c:\cofi.exe\s0rt.cfxxe

c:\cofi.exe\safeboot.dat

c:\cofi.exe\safeboot.def.dat

c:\cofi.exe\safeboot.def.W2K.dat

c:\cofi.exe\safeboot00

c:\cofi.exe\sed.cfxxe

c:\cofi.exe\SendTo.folder.dat

c:\cofi.exe\ServiceFiles.dat

c:\cofi.exe\SetEnvmt.bat

c:\cofi.exe\SetPath.bat

c:\cofi.exe\setpath.cfxxe

c:\cofi.exe\setpath_N.cmd

c:\cofi.exe\SF.exe

c:\cofi.exe\sfx.cmd

c:\cofi.exe\SigChkMissing.dat

c:\cofi.exe\SnapRef.dat

c:\cofi.exe\snapshot.00.dat

c:\cofi.exe\SnapShot.01.dat

c:\cofi.exe\SnapShot.02.dat

c:\cofi.exe\srizbi.md5

c:\cofi.exe\SrPeek.cfscript

c:\cofi.exe\Start_dat

c:\cofi.exe\StartUp.folder.dat

c:\cofi.exe\SuppScan_Completed

c:\cofi.exe\SuspectB_netsvc.dat

c:\cofi.exe\suspectSvc.dat

c:\cofi.exe\svc_wht.dat

c:\cofi.exe\SvcCovered

c:\cofi.exe\SvcDiff

c:\cofi.exe\SvcDrv.vbs

c:\cofi.exe\SvcDump

c:\cofi.exe\SvcDumpB

c:\cofi.exe\SvcDumpFull

c:\cofi.exe\SvcFull

c:\cofi.exe\svchost.dat

c:\cofi.exe\svchost.vista.x64.dat

c:\cofi.exe\svclist.dat

c:\cofi.exe\SvcTarget.dat

c:\cofi.exe\SvcTempAa

c:\cofi.exe\swreg.cfxxe

c:\cofi.exe\swsc.cfxxe

c:\cofi.exe\swxcacls.cfxxe

c:\cofi.exe\sys_enum.dat

c:\cofi.exe\SysPath.dat

c:\cofi.exe\System.dump

c:\cofi.exe\system_ini.dat

c:\cofi.exe\tail.cfxxe

c:\cofi.exe\temp2000

c:\cofi.exe\temp4000

c:\cofi.exe\time_.dat

c:\cofi.exe\toolbar.sed

c:\cofi.exe\unhand.dat

c:\cofi.exe\Unhandled.dat

c:\cofi.exe\Update-CF.cmd

c:\cofi.exe\UploadThese

c:\cofi.exe\V-FilesB.dat

c:\cofi.exe\v-tmp.dat

c:\cofi.exe\v_str.dat

c:\cofi.exe\v_wht.dat

c:\cofi.exe\VerCF.bat

c:\cofi.exe\VikPev00

c:\cofi.exe\Vikpev01

c:\cofi.exe\VInfo2

c:\cofi.exe\Vipev.dat

c:\cofi.exe\vistaMcode.dat

c:\cofi.exe\Volsnap.sys.ND_

c:\cofi.exe\vRun_DLL

c:\cofi.exe\vun.dat

c:\cofi.exe\W2K.mac

c:\cofi.exe\w7Mcode.dat

c:\cofi.exe\whiteAll.dat

c:\cofi.exe\Wmi_rem.vbs

c:\cofi.exe\WrgNameDLL

c:\cofi.exe\xpmcode.dat

c:\cofi.exe\XPSBoot.reg

c:\cofi.exe\zDomain.dat

c:\cofi.exe\zip.cfxxe

c:\cofi.exe\Zlob01

c:\winnt\system32\drivers\ncxaif.sys

c:\winnt\system32\drivers\ycbq.sys

.

.

.

Infizierte Kopie von c:\winnt\system32\mstask.exe wurde gefunden und desinfiziert 

Kopie von - c:\winnt\$NtUpdateRollupPackUninstall$\mstask.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_gdbdyrc

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-05-01 bis 2011-06-01  ))))))))))))))))))))))))))))))

.

.

2011-05-31 19:26 . 2011-05-31 19:26        553        ----a-w-        C:\backup.reg

2011-05-30 15:34 . 2011-05-30 15:41        --------        d-----w-        C:\ComboFix

2011-05-30 14:57 . 2011-05-30 14:57        --------        d-----w-        C:\_OTL

2011-05-30 10:02 . 2011-05-30 10:13        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Canon

2011-05-30 10:00 . 2003-06-19 19:05        12592        -c--a-w-        c:\winnt\system32\dllcache\usbscan.sys

2011-05-30 10:00 . 2003-06-19 19:05        12592        ----a-w-        c:\winnt\system32\drivers\usbscan.sys

2011-05-30 09:53 . 2002-11-20 13:15        729088        ----a-w-        c:\winnt\system32\CNQA1209.DLL

2011-05-30 09:53 . 2002-11-20 11:42        507904        ----a-w-        c:\winnt\system32\CNQL1209.DLL

2011-05-30 09:53 . 2002-11-15 08:15        40960        ----a-w-        c:\winnt\system32\CNQU83.DLL

2011-05-30 09:53 . 2002-05-24 01:04        389180        ----a-w-        c:\winnt\system32\UCS32P.DLL

2011-05-29 21:02 . 2011-05-29 21:02        --------        d-----w-        C:\PerfLogs

2011-05-29 17:39 . 2011-05-29 17:39        --------        d-----w-        c:\winnt\Profiles

2011-05-29 17:39 . 2011-05-29 17:39        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\InterTrust

2011-05-29 17:21 . 2011-05-30 09:53        --------        d-----w-        C:\CanoScan

2011-05-29 15:34 . 1999-12-07 22:59        148752        -c--a-w-        c:\winnt\system32\dllcache\gfototwn.dll

2011-05-29 15:34 . 1999-12-07 22:59        148752        ----a-w-        c:\winnt\system32\gFotoTwn.dll

2011-05-29 15:34 . 1999-12-07 22:59        74000        -c--a-w-        c:\winnt\system32\dllcache\fnfilter.dll

2011-05-29 15:34 . 1999-12-07 22:59        74000        ----a-w-        c:\winnt\system32\fnfilter.dll

2011-05-29 15:34 . 1999-12-07 21:19        6896        -c--a-w-        c:\winnt\system32\dllcache\serscan.sys

2011-05-29 15:34 . 1999-12-07 21:19        6896        ----a-w-        c:\winnt\system32\drivers\serscan.sys

2011-05-29 15:34 . 1999-12-07 22:58        24848        -c--a-w-        c:\winnt\system32\dllcache\cnusd.dll

2011-05-29 15:34 . 1999-12-07 22:58        24848        ----a-w-        c:\winnt\system32\cnusd.dll

2011-05-29 13:57 . 2011-05-29 13:57        --------        d-----w-        C:\Program Files

2011-05-29 13:57 . 2000-06-22 11:02        44544        ----a-w-        c:\programme\Internet Explorer\PLUGINS\NPIPRT32.DLL

2011-05-29 13:55 . 2011-05-29 13:55        --------        d-----w-        c:\programme\EPSON

2011-05-28 17:54 . 2011-05-28 17:54        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Avira

2011-05-28 08:32 . 2011-04-01 15:07        73584        ----a-w-        c:\winnt\system32\drivers\avgntflt.sys

2011-05-28 08:32 . 2011-04-01 15:07        132800        ----a-w-        c:\winnt\system32\drivers\avipbb.sys

2011-05-28 08:32 . 2010-06-17 13:27        64488        ----a-w-        c:\winnt\system32\drivers\avgntdd.sys

2011-05-28 08:32 . 2010-06-17 13:27        18520        ----a-w-        c:\winnt\system32\drivers\avgntmgr.sys

2011-05-28 08:32 . 2011-05-28 08:32        --------        dc----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2011-05-28 08:32 . 2011-05-28 08:32        --------        d-----w-        c:\programme\Avira

2011-05-27 20:20 . 2011-05-27 20:20        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Malwarebytes

2011-05-27 20:20 . 2010-12-20 16:09        38224        ----a-w-        c:\winnt\system32\drivers\mbamswissarmy.sys

2011-05-27 20:19 . 2011-05-27 20:19        --------        dc----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-05-27 20:19 . 2011-05-27 20:20        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-05-27 20:19 . 2010-12-20 16:08        19288        ----a-w-        c:\winnt\system32\drivers\mbam.sys

2011-05-27 19:21 . 2011-05-29 17:39        --------        d-----w-        c:\winnt\system32\Adobe

2011-05-24 19:54 . 2011-05-24 19:54        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\QuickScan

2011-05-24 18:59 . 2011-05-24 18:59        --------        d-----w-        c:\programme\Gemeinsame Dateien\Skype

2011-05-24 18:59 . 2011-05-24 18:59        --------        d-----r-        c:\programme\Skype

2011-05-16 18:06 . 2011-05-16 18:06        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\FreeFLVConverter

2011-05-16 17:28 . 2006-10-17 20:29        487479        ----a-w-        c:\winnt\system32\SkinMagic.dll

2011-05-16 16:57 . 2011-05-16 16:57        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\AnvSoft

2011-05-16 16:56 . 2010-03-19 06:23        686592        ----a-w-        c:\programme\Mozilla Firefox\plugins\npmieze.dll

2011-05-16 16:56 . 2011-05-16 18:01        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Gutscheinmieze

2011-05-15 21:54 . 2011-05-16 17:03        --------        d-----w-        c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\vlc

2011-05-15 21:40 . 2011-05-15 21:40        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java

2011-05-15 21:39 . 2011-04-14 03:08        472808        ----a-w-        c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll

2011-05-15 21:39 . 2011-04-14 03:07        472808        ----a-w-        c:\winnt\system32\deployJava1.dll

2011-05-15 21:39 . 2011-04-14 00:40        73728        ----a-w-        c:\winnt\system32\javacpl.cpl

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-20 17:15 . 2008-12-25 19:44        307200        ----a-w-        c:\winnt\system32\TubeFinder.exe

2007-03-30 13:38 . 2007-03-30 13:38        77160        ----a-w-        c:\programme\DSETUP.dll

2007-03-30 13:38 . 2007-03-30 13:38        503144        ----a-w-        c:\programme\DXSETUP.exe

2007-03-30 13:38 . 2007-03-30 13:38        1673576        ----a-w-        c:\programme\dsetup32.dll

2008-09-16 00:12 . 2008-09-16 00:12        479232        ----a-w-        c:\programme\mozilla firefox\plugins\msvcm80.dll

2008-09-16 00:12 . 2008-09-16 00:12        548864        ----a-w-        c:\programme\mozilla firefox\plugins\msvcp80.dll

2008-09-16 00:12 . 2008-09-16 00:12        626688        ----a-w-        c:\programme\mozilla firefox\plugins\msvcr80.dll

2011-05-26 18:12 . 2011-05-26 18:12        142296        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\winnt\Profile ----

.

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

.

[-] 2002-11-26 17:03 . 36678803A8030EE9A771935CFC1848BD . 52224 . . [ERROR: 0x0] . . c:\winnt\system32\mspmsnsv.dll

.

[-] 2004-07-09 03:27 . 0E51BD586D186F61A9E4453DB8AEC774 . 1703936 . . [ERROR: 0x0] . . c:\winnt\system32\d3d9.dll

.

c:\winnt\System32\comres.dll ... Fehlt !!

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Picasa Media Detector"="c:\programme\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2006-03-09 7561216]

"Synchronization Manager"="mobsync.exe" [2003-06-19 112400]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-01-07 253672]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

.

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

EPSON Status Monitor 3 Environment Check 2.lnk - c:\winnt\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2011-5-29 127488]

Microsoft Office.lnk - c:\programme\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders        msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Omnipage

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]

c:\programme\Picasa2\PicasaMediaDetector [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

2001-07-03 11:26        753664        ------w-        c:\programme\ahead\InCD\InCD.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]

2001-07-09 09:50        155648        ----a-w-        c:\winnt\system32\NeroCheck.exe

.

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [28.05.2011 10:33 136360]

R2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\winnt\system32\drivers\npf_devolo.sys [13.05.2008 16:00 35840]

R3 openhci;Microsoft USB-Open Host-Controllertreiber;c:\winnt\system32\drivers\openhci.sys [03.09.2006 18:00 24784]

S3 Slnt7554;USB Soft Modem Driver;c:\winnt\system32\drivers\slnt7554.sys [19.03.2006 17:00 210488]

.

.

------- Zusätzlicher Suchlauf -------

.

uDefault_Search_URL = hxxp://www.google.com/ie

uStart Page = hxxp://www.google.de/

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Add animation to IncrediMail Style Box - c:\programme\IncrediMail\bin\resources\WebMenuImg.htm

IE: Save YouTube Video as MP3

LSP: %SystemRoot%\system32\msafd.dll

TCP: DhcpNameServer = 192.168.2.1

DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab

DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll

FF - ProfilePath - c:\dokumente und einstellungen\Paulsen\Anwendungsdaten\Mozilla\Firefox\Profiles\1s8cc649.default\

FF - prefs.js: browser.search.selectedEngine - foxsearch

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=

FF - prefs.js: network.proxy.type - 0

FF - user.js: browser.search.selectedEngine - foxsearch

FF - user.js: browser.search.order.1 - foxsearch

FF - user.js: browser.search.defaultenginename - foxsearch

FF - user.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=

FF - user.js: privacy.item.cookies - false

FF - user.js: privacy.sanitize.promptOnSanitize - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-06-01 18:08

Windows 5.0.2195 Service Pack 4 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(112)

c:\winnt\system32\wzcdlg.dll

c:\winnt\system32\WZCSAPI.DLL

c:\winnt\system32\msv1_0.dll

.

- - - - - - - > 'lsass.exe'(244)

c:\winnt\system32\mpr.dll

.

- - - - - - - > 'explorer.exe'(1328)

c:\winnt\system32\SHDOCVW.DLL

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\winnt\System32\cisvc.exe

c:\winnt\System32\CTSvcCDA.exe

c:\programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\winnt\System32\nvsvc32.exe

c:\winnt\system32\regsvc.exe

c:\winnt\system32\stisvc.exe

c:\winnt\System32\WBEM\WinMgmt.exe

c:\winnt\system32\mspmspsv.exe

c:\winnt\system32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

c:\winnt\System32\cidaemon.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-06-01  18:17:10 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-06-01 16:17

ComboFix2.txt  2011-06-01 15:43

ComboFix3.txt  2011-05-31 20:43

ComboFix4.txt  2011-05-30 16:07

.

Vor Suchlauf: 6.478.721.024 Bytes frei

Nach Suchlauf: 6.464.618.496 Bytes frei

.

- - End Of File - - F72E0B84452C614CD2ECC4DB44F241CC

--- --- ---

Ok, sieht schonmal besser aus. Ich brauch neue Logs von GMER und OSAM, bitte neu ausführen und die neuen Logs posten.

Mein Pc ist kurz nach dem scannen GMER abgestürzt.Normal wieder hochgefahren,hatte dann eine Meldung vom DFÜ auf dem Bildschirm.Habe ich geschlossen mit "Während dieser Sitzung nicht mehr anzeigen" Habe jetzt noch keinen scann von GMER und OSAM gemacht.
Soll ich nochmal GMER probieren?
LG Heike

Ja 1x noch. Wenn es wieder abstürzt nur Logs nur mit OSAM fortfahren

GMER Logfile:

Code:

GMER 1.0.15.15640 - GMER - Rootkit Detector and Remover

Rootkit scan 2011-06-02 15:26:14

Windows 5.0.2195 Service Pack 4 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-2 Maxtor_2B020H1 rev.WAH21PB0

Running: 7svv5y7u.exe; Driver: C:\DOKUME~1\Paulsen\LOKALE~1\Temp\ufpyqaow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            8242DDE6                                                                                    ZwCreateKey

SSDT            8242DDDC                                                                                    ZwCreateThread

SSDT            8242DDEB                                                                                    ZwDeleteKey

SSDT            8242DDF5                                                                                    ZwDeleteValueKey

SSDT            8242DDFA                                                                                    ZwLoadKey

SSDT            8242DDC8                                                                                    ZwOpenProcess

SSDT            8242DDCD                                                                                    ZwOpenThread

SSDT            8242DE04                                                                                    ZwReplaceKey

SSDT            8242DDFF                                                                                    ZwRestoreKey

SSDT            8242DDF0                                                                                    ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINNT\System32\DRIVERS\nv4_mini.sys                                                      section is writeable [0xBFAF5380, 0x21F24D, 0xE8000020]
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!CreateProcessW]           [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryW]             [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!GetProcAddress]           [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!FreeLibrary]              [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryA]             [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryExW]  [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessA]  [4AD84AE3] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessW]  [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryW]    [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!FreeLibrary]     [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryA]    [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!GetProcAddress]  [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW]      [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary]       [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]    [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA]      [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryExW]     [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryA]       [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!FreeLibrary]        [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!GetProcAddress]     [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryW]       [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]    [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!CreateProcessW]    [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]      [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]      [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!FreeLibrary]       [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExA]   [760B78DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExW]   [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryW]     [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessA]   [4AD84AE3] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessW]   [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]    [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA]      [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary]       [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessA]    [4AD84AE3] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\msvcrt.dll [KERNEL32.dll!CreateProcessW]    [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]   [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!CreateProcessW]   [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]     [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!GetProcAddress]     [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryA]       [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!FreeLibrary]        [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryW]       [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryExW]     [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!CreateProcessW]     [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!LoadLibraryW]    [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!GetProcAddress]  [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!FreeLibrary]     [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW]     [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!FreeLibrary]       [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!LoadLibraryA]      [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!GetProcAddress]    [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryW]     [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryExW]   [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!CreateProcessW]   [4AD84C9A] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryW]     [760B786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\WININET.DLL [KERNEL32.dll!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]   [760B771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA]     [760B7800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW]   [760B7955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA]   [760B78DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)

IAT             C:\WINNT\Explorer.EXE[1268] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary]      [760B7A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                    fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout          15

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota             10000

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                           yes

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                          

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout          90

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota            10000

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs         1
 

---- EOF - GMER 1.0.15 ----

--- --- ---