| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Sulimo.datWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
18.10.2007, 18:49
| #1 |
 |  Sulimo.dat Ich bitte auf Proffesionelle Hilfe von einem Mod abzuwarten! Es wird sich bestimmt jemand bald drum kümmern Ps:solange du es nicht must halte den PC vom Internet getrennt! Mfg Trojanerade @Heidefighter:Spyware Doctor ist ein Programm was öfters nur Fehlermeldungen mit sich bringt. @The Ulrich:Bitte instaliere dir NICHT SPyware Doctor ein Mod hätte dir es sicherlich auch geraten.
__________________ Nothing can stop me in MY work  Geändert von Trojanerade (18.10.2007 um 18:51 Uhr) Grund: einiges vergessen |
|
18.10.2007, 18:59
| #2 | |
| | Sulimo.datZitat:
Spyware Doctor war jedenfalls das einzigste Programm was den Virus zuverlässig entfernt hat. Er kann die Software ja nach der Virenbeseitigung wieder entfernen. mfg.Heidefighter
__________________ |
|
18.10.2007, 19:17
| #3 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Sulimo.dat Hallo.
__________________Werte die beiden fraglichen Dateien mal bei Virustotal aus und poste sämtliche Ergebnisse inkl. Dateigrößen und Prüfsummen. Führ auch folgende Tools bzw. Anleitungen aus und poste die Logfiles: - eScan
__________________ |
|
18.10.2007, 19:56
| #4 |
| | Sulimo.dat Hallo! War inzwischen im abgesichertem Modus und hab das System mit Smitfraud: SmitFraudFix v2.240 Scan done at 19:25:20,64, 18.10.2007 Run from C:\Dokumente und Einstellungen\Gnter\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\Delete_Me_Dummy_systems.txt FOUND ! C:\WINDOWS\system32\systems.txt FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Gnter »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Gnter\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\GNTER~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Programme »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End und auch mit eScan gescannt: [HTML]Tue Oct 16 00:00:00 2007 => ********************************************************** Tue Oct 16 00:00:00 2007 => eScan AntiVirus Toolkit Utility. Tue Oct 16 00:00:00 2007 => Copyright © 2003-2006, MicroWorld Technologies Inc. Tue Oct 16 00:00:00 2007 => ********************************************************** Tue Oct 16 00:00:00 2007 => Version 9.2.2 Tue Oct 16 00:00:00 2007 => Protokolldatei: C:\PROGRA~1\eScan\MWAV.LOG Tue Oct 16 00:00:00 2007 => MWAV Registered: FALSE. Tue Oct 16 00:00:00 2007 => User Account: Günter Tue Oct 16 00:00:00 2007 => OS Type: Windows Workstation Tue Oct 16 00:00:00 2007 => OS: Windows XP Tue Oct 16 00:00:00 2007 => Ver: Service Pack 2 (Build 2600) Tue Oct 16 00:00:00 2007 => Windows Root Folder: C:\WINDOWS Tue Oct 16 00:00:00 2007 => Windows Sys32 Folder: C:\WINDOWS\system32 Tue Oct 16 00:00:00 2007 => Local Fixed Drives: c:\,f:\ Tue Oct 16 00:00:00 2007 => MWAV Mode: Only Scan files. Tue Oct 16 00:00:00 2007 => Database Path in KL Key: C:\PROGRA~1\eScan. Tue Oct 16 00:00:04 2007 => Letztes Datum der KL key Dateien: 15 Oct 2007 20:32:5. Tue Oct 16 00:00:04 2007 => Letztes Datum der MWAV Dateien: 15 Oct 2007 20:32:5. Tue Oct 16 00:00:18 2007 => Setting Database Path to C:\DOKUME~1\GNTER~1\LOKALE~1\Temp\MWBASES Tue Oct 16 00:00:32 2007 => AV Bibliothek wird geladen... Tue Oct 16 00:00:32 2007 => MWAV doing self scanning... Tue Oct 16 00:00:32 2007 => Scanne Datei C:\PROGRA~1\eScan\getvlist.exe Tue Oct 16 00:00:32 2007 => Result: ERROR!!! File C:\PROGRA~1\eScan\getvlist.exe: Scanning Failure!!! Tue Oct 16 00:00:32 2007 => Error while scanning C:\PROGRA~1\eScan\getvlist.exe!!! Ignoring and continuing... Tue Oct 16 00:00:32 2007 => Scanne Datei C:\PROGRA~1\eScan\main.avi Tue Oct 16 00:00:32 2007 => Result: ERROR!!! File C:\PROGRA~1\eScan\main.avi: Scanning Failure!!! Tue Oct 16 00:00:32 2007 => Error while scanning Thu Oct 18 19:27:07 2007 => ***** Adware/Spyware - Scan der Registrierung und des Dateisystems ***** Thu Oct 18 19:27:07 2007 => Loading Spyware Signatures from new External Database [Name: C:\PROGRA~1\eScan\spydb.avs, Size: 255523]. Thu Oct 18 19:27:07 2007 => Indexed Spyware Databases Successfully Created... Thu Oct 18 19:27:23 2007 => Offending file found: C:\WINDOWS\system32\moveex.exe Thu Oct 18 19:27:23 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (moveex.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:23 2007 => Offending file found: C:\WINDOWS\system32\process.exe Thu Oct 18 19:27:23 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (process.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:23 2007 => Offending file found: C:\WINDOWS\system32\swreg.exe Thu Oct 18 19:27:23 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swreg.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:23 2007 => Offending file found: C:\WINDOWS\system32\swsc.exe Thu Oct 18 19:27:23 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swsc.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:28 2007 => Offending file found: C:\Dokumente und Einstellungen\Günter\Desktop\smitfraudfix\process.exe Thu Oct 18 19:27:28 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (process.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:28 2007 => Offending file found: C:\Dokumente und Einstellungen\Günter\Desktop\smitfraudfix\reboot.exe Thu Oct 18 19:27:28 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (reboot.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:28 2007 => Offending file found: C:\Dokumente und Einstellungen\Günter\Desktop\smitfraudfix\swreg.exe Thu Oct 18 19:27:28 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swreg.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:28 2007 => Offending file found: C:\Dokumente und Einstellungen\Günter\Desktop\smitfraudfix\swsc.exe Thu Oct 18 19:27:28 2007 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swsc.exe)! Action taken: Keine Aktion vorgenommen. Thu Oct 18 19:27:43 2007 => Checking MountPoints2 Registry Key... Thu Oct 18 19:27:43 2007 => Checking CLSID Reference Entries... Thu Oct 18 19:27:46 2007 => Checking Module Usage Entries... Thu Oct 18 19:27:46 2007 => Checking User Trusted External App Entries... Thu Oct 18 19:27:47 2007 => Checking Shared DLL Entries... Thu Oct 18 19:27:50 2007 => Checking Installer Entries... Thu Oct 18 19:27:53 2007 => Checking Shared Tools Entries... Thu Oct 18 19:27:53 2007 => Checking File Extension Entries... Thu Oct 18 19:27:53 2007 => Checking Application Cache Entries... Thu Oct 18 20:49:29 2007 => ***** Überprüfe spezielle ITW Viren ***** Thu Oct 18 20:49:29 2007 => Überprüfe auf Welchia Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf LovGate Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf CodeRed Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf OpaServ Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Sobig.e Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Winupie Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Swen Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf JS.Fortnight Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Novarg Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Pagabot Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Parite.b Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Parite.a Virus... Thu Oct 18 20:49:29 2007 => Überprüfe auf Adware.SeekSeek Virus... Thu Oct 18 20:49:29 2007 => ***** Scan vollständig. ***** Thu Oct 18 20:49:29 2007 => Gescannte Dateien: 130402 Thu Oct 18 20:49:29 2007 => Gefundene Viren: 11 Thu Oct 18 20:49:29 2007 => Anzahl der desinfizierten Dateien: 0 Thu Oct 18 20:49:29 2007 => Umbenannte Dateien: 0 Thu Oct 18 20:49:29 2007 => Anzahl der gelöschten Dateien: 0 Thu Oct 18 20:49:29 2007 => Anzahl Fehler: 61 Thu Oct 18 20:49:29 2007 => Dauer des Scans bisher: 01:22:40 Thu Oct 18 20:49:29 2007 => Virus-Datenbank Datum: 10/18/2007 Thu Oct 18 20:49:29 2007 => Virus-Datenbank Zähler: 437470 Thu Oct 18 20:49:29 2007 => Scan vollständig. Werde umgehend comboFix und Silentrunners anwenden und danach die log Files posten. Danke schön Günter |
|
18.10.2007, 20:19
| #5 |
| | Sulimo.dat Hier die Log von ComboFix: Teil1 ComboFix 07-10-17.8@ - Gnter 2007-10-18 21:33:12.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.178 [GMT 2:00] ausgeführt von:: C:\Dokumente und Einstellungen\Gnter\Desktop\ComboFix(2).exe * Neuer Wiederherstellungspunkt wurde erstellt . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\regedit.com C:\WINDOWS\system32\taskmgr.com . ((((((((((((((((((((((( Dateien erstellt von 2007-09-18 bis 2007-10-18 )))))))))))))))))))))))))))))) . 2007-10-18 21:03 356 --a------ C:\Pass2.reg 2007-10-18 21:01 196,930 --a------ C:\Pass2.cmd 2007-10-18 19:25 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-18 19:25 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-18 19:25 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-18 19:25 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-18 19:25 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-18 19:14 <DIR> C:\Dokumente und Einstellungen\Günter\SmitfraudFix 2007-10-18 02:42 <DIR> C:\Dokumente und Einstellungen\Günter\Neuer Ordner 2007-10-17 22:15 <DIR> d-a------ C:\WINDOWS\system32\systems.txt 2007-10-17 22:15 4,827,279 --a------ C:\WINDOWS\REGBK00.ZIP 2007-10-16 02:48 2,552 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-16 01:56 <DIR> d-------- C:\Programme\Trend Micro 2007-10-16 01:46 <DIR> d-------- C:\Programme\a-squared HiJackFree 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\zts2.exe 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\system32\Delete_Me_Dummy_systems.txt 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\rundll16.exe 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\rundl132.dll 2007-10-16 00:04 <DIR> d-a------ C:\WINDOWS\logo1_.exe 2007-10-15 23:52 <DIR> d-------- C:\WINDOWS\system32\ebay 2007-10-15 23:48 <DIR> d-------- C:\Programme\Ashampoo 2007-10-15 20:45 <DIR> C:\Dokumente und Einstellungen\Günter\Contacts 2007-10-15 20:39 13,816 --a------ C:\WINDOWS\WSSPORD.DAT 2007-10-15 20:38 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-10-15 20:37 <DIR> d-------- C:\Programme\MSN Messenger 2007-10-15 20:34 8,417 --a------ C:\WINDOWS\system32\eInstall.dat 2007-10-15 20:33 <DIR> d-------- C:\PUB 2007-10-15 20:32 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MicroWorld 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\remoteservice\Vorlagen 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\remoteservice\Startmen 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\remoteservice\Favoriten 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\remoteservice\Dokumente 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\remoteservice\Anwendungsdaten 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Vorlagen 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Startmen 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Favoriten 2007-10-15 20:32 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Dokumente 2007-10-15 20:32 153,600 --a------ C:\WINDOWS\R.COM 2007-10-15 20:32 140,800 --a------ C:\WINDOWS\system32\T.COM 2007-10-15 20:32 138,000 --a------ C:\WINDOWS\system32\drivers\klif108.sys 2007-10-15 20:32 117,844 --a------ C:\WINDOWS\winsbak2.reg 2007-10-15 20:32 117,008 --a------ C:\WINDOWS\system32\drivers\klif50.sys 2007-10-15 20:32 43,520 --a------ C:\WINDOWS\killproc.exe 2007-10-15 20:32 16,786 --a------ C:\WINDOWS\winsbak.reg 2007-10-15 20:31 <DIR> d-------- C:\Programme\eScan 2007-10-15 20:31 <DIR> d-------- C:\AVPDOS 2007-10-15 00:39 <DIR> d-------- C:\Programme\Winamp 2007-10-14 20:50 <DIR> d-------- C:\Programme\Windows Media Connect 2 2007-10-14 20:47 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-10-14 20:47 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2007-10-10 01:16 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-09-30 01:56 <DIR> d-------- C:\Programme\PokerAcademyPro2 2007-09-27 23:06 <DIR> d-------- C:\Programme\PacificPoker 2007-09-19 20:38 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-19 20:37 69,632 --a------ C:\WINDOWS\system32\remove.exe . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-18 19:03 7,077,888 ----a-w C:\Dokumente und Einstellungen\Günter\ntuser.dat 2007-10-14 18:46 --------- d-----w C:\Programme\Windows Media Connect 2007-10-10 23:56 --------- d-----w C:\Programme\Cake Poker 2007-09-24 22:35 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe 2007-09-09 19:10 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic 2007-08-29 23:17 --------- d-----w C:\Programme\Hyplay 2007-08-29 21:32 --------- d--h--w C:\Programme\InstallShield Installation Information 2007-08-29 21:26 --------- d-----w C:\Programme\VideoLAN 2007-08-29 21:14 --------- d-----w C:\Programme\DivXCodec 2007-08-29 21:02 --------- d-----w C:\Programme\Gemeinsame Dateien\Hypnotizer 2007-08-22 20:24 --------- d-----w C:\Programme\PartyGaming 2007-08-21 06:16 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-13 16:54 413,696 ----a-w C:\WINDOWS\system32\vbscript.dll 2007-08-13 16:54 156,160 ----a-w C:\WINDOWS\system32\msls31.dll 2007-08-13 16:45 78,336 ----a-w C:\WINDOWS\system32\ieencode.dll 2007-08-13 16:44 40,960 ----a-w C:\WINDOWS\system32\licmgr10.dll 2007-08-13 16:39 71,680 ----a-w C:\WINDOWS\system32\admparse.dll 2007-08-13 16:39 55,296 ----a-w C:\WINDOWS\system32\iesetup.dll 2007-08-13 16:36 36,352 ----a-w C:\WINDOWS\system32\imgutil.dll 2007-08-13 16:32 45,568 ----a-w C:\WINDOWS\system32\mshta.exe 2007-08-13 16:01 48,128 ----a-w C:\WINDOWS\system32\mshtmler.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 -c--a-w C:\WINDOWS\system32\wups.dll 2007-02-03 15:55 6,899,010 ----a-w C:\Dokumente und Einstellungen\Günter\pPokerSetup.exe 2006-02-05 21:38 243,525 ----a-w C:\Dokumente und Einstellungen\Günter\setup.exe 2006-01-26 15:13 28,672 ----a-w C:\Dokumente und Einstellungen\Günter\LicenceWM.exe 2005-12-29 17:26 65,520 ----a-w C:\Dokumente und Einstellungen\Jasmyn\Anwendungsdaten\GDIPFONTCACHEV1.DAT 2004-04-06 15:16 457 -c--a-w C:\Programme\INSTALL.LOG 2004-03-26 17:24 59,992 -c--a-w C:\Programme\msnaddin.exe 2004-03-26 14:21 18,676,216 -c--a-w C:\Programme\AdbeRdr60_deu_full.exe 2004-03-26 14:18 6,598,400 -c--a-w C:\Programme\psa2se_ger.exe . ((((((((((((((((((((((((((((( snapshot_2007-09-19_204327.12 ))))))))))))))))))))))))))))))))))))))))) . + 2007-08-20 09:47:59 124,928 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\advpack.dll + 2007-08-20 09:48:08 214,528 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\dxtrans.dll + 2007-08-20 09:47:59 132,608 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\extmgr.dll + 2007-08-20 09:47:59 63,488 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\icardie.dll + 2007-08-17 10:11:44 70,656 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ie4uinit.exe + 2007-08-20 09:47:59 153,088 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieakeng.dll + 2007-08-20 09:48:00 230,400 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieaksie.dll + 2007-08-17 07:29:55 161,792 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieakui.dll + 2007-04-17 09:32:38 2,455,488 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieapfltr.dat + 2007-08-20 09:48:00 383,488 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieapfltr.dll + 2007-08-20 09:48:00 387,584 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iedkcs32.dll + 2007-08-20 09:48:02 6,066,176 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieframe.dll + 2007-08-20 09:48:02 44,544 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iernonce.dll + 2007-08-20 09:48:02 267,776 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iertutil.dll + 2007-08-17 10:11:44 13,824 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\ieudinit.exe + 2007-08-17 10:11:54 625,152 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe + 2007-08-20 09:48:03 27,648 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\jsproxy.dll + 2007-08-20 09:48:03 459,264 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msfeeds.dll + 2007-08-20 09:48:03 52,224 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msfeedsbs.dll + 2007-08-20 09:48:05 3,592,192 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mshtml.dll + 2007-08-20 09:48:06 478,208 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mshtmled.dll + 2007-08-20 09:48:06 193,024 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\msrating.dll + 2007-08-20 09:48:06 671,232 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\mstime.dll + 2007-08-20 09:48:07 102,400 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\occache.dll + 2007-08-20 09:48:07 105,984 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\url.dll + 2007-08-20 09:48:07 1,161,728 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\urlmon.dll + 2007-08-20 09:48:08 232,960 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\webcheck.dll + 2007-08-20 09:48:08 825,344 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll + 2007-03-06 01:14:08 15,584 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\spmsg.dll + 2007-03-06 01:14:13 217,312 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\spuninst.exe + 2007-03-06 01:14:07 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\update\spcustom.dll + 2007-03-06 01:14:35 725,728 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\update\update.exe + 2007-03-06 01:15:25 377,568 ----a-w C:\WINDOWS\$hf_mig$\KB939653-IE7\update\updspapi.dll + 2007-08-21 06:25:05 683,520 ----a-w C:\WINDOWS\$hf_mig$\KB941202\SP2QFE\inetcomm.dll + 2007-03-06 01:14:12 15,584 ----a-w C:\WINDOWS\$hf_mig$\KB941202\spmsg.dll + 2007-03-06 01:14:17 217,312 ----a-w C:\WINDOWS\$hf_mig$\KB941202\spuninst.exe + 2007-03-06 01:14:11 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB941202\update\spcustom.dll + 2007-03-06 01:14:35 725,728 ----a-w C:\WINDOWS\$hf_mig$\KB941202\update\update.exe + 2007-03-06 01:15:25 377,568 ----a-w C:\WINDOWS\$hf_mig$\KB941202\update\updspapi.dll + 2004-08-04 07:57:32 581,120 -c----w C:\WINDOWS\$NtUninstallKB933729$\rpcrt4.dll + 2005-10-12 23:11:08 217,312 -c----w C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe + 2005-10-12 23:11:18 377,568 -c----w C:\WINDOWS\$NtUninstallKB933729$\spuninst\updspapi.dll + 2007-03-09 11:51:21 270,336 -c----w C:\WINDOWS\$NtUninstallKB933729$\xpsp3res.dll + 2007-05-16 15:11:44 683,520 -c----w C:\WINDOWS\$NtUninstallKB941202$\inetcomm.dll + 2007-03-06 01:14:17 217,312 -c----w C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe + 2007-03-06 01:15:25 377,568 -c----w C:\WINDOWS\$NtUninstallKB941202$\spuninst\updspapi.dll + 2006-10-04 14:05:26 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll - 2007-07-19 22:47:22 109,056 ----a-w C:\WINDOWS\catchme.exe + 2007-09-28 07:06:08 135,168 ----a-w C:\WINDOWS\catchme.exe - 2006-11-17 17:55:08 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe + 2007-09-26 16:06:42 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe + 2007-06-27 14:04:08 124,928 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\advpack.dll + 2006-10-17 10:57:50 214,528 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\dxtrans.dll + 2007-06-27 14:04:08 132,608 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\extmgr.dll + 2006-10-17 10:58:20 61,952 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\icardie.dll + 2007-06-27 08:27:04 63,488 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ie4uinit.exe + 2007-06-27 14:04:08 153,088 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ieakeng.dll + 2007-06-27 14:04:11 230,400 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ieaksie.dll + 2007-06-27 07:00:33 161,792 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ieakui.dll + 2007-06-27 14:04:14 383,488 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ieapfltr.dll + 2007-06-27 14:04:18 384,512 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\iedkcs32.dll + 2007-06-27 14:04:49 6,058,496 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ieframe.dll + 2007-06-27 14:04:49 44,544 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\iernonce.dll + 2007-06-27 14:04:51 267,776 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\iertutil.dll + 2007-06-27 08:27:05 13,824 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\ieudinit.exe + 2007-06-27 08:26:28 625,152 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe + 2007-06-27 14:05:04 27,648 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\jsproxy.dll + 2007-06-27 14:05:06 459,264 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\msfeeds.dll + 2007-06-27 14:05:06 52,224 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\msfeedsbs.dll + 2007-07-19 06:56:29 3,583,488 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\mshtml.dll + 2007-06-27 14:05:37 477,696 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\mshtmled.dll + 2007-06-27 14:05:38 193,024 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\msrating.dll + 2007-06-27 14:05:41 671,232 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\mstime.dll + 2007-06-27 14:05:41 102,400 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\occache.dll + 2007-03-06 01:14:17 217,312 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe + 2007-03-06 01:15:25 377,568 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\updspapi.dll + 2007-06-27 14:05:41 105,984 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\url.dll + 2007-06-27 14:05:53 1,152,000 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\urlmon.dll + 2007-06-27 14:05:54 232,960 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\webcheck.dll + 2007-06-27 14:05:57 823,808 -c----w C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll - 2005-01-28 14:23:20 196,608 -c--a-w C:\WINDOWS\inf\unregmp2.exe + 2007-06-29 10:02:06 318,464 ----a-w C:\WINDOWS\inf\unregmp2.exe + 2007-04-17 14:21:36 44,032 ----a-w C:\WINDOWS\inst_tsp.exe + 2007-10-15 18:38:29 29,926 ----a-r C:\WINDOWS\Installer\{279DB581-239C-4E13-97F8-0F48E40BE75C}\MsblIco.Exe + 1997-09-18 04:12:32 9,488 ----a-w C:\WINDOWS\sporder.dll + 1997-09-18 04:12:48 7,680 ----a-w C:\WINDOWS\sporder.exe - 2007-06-27 14:04:08 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2007-08-20 09:55:27 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2005-01-28 14:23:32 9,216 -c--a-w C:\WINDOWS\system32\asferror.dll + 2006-11-03 07:54:08 8,192 ----a-w C:\WINDOWS\system32\asferror.dll - 2005-01-28 14:23:20 486,400 ----a-w C:\WINDOWS\system32\Audiodev.dll + 2006-10-18 19:47:08 276,992 ----a-w C:\WINDOWS\system32\audiodev.dll - 2005-01-28 07:53:28 294,912 -c--a-w C:\WINDOWS\system32\blackbox.dll + 2006-10-18 19:47:10 542,720 ----a-w C:\WINDOWS\system32\blackbox.dll - 2005-01-28 07:53:20 164,864 -c--a-w C:\WINDOWS\system32\cewmdm.dll + 2006-10-18 19:47:10 229,376 ----a-w C:\WINDOWS\system32\cewmdm.dll + 2007-04-19 17:37:56 1,044,480 ----a-w C:\WINDOWS\system32\contfilt.dll - 2006-11-07 02:26:44 71,680 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll + 2007-08-13 16:39:20 71,680 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll - 2007-06-27 14:04:08 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll + 2007-08-20 09:55:27 124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll - 2005-01-28 14:23:32 9,216 -c--a-w C:\WINDOWS\system32\dllcache\asferror.dll + 2006-11-03 07:54:08 8,192 -c--a-w C:\WINDOWS\system32\dllcache\asferror.dll - 2005-01-28 07:53:28 294,912 -c--a-w C:\WINDOWS\system32\dllcache\blackbox.dll + 2006-10-18 19:47:10 542,720 -c--a-w C:\WINDOWS\system32\dllcache\blackbox.dll - 2005-01-28 07:53:20 164,864 -c--a-w C:\WINDOWS\system32\dllcache\cewmdm.dll + 2006-10-18 19:47:10 229,376 -c--a-w C:\WINDOWS\system32\dllcache\cewmdm.dll - 2006-11-07 20:03:36 33,792 -c--a-w C:\WINDOWS\system32\dllcache\custsat.dll + 2007-08-13 16:54:10 33,792 -c--a-w C:\WINDOWS\system32\dllcache\custsat.dll - 2005-01-28 07:53:38 502,272 -c--a-w C:\WINDOWS\system32\dllcache\drmv2clt.dll + 2006-10-18 19:47:10 991,744 -c--a-w C:\WINDOWS\system32\dllcache\drmv2clt.dll - 2006-10-17 10:58:06 346,624 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2007-08-13 16:35:46 346,624 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2006-10-17 10:57:50 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2007-08-20 09:55:28 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2007-06-27 14:04:08 132,608 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2007-08-20 09:55:28 132,608 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2006-10-17 10:44:36 60,416 -c--a-w C:\WINDOWS\system32\dllcache\hmmapi.dll + 2007-08-13 16:18:02 60,416 -c--a-w C:\WINDOWS\system32\dllcache\hmmapi.dll + 2007-08-20 09:55:28 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll - 2007-06-27 08:27:04 63,488 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2007-08-17 10:19:56 63,488 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2007-06-27 14:04:08 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2007-08-20 09:55:28 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2007-06-27 14:04:11 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2007-08-20 09:55:29 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2007-06-27 07:00:33 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2007-08-17 07:34:25 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll - 2007-06-27 14:04:14 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2007-08-20 09:55:29 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2007-06-27 14:04:18 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2007-08-20 09:55:29 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2006-10-17 11:04:50 69,120 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe + 2007-08-13 16:44:02 69,120 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe - 2006-10-17 11:06:00 78,336 -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll + 2007-08-13 16:45:18 78,336 -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll - 2007-06-27 14:04:49 6,058,496 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll + 2007-08-20 09:55:31 6,058,496 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll - 2006-11-07 20:03:36 191,488 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll + 2007-08-13 16:54:10 191,488 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll - 2007-06-27 14:04:49 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll + 2007-08-20 09:55:31 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll - 2007-06-27 14:04:51 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll + 2007-08-20 09:55:31 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll - 2006-11-07 02:26:42 55,296 -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll + 2007-08-13 16:39:12 55,296 -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll - 2007-06-27 08:27:05 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe + 2007-08-17 10:19:56 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe - 2007-06-27 08:26:28 625,152 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2007-08-17 10:20:22 625,152 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe - 2006-10-17 10:57:58 36,352 -c--a-w C:\WINDOWS\system32\dllcache\imgutil.dll + 2007-08-13 16:36:06 36,352 -c--a-w C:\WINDOWS\system32\dllcache\imgutil.dll - 2007-05-16 15:11:44 683,520 -c--a-w C:\WINDOWS\system32\dllcache\inetcomm.dll + 2007-08-21 06:16:14 683,520 -c--a-w C:\WINDOWS\system32\dllcache\inetcomm.dll - 2006-11-07 02:26:24 92,672 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll + 2007-08-13 16:39:02 92,672 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll - 2006-10-17 11:00:00 491,520 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll + 2007-08-13 16:38:04 491,520 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll - 2007-06-27 14:05:04 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2007-08-20 09:55:31 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2005-01-28 07:53:16 6,656 -c--a-w C:\WINDOWS\system32\dllcache\laprxy.dll + 2006-10-18 19:47:14 11,264 -c--a-w C:\WINDOWS\system32\dllcache\LAPRXY.dll - 2006-10-17 11:05:10 40,960 -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll + 2007-08-13 16:44:18 40,960 -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll - 2005-01-28 00:21:46 96,768 -c--a-w C:\WINDOWS\system32\dllcache\logagent.exe + 2006-10-18 18:03:58 100,864 -c--a-w C:\WINDOWS\system32\dllcache\logagent.exe - 2004-08-04 07:57:24 310,272 -c--a-w C:\WINDOWS\system32\dllcache\mp43dmod.dll + 2006-10-18 19:47:14 4,096 -c--a-w C:\WINDOWS\system32\dllcache\MP43DMOD.dll - 2004-08-04 07:57:24 384,512 -c--a-w C:\WINDOWS\system32\dllcache\mp4sdmod.dll + 2006-10-18 19:47:14 4,096 -c--a-w C:\WINDOWS\system32\dllcache\MP4SDMOD.dll - 2004-08-04 07:57:24 240,640 -c--a-w C:\WINDOWS\system32\dllcache\mpg4dmod.dll + 2006-10-18 19:47:14 4,096 -c--a-w C:\WINDOWS\system32\dllcache\MPG4DMOD.dll - 2005-01-28 14:23:20 352,256 -c--a-w C:\WINDOWS\system32\dllcache\mpvis.dll + 2006-11-03 07:54:20 243,712 -c--a-w C:\WINDOWS\system32\dllcache\mpvis.dll - 2007-06-27 14:05:06 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2007-08-20 09:55:32 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll - 2007-06-27 14:05:06 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2007-08-20 09:55:32 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2006-10-17 10:56:10 45,568 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe + 2007-08-13 16:32:30 45,568 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe |
|
18.10.2007, 20:20
| #6 |
| | Sulimo.dat Teil 2: - 2007-07-19 06:56:29 3,583,488 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2007-08-20 09:55:33 3,584,512 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll - 2007-06-27 14:05:37 477,696 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2007-08-20 09:55:33 477,696 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2006-10-17 10:28:56 48,128 -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll + 2007-08-13 16:01:12 48,128 -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll - 2006-11-07 20:03:36 156,160 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll + 2007-08-13 16:54:10 156,160 -c--a-w C:\WINDOWS\system32\dllcache\msls31.dll - 2005-01-28 07:53:22 142,336 -c--a-w C:\WINDOWS\system32\dllcache\msnetobj.dll + 2006-10-18 19:47:16 179,712 -c--a-w C:\WINDOWS\system32\dllcache\msnetobj.dll - 2005-01-28 07:53:20 25,088 -c--a-w C:\WINDOWS\system32\dllcache\mspmsnsv.dll + 2006-10-18 19:47:16 27,136 -c--a-w C:\WINDOWS\system32\dllcache\mspmsnsv.dll - 2005-01-28 07:53:20 173,568 -c--a-w C:\WINDOWS\system32\dllcache\mspmsp.dll + 2006-10-18 19:47:16 175,616 -c--a-w C:\WINDOWS\system32\dllcache\mspmsp.dll - 2007-06-27 14:05:38 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2007-08-20 09:55:33 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2005-01-28 12:32:44 364,784 -c--a-w C:\WINDOWS\system32\dllcache\msscp.dll + 2006-12-04 14:21:50 414,720 -c--a-w C:\WINDOWS\system32\dllcache\msscp.dll - 2007-06-27 14:05:41 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2007-08-20 09:55:34 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2005-01-28 14:23:20 316,416 -c--a-w C:\WINDOWS\system32\dllcache\mswmdm.dll + 2006-10-18 19:47:16 321,536 -c--a-w C:\WINDOWS\system32\dllcache\mswmdm.dll - 2007-06-27 14:05:41 102,400 -c----w C:\WINDOWS\system32\dllcache\occache.dll + 2007-08-20 09:55:34 102,400 -c----w C:\WINDOWS\system32\dllcache\occache.dll - 2006-10-17 10:58:08 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2007-08-13 16:36:12 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2005-01-28 07:53:22 221,184 -c--a-w C:\WINDOWS\system32\dllcache\qasf.dll + 2006-10-18 19:47:18 211,456 -c--a-w C:\WINDOWS\system32\dllcache\qasf.dll - 2005-01-28 14:23:20 827,392 -c--a-w C:\WINDOWS\system32\dllcache\setup_wm.exe + 2006-11-03 08:02:20 1,678,848 -c--a-w C:\WINDOWS\system32\dllcache\setup_wm.exe - 2005-01-28 14:23:20 196,608 -c--a-w C:\WINDOWS\system32\dllcache\unregmp2.exe + 2007-06-29 10:02:06 318,464 -c--a-w C:\WINDOWS\system32\dllcache\unregmp2.exe - 2007-06-27 14:05:41 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll + 2007-08-20 09:55:34 105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll - 2007-06-27 14:05:53 1,152,000 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2007-08-20 09:55:34 1,152,000 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2006-11-07 20:03:36 413,696 -c--a-w C:\WINDOWS\system32\dllcache\vbscript.dll + 2007-08-13 16:54:10 413,696 -c--a-w C:\WINDOWS\system32\dllcache\vbscript.dll - 2007-06-27 14:05:54 232,960 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll + 2007-08-20 09:55:34 232,960 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll - 2007-06-27 14:05:57 823,808 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2007-08-20 09:55:34 824,832 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll - 2005-01-28 12:32:44 396,528 -c--a-w C:\WINDOWS\system32\dllcache\wmadmod.dll + 2006-10-18 19:47:18 757,248 -c--a-w C:\WINDOWS\system32\dllcache\WMADMOD.dll - 2005-01-28 07:53:18 716,288 -c--a-w C:\WINDOWS\system32\dllcache\wmadmoe.dll + 2006-10-18 19:47:18 1,117,696 -c--a-w C:\WINDOWS\system32\dllcache\WMADMOE.dll - 2005-01-28 07:53:16 224,768 -c--a-w C:\WINDOWS\system32\dllcache\wmasf.dll + 2006-10-18 19:47:18 222,208 -c--a-w C:\WINDOWS\system32\dllcache\WMASF.dll - 2005-01-28 07:53:20 28,160 -c--a-w C:\WINDOWS\system32\dllcache\wmdmlog.dll + 2006-10-18 19:47:18 33,792 -c--a-w C:\WINDOWS\system32\dllcache\wmdmlog.dll - 2005-01-28 07:53:20 33,792 -c--a-w C:\WINDOWS\system32\dllcache\wmdmps.dll + 2006-10-18 19:47:18 37,376 -c--a-w C:\WINDOWS\system32\dllcache\wmdmps.dll - 2005-01-28 14:23:32 228,352 -c--a-w C:\WINDOWS\system32\dllcache\wmerror.dll + 2006-11-03 07:55:54 275,968 -c--a-w C:\WINDOWS\system32\dllcache\wmerror.dll - 2005-01-28 07:53:16 150,016 -c--a-w C:\WINDOWS\system32\dllcache\wmidx.dll + 2006-10-18 19:47:20 157,184 -c--a-w C:\WINDOWS\system32\dllcache\wmidx.dll - 2005-01-28 07:53:16 1,027,072 -c--a-w C:\WINDOWS\system32\dllcache\wmnetmgr.dll + 2006-10-18 19:47:20 937,984 -c--a-w C:\WINDOWS\system32\dllcache\WMNetMgr.dll - 2007-04-30 06:20:24 5,537,792 -c--a-w C:\WINDOWS\system32\dllcache\wmp.dll + 2007-06-11 21:51:12 10,834,944 -c--a-w C:\WINDOWS\system32\dllcache\wmp.dll - 2005-01-28 07:53:20 135,168 -c--a-w C:\WINDOWS\system32\dllcache\wmpasf.dll + 2006-10-18 19:47:20 242,688 -c--a-w C:\WINDOWS\system32\dllcache\wmpasf.dll - 2005-01-28 14:23:20 77,824 -c--a-w C:\WINDOWS\system32\dllcache\wmpband.dll + 2006-11-03 07:56:02 96,256 -c--a-w C:\WINDOWS\system32\dllcache\wmpband.dll - 2005-01-28 07:53:20 282,624 -c--a-w C:\WINDOWS\system32\dllcache\wmpdxm.dll + 2006-10-18 19:47:20 314,880 -c--a-w C:\WINDOWS\system32\dllcache\wmpdxm.dll - 2005-01-28 14:23:20 73,728 -c--a-w C:\WINDOWS\system32\dllcache\wmplayer.exe + 2006-11-03 07:56:14 64,000 -c--a-w C:\WINDOWS\system32\dllcache\wmplayer.exe - 2005-01-28 14:23:22 3,407,872 -c--a-w C:\WINDOWS\system32\dllcache\wmploc.dll + 2006-11-03 08:02:58 8,282,112 -c--a-w C:\WINDOWS\system32\dllcache\wmploc.dll - 2005-01-28 14:23:26 86,016 -c--a-w C:\WINDOWS\system32\dllcache\wmpshell.dll + 2006-11-03 07:56:20 99,840 -c--a-w C:\WINDOWS\system32\dllcache\wmpshell.dll - 2005-01-28 12:32:56 774,904 -c--a-w C:\WINDOWS\system32\dllcache\wmsdmod.dll + 2006-10-18 19:47:22 4,096 -c--a-w C:\WINDOWS\system32\dllcache\wmsdmod.dll - 2005-01-28 07:53:18 1,119,744 -c--a-w C:\WINDOWS\system32\dllcache\wmsdmoe2.dll + 2006-10-18 19:47:22 4,096 -c--a-w C:\WINDOWS\system32\dllcache\wmsdmoe2.dll - 2005-01-28 12:32:44 413,944 -c--a-w C:\WINDOWS\system32\dllcache\wmspdmod.dll + 2006-10-18 19:47:22 603,648 -c--a-w C:\WINDOWS\system32\dllcache\WMSPDMOD.dll - 2005-01-28 07:53:18 940,544 -c--a-w C:\WINDOWS\system32\dllcache\wmspdmoe.dll + 2006-10-18 19:47:22 1,329,152 -c--a-w C:\WINDOWS\system32\dllcache\WMSPDMOE.dll - 2006-12-07 05:29:34 2,374,472 -c--a-w C:\WINDOWS\system32\dllcache\wmvcore.dll + 2006-10-18 19:47:22 2,450,944 -c--a-w C:\WINDOWS\system32\dllcache\wmvcore.dll - 2005-01-28 12:32:58 895,736 -c--a-w C:\WINDOWS\system32\dllcache\wmvdmod.dll + 2006-10-18 19:47:22 4,096 -c--a-w C:\WINDOWS\system32\dllcache\wmvdmod.dll - 2005-01-28 07:53:18 1,003,008 -c--a-w C:\WINDOWS\system32\dllcache\wmvdmoe2.dll + 2006-10-18 19:47:22 4,096 -c--a-w C:\WINDOWS\system32\dllcache\wmvdmoe2.dll - 2007-09-09 14:36:37 62,016 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2007-10-11 00:08:41 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2004-07-29 02:35:30 117,008 ----a-w C:\WINDOWS\system32\drivers\klif.sys + 2006-10-18 19:47:22 671,232 ------w C:\WINDOWS\system32\drivers\UMDF\wpdmtpdr.dll - 2005-01-28 00:36:24 18,944 -c--a-w C:\WINDOWS\system32\drivers\wpdusb.sys + 2006-10-18 18:00:00 38,528 ----a-w C:\WINDOWS\system32\drivers\wpdusb.sys + 2006-09-28 16:55:50 77,568 ------w C:\WINDOWS\system32\drivers\WudfPf.sys + 2006-09-28 17:00:34 82,944 ------w C:\WINDOWS\system32\drivers\WudfRd.sys + 2006-10-18 18:00:46 249,856 ------w C:\WINDOWS\system32\drmupgds.exe - 2005-01-28 07:53:38 502,272 -c--a-w C:\WINDOWS\system32\drmv2clt.dll + 2006-10-18 19:47:10 991,744 ----a-w C:\WINDOWS\system32\drmv2clt.dll - 2006-10-17 10:58:06 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2007-08-13 16:35:46 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2006-10-17 10:57:50 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2007-08-20 09:55:28 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2005-01-24 10:50:22 508,928 ----a-w C:\WINDOWS\system32\eInstall.exe + 2002-12-18 15:58:32 32,768 ----a-w C:\WINDOWS\system32\esmxlog.dll - 2007-06-27 14:04:08 132,608 ----a-w C:\WINDOWS\system32\extmgr.dll + 2007-08-20 09:55:28 132,608 ----a-w C:\WINDOWS\system32\extmgr.dll - 2006-10-17 10:58:20 61,952 ------w C:\WINDOWS\system32\icardie.dll + 2007-08-20 09:55:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2007-06-27 08:27:04 63,488 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2007-08-17 10:19:56 63,488 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2007-06-27 14:04:08 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2007-08-20 09:55:28 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll - 2007-06-27 14:04:11 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2007-08-20 09:55:29 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll - 2007-06-27 07:00:33 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll + 2007-08-17 07:34:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll - 2007-06-27 14:04:14 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll + 2007-08-20 09:55:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2007-06-27 14:04:18 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2007-08-20 09:55:29 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll - 2007-06-27 14:04:49 6,058,496 ----a-w C:\WINDOWS\system32\ieframe.dll + 2007-08-20 09:55:31 6,058,496 ----a-w C:\WINDOWS\system32\ieframe.dll - 2006-11-07 20:03:36 191,488 ----a-w C:\WINDOWS\system32\iepeers.dll + 2007-08-13 16:54:10 191,488 ----a-w C:\WINDOWS\system32\iepeers.dll - 2007-06-27 14:04:49 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll + 2007-08-20 09:55:31 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll - 2007-06-27 14:04:51 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll + 2007-08-20 09:55:31 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2007-06-27 08:27:05 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2007-08-17 10:20:54 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2006-11-07 20:03:36 180,736 ------w C:\WINDOWS\system32\ieui.dll + 2007-08-13 16:54:10 180,736 ----a-w C:\WINDOWS\system32\ieui.dll - 2006-11-07 02:26:24 92,672 ----a-w C:\WINDOWS\system32\inseng.dll + 2007-08-13 16:39:02 92,672 ----a-w C:\WINDOWS\system32\inseng.dll - 2006-10-17 11:00:00 491,520 ----a-w C:\WINDOWS\system32\jscript.dll + 2007-08-13 16:38:04 491,520 ----a-w C:\WINDOWS\system32\jscript.dll - 2007-06-27 14:05:04 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2007-08-20 09:55:31 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll - 2005-01-28 07:53:16 6,656 -c--a-w C:\WINDOWS\system32\laprxy.dll + 2006-10-18 19:47:14 11,264 ----a-w C:\WINDOWS\system32\LAPRXY.dll - 2005-01-28 00:21:46 96,768 -c--a-w C:\WINDOWS\system32\logagent.exe + 2006-10-18 18:03:58 100,864 ----a-w C:\WINDOWS\system32\logagent.exe + 2006-10-18 19:47:14 212,992 ------w C:\WINDOWS\system32\MFPLAT.dll + 2006-10-18 19:47:14 259,072 ------w C:\WINDOWS\system32\MP43DECD.dll - 2004-08-04 07:57:24 310,272 -c--a-w C:\WINDOWS\system32\mp43dmod.dll + 2006-10-18 19:47:14 4,096 ----a-w C:\WINDOWS\system32\MP43DMOD.dll + 2006-10-18 19:47:14 317,440 ------w C:\WINDOWS\system32\MP4SDECD.dll - 2004-08-04 07:57:24 384,512 -c--a-w C:\WINDOWS\system32\mp4sdmod.dll + 2006-10-18 19:47:14 4,096 ----a-w C:\WINDOWS\system32\MP4SDMOD.dll + 2006-10-18 19:47:14 259,072 ------w C:\WINDOWS\system32\MPG4DECD.dll - 2004-08-04 07:57:24 240,640 -c--a-w C:\WINDOWS\system32\mpg4dmod.dll + 2006-10-18 19:47:14 4,096 ----a-w C:\WINDOWS\system32\MPG4DMOD.dll - 2007-09-06 02:50:42 17,474,680 ----a-w C:\WINDOWS\system32\MRT.exe + 2007-09-28 05:19:39 18,089,592 ----a-w C:\WINDOWS\system32\MRT.exe + 2006-10-02 13:28:42 312,128 ------w C:\WINDOWS\system32\msdelta.dll - 2007-06-27 14:05:06 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2007-08-20 09:55:32 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2007-06-27 14:05:06 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2007-08-20 09:55:32 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2006-10-17 10:58:32 12,288 ------w C:\WINDOWS\system32\msfeedssync.exe + 2007-08-13 16:36:40 12,288 ----a-w C:\WINDOWS\system32\msfeedssync.exe - 2007-07-19 06:56:29 3,583,488 ----a-w C:\WINDOWS\system32\mshtml.dll + 2007-08-20 09:55:33 3,584,512 ----a-w C:\WINDOWS\system32\mshtml.dll - 2007-06-27 14:05:37 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2007-08-20 09:55:33 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2005-01-28 07:53:22 142,336 -c--a-w C:\WINDOWS\system32\msnetobj.dll + 2006-10-18 19:47:16 179,712 ----a-w C:\WINDOWS\system32\msnetobj.dll - 2005-01-28 07:53:20 25,088 -c--a-w C:\WINDOWS\system32\MsPMSNSv.dll + 2006-10-18 19:47:16 27,136 ----a-w C:\WINDOWS\system32\mspmsnsv.dll - 2005-01-28 07:53:20 173,568 -c--a-w C:\WINDOWS\system32\MsPMSP.dll + 2006-10-18 19:47:16 175,616 ----a-w C:\WINDOWS\system32\mspmsp.dll - 2007-06-27 14:05:38 193,024 ----a-w C:\WINDOWS\system32\msrating.dll + 2007-08-20 09:55:33 193,024 ----a-w C:\WINDOWS\system32\msrating.dll - 2005-01-28 12:32:44 364,784 -c--a-w C:\WINDOWS\system32\MSSCP.dll + 2006-12-04 14:21:50 414,720 ----a-w C:\WINDOWS\system32\msscp.dll - 2007-06-27 14:05:41 671,232 ----a-w C:\WINDOWS\system32\mstime.dll + 2007-08-20 09:55:34 671,232 ----a-w C:\WINDOWS\system32\mstime.dll - 2005-01-28 14:23:20 316,416 -c--a-w C:\WINDOWS\system32\MSWMDM.dll + 2006-10-18 19:47:16 321,536 ----a-w C:\WINDOWS\system32\mswmdm.dll + 2007-04-17 14:18:42 126,976 ----a-w C:\WINDOWS\system32\mwnsp.dll + 2007-04-17 14:21:30 356,352 ----a-w C:\WINDOWS\system32\mwtsp.dll - 2007-06-27 14:05:41 102,400 ----a-w C:\WINDOWS\system32\occache.dll + 2007-08-20 09:55:34 102,400 ----a-w C:\WINDOWS\system32\occache.dll - 2006-10-17 10:58:08 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2007-08-13 16:36:12 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2006-10-18 19:47:18 284,160 ------w C:\WINDOWS\system32\PortableDeviceApi.dll + 2006-10-18 19:47:18 101,888 ------w C:\WINDOWS\system32\PortableDeviceClassExtension.dll + 2006-10-18 19:47:18 166,912 ------w C:\WINDOWS\system32\PortableDeviceTypes.dll + 2006-10-18 19:47:18 132,096 ------w C:\WINDOWS\system32\PortableDeviceWiaCompat.dll + 2006-10-18 19:47:18 199,168 ------w C:\WINDOWS\system32\PortableDeviceWMDRM.dll - 2005-01-28 07:53:22 221,184 -c--a-w C:\WINDOWS\system32\qasf.dll + 2006-10-18 19:47:18 211,456 ----a-w C:\WINDOWS\system32\qasf.dll - 2006-01-09 12:34:17 436,548 -c--a-w C:\WINDOWS\system32\Restore\rstrlog.dat + 2007-10-14 18:38:14 1,782,300 -c--a-w C:\WINDOWS\system32\Restore\rstrlog.dat - 2004-08-04 07:57:32 581,120 ----a-w C:\WINDOWS\system32\rpcrt4.dll + 2007-07-09 13:16:16 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll + 2007-01-19 10:53:04 51,056 ----a-w C:\WINDOWS\system32\sirenacm.dll - 2006-11-17 14:14:30 16,176 ------w C:\WINDOWS\system32\spmsg.dll + 2006-09-25 15:58:48 14,640 ------w C:\WINDOWS\system32\spmsg.dll - 2005-06-28 08:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe + 2006-09-25 15:58:48 23,856 ----a-w C:\WINDOWS\system32\spupdsvc.exe - 2007-07-22 16:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2007-04-02 12:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe - 2006-11-29 15:21:29 370,688 ----a-w C:\WINDOWS\system32\swsc.exe + 2006-01-09 08:36:06 40,960 ----a-w C:\WINDOWS\system32\swsc.exe - 2006-12-01 03:20:32 212,480 ----a-w C:\WINDOWS\system32\swxcacls.exe + 2006-12-01 04:20:32 79,360 ----a-w C:\WINDOWS\system32\swxcacls.exe + 2005-10-09 16:53:50 125,440 ----a-w C:\WINDOWS\system32\UNZDLL.DLL - 2007-06-27 14:05:41 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2007-08-20 09:55:34 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2007-06-27 14:05:53 1,152,000 ----a-w C:\WINDOWS\system32\urlmon.dll + 2007-08-20 09:55:34 1,152,000 ----a-w C:\WINDOWS\system32\urlmon.dll - 2005-01-28 00:36:04 47,104 -c--a-w C:\WINDOWS\system32\uwdf.exe + 2006-10-18 19:58:00 8,704 ----a-w C:\WINDOWS\system32\uwdf.exe - 2005-01-28 00:35:58 15,872 -c--a-w C:\WINDOWS\system32\wdfapi.dll + 2006-10-18 19:47:18 4,096 ----a-w C:\WINDOWS\system32\wdfapi.dll - 2005-01-28 00:36:00 38,912 ----a-w C:\WINDOWS\system32\wdfmgr.exe + 2006-10-18 19:58:00 8,704 ----a-w C:\WINDOWS\system32\wdfmgr.exe - 2007-06-27 14:05:54 232,960 ----a-w C:\WINDOWS\system32\webcheck.dll + 2007-08-20 09:55:34 232,960 ----a-w C:\WINDOWS\system32\webcheck.dll - 2006-10-17 11:05:58 206,336 ------w C:\WINDOWS\system32\WinFXDocObj.exe + 2007-08-13 16:45:16 206,336 ----a-w C:\WINDOWS\system32\WinFXDocObj.exe - 2007-06-27 14:05:57 823,808 ----a-w C:\WINDOWS\system32\wininet.dll + 2007-08-20 09:55:34 824,832 ----a-w C:\WINDOWS\system32\wininet.dll - 2005-01-28 12:32:44 396,528 -c--a-w C:\WINDOWS\system32\wmadmod.dll + 2006-10-18 19:47:18 757,248 ----a-w C:\WINDOWS\system32\WMADMOD.dll - 2005-01-28 07:53:18 716,288 -c--a-w C:\WINDOWS\system32\wmadmoe.dll + 2006-10-18 19:47:18 1,117,696 ----a-w C:\WINDOWS\system32\WMADMOE.dll - 2005-01-28 07:53:16 224,768 ----a-w C:\WINDOWS\system32\wmasf.dll + 2006-10-18 19:47:18 222,208 ----a-w C:\WINDOWS\system32\WMASF.dll - 2005-01-28 07:53:20 28,160 -c--a-w C:\WINDOWS\system32\WMDMLOG.dll + 2006-10-18 19:47:18 33,792 ----a-w C:\WINDOWS\system32\wmdmlog.dll - 2005-01-28 07:53:20 33,792 -c--a-w C:\WINDOWS\system32\WMDMPS.dll + 2006-10-18 19:47:18 37,376 ----a-w C:\WINDOWS\system32\wmdmps.dll - 2005-01-28 07:53:50 335,872 -c--a-w C:\WINDOWS\system32\WMDRMdev.dll + 2006-10-18 19:47:18 429,056 ----a-w C:\WINDOWS\system32\wmdrmdev.dll - 2005-01-28 07:53:54 290,816 -c--a-w C:\WINDOWS\system32\WMDRMNet.dll + 2006-10-18 19:47:20 348,672 ----a-w C:\WINDOWS\system32\wmdrmnet.dll + 2006-10-18 19:47:20 535,040 ------w C:\WINDOWS\system32\wmdrmsdk.dll - 2005-01-28 14:23:32 228,352 -c--a-w C:\WINDOWS\system32\wmerror.dll + 2006-11-03 07:55:54 275,968 ----a-w C:\WINDOWS\system32\wmerror.dll - 2005-01-28 07:53:16 150,016 -c--a-w C:\WINDOWS\system32\wmidx.dll + 2006-10-18 19:47:20 157,184 ----a-w C:\WINDOWS\system32\wmidx.dll - 2005-01-28 07:53:16 1,027,072 -c--a-w C:\WINDOWS\system32\wmnetmgr.dll + 2006-10-18 19:47:20 937,984 ----a-w C:\WINDOWS\system32\WMNetMgr.dll - 2007-04-30 06:20:24 5,537,792 ----a-w C:\WINDOWS\system32\wmp.dll + 2007-06-11 21:51:12 10,834,944 ----a-w C:\WINDOWS\system32\wmp.dll - 2005-01-28 07:53:20 135,168 -c--a-w C:\WINDOWS\system32\wmpasf.dll + 2006-10-18 19:47:20 242,688 ----a-w C:\WINDOWS\system32\wmpasf.dll - 2005-01-28 07:53:20 282,624 -c--a-w C:\WINDOWS\system32\wmpdxm.dll + 2006-10-18 19:47:20 314,880 ----a-w C:\WINDOWS\system32\wmpdxm.dll + 2006-10-18 19:47:20 295,936 ------w C:\WINDOWS\system32\wmpeffects.dl |
|
18.10.2007, 20:21
| #7 |
| | Sulimo.dat und Teil 3: - 2005-01-28 07:53:18 1,594,880 -c--a-w C:\WINDOWS\system32\wmpencen.dll + 2006-10-18 19:47:20 1,661,440 ----a-w C:\WINDOWS\system32\wmpencen.dll - 2005-01-28 14:23:22 3,407,872 -c--a-w C:\WINDOWS\system32\wmploc.dll + 2006-11-03 08:02:58 8,282,112 ----a-w C:\WINDOWS\system32\wmploc.dll + 2006-10-18 19:47:20 613,376 ------w C:\WINDOWS\system32\wmpmde.dll + 2006-10-18 19:47:20 130,048 ------w C:\WINDOWS\system32\wmpps.dll - 2005-01-28 14:23:26 86,016 ----a-w C:\WINDOWS\system32\wmpshell.dll + 2006-11-03 07:56:20 99,840 ----a-w C:\WINDOWS\system32\wmpshell.dll - 2005-01-28 07:53:18 175,104 -c--a-w C:\WINDOWS\system32\wmpsrcwp.dll + 2006-10-18 19:47:20 204,288 ----a-w C:\WINDOWS\system32\wmpsrcwp.dll - 2005-01-28 12:32:56 774,904 -c--a-w C:\WINDOWS\system32\wmsdmod.dll + 2006-10-18 19:47:22 4,096 ----a-w C:\WINDOWS\system32\wmsdmod.dll - 2005-01-28 07:53:18 1,119,744 -c--a-w C:\WINDOWS\system32\wmsdmoe2.dll + 2006-10-18 19:47:22 4,096 ----a-w C:\WINDOWS\system32\wmsdmoe2.dll - 2005-01-28 12:32:44 413,944 -c--a-w C:\WINDOWS\system32\wmspdmod.dll + 2006-10-18 19:47:22 603,648 ----a-w C:\WINDOWS\system32\WMSPDMOD.dll - 2005-01-28 07:53:18 940,544 -c--a-w C:\WINDOWS\system32\wmspdmoe.dll + 2006-10-18 19:47:22 1,329,152 ----a-w C:\WINDOWS\system32\WMSPDMOE.dll - 2005-01-28 12:32:56 1,218,808 -c--a-w C:\WINDOWS\system32\wmvadvd.dll + 2006-10-18 19:47:22 4,096 ----a-w C:\WINDOWS\system32\WMVADVD.dll - 2005-01-28 07:53:20 1,512,448 -c--a-w C:\WINDOWS\system32\WMVADVE.DLL + 2006-10-18 19:47:22 4,096 ----a-w C:\WINDOWS\system32\WMVADVE.DLL - 2006-12-07 05:29:34 2,374,472 ----a-w C:\WINDOWS\system32\wmvcore.dll + 2006-10-18 19:47:22 2,450,944 ----a-w C:\WINDOWS\system32\wmvcore.dll + 2006-10-18 19:47:22 1,543,680 ------w C:\WINDOWS\system32\WMVDECOD.dll - 2005-01-28 12:32:58 895,736 -c--a-w C:\WINDOWS\system32\wmvdmod.dll + 2006-10-18 19:47:22 4,096 ----a-w C:\WINDOWS\system32\wmvdmod.dll - 2005-01-28 07:53:18 1,003,008 -c--a-w C:\WINDOWS\system32\wmvdmoe2.dll + 2006-10-18 19:47:22 4,096 ----a-w C:\WINDOWS\system32\wmvdmoe2.dll + 2006-10-18 19:47:22 1,574,912 ------w C:\WINDOWS\system32\WMVENCOD.dll + 2006-10-18 19:47:22 1,382,912 ------w C:\WINDOWS\system32\WMVSDECD.dll + 2006-10-18 19:47:22 767,488 ------w C:\WINDOWS\system32\WMVSENCD.dll + 2006-10-18 19:47:22 656,896 ------w C:\WINDOWS\system32\WMVXENCD.dll - 2005-01-28 00:36:28 38,912 -c--a-w C:\WINDOWS\system32\wpd_ci.dll + 2006-10-18 19:47:22 629,760 ----a-w C:\WINDOWS\system32\wpd_ci.dll - 2005-01-28 00:36:20 61,952 -c--a-w C:\WINDOWS\system32\wpdconns.dll + 2006-10-18 19:47:22 35,840 ----a-w C:\WINDOWS\system32\wpdconns.dll - 2005-01-28 00:36:24 114,176 -c--a-w C:\WINDOWS\system32\wpdmtp.dll + 2006-10-18 19:47:22 154,624 ----a-w C:\WINDOWS\system32\wpdmtp.dll - 2005-01-28 00:36:22 66,560 -c--a-w C:\WINDOWS\system32\wpdmtpus.dll + 2006-10-18 19:47:22 63,488 ----a-w C:\WINDOWS\system32\wpdmtpus.dll + 2006-10-18 19:47:22 2,603,008 ------w C:\WINDOWS\system32\WpdShext.dll + 2006-10-18 18:00:14 17,408 ------w C:\WINDOWS\system32\wpdshextautoplay.exe + 2006-11-02 09:51:52 43,008 ------w C:\WINDOWS\system32\wpdshextres.dll + 2006-10-18 19:47:22 133,632 ------w C:\WINDOWS\system32\WPDShServiceObj.dll - 2005-01-28 00:36:28 331,264 -c--a-w C:\WINDOWS\system32\wpdsp.dll + 2006-10-18 19:47:22 356,352 ----a-w C:\WINDOWS\system32\wpdsp.dll + 2006-09-28 18:13:26 95,344 ------w C:\WINDOWS\system32\WUDFCoinstaller.dll + 2006-09-28 16:56:38 146,432 ------w C:\WINDOWS\system32\WudfHost.exe + 2006-09-28 16:56:16 165,376 ------w C:\WINDOWS\system32\WudfPlatform.dll + 2006-09-28 16:56:14 55,808 ------w C:\WINDOWS\system32\WudfSvc.dll + 2006-09-28 16:56:38 316,416 ------w C:\WINDOWS\system32\WUDFx.dll - 2007-03-09 11:51:21 270,336 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2007-06-18 22:24:36 373,760 ----a-w C:\WINDOWS\system32\xpsp3res.dll + 2000-04-03 20:00:00 130,560 ----a-w C:\WINDOWS\system32\ZIPDLL.DLL + 2006-06-05 12:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll + 2006-06-05 12:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll + 2006-06-05 12:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll . -- Snapshot reset to current date -- . (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Programme\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-23 00:44] "QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-03-09 22:29] "PMXInit"="C:\WINDOWS\System32\pmxinit.exe" [2002-08-22 01:00] "MailScan Dispatcher"="C:\PROGRA~1\eScan\LAUNCH.EXE" [2007-04-17 16:02] "HydraVisionDesktopManager"="C:\Programme\ATI Technologies\ATI HydraVision\HydraDM.exe" [2003-04-01 17:41] "eScan Updater"="C:\PROGRA~1\eScan\TRAYICOS.exe" [2007-04-18 16:27] "eScan Server"="C:\PROGRA~1\eScan\ESERV.exe" [2007-05-15 10:38] "eScan Monitor"="C:\PROGRA~1\eScan\AVPMWrap.EXE" [2007-04-19 15:25] "eScan Install-checker"="C:\WINDOWS\system32\eInstall.exe" [2005-01-24 12:50] "avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-11 02:08] "ATIPTA"="C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 08:15] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:57] "SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"=0 (0x0) "SynchronousUserGroupPolicy"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"=0 (0x0) "NoFileAssociate"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoCommonGroups"=0 (0x0) "NoSimpleStartMenu"=0 (0x0) "NoToolbarsOnTaskbar"=0 (0x0) "NoTrayContextMenu"=0 (0x0) "NoWinKeys"=0 (0x0) "NoShellSearchButton"=0 (0x0) "NoFileAssociate"=0 (0x0) "NoRecentDocsHistory"=0 (0x0) "NoTrayItemsDisplay"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "WMPNSCFG"=C:\Programme\Windows Media Player\WMPNSCFG.exe "MsnMsgr"="C:\Programme\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "DAEMON Tools-1033"="C:\Programme\D-Tools\daemon.exe" -lang 1033 R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys R1 SSHDRV84;SSHDRV84;\??\C:\WINDOWS\system32\drivers\SSHDRV84.sys R2 eScan-eServ;eScan Management-Console;C:\PROGRA~1\eScan\TRAYESER.EXE R2 eScan-trayicos;eScan Server-Updater;C:\PROGRA~1\eScan\TRAYSSER.EXE R2 KAVMonitorService;eScan Monitor Service;C:\PROGRA~1\eScan\avpm.exe /service R3 DKbFltr;Dritek HotKey Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys S3 powervr;powervr;C:\WINDOWS\system32\DRIVERS\powervr.sys S3 Probe;Probe;C:\WINDOWS\system32\DRIVERS\probe.sys S3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-18 21:36:21 Windows 5.1.2600 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostart Einträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . Zeit der Fertigstellung: 2007-10-18 21:36:52 C:\ComboFix-quarantined-files.txt ... 2007-10-18 01:20 C:\ComboFix2.txt ... 2007-10-18 01:20 C:\ComboFix3.txt ... 2007-09-19 20:43 . --- E O F --- Soll ich die von eScan angegebenen Dateien von VirusTotal scannen lassen? |
|
18.10.2007, 20:28
| #8 |
| | Sulimo.dat Und hier silentrunners: "Silent Runners.vbs", revision 52, Silent Runners - Adware? Disinfect, don't reformat! Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SunJavaUpdateSched" = "C:\Programme\Java\j2re1.4.2_04\bin\jusched.exe" [null data] "QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "PMXInit" = "C:\WINDOWS\System32\pmxinit.exe" [null data] "MailScan Dispatcher" = "C:\PROGRA~1\eScan\LAUNCH.EXE" ["MicroWorld Technologies Inc."] "HydraVisionDesktopManager" = "C:\Programme\ATI Technologies\ATI HydraVision\HydraDM.exe" ["ATI Technologies Inc."] "eScan Updater" = "C:\PROGRA~1\eScan\TRAYICOS.EXE /App" ["MicroWorld Technologies Inc."] "eScan Server" = "C:\PROGRA~1\eScan\ESERV.EXE /App" ["MicroWorld Technologies Inc."] "eScan Monitor" = "C:\PROGRA~1\eScan\AVPMWrap.EXE" ["MicroWorld Technologies Inc."] "eScan Install-checker" = "C:\WINDOWS\system32\eInstall.exe" ["MicroWorld Technologies Inc."] "avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] "ATIPTA" = "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung" \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS] "{59403EC0-EA55-11d5-954A-9A53884D6E09}" = "SecureDoc" -> {HKLM...CLSID} = "SecureDoc" \InProcServer32\(Default) = "C:\PROGRA~1\MSI\SECURE~1\SecDoc.dll" ["msi"] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Programme\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Meine freigegebenen Ordner" \InProcServer32\(Default) = "C:\Programme\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string] SecureDocMenu\(Default) = "{59403EC0-EA55-11d5-954A-9A53884D6E09}" -> {HKLM...CLSID} = "SecureDoc" \InProcServer32\(Default) = "C:\PROGRA~1\MSI\SECURE~1\SecDoc.dll" ["msi"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string] SecureDocMenu\(Default) = "{59403EC0-EA55-11d5-954A-9A53884D6E09}" -> {HKLM...CLSID} = "SecureDoc" \InProcServer32\(Default) = "C:\PROGRA~1\MSI\SECURE~1\SecDoc.dll" ["msi"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoCommonGroups" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSimpleStartMenu" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoToolbarsOnTaskbar" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSMHelp" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} "NoTrayContextMenu" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoWinKeys" = (REG_DWORD) hex:0x00000000 {Disable Windows+X hotkeys} "NoShellSearchButton" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFileAssociate" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFileMenu" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoCDBurning" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoRecentDocsHistory" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000001 {unrecognized setting} "NoTrayItemsDisplay" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Hide the notification area} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoResolveTrack" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoPropertiesMyComputer" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFileAssociate" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSMHelp" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "SynchronousMachineGroupPolicy" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "SynchronousUserGroupPolicy" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "ShutdownWithoutLogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp" Startup items in "Günter" & "All Users" startup folders: -------------------------------------------------------- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart "Adobe Gamma Loader" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader - Schnellstart" -> shortcut to: "C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "EPSON Status Monitor 3 Environment Check 2" -> shortcut to: "C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE" ["SEIKO EPSON CORPORATION"] "LightSurf" -> shortcut to: "C:\Programme\LightSurf\Common\IconMgr.exe" ["LightSurf Technologies, Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mwtsp.dll ["MicroWorld Technologies Inc."], 01 - 02, 22 %SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 08 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {6FDD5236-C9F0-49EF-935D-385F5E21991A}\ "ButtonText" = "Poker.com" "Exec" = "C:\Programme\Poker.com\Poker.exe" ["Poker.com"] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" {49783ED4-258D-4F9F-BE11-137C18D3E543}\ "ButtonText" = "Titan Poker" "MenuText" = "Titan Poker" "Exec" = "C:\Poker\Titan Poker\casino.exe" [null data] {A68FC757-51CF-4F3C-B13A-BFB8CA69BB99}\ "ButtonText" = "CDPoker" "MenuText" = "CDPoker" "Exec" = "C:\Poker\CDPoker\casino.exe" [null data] {B723B1B8-9788-4684-ADA7-D1DB02E1D516}\ "ButtonText" = "Noble Poker" "MenuText" = "Noble Poker" "Exec" = "C:\Poker\Noble Poker\casino.exe" [null data] {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ "ButtonText" = "PartyPoker.com" "MenuText" = "PartyPoker.com" "Exec" = "C:\Programme\PartyGaming\PartyPoker\RunApp.exe" [empty string] {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ "ButtonText" = "ICQ Lite" "MenuText" = "ICQ Lite" "Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"] AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] EPSON Printer Status Agent2, EPSONStatusAgent2, "C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe" ["SEIKO EPSON CORPORATION"] eScan Management-Console, eScan-eServ, "C:\PROGRA~1\eScan\TRAYESER.EXE" ["MWTI2"] eScan Monitor Service, KAVMonitorService, "C:\PROGRA~1\eScan\avpm.exe /service" ["Kaspersky Labs."] eScan Server-Updater, eScan-trayicos, "C:\PROGRA~1\eScan\TRAYSSER.EXE" ["MicroWorld Technologies Inc."] MWAgent, MWAgent, "C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE" ["MicroWorld Technologies Inc."] Windows Media Player-Netzwerkfreigabedienst, WMPNetworkSvc, ""C:\Programme\Windows Media Player\WMPNetwk.exe"" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor S750\Driver = "CNMLM3q.DLL" ["CANON INC."] EPSON V5 2KMonitor\Driver = "EBPMON2.DLL" ["SEIKO EPSON CORPORATION"] ---------- (launch time: 2007-10-18 21:49:47) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 37 seconds, including 7 seconds for message boxes) Lg Günter PS: WICHTIGE ANMERKUNG: Während des Scanns hat Antivir 4x augeschrien, dass ein TR/Hijack.Agent.AC an Bord ist. Geändert von TheUlrich (18.10.2007 um 20:56 Uhr) |
|
19.10.2007, 16:41
| #9 | ||
| | Sulimo.dat Wie kompliziert macht ihr euch das eig. alle hier....  Die Lösung ist doch schon lange gepostet worden...  Zitat:
stattdessen gibts hier nen kompetenzteam, welches so kompetent is, das es nicht einmal posts lesen kann  Zitat:
und die lösung vom Heidefighter funzt einwandfrei... aber stattdessen macht ihr euchs alle so schwer nuja, warum einfach, wenns auch kompliziert geht  |
|
19.10.2007, 16:50
| #10 |
| | Sulimo.dat Hallo! Naja, das Problem wird dadurch etwas schwer gemacht, dass SmitFraudFix die Datei eben gelöscht hat, aber leider nur oberflächlich, d.h.: ich kann sie im Explorer nicht finden und demnach auch leider nicht editieren. Wenn ich über cmd in den Dos Ebene gelange, finde ich zwar die Datei, ich kann auch del C:\WINDOWS\system32\sulimo_Delete_Me_Dummy_systems.dat anwenden, er fragt mich auch ob ich die Datei sicher löschen will, aber sie läßt sich nicht löschen. Insofern wäre ich für einen Hinweis, welche Alternativen ich noch habe, gerne offen. So leicht ist es leider nun eben doch nicht, Lg Günter |
|
19.10.2007, 16:58
| #11 | |
| | Sulimo.datZitat:
und wenn die sulimo.dat nich mehr vorhanden ist, dann erstellst du ebend erstma eine mitm Editor somit haste dann beide dateien als 0 byte dateien vorhanden wenn du nur im dos modus an die sulimo_Delete_Me_Dummy_systems.dat kommen solltest, dann editierste sie halt mitm dos texteditor (die solltest du aber auch im windowsordner finden, vllt haste ja systemdateien und versteckte dateien in den ordneroptionen ausgeschaltet, was ja standardmäßig der fall is) |
|
19.10.2007, 18:57
| #12 |
| | Sulimo.dat Hiermal die aktuelle Smitfraus Scan Log: SmitFraudFix v2.240 Scan done at 20:04:15,68, 19.10.2007 Run from C:\Dokumente und Einstellungen\Gnter\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\Delete_Me_Dummy_systems.txt FOUND ! C:\WINDOWS\system32\systems.txt FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Gnter »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Gnter\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\GNTER~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Programme »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Leider kann ich beide Dateien nicht finden und auch nicht mit dem Editor bearbeiten. Versuche jetzt eine neue Datei gleichen Namens zu erstellen und werd dann posten was dabei heraus kam, Lg Günter |
|
19.10.2007, 19:04
| #13 | |
| | Sulimo.datZitat:
dann passiert nämlich folgendes: Windows wird zwar natürlich immer noch angewiesen auf die datei dann zuzugreifen, da aber nun kein inhalt mehr in den dat dateien ist, kommt ne stinknormale windows fehlermeldung, das die dll datei ungültig sei, die klickste dann halt immer weg und alles funzt ganz normal danach entfernste dann mit spyware doctor den virus komplett vom system |
|
| Themen zu Sulimo.dat |
| abgesicherten modus, antivir, bild, datei, dauert ewig, dringend, file, forum, fraud, gelöscht, hijack, hijackthis, hijackthis log, internet, log, log file, löschen, neu, neustart, nicht mehr, problem, programme, seite, smitfraud, starten., system, system32, trojaner, trojaner eingefangen, windows |
Hybrid-Darstellung
