JS/Downloader.Agent 75824.shoutbox[n]htm

Qorqael

iclean log:

iclean log 31.10.2007 22:40:12

Windows XP SP2, Kernel functions unavailable

Processes
---------
772 - \SystemRoot\System32\smss.exe - \SystemRoot\System32\smss.exe
844 - \??\C:\WINDOWS\system32\csrss.exe - \??\C:\WINDOWS\system32\csrss.exe
868 - \??\C:\WINDOWS\system32\winlogon.exe - \??\C:\WINDOWS\system32\winlogon.exe
912 - C:\WINDOWS\system32\services.exe - Anwendung für Dienste und Controller
924 - C:\WINDOWS\system32\lsass.exe - LSA Shell (Export Version)
1084 - C:\WINDOWS\system32\Ati2evxx.exe - ATI External Event Utility EXE Module
1108 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1172 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1268 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1428 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1572 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1584 - C:\WINDOWS\system32\ZoneLabs\vsmon.exe - TrueVector Service (Signed)
2044 - C:\WINDOWS\system32\spoolsv.exe - Spooler SubSystem App
612 - C:\Programme\Grisoft\AVG Anti-Spyware 7.5\guard.exe - AVG Anti-Spyware guard (Signed)
636 - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe - AVG Alert Manager
660 - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe - AVG Update Service
688 - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe - AVG E-Mail Scanner
1320 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1392 - C:\WINDOWS\system32\Ati2evxx.exe - ATI External Event Utility EXE Module
1464 - C:\WINDOWS\Explorer.EXE - Windows Explorer
1736 - C:\WINDOWS\system32\wdfmgr.exe - Windows User Mode Driver Manager
1908 - C:\WINDOWS\SOUNDMAN.EXE - Realtek Sound Manager
1924 - C:\Programme\ATI Technologies\ATI.ACE\cli.exe - CLI.EXE
1984 - C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe - AVG Control Center
1668 - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe - ZoneAlarm Client (Signed)
336 - C:\Programme\Grisoft\AVG Anti-Spyware 7.5\avgas.exe - AVG Anti-Spyware (Signed)
352 - C:\WINDOWS\system32\ctfmon.exe - CTF Loader
472 - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe - System settings protector (Signed)
256 - C:\Programme\WinZip\WZQKPICK.EXE - WinZip Executable
1220 - C:\Programme\OpenOffice.org 2.0\program\soffice.exe - OpenOffice.org 2.0
2208 - C:\WINDOWS\System32\alg.exe - Application Layer Gateway Service
2368 - C:\Programme\OpenOffice.org 2.0\program\soffice.BIN - OpenOffice.org 2.0
3720 - C:\WINDOWS\system32\wuauclt.exe - Windows Update Automatic Updates (Signed)
2412 - C:\Programme\Mozilla Firefox\firefox.exe - Firefox (Signed)
2688 - C:\Programme\HJT\This.com.exe - HijackThis (Signed)
2300 - C:\WINDOWS\system32\wbem\wmiprvse.exe - WMI
2332 - C:\WINDOWS\system32\NOTEPAD.EXE - Editor
1260 - C:\Dokumente und Einstellungen\Konstantin\Desktop\iclean.exe - Interactive Cleaner

Services
--------
C:\WINDOWS\system32\svchost.exe=6to4
C:\WINDOWS\system32\alg.exe=ALG
C:\WINDOWS\system32\ati2evxx.exe=Ati HotKey Poller
C:\WINDOWS\system32\svchost.exe=AudioSrv
c:\programme\grisoft\avg anti-spyware 7.5\guard.exe=AVG Anti-Spyware Guard
c:\progra~1\grisoft\avgfre~1\avgamsvr.exe=Avg7Alrt
c:\progra~1\grisoft\avgfre~1\avgupsvc.exe=Avg7UpdSvc
c:\progra~1\grisoft\avgfre~1\avgemc.exe=AVGEMS
C:\WINDOWS\system32\svchost.exe=BITS
C:\WINDOWS\system32\svchost.exe=Browser
C:\WINDOWS\system32\svchost.exe=CryptSvc
C:\WINDOWS\system32\svchost.exe=DcomLaunch
C:\WINDOWS\system32\svchost.exe=Dhcp
C:\WINDOWS\system32\svchost.exe=dmserver
C:\WINDOWS\system32\svchost.exe=Dnscache
C:\WINDOWS\system32\svchost.exe=ERSvc
C:\WINDOWS\system32\services.exe=Eventlog
c:\windows\system32\svchost.exe=EventSystem
C:\WINDOWS\system32\svchost.exe=FastUserSwitchingCompatibility
C:\WINDOWS\system32\svchost.exe=helpsvc
C:\WINDOWS\system32\svchost.exe=HidServ
C:\WINDOWS\system32\svchost.exe=lanmanserver
C:\WINDOWS\system32\svchost.exe=lanmanworkstation
C:\WINDOWS\system32\svchost.exe=LmHosts
C:\WINDOWS\system32\svchost.exe=Netman
C:\WINDOWS\system32\svchost.exe=Nla
C:\WINDOWS\system32\svchost.exe=NWCWorkstation
C:\WINDOWS\system32\services.exe=PlugPlay
C:\WINDOWS\system32\lsass.exe=PolicyAgent
C:\WINDOWS\system32\lsass.exe=ProtectedStorage
C:\WINDOWS\system32\svchost.exe=RasMan
C:\WINDOWS\system32\svchost.exe=RemoteRegistry
C:\WINDOWS\system32\svchost.exe=RpcSs
C:\WINDOWS\system32\lsass.exe=SamSs
C:\WINDOWS\system32\svchost.exe=Schedule
C:\WINDOWS\system32\svchost.exe=seclogon
C:\WINDOWS\system32\svchost.exe=SENS
C:\WINDOWS\system32\svchost.exe=SharedAccess
C:\WINDOWS\system32\svchost.exe=ShellHWDetection
C:\WINDOWS\system32\spoolsv.exe=Spooler
C:\WINDOWS\system32\svchost.exe=srservice
C:\WINDOWS\system32\svchost.exe=SSDPSRV
C:\WINDOWS\system32\svchost.exe=stisvc
C:\WINDOWS\system32\svchost.exe=TapiSrv
C:\WINDOWS\system32\svchost.exe=TermService
C:\WINDOWS\system32\svchost.exe=Themes
C:\WINDOWS\system32\svchost.exe=TrkWks
c:\windows\system32\wdfmgr.exe=UMWdf
c:\windows\system32\zonelabs\vsmon.exe=vsmon
C:\WINDOWS\system32\svchost.exe=W32Time
C:\WINDOWS\system32\svchost.exe=WebClient
C:\WINDOWS\system32\svchost.exe=winmgmt
C:\WINDOWS\system32\svchost.exe=wscsvc
C:\WINDOWS\system32\svchost.exe=wuauserv
C:\WINDOWS\system32\svchost.exe=WZCSVC

Registry
--------
000=HKCU\Run: CTFMON.EXE=c:\windows\system32\ctfmon.exe
000=HKCU\Run: MsnMsgr="c:\programme\msn messenger\msnmsgr.exe" /background
000=HKCU\Run: Skype="c:\programme\skype\phone\skype.exe" /nosplash /minimized
000=HKCU\Run: SpybotSD TeaTimer=c:\programme\spybot - search & destroy\teatimer.exe
000=HKCU\Run: swg=c:\programme\google\googletoolbarnotifier\1.0.720.3640\googletoolbarnotifier.exe
000=HKLM\Run: !AVG Anti-Spyware="c:\programme\grisoft\avg anti-spyware 7.5\avgas.exe" /minimized
000=HKLM\Run: ATICCC="c:\programme\ati technologies\ati.ace\cli.exe" runtime
000=HKLM\Run: ATIPTA=c:\programme\ati technologies\ati control panel\atiptaxx.exe
000=HKLM\Run: AVG7_CC=c:\progra~1\grisoft\avgfre~1\avgcc.exe
000=HKLM\Run: SoundMan=c:\windows\soundman.exe
000=HKLM\Run: ZoneAlarm Client="c:\programme\zone labs\zonealarm\zlclient.exe"
001=Firewall bypass: C:\Programme\Skype\Phone\Skype.exe=c:\programme\skype\phone\skype.exe
020=SSODL: CDBurn=C:\WINDOWS\system32\shell32.dll
020=SSODL: PostBootReminder=C:\WINDOWS\system32\shell32.dll
020=SSODL: SysTray=c:\windows\system32\stobject.dll
020=SSODL: WebCheck=C:\WINDOWS\system32\webcheck.dll
030=BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\programme\adobe\acrobat 6.0\reader\activex\acroiehelper.dll (AcroIEHlprObj Class)
030=BHO: {53707962-6F74-2D53-2644-206D7942484F}=c:\progra~1\spybot~1\sdhelper.dll (Spybot-S&D IE Protection)
031=Toolbar: {01E04581-4EEE-11D0-BFE9-00AA005B4383}=C:\WINDOWS\system32\browseui.dll
031=Toolbar: {0E5CBF21-D15F-11D0-8301-00AA005B4383}=C:\WINDOWS\system32\shell32.dll
031=Toolbar: {855F3B16-6D32-4FE6-8A56-BBB695989046}=c:\programme\icqtoolbar\toolbaru.dll
031=Toolbar: {855F3B16-6D32-4fe6-8A56-BBB695989046}=c:\programme\icqtoolbar\toolbaru.dll
031=Toolbar: {BA52B914-B692-46c4-B683-905236F6F655}=(null)

Startup Folders
---------------
Common: ati catalyst system tray.lnk -> C:\PROGRA~1\ATITEC~1\ATI.ACE\CLI.exe
Common: desktop.ini
Common: winzip quick pick.lnk -> C:\PROGRA~1\WinZip\WZQKPICK.EXE
Personal: desktop.ini
Personal: OpenOffice.org 2.0.lnk -> C:\PROGRA~1\OPENOF~1.0\program\QUICKS~1.EXE

HOSTS
-----
127.0.0.1 localhost