| |
| |||||||
Log-Analyse und Auswertung: Bitte um überprüfung von HJT LogWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
08.12.2007, 19:21
| #1 |
| Gast |  Bitte um überprüfung von HJT Log Hallo als erstes möchte ich eun Hallo hier ins Forum werfen. Habe mich eben neu angemedet und hoffe auf Hilfe da ich selbst nicht mehr weiter komme. Ich habe heute ein Online Scan mit Symantec gemacht, Ad Aware laufen lassen und Anti Vir. Jeweils alles upgedatet. Alle drei Programme haben keine Viren gefunden. Eben schalte ich den PC ein starte den Firefox und klack Anti Vir geht auf. Meldung war das sich hier C:\WINDOWS\system32\geebb.dll ein Trojaner verbirgt. Hab die Datei dann gelöscht. Da ich aber auf nummer sicher gehen möchte, da ich viele Dateien und Programm (für Privat als auch geschäftliche nutzen) auf dem Rechner habe und ich kein Risiko eingehnen möchte poste ich hier mal mein HijackThis Report. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:37:14, on 08.12.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE D:\EXT~1.HAR\SIDEWI~1\common\swtrayv4.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe D:\Ext.Hardware\Logitech Wheel\lwemon.exe C:\Dokumente und Einstellungen\xxx\Desktop\EasyToolz.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4ss.exe D:\Programme\3ds Max 8\mentalray\satellite\raysat_3dsmax8server.exe D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4gui.exe D:\Programme\3ds Max 8\plugins\Brazil\sfmgr\sfmgr.exe D:\Programme\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4gui.exe D:\Programme\ICQ\Icq.exe D:\Programme\Hijackthis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe Reader 7\ActiveX\AcroIEHelper.dll O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll O2 - BHO: (no name) - {740267D5-4FD0-4E34-AEA6-740E4C68D2AA} - C:\WINDOWS\system32\efcyabx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SideWinderTrayV4] d:\EXT~1.HAR\SIDEWI~1\common\swtrayv4.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe " O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Start WingMan Profiler] "D:\Ext.Hardware\Logitech Wheel\lwemon.exe" /noui O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: EasyToolz.lnk = C:\Dokumente und Einstellungen\xxx\Desktop\EasyToolz.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader - Schnellstart.lnk = D:\Programme\Adobe Reader 7\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office 2000\Office\OSA9.EXE O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Spiele\Party Poker\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Spiele\Party Poker\PartyPokerNet\RunPF.exe O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FC398E74-4F33-422B-9881-3638C380B8CA}: NameServer = 217.237.151.142 217.237.150.188 O20 - Winlogon Notify: efcyabx - C:\WINDOWS\SYSTEM32\efcyabx.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4ss.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\Programme\3ds Max 8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - D:\Programme\3ds Max 8\plugins\Brazil\sfmgr\sfmgr.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\ -- End of file - 7042 bytes Hoffe ihr könnt mir hier weiter helfen, 6 Jahre ohne Virus und Trojaner und dann das  mfg Marco |
|
08.12.2007, 19:29
| #2 |
| Gast | Bitte um überprüfung von HJT Log Hi
__________________eben wieder ein Anti Vir Pop Up bekommen.  Habe die Datei gelöscht. Komisch finde ich das laut Dieser Seite es sich immer um Browser Helper Object (BHO) Dateien handelt. mfg Marco |
|
08.12.2007, 19:41
| #3 | |
  | Bitte um überprüfung von HJT Log Grüße zurück,
__________________alles hast du noch nicht erwischt. Fixe mit HJT folgende Einträge: Zitat:
1.Vundofix * Lade dir vundofix.exe * Doppelklick VundoFix.exe * Klicke "Scan" --> Vundo button. * Nach dem Scannen, klicke den "Remove" Vundo button. * Man wird nun gefragt, ob man "remove" will --> klicke YES * Danach werden alle Desktop-Symbole verschwinden * Dann wird man gefragt, ob der PC neustarten soll --> klicke OK. 2. Erstelle eine log mit filelist.zip und poste bitte die Einträge der letzten 30 Tage. 3. Silentrunners Logfile -Lade dir das Tool -> Silentrunners -Entpacke das Script in einen Ordner deiner Wahl -Doppelklick auf -> Silent Runners -> Option Supplementary Searches auswählen -System wird nun überprüft, nach Beendigung wird eine Log-Datei erstellt (Dein Antiviren-Scanner könnte eine Meldung wegen bösartigem Script erstellen, ignoriere dieses und arbeite weiter!) -Dann öffne die Silent Runners xxx.txt mit einem Editor und kopiere den gesamten Inhalt ab und füge ihn in einen Beitrag ein. (Strg+A markieren -> Strg+C kopieren -> Strg+V einfügen) 4. Lade dir autoruns runter, entpacke das zip-Archiv und kopiere die autorunsc.exe nach c:\. Kopiere den folgenden Text, speicher ihn als autoruns.bat ab. Code:
ATTFilter echo off
cd %systemdrive%
cd\
reg add HKCU\Software\Sysinternals\autoruns /f /v EulaAccepted /t REG_DWORD /d 1
autorunsc -acmv >> %temp%\autoruns.log
findstr /v (Verified) %temp%\autoruns.log >> %temp%\autoruns.txt
notepad %temp%\autoruns.txt
exit
Schaun mer mal... |
|
08.12.2007, 20:17
| #4 |
| Gast | Bitte um überprüfung von HJT Log Hi also bin so vorgegangen 1. die zwei dateien ein häckchen gesetzt 2. auf fix checked --> yes 3. config -> Misc Tools -> delete file on reboot: C:\windows\system32\efcyabx.dll keinen neustart gemacht 4. VundoFix ausgeführt --> keine dateien gefunden worden 5. Filelist Log --> habe einfach doppelklick auf die bat gemacht und di eltzten 3ß tage abgezählt, war das richtig so ?. ----- Root ----------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\ 08.12.2007 20:17 1.610.612.736 pagefile.sys 08.12.2007 20:15 210 VundoFix.txt 01.11.2006 20:21 2.824 LGSInst.Log 01.08.2006 12:01 44 01_[HTTP_1_0 200 OK] http___62_75_176_40_80_bigfm-cbr-128.wav 24.07.2006 15:27 44 01_bigFM.wav 23.05.2006 23:28 227 boot.ini 21.03.2006 15:21 34 hcwclear.txt 21.03.2006 01:48 251.712 ntldr 21.03.2006 00:41 0 MSDOS.SYS 21.03.2006 00:41 0 AUTOEXEC.BAT 21.03.2006 00:41 0 CONFIG.SYS 21.03.2006 00:41 0 IO.SYS 04.08.2004 13:00 4.952 bootfont.bin 04.08.2004 13:00 47.564 NTDETECT.COM 14 Datei(en) 1.610.920.347 Bytes 0 Verzeichnis(se), 8.082.821.120 Bytes frei ----- System32 ------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\WINDOWS\system32 08.12.2007 20:19 2.206 wpa.dbl 08.12.2007 03:25 130.096 FNTCACHE.DAT 08.12.2007 01:51 38.912 efcyabx.dll 17.11.2007 00:04 5.686 jupdate-1.6.0_03-b05.log 02.11.2007 08:12 18.238.072 MRT.exe 29.10.2007 16:07 373.760 xpsp3res.dll 28.10.2007 11:57 401.064 perfh009.dat 28.10.2007 11:57 62.344 perfc009.dat 28.10.2007 11:57 74.996 perfc007.dat 28.10.2007 11:57 415.470 perfh007.dat 28.10.2007 11:57 966.250 PerfStringBackup.INI 25.10.2007 17:42 8.501.248 shell32.dll 27.09.2007 14:43 107.888 CmdLineExt.dll 24.09.2007 23:31 69.632 javacpl.cpl 24.09.2007 23:31 139.264 javaws.exe 24.09.2007 22:30 135.168 javaw.exe 24.09.2007 22:30 135.168 java.exe 29.08.2007 19:10 249.852 TZLog.log 22.08.2007 13:56 671.232 wininet.dll 22.08.2007 13:56 620.032 urlmon.dll 22.08.2007 13:56 1.498.112 shdocvw.dll 22.08.2007 13:56 474.624 shlwapi.dll 22.08.2007 13:56 39.424 pngfilt.dll 22.08.2007 13:56 449.024 mshtmled.dll 22.08.2007 13:56 532.480 mstime.dll 22.08.2007 13:56 146.432 msrating.dll 22.08.2007 13:56 3.085.824 mshtml.dll 22.08.2007 13:56 357.888 dxtmsft.dll 22.08.2007 13:56 1.056.256 danim.dll 22.08.2007 13:56 205.824 dxtrans.dll 6.Silenntrunners Log erstellen wolle, musste aber erst das Windows script Hosting in der Regystrie aktivieren Sielenntrunners Log "Silent Runners.vbs", revision 53, Silent Runners - Adware? Disinfect, don't reformat! Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Start WingMan Profiler" = ""D:\Ext.Hardware\Logitech Wheel\lwemon.exe" /noui" ["Logitech Inc."] "Steam" = (empty string) [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "SideWinderTrayV4" = "d:\EXT~1.HAR\SIDEWI~1\common\swtrayv4.exe" [MS] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] "ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data] "Easy-PrintToolBox" = "C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon" ["CANON INC."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Programme\Adobe Reader 7\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {68F9551E-0411-48E4-9AAF-4BC42A6A46BE}\(Default) = "Canon Easy Web Print Helper" -> {HKLM...CLSID} = "EWPBrowseObject Class" \InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll" [null data] {740267D5-4FD0-4E34-AEA6-740E4C68D2AA}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\efcyabx.dll" [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung" -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{262E6512-1611-4d54-B6F5-58A6719B31EC}" = "SigmaTel MSCN PlayerShell Hook" -> {HKLM...CLSID} = "SigmaTel MSCN PlayerShell Hook" \InProcServer32\(Default) = "MSCNh.dll" ["SigmaTel, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "D:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{F802F260-519B-11D1-BB5D-0060974C6013}" = "ICQ Shell Extension" -> {HKLM...CLSID} = "ICQ Shell Extension" \InProcServer32\(Default) = "D:\Programme\ICQ\ICQShExt.dll" ["ICQ"] "{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}" = "Bluetooth" -> {HKLM...CLSID} = "Bluetooth-Informationsaustausch" \InProcServer32\(Default) = "C:\WINDOWS\system32\TosBtExt.dll" [file not found] "{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu" -> {HKLM...CLSID} = "IZArc DragDrop Menu" \InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data] "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu" -> {HKLM...CLSID} = "IZArc Shell Context Menu" \InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data] "{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview" -> {HKLM...CLSID} = "ACDWFTHMBPRXY" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Autodesk Shared\AcDwfThmbPrxy16.dll" ["Autodesk"] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "D:\Programme\Unlocker\UnlockerCOM.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}" = "*]" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\efcyabx.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> efcyabx\DLLName = "efcyabx.dll" [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "D:\Programme\Adobe Reader 7\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" -> {HKLM...CLSID} = "IZArc Shell Context Menu" \InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] tosBtShllExt\(Default) = "{6BEF3D0B-53F0-4b0d-B91C-C19ED3D4C9D1}" -> {HKLM...CLSID} = "Bluetooth File Extenstion" \InProcServer32\(Default) = "C:\WINDOWS\system32\TosBtShell.dll" [file not found] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" -> {HKLM...CLSID} = "IZArc Shell Context Menu" \InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data] tosBtShllExt\(Default) = "{6BEF3D0B-53F0-4b0d-B91C-C19ED3D4C9D1}" -> {HKLM...CLSID} = "Bluetooth File Extenstion" \InProcServer32\(Default) = "C:\WINDOWS\system32\TosBtShell.dll" [file not found] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "D:\Programme\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "D:\Programme\Unlocker\UnlockerCOM.dll" [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in "Marco" & "All Users" startup folders: ------------------------------------------------------- C:\Dokumente und Einstellungen\Marco\Startmenü\Programme\Autostart "Adobe Gamma" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "EasyToolz" -> shortcut to: "C:\Dokumente und Einstellungen\Marco\Desktop\EasyToolz.exe" [null data] C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart "Adobe Gamma Loader" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader - Schnellstart" -> shortcut to: "D:\Programme\Adobe Reader 7\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Microsoft Office" -> shortcut to: "D:\Programme\Microsoft Office 2000\Office\OSA9.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint" -> {HKLM...CLSID} = "Easy-WebPrint" \InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\Toolband.dll" [null data] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{03C1C47F-0538-4645-8372-D3109B9FC636}\(Default) = "Easy-WebPrint" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\Toolband.dll" [null data] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."] {6224F700-CBA3-4071-B251-47CB894244CD}\ "ButtonText" = "ICQ Pro" "MenuText" = "ICQ" "Exec" = "D:\PROGRA~1\ICQ\ICQ.exe" ["ICQ Inc."] {F4430FE8-2638-42E5-B849-800749B94EED}\ "ButtonText" = "PartyPoker.net" "MenuText" = "PartyPoker.net" "Exec" = "D:\Spiele\Party Poker\PartyPokerNet\RunPF.exe" [empty string] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "@C:\Programme\Messenger\Msgslang.dll,-61144" "MenuText" = "@C:\Programme\Messenger\Msgslang.dll,-61144" "Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"] AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Autodesk Licensing Service, Autodesk Licensing Service, ""C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe"" ["Autodesk"] C-DillaSrv, C-DillaSrv, "C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE" ["C-Dilla Ltd"] CaReTaKeR-CT NetMgr 1.2.1, sfmgr, "D:\Programme\3ds Max 8\plugins\Brazil\sfmgr\sfmgr.exe" [null data] Kerio Personal Firewall 4, KPF4, ""D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4ss.exe"" ["Kerio Technologies"] RaySat_3dsmax8 Server, mi-raysat_3dsmax8, ""D:\Programme\3ds Max 8\mentalray\satellite\raysat_3dsmax8server.exe"" [null data] StarWind iSCSI Service, StarWindService, "D:\Programme\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor iP3300\Driver = "CNMLM84.DLL" ["CANON INC."] CutePDF Writer Monitor\Driver = "cpwmon2k.dll" [null data] ---------- (launch time: 2007-12-08 20:28:58) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 25 seconds, including 4 seconds for message boxes) Geändert von Marco (08.12.2007 um 20:33 Uhr) |
|
08.12.2007, 20:30
| #5 |
| | Bitte um überprüfung von HJT Log Dann hole bitte jetzt - falls noch nicht geschehen - den Neustart nach und poste die restlichen logs. |
|
08.12.2007, 20:43
| #6 |
| Gast | Bitte um überprüfung von HJT Log 6. autoruns log Entry Location,Entry,Enabled,Description,Publisher,Image Path HKLM\System\CurrentControlSet\Services,AntiVirScheduler,enabled,"Dienst zur Planung und Steuerung von Prüf- und Updateaufgaben der AntiVir PersonalEdition Classic.","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\sched.exe" HKLM\System\CurrentControlSet\Services,AntiVirService,enabled,"Echtzeit Virenschutz durch H+BEDV AntiVir Engine","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avguard.exe" HKLM\System\CurrentControlSet\Services,Autodesk Licensing Service,enabled,"Anchor service for Autodesk products licensed with SafeCast","(Not verified) Autodesk","c:\programme\gemeinsame dateien\autodesk shared\service\adskscsrv.exe" HKLM\System\CurrentControlSet\Services,C-DillaSrv,enabled,"C-Dilla RTS Service","(Not verified) C-Dilla Ltd","c:\windows\system32\drivers\cdantsrv.exe" HKLM\System\CurrentControlSet\Services,KPF4,enabled,"Kerio Personal Firewall-Engine","(Not verified) Kerio Technologies","d:\programme\kerio personal firewall\personal firewall 4\kpf4ss.exe" HKLM\System\CurrentControlSet\Services,mi-raysat_3dsmax8,enabled,"mental ray 3.4 Satellite",,"d:\programme\3ds max 8\mentalray\satellite\raysat_3dsmax8server.exe" HKLM\System\CurrentControlSet\Services,sfmgr,enabled,"",,"d:\programme\3ds max 8\plugins\brazil\sfmgr\sfmgr.exe" HKLM\System\CurrentControlSet\Services,StarWindService,enabled,"Enables network access to local devices via iSCSI protocol.","(Not verified) Rocket Division Software","d:\programme\alcohol 120%\alcohol 120\starwind\starwindservice.exe" HKLM\System\CurrentControlSet\Services,as6eio,enabled,"",,"c:\windows\system32\drivers\as6eio.sys" HKLM\System\CurrentControlSet\Services,Changer,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\Changer.sys" HKLM\System\CurrentControlSet\Services,CO_Mon,enabled,"",,"c:\windows\system32\drivers\co_mon.sys" HKLM\System\CurrentControlSet\Services,fwdrv,enabled,"","(Not verified) Kerio Technologies","c:\windows\system32\drivers\fwdrv.sys" HKLM\System\CurrentControlSet\Services,i2omgmt,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys" HKLM\System\CurrentControlSet\Services,khips,enabled,"Kerio Host Intrusion Prevention Driver",,"c:\windows\system32\drivers\khips.sys" HKLM\System\CurrentControlSet\Services,lbrtfdc,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys" HKLM\System\CurrentControlSet\Services,NuVision,enabled,"USBVision Streaming Class Driver","(Not verified) Hauppauge Computer Works","c:\windows\system32\drivers\nuvision.sys" HKLM\System\CurrentControlSet\Services,papycpu2,enabled,"",,"c:\windows\system32\drivers\papycpu2.sys" HKLM\System\CurrentControlSet\Services,papyjoy,enabled,"",,"c:\windows\system32\drivers\papyjoy.sys" HKLM\System\CurrentControlSet\Services,PCIDump,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys" HKLM\System\CurrentControlSet\Services,PDCOMP,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys" HKLM\System\CurrentControlSet\Services,PDFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys" HKLM\System\CurrentControlSet\Services,PDRELI,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys" HKLM\System\CurrentControlSet\Services,PDRFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys" HKLM\System\CurrentControlSet\Services,PxHelp20,enabled,"Px Engine Device Driver for Windows 2000/XP","(Not verified) Sonic Solutions","c:\windows\system32\drivers\pxhelp20.sys" HKLM\System\CurrentControlSet\Services,toshidpt,enabled,"Toshiba Bluetooth HID mini port driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\toshidpt.sys" HKLM\System\CurrentControlSet\ServicesEntry Location,Entry,Enabled,Description,Publisher,Image Path HKLM\System\CurrentControlSet\Services,AntiVirScheduler,enabled,"Dienst zur Planung und Steuerung von Prüf- und Updateaufgaben der AntiVir PersonalEdition Classic.","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\sched.exe" HKLM\System\CurrentControlSet\Services,AntiVirService,enabled,"Echtzeit Virenschutz durch H+BEDV AntiVir Engine","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avguard.exe" HKLM\System\CurrentControlSet\Services,Autodesk Licensing Service,enabled,"Anchor service for Autodesk products licensed with SafeCast","(Not verified) Autodesk","c:\programme\gemeinsame dateien\autodesk shared\service\adskscsrv.exe" HKLM\System\CurrentControlSet\Services,C-DillaSrv,enabled,"C-Dilla RTS Service","(Not verified) C-Dilla Ltd","c:\windows\system32\drivers\cdantsrv.exe" HKLM\System\CurrentControlSet\Services,KPF4,enabled,"Kerio Personal Firewall-Engine","(Not verified) Kerio Technologies","d:\programme\kerio personal firewall\personal firewall 4\kpf4ss.exe" HKLM\System\CurrentControlSet\Services,mi-raysat_3dsmax8,enabled,"mental ray 3.4 Satellite",,"d:\programme\3ds max 8\mentalray\satellite\raysat_3dsmax8server.exe" HKLM\System\CurrentControlSet\Services,sfmgr,enabled,"",,"d:\programme\3ds max 8\plugins\brazil\sfmgr\sfmgr.exe" HKLM\System\CurrentControlSet\Services,StarWindService,enabled,"Enables network access to local devices via iSCSI protocol.","(Not verified) Rocket Division Software","d:\programme\alcohol 120%\alcohol 120\starwind\starwindservice.exe" HKLM\System\CurrentControlSet\Services,as6eio,enabled,"",,"c:\windows\system32\drivers\as6eio.sys" HKLM\System\CurrentControlSet\Services,Changer,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\Changer.sys" HKLM\System\CurrentControlSet\Services,CO_Mon,enabled,"",,"c:\windows\system32\drivers\co_mon.sys" HKLM\System\CurrentControlSet\Services,fwdrv,enabled,"","(Not verified) Kerio Technologies","c:\windows\system32\drivers\fwdrv.sys" HKLM\System\CurrentControlSet\Services,i2omgmt,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys" HKLM\System\CurrentControlSet\Services,khips,enabled,"Kerio Host Intrusion Prevention Driver",,"c:\windows\system32\drivers\khips.sys" HKLM\System\CurrentControlSet\Services,lbrtfdc,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys" HKLM\System\CurrentControlSet\Services,NuVision,enabled,"USBVision Streaming Class Driver","(Not verified) Hauppauge Computer Works","c:\windows\system32\drivers\nuvision.sys" HKLM\System\CurrentControlSet\Services,papycpu2,enabled,"",,"c:\windows\system32\drivers\papycpu2.sys" HKLM\System\CurrentControlSet\Services,papyjoy,enabled,"",,"c:\windows\system32\drivers\papyjoy.sys" HKLM\System\CurrentControlSet\Services,PCIDump,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys" HKLM\System\CurrentControlSet\Services,PDCOMP,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys" HKLM\System\CurrentControlSet\Services,PDFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys" HKLM\System\CurrentControlSet\Services,PDRELI,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys" HKLM\System\CurrentControlSet\Services,PDRFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys" HKLM\System\CurrentControlSet\Services,PxHelp20,enabled,"Px Engine Device Driver for Windows 2000/XP","(Not verified) Sonic Solutions","c:\windows\system32\drivers\pxhelp20.sys" HKLM\System\CurrentControlSet\Services,toshidpt,enabled,"Toshiba Bluetooth HID mini port driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\toshidpt.sys" HKLM\System\CurrentControlSet\ServicesEntry Location,Entry,Enabled,Description,Publisher,Image Path HKLM\System\CurrentControlSet\Services,AntiVirScheduler,enabled,"Dienst zur Planung und Steuerung von Prüf- und Updateaufgaben der AntiVir PersonalEdition Classic.","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\sched.exe" HKLM\System\CurrentControlSet\Services,AntiVirService,enabled,"Echtzeit Virenschutz durch H+BEDV AntiVir Engine","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avguard.exe" HKLM\System\CurrentControlSet\Services,Autodesk Licensing Service,enabled,"Anchor service for Autodesk products licensed with SafeCast","(Not verified) Autodesk","c:\programme\gemeinsame dateien\autodesk shared\service\adskscsrv.exe" HKLM\System\CurrentControlSet\Services,C-DillaSrv,enabled,"C-Dilla RTS Service","(Not verified) C-Dilla Ltd","c:\windows\system32\drivers\cdantsrv.exe" HKLM\System\CurrentControlSet\Services,KPF4,enabled,"Kerio Personal Firewall-Engine","(Not verified) Kerio Technologies","d:\programme\kerio personal firewall\personal firewall 4\kpf4ss.exe" HKLM\System\CurrentControlSet\Services,mi-raysat_3dsmax8,enabled,"mental ray 3.4 Satellite",,"d:\programme\3ds max 8\mentalray\satellite\raysat_3dsmax8server.exe" HKLM\System\CurrentControlSet\Services,sfmgr,enabled,"",,"d:\programme\3ds max 8\plugins\brazil\sfmgr\sfmgr.exe" HKLM\System\CurrentControlSet\Services,StarWindService,enabled,"Enables network access to local devices via iSCSI protocol.","(Not verified) Rocket Division Software","d:\programme\alcohol 120%\alcohol 120\starwind\starwindservice.exe" HKLM\System\CurrentControlSet\Services,as6eio,enabled,"",,"c:\windows\system32\drivers\as6eio.sys" HKLM\System\CurrentControlSet\Services,Changer,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\Changer.sys" HKLM\System\CurrentControlSet\Services,CO_Mon,enabled,"",,"c:\windows\system32\drivers\co_mon.sys" HKLM\System\CurrentControlSet\Services,fwdrv,enabled,"","(Not verified) Kerio Technologies","c:\windows\system32\drivers\fwdrv.sys" HKLM\System\CurrentControlSet\Services,i2omgmt,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys" HKLM\System\CurrentControlSet\Services,khips,enabled,"Kerio Host Intrusion Prevention Driver",,"c:\windows\system32\drivers\khips.sys" HKLM\System\CurrentControlSet\Services,lbrtfdc,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys" HKLM\System\CurrentControlSet\Services,NuVision,enabled,"USBVision Streaming Class Driver","(Not verified) Hauppauge Computer Works","c:\windows\system32\drivers\nuvision.sys" HKLM\System\CurrentControlSet\Services,papycpu2,enabled,"",,"c:\windows\system32\drivers\papycpu2.sys" HKLM\System\CurrentControlSet\Services,papyjoy,enabled,"",,"c:\windows\system32\drivers\papyjoy.sys" HKLM\System\CurrentControlSet\Services,PCIDump,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys" HKLM\System\CurrentControlSet\Services,PDCOMP,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys" HKLM\System\CurrentControlSet\Services,PDFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys" HKLM\System\CurrentControlSet\Services,PDRELI,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys" HKLM\System\CurrentControlSet\Services,PDRFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys" HKLM\System\CurrentControlSet\Services,PxHelp20,enabled,"Px Engine Device Driver for Windows 2000/XP","(Not verified) Sonic Solutions","c:\windows\system32\drivers\pxhelp20.sys" HKLM\System\CurrentControlSet\Services,toshidpt,enabled,"Toshiba Bluetooth HID mini port driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\toshidpt.sys" HKLM\System\CurrentControlSet\Services,tosporte,enabled,"TOSHIBA Bluetooth Port Emulation Driver","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosporte.sys" HKLM\System\CurrentControlSet\Services,Tosrfbd,enabled,"Bluetooth RF Bus Driver","(Not verified) TOSHIBA CORPORATION","c:\windows\system32\drivers\tosrfbd.sys" HKLM\System\CurrentControlSet\Services,Tosrfbnp,enabled,"Bluetooth RFBNEP Driver","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosrfbnp.sys" HKLM\System\CurrentControlSet\Services,Tosrfcom,enabled,"Bluetooth RFCOMM Driver","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosrfcom.sys" HKLM\System\CurrentControlSet\Services,Tosrfhid,enabled,"Bluetooth HID Driver from TOSHIBA","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\tosrfhid.sys" HKLM\System\CurrentControlSet\Services,tosrfnds,enabled,"Bluetooth BNEP Driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\tosrfnds.sys" HKLM\System\CurrentControlSet\Services,TosRfSnd,enabled,"Bluetooth Audio Driver (WDM)","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosrfsnd.sys" HKLM\System\CurrentControlSet\Services,Tosrfusb,enabled,"Bluetooth USB Miniport Driver","(Not verified) TOSHIBA CORPORATION","c:\windows\system32\drivers\tosrfusb.sys" HKLM\System\CurrentControlSet\Services,Vax347b,enabled,"Plug and Play BIOS Extension","(Not verified) ","c:\windows\system32\drivers\vax347b.sys" HKLM\System\CurrentControlSet\Services,Vax347s,enabled,"SCSI miniport","(Not verified) ","c:\windows\system32\drivers\vax347s.sys" HKLM\System\CurrentControlSet\Services,WDICA,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\WDICA.sys" HKLM\System\CurrentControlSet\Services,xlink,enabled,"USBIO Driver","(Not verified) Thesycon GmbH, Germany","c:\windows\system32\drivers\xlink.sys" HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify,efcyabx,enabled,"",,"c:\windows\system32\efcyabx.dll" HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors,CutePDF Writer Monitor,enabled,"",,"c:\windows\system32\cpwmon2k.dll" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,SideWinderTrayV4,enabled,"MS SideWinder Tray Application","(Not verified) Microsoft Corporation","d:\ext.hardware\sidewinder precision racing wheel\common\swtrayv4.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,NeroFilterCheck,enabled,"NeroCheck","(Not verified) Ahead Software Gmbh","c:\windows\system32\nerocheck.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,avgnt,enabled,"Antivirus System Tray Tool","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avgnt.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ATICCC,enabled,"CLI Application (Command Line Interface)","(Not verified) ATI Technologies Inc.","c:\programme\ati technologies\ati.ace\cli.exe" HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Easy-PrintToolBox,enabled,"BJPSMAIN","(Not verified) CANON INC.","c:\programme\canon\easy-printtoolbox\bjpsmain.exe" HKLM\SOFTWARE\Classes\Protocols\Filter,application/octet-stream,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll" HKLM\SOFTWARE\Classes\Protocols\Filter,application/x-complus,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll" HKLM\SOFTWARE\Classes\Protocols\Filter,application/x-msdownload,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll" HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components,0,enabled,"",,"File not found: About:Home" HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components,n/a,enabled,"Microsoft .NET IE SECURITY REGISTRATION","(Not verified) Microsoft Corporation","c:\windows\system32\mscories.dll" C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart,Adobe Gamma Loader.lnk,enabled,"Adobe Gamma Loader","(Not verified) Adobe Systems, Inc.","c:\programme\gemeinsame dateien\adobe\calibration\adobe gamma loader.exe" C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart,Adobe Reader - Schnellstart.lnk,enabled,"Adobe Acrobat SpeedLauncher","(Not verified) Adobe Systems Incorporated","d:\programme\adobe reader 7\reader\reader_sl.exe" C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart,Microsoft Office.lnk,enabled,"Microsoft Office 2000 component","(Not verified) Microsoft Corporation","d:\programme\microsoft office 2000\office\osa9.exe" C:\Dokumente und Einstellungen\Marco\Startmenü\Programme\Autostart,Adobe Gamma.lnk,enabled,"Adobe Gamma Loader","(Not verified) Adobe Systems, Inc.","c:\programme\gemeinsame dateien\adobe\calibration\adobe gamma loader.exe" C:\Dokumente und Einstellungen\Marco\Startmenü\Programme\Autostart,EasyToolz.lnk,enabled,"",,"c:\dokumente und einstellungen\marco\desktop\easytoolz.exe" HKCU\Software\Microsoft\Windows\CurrentVersion\Run,Start WingMan Profiler,enabled,"Logitech WingMan Event Monitor","(Not verified) Logitech Inc.","d:\ext.hardware\logitech wheel\lwemon.exe" HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects,EWPBrowseObject Class,enabled,"Easy-WebPrint EWPBrowseLoader Module",,"c:\programme\canon\easy-webprint\ewpbrowseloader.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects,{740267D5-4FD0-4E34-AEA6-740E4C68D2AA},enabled,"",,"c:\windows\system32\efcyabx.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks,efcyabx.dll,enabled,"",,"c:\windows\system32\efcyabx.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,CPL-Erweiterung für Anzeigeverschiebung,enabled,"",,"File not found: deskpan.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Fusion Cache,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,ShellLink for Application References,enabled,"Application Deployment Support Library","(Not verified) Microsoft Corporation","c:\windows\system32\dfshim.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Shell Icon Handler for Application References,enabled,"Application Deployment Support Library","(Not verified) Microsoft Corporation","c:\windows\system32\dfshim.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Catalyst Context Menu extension,enabled,"ACE Context Menu",,"c:\programme\ati technologies\ati.ace\atiacmxx.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,SigmaTel MSCN PlayerShell Hook,enabled,"SigmaTel MSCN Audio Player Shell Extension","(Not verified) SigmaTel, Inc.","c:\windows\system32\mscnh.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,WinRAR shell extension,enabled,"",,"d:\programme\winrar\rarext.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Shell Extension for Malware scanning,enabled,"ShlExt.dll","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\shlext.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,AlcoholShellEx,enabled,"AXShlEx.dll","(Not verified) Alcohol Soft Development Team","d:\programme\alcohol 120%\alcohol 120\axshlex.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,ICQ Shell Extension,enabled,"ICQ Shell Extension","(Not verified) ICQ","d:\programme\icq\icqshext.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Bluetooth,enabled,"",,"File not found: C:\WINDOWS\system32\TosBtExt.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,IZArc DragDrop Menu,enabled,"",,"d:\programme\7z\izarccm.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,IZArc Shell Context Menu,enabled,"",,"d:\programme\7z\izarccm.dll" HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,UnlockerShellExtension,enabled,"",,"d:\programme\unlocker\unlockercom.dll" HKLM\Software\Classes\Folder\Shellex\ColumnHandlers,PDF Shell Extension,enabled,"PDF Shell Extension","(Not verified) Adobe Systems, Inc.","d:\programme\adobe reader 7\activex\pdfshell.dll" HKLM\Software\Microsoft\Internet Explorer\Toolbar,Easy-WebPrint,enabled,"Easy-WebPrint",,"c:\programme\canon\easy-webprint\toolband.dll" HKLM\Software\Microsoft\Internet Explorer\Extensions,ICQ,enabled,"ICQ","(Not verified) ICQ Inc.","d:\programme\icq\icq.exe" HKLM\Software\Microsoft\Internet Explorer\Extensions,PartyPoker.net,enabled,"RunApp MFC Application",,"d:\spiele\party poker\partypokernet\runpf.exe" Brauchst du noch einen log etwas anderes ?. mfg Marco |
|
08.12.2007, 21:09
| #7 |
| Gast | Bitte um überprüfung von HJT Log Hi jetzt bekomme ich auch von Anti Vir die Meldung das die Datei C:\Windows\system32\jkkjk.dll den Trojaner TR/Vundo.Gen enthält. mfg Marco |
|
08.12.2007, 21:55
| #8 |
| Gast | Bitte um überprüfung von HJT Log Hi mh ich habe jetzt festgestellt das meinTry Icon von dem Catalyst Control Center verschwunden ist, obwohl das in den Treibern aktiviert ist.  Ich glaube da hat sich schon einiges verabschiedet !?. mfg Marco |
|
08.12.2007, 21:57
| #9 |
| | Bitte um überprüfung von HJT Log Hm, okay. Hab in deinen logs erst mal nichts weltbewegendes gefunden. 1. Anleitung Avenger: a.) Lade dir das Tool Avenger und speichere es auf dem Desktop:  b.) Klicke nun auf die Option „Input Script manually“ -> klicke jetzt auf die Lupe und kopiere folgenden Text rein: Code:
ATTFilter Files to delete:
c:\windows\system32\efcyabx.dll
C:\Windows\system32\jkkjk.dll
Registry keys to delete:
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}"
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll
 d.) Danach das System unverzüglich neu starten lassen e.) Poste den Inhalt der C:\avenger.txt Datei. 2. Nach dem Neustart erstelle bitte noch mal ein Log der filelist. Poste bitte die Einträge der letzten 30 Tage, das Datum findest du in der linken Spalte. Dies sind die Verzeichnisse von denen wir jeweils die letzten 30 Tage sehen wollen: Verzeichnis von C:\ Verzeichnis von C:\WINDOWS\system32 Verzeichnis von C:\WINDOWS Verzeichnis von C:\WINDOWS\Prefetch Verzeichnis von C:\WINDOWS\tasks Verzeichnis von C:\WINDOWS\Temp Verzeichnis von C:\DOCUME~1\Name\LOCALS~1\Temp Nachtrag: Nutzt XP Pro oder Home? Geändert von ordell1234 (08.12.2007 um 22:06 Uhr) Grund: combofix funzt nicht |
|
08.12.2007, 22:31
| #10 |
| Gast | Bitte um überprüfung von HJT Log Aveneger Log Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ihindscs ******************* Script file located at: \??\C:\mgujjwgt.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File c:\windows\system32\efcyabx.dll deleted successfully. File C:\Windows\system32\jkkjk.dll not found! Deletion of file C:\Windows\system32\jkkjk.dll failed! Could not process line: C:\Windows\system32\jkkjk.dll Status: 0xc0000034 Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} deleted successfully. Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} not found! Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} failed! Status: 0xc0000034 Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll not found! Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll failed! Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate. Fileleist Log Ich hab einfach mal alles kopiert :-) Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ihindscs ******************* Script file located at: \??\C:\mgujjwgt.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File c:\windows\system32\efcyabx.dll deleted successfully. File C:\Windows\system32\jkkjk.dll not found! Deletion of file C:\Windows\system32\jkkjk.dll failed! Could not process line: C:\Windows\system32\jkkjk.dll Status: 0xc0000034 Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} deleted successfully. Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} not found! Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} failed! Status: 0xc0000034 Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll not found! Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll failed! Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate. Filelist Log Ich habe einfach mal alles kopiert :-) ----- Root ----------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\ 08.12.2007 22:11 2.878 avenger.txt 08.12.2007 22:11 1.610.612.736 pagefile.sys 08.12.2007 20:15 210 VundoFix.txt 19.08.2007 21:40 456.064 autorunsc.exe 23.03.2007 03:07 2.478 filelist.bat 01.11.2006 20:21 2.824 LGSInst.Log 01.08.2006 12:01 44 01_[HTTP_1_0 200 OK] http___62_75_176_40_80_bigfm-cbr-128.wav 24.07.2006 15:27 44 01_bigFM.wav 23.05.2006 23:28 227 boot.ini 21.03.2006 15:21 34 hcwclear.txt 21.03.2006 01:48 251.712 ntldr 21.03.2006 00:41 0 MSDOS.SYS 21.03.2006 00:41 0 CONFIG.SYS 21.03.2006 00:41 0 IO.SYS 21.03.2006 00:41 0 AUTOEXEC.BAT 04.08.2004 13:00 4.952 bootfont.bin 04.08.2004 13:00 47.564 NTDETECT.COM 17 Datei(en) 1.611.381.767 Bytes 0 Verzeichnis(se), 8.078.340.096 Bytes frei Geändert von Marco (08.12.2007 um 22:39 Uhr) |
|
08.12.2007, 22:32
| #11 |
| Gast | Bitte um überprüfung von HJT Log ----- System32 ------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\WINDOWS\system32 08.12.2007 22:13 2.206 wpa.dbl 08.12.2007 03:25 130.096 FNTCACHE.DAT 17.11.2007 00:04 5.686 jupdate-1.6.0_03-b05.log 02.11.2007 08:12 18.238.072 MRT.exe 29.10.2007 16:07 373.760 xpsp3res.dll 28.10.2007 11:57 74.996 perfc007.dat 28.10.2007 11:57 62.344 perfc009.dat 28.10.2007 11:57 415.470 perfh007.dat 28.10.2007 11:57 401.064 perfh009.dat 28.10.2007 11:57 966.250 PerfStringBackup.INI 25.10.2007 17:42 8.501.248 shell32.dll 27.09.2007 14:43 107.888 CmdLineExt.dll 24.09.2007 23:31 69.632 javacpl.cpl 24.09.2007 23:31 139.264 javaws.exe 24.09.2007 22:30 135.168 javaw.exe 24.09.2007 22:30 135.168 java.exe 29.08.2007 19:10 249.852 TZLog.log 22.08.2007 13:56 671.232 wininet.dll 22.08.2007 13:56 620.032 urlmon.dll 22.08.2007 13:56 1.498.112 shdocvw.dll 22.08.2007 13:56 474.624 shlwapi.dll 22.08.2007 13:56 39.424 pngfilt.dll 22.08.2007 13:56 532.480 mstime.dll 22.08.2007 13:56 146.432 msrating.dll 22.08.2007 13:56 449.024 mshtmled.dll 22.08.2007 13:56 3.085.824 mshtml.dll 22.08.2007 13:56 357.888 dxtmsft.dll 22.08.2007 13:56 205.824 dxtrans.dll 22.08.2007 13:56 96.768 inseng.dll 22.08.2007 13:56 55.808 extmgr.dll 22.08.2007 13:56 251.904 iepeers.dll 22.08.2007 13:56 1.056.256 danim.dll 22.08.2007 13:56 16.384 jsproxy.dll 22.08.2007 13:56 1.022.976 browseui.dll 22.08.2007 13:56 152.064 cdfview.dll 21.08.2007 07:16 683.520 inetcomm.dll 30.07.2007 18:20 30.040 wuaucpl.cpl.mui 30.07.2007 18:20 30.040 wuapi.dll.mui 30.07.2007 18:19 1.712.984 wuaueng.dll 30.07.2007 18:19 549.720 wuapi.dll 30.07.2007 18:19 325.976 wucltui.dll 30.07.2007 18:19 216.408 wuaucpl.cpl 30.07.2007 18:19 203.096 wuweb.dll 30.07.2007 18:19 92.504 cdm.dll 30.07.2007 18:19 53.080 wuauclt.exe 30.07.2007 18:19 43.352 wups2.dll 30.07.2007 18:18 34.136 wucltui.dll.mui 30.07.2007 18:18 33.624 wups.dll 30.07.2007 18:18 20.824 wuaueng.dll.mui 18.07.2007 13:42 60.416 tzchange.exe 16.07.2007 20:38 5.214 jupdate-1.6.0_02-b06.log 09.07.2007 14:11 584.192 rpcrt4.dll 26.06.2007 07:08 1.104.896 msxml3.dll 19.06.2007 14:31 282.112 gdi32.dll 17.05.2007 12:28 549.376 oleaut32.dll 30.04.2007 07:20 5.537.792 wmp.dll 25.04.2007 15:22 144.896 schannel.dll 18.04.2007 17:13 2.854.400 msi.dll 16.04.2007 19:20 4.254 jupdate-1.6.0_01-b06.log 16.04.2007 16:53 1.058.304 kernel32.dll 13.04.2007 02:21 271.360 mscoree.dll 17.03.2007 14:44 293.376 winsrv.dll 08.03.2007 16:36 40.960 mf3216.dll 08.03.2007 16:36 579.072 user32.dll 08.03.2007 16:32 1.843.712 win32k.sys 28.02.2007 17:06 2.140.160 ntoskrnl.exe 28.02.2007 17:06 2.019.840 ntkrnlpa.exe 16.02.2007 20:50 9.857 jupdate-1.5.0_11-b03.log 15.02.2007 18:01 337.280 WgaTray.exe 15.02.2007 18:01 1.476.992 LegitCheckControl.dll 15.02.2007 18:00 236.928 WgaLogon.dll 05.02.2007 21:18 185.856 upnphost.dll 23.01.2007 20:30 546.304 hhctrl.ocx Geändert von Marco (08.12.2007 um 22:40 Uhr) |
|
08.12.2007, 22:34
| #12 |
| Gast | Bitte um überprüfung von HJT Log ----- Prefetch ------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\WINDOWS\Prefetch 08.12.2007 22:33 21.744 CMD.EXE-087B4001.pf 08.12.2007 22:30 15.518 NOTEPAD.EXE-336351A9.pf 08.12.2007 22:26 45.006 WMIPRVSE.EXE-28F301A9.pf 08.12.2007 22:26 28.842 RUNDLL32.EXE-147710F4.pf 08.12.2007 22:23 34.816 WINRAR.EXE-1A0EFB18.pf 08.12.2007 22:20 107.854 FIREFOX.EXE-28BE8AE1.pf 08.12.2007 22:15 8.554 VERCLSID.EXE-3667BD89.pf 08.12.2007 22:15 13.214 RUNDLL32.EXE-451FC2C0.pf 08.12.2007 22:14 23.190 ICQSRP.EXE-39F52848.pf 08.12.2007 22:14 23.832 DBADMIN.EXE-3114FE5A.pf 08.12.2007 22:14 50.080 ICQ.EXE-12D03E8D.pf 08.12.2007 22:13 90.696 WUAUCLT.EXE-399A8E72.pf 08.12.2007 22:13 60.782 WGATRAY.EXE-0ED38BED.pf 08.12.2007 22:13 15.396 ALG.EXE-0F138680.pf 08.12.2007 22:13 18.204 WMIAPSRV.EXE-1E2270A5.pf 08.12.2007 22:13 45.364 KPF4GUI.EXE-15C10A26.pf 08.12.2007 22:13 51.044 IMAPI.EXE-0BF740A4.pf 08.12.2007 22:13 7.138 WDFMGR.EXE-2CF4013B.pf 08.12.2007 22:13 19.922 STARWINDSERVICE.EXE-08BAA24A.pf 08.12.2007 22:13 13.262 SFMGR.EXE-19B27493.pf 08.12.2007 22:12 5.604 RAYSAT_3DSMAX8SERVER.EXE-277B3C21.pf 08.12.2007 22:12 56.736 KPF4SS.EXE-1113FC5E.pf 08.12.2007 22:12 4.956 CDANTSRV.EXE-199606CD.pf 08.12.2007 22:12 10.696 ADSKSCSRV.EXE-162256D2.pf 08.12.2007 22:12 32.600 SCHED.EXE-236A886F.pf 08.12.2007 22:12 49.390 AVGUARD.EXE-3490B18B.pf 08.12.2007 22:12 643.312 NTOSBOOT-B00DFAAD.pf 08.12.2007 21:46 87.262 THUNDERBIRD.EXE-05833C98.pf 08.12.2007 21:42 32.804 TASKMGR.EXE-20256C55.pf 08.12.2007 21:25 87.106 CLI.EXE-02B0DB56.pf 08.12.2007 21:04 34.690 GUARDGUI.EXE-1BD45C30.pf 08.12.2007 20:41 35.596 NET.EXE-01A53C2F.pf 08.12.2007 20:41 13.470 NET1.EXE-029B9DB4.pf 08.12.2007 20:16 67.784 LOGONUI.EXE-0AF22957.pf 08.12.2007 19:59 8.992 ADOBELM_CLEANUP.0001-235018B4.pf 08.12.2007 19:59 21.470 ADOBELMSVC.EXE-0665217B.pf 08.12.2007 19:58 17.844 RUNDLL32.EXE-27680499.pf 08.12.2007 19:58 52.118 PHOTOSHOP.EXE-2913E2C2.pf 08.12.2007 19:44 31.606 NRASSISTANT.EXE-28801A1F.pf 08.12.2007 19:44 19.364 NR2003.EXE-14CED467.pf 08.12.2007 19:25 8.016 FZSFTP.EXE-01F0F415.pf 08.12.2007 19:25 51.262 FILEZILLA.EXE-23D4BC5B.pf 08.12.2007 19:24 19.116 SVCHOST.EXE-3530F672.pf 08.12.2007 16:29 35.978 RUNDLL32.EXE-14A3110C.pf 08.12.2007 16:29 50.276 PHOTOSHOP.EXE-075B1321.pf 08.12.2007 16:20 75.956 IEXPLORE.EXE-2CA9778D.pf 08.12.2007 16:07 69.576 AD-AWARE.EXE-2AD0F08E.pf 08.12.2007 15:39 47.200 AVSCAN.EXE-05AECC0E.pf 08.12.2007 15:38 36.318 UPDATE.EXE-13D57D76.pf 08.12.2007 15:38 14.708 PREUPD.EXE-358AA1C1.pf 08.12.2007 15:38 54.400 AVCENTER.EXE-37584419.pf 08.12.2007 03:06 26.674 ACRORD32INFO.EXE-30E2C0D7.pf 08.12.2007 02:46 121.692 FIREFOX.EXE-2A1B96AB.pf 08.12.2007 02:25 64.188 AVNOTIFY.EXE-22AE9451.pf 08.12.2007 02:07 83.886 WINWORD.EXE-2BCF0340.pf 08.12.2007 02:01 60.368 NERO.EXE-03DF656C.pf 08.12.2007 01:56 40.536 NEROSTARTSMART.EXE-3ABC3EBB.pf 08.12.2007 01:35 11.336 KEYGEN.EXE-2339A7FA.pf 08.12.2007 01:31 25.324 ADOBEUPDATER.EXE-0A2E1E73.pf 08.12.2007 01:29 50.094 MSIEXEC.EXE-2F8A8CAE.pf 08.12.2007 01:29 125.898 AHC.EXE-1FB51FFF.pf 08.12.2007 01:29 44.200 MSI55.TMP-1A81A3AE.pf 08.12.2007 01:28 41.096 IMAGEREADY.EXE-26C1446A.pf 08.12.2007 01:26 6.976 KEYGEN.EXE-251A93E3.pf 08.12.2007 01:25 14.554 SETUP.EXE-3339E875.pf 08.12.2007 01:24 19.046 SETUP.EXE-0F40F254.pf 08.12.2007 01:24 36.078 ALCOHOL.EXE-0E83AC57.pf 07.12.2007 23:26 56.764 MPTH.EXE-2065D98C.pf 07.12.2007 23:25 18.052 IS-QQ045.TMP-16829C08.pf 07.12.2007 23:25 10.100 MPTH_15010.EXE-2A6C6F68.pf 07.12.2007 23:24 39.156 PS2SAVE-BUILDER.EXE-077FB7F0.pf 07.12.2007 19:21 48.318 HELPSVC.EXE-2878DDA2.pf 07.12.2007 19:21 477.374 Layout.ini 07.12.2007 19:00 70.156 AZUREUS.EXE-2AFB9441.pf 07.12.2007 18:48 75.136 IMAGEREADY.EXE-1EBE47C6.pf 07.12.2007 18:28 32.386 OSADOBEPHOTOSHOPCS2TRYOUTTOFU-34ACCCB6.pf 07.12.2007 17:52 35.542 MSI3EC.TMP-2E12BD7C.pf 07.12.2007 17:51 51.264 RUNDLL32.EXE-13404D23.pf 07.12.2007 17:45 12.408 KEYGEN.EXE-391C3DE2.pf 07.12.2007 17:19 16.014 PHOTOSHOP CS2 KEYGEN WORKING!-1177B4E7.pf 07.12.2007 17:17 43.014 MSI59.TMP-0FE4FB36.pf 07.12.2007 17:15 15.674 SETUP.EXE-14CA2A53.pf 07.12.2007 16:55 16.006 PHOTOSHOP CS2 KEYGEN WORKING!-00DD69E2.pf 07.12.2007 15:05 42.452 ADSKCLEANUP.0001-101BA35C.pf 07.12.2007 15:05 60.012 3DSMAX.EXE-078D9D50.pf 07.12.2007 15:04 69.888 WINAMP.EXE-065B55C4.pf 07.12.2007 14:07 59.258 DFRGNTFS.EXE-269967DF.pf 07.12.2007 13:58 30.692 MMC.EXE-1EF9AA05.pf 07.12.2007 13:12 23.408 EASYTOOLZ.EXE-0CF2EA37.pf 07.12.2007 13:12 10.554 READER_SL.EXE-33DE7F37.pf 07.12.2007 13:12 10.414 ADOBE GAMMA LOADER.EXE-1FD09C3A.pf 07.12.2007 13:12 13.036 OSA9.EXE-329C204E.pf 07.12.2007 13:12 14.738 SWTRAYV4.EXE-0E72E912.pf 07.12.2007 13:12 9.998 SOUNDMAN.EXE-19745A34.pf 07.12.2007 13:12 16.374 USERINIT.EXE-30B18140.pf 07.12.2007 13:12 51.698 ATI2EVXX.EXE-19D16EB9.pf 07.12.2007 13:12 57.548 EXPLORER.EXE-082F38A9.pf 07.12.2007 13:10 61.672 JAVAW.EXE-2826389B.pf 07.12.2007 13:10 6.616 JAVACPL.EXE-1B4C9006.pf 07.12.2007 13:10 14.584 RUNDLL32.EXE-3001C307.pf 07.12.2007 13:10 21.310 RUNDLL32.EXE-29A2BA7C.pf 07.12.2007 13:10 16.790 SNDVOL32.EXE-383480B7.pf 07.12.2007 13:09 31.334 RUNDLL32.EXE-2576181F.pf 07.12.2007 13:06 55.384 AVGNT.EXE-36CA4640.pf 07.12.2007 12:59 15.854 MAX8KEYGEN.EXE-04A63A5C.pf 07.12.2007 12:32 19.068 RUNDLL32.EXE-2341BBC5.pf 07.12.2007 12:32 19.700 CONTROL.EXE-013DBFB5.pf 07.12.2007 12:16 13.880 AZUREUS_2.5.0.4_WIN32.SETUP.E-013945A7.pf 07.12.2007 11:50 18.018 MAX8KEYGEN.EXE-0BC40921.pf 07.12.2007 11:16 22.790 RUNDLL32.EXE-14BE42EE.pf 07.12.2007 11:15 49.590 I_VIEW32.EXE-3680CA15.pf 07.12.2007 11:14 20.418 WINMIP2.EXE-204E679C.pf 07.12.2007 11:04 10.598 RUNONCE.EXE-2803F297.pf 07.12.2007 11:03 20.706 RUNDLL32.EXE-16BBAF5D.pf 07.12.2007 10:59 32.376 MMC.EXE-39071BCC.pf 07.12.2007 10:59 29.126 RUNDLL32.EXE-31EBBE5F.pf 07.12.2007 09:09 19.238 RUNDLL32.EXE-188DF14E.pf 07.12.2007 08:54 59.844 3DSMAX.EXE-11777381.pf 07.12.2007 08:46 8.012 BRAZIL??.EXE-27FE9DFB.pf 07.12.2007 08:46 8.368 BRAZIL??.EXE-308BBF13.pf 07.12.2007 08:22 13.816 NTVDM.EXE-1A10A423.pf 07.12.2007 08:15 17.986 MAX8KEYGEN.EXE-08C84B33.pf 07.12.2007 08:10 7.014 REGCLEANER.EXE-296199B0.pf 07.12.2007 08:10 49.260 DWFVIEWERSETUP.EXE-3208D4AD.pf 07.12.2007 08:10 26.920 AUTORUN.EXE-21898424.pf 07.12.2007 08:10 39.490 SETUP.EXE-1C2DF0DE.pf 07.12.2007 08:10 52.710 DXSETUP.EXE-18483C9E.pf 07.12.2007 03:06 17.976 DEFRAG.EXE-273F131E.pf 07.12.2007 01:02 46.608 TEAMSPEAK.EXE-16AE4E70.pf 06.12.2007 22:03 20.736 REGSVR32.EXE-25EEFE2F.pf 130 Datei(en) 5.597.836 Bytes 0 Verzeichnis(se), 8.078.229.504 Bytes frei Geändert von Marco (08.12.2007 um 22:41 Uhr) |
|
08.12.2007, 22:42
| #13 |
| Gast | Bitte um überprüfung von HJT Log ----- Windows -------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\WINDOWS 08.12.2007 22:12 0 0.log 08.12.2007 22:12 1.371.005 WindowsUpdate.log 08.12.2007 22:11 2.048 bootstat.dat 08.12.2007 22:10 32.618 SchedLgU.Txt 08.12.2007 21:18 864.846 setupapi.log 08.12.2007 20:16 506 wiadebug.log 08.12.2007 19:24 50 wiaservc.log 07.12.2007 08:10 9.566 DirectX.log 05.12.2007 15:13 1.537 AS6E32.INI 05.12.2007 15:13 543 SUPMINI.INI 05.12.2007 15:11 7.650 aWhite.dat 05.12.2007 15:11 4 aError.dat 05.12.2007 15:11 7.650 aDark.dat 05.12.2007 15:11 12 aExpo.dat 20.11.2007 21:56 51.028 wmsetup.log 19.11.2007 22:41 13.771 Car of Tomorrow Mod Setup Log.txt 14.11.2007 17:05 146.159 iis6.log 14.11.2007 17:05 355.099 tsoc.log 14.11.2007 17:05 50.817 ocmsn.log 14.11.2007 17:05 189.587 ntdtcsetup.log 14.11.2007 17:05 315.499 comsetup.log 14.11.2007 17:05 1.393 imsins.log 14.11.2007 17:05 10.699 KB943460.log 14.11.2007 17:05 443.337 ocgen.log 14.11.2007 17:05 46.294 msgsocm.log 14.11.2007 17:05 920.373 FaxSetup.log 14.11.2007 17:05 57.722 updspapi.log 06.11.2007 00:33 69 NeroDigital.ini 10.10.2007 21:58 1.393 imsins.BAK 10.10.2007 21:58 38.634 KB939653.log 09.10.2007 21:49 9.759 KB933729.log 09.10.2007 21:48 13.882 KB941202.log 29.08.2007 19:10 25.266 KB933360.log 15.08.2007 21:07 5.048 spupdsvc.log 15.08.2007 20:57 19.710 KB936021.log 15.08.2007 20:57 24.419 KB938828.log 15.08.2007 20:57 18.792 KB921503.log 15.08.2007 20:57 18.393 KB938829.log 15.08.2007 20:56 18.221 KB938127.log 15.08.2007 20:56 38.610 KB937143.log 15.08.2007 20:56 7.054 KB936782.log 13.06.2007 15:47 38.280 KB933566.log 13.06.2007 15:46 15.053 KB929123.log 13.06.2007 15:46 14.357 KB935840.log 13.06.2007 15:45 14.283 KB935839.log 13.06.2007 14:10 1.036.288 explorer.exe 08.06.2007 21:59 68 3doEd.INI 25.05.2007 15:50 9.116 KB927891.log 10.05.2007 18:33 13.604 KB930916.log 09.05.2007 21:52 19.483 KB931768.log 11.04.2007 11:47 24.907 KB931784.log 11.04.2007 11:47 15.080 KB931261.log 11.04.2007 11:47 15.389 KB930178.log 11.04.2007 11:47 19.616 KB932168.log 04.04.2007 13:36 15.002 KB925902.log 02.04.2007 23:25 1.073.303.552 MEMORY.DMP 02.04.2007 18:12 0 tosOBEX.INI 02.04.2007 18:11 188.682 setupact.log 24.03.2007 16:37 1.785 vtplus32.ini 15.03.2007 13:32 20.476 KB929338.log 01.03.2007 23:10 29.406 WgaNotify.log 14.02.2007 00:44 21.505 KB927779.log 14.02.2007 00:44 18.203 KB927802.log 14.02.2007 00:43 18.709 KB928255.log 14.02.2007 00:43 15.228 KB924667.log 14.02.2007 00:43 27.778 KB931836.log 14.02.2007 00:43 17.169 KB926436.log 14.02.2007 00:43 17.694 KB918118.log 14.02.2007 00:43 36.703 KB928090.log 14.02.2007 00:43 12.956 KB928843.log 13.01.2007 22:00 720.896 iun6002ev.exe 11.01.2007 19:30 16.720 KB929969.log 17.12.2006 18:48 35.542 KB925454.log 17.12.2006 18:47 13.348 KB926255.log 17.12.2006 18:47 13.120 KB923694.log 17.12.2006 11:39 7.006 KB925398.log 17.12.2006 11:38 8.377 KB923689.log 05.12.2006 20:03 1.173 ie7_main.log 02.12.2006 22:18 354 HPSETLOG.TXT 18.11.2006 12:54 17.999 KB923980.log 18.11.2006 12:54 21.116 KB924270.log 18.11.2006 12:54 20.755 KB920213.log 18.11.2006 12:54 33.777 KB922760.log 27.10.2006 20:50 32 wininit.ini 16.10.2006 18:13 6.443 mozver.dat |
|
08.12.2007, 22:44
| #14 |
| Gast | Bitte um überprüfung von HJT Log ----- Tasks ---------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\WINDOWS\tasks 08.12.2007 22:11 6 SA.DAT 04.08.2004 13:00 65 desktop.ini 2 Datei(en) 71 Bytes 0 Verzeichnis(se), 8.078.225.408 Bytes frei ----- Wintemp -------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\WINDOWS\temp 08.12.2007 22:13 409 WGANotify.settings 08.12.2007 22:11 255 WGAErrLog.txt 16.09.2007 12:26 0 Upd3F.tmp 26.08.2007 18:00 0 Upd43.tmp 26.08.2007 17:58 0 Upd42.tmp 26.08.2007 17:57 0 Upd41.tmp 19.08.2007 14:46 0 Upd38.tmp 19.08.2007 14:43 0 Upd37.tmp 12.08.2007 13:21 0 Upd36.tmp 12.08.2007 13:17 0 Upd32.tmp 05.08.2007 12:46 0 Upd31.tmp 05.08.2007 12:44 0 Upd30.tmp 29.07.2007 13:56 0 Upd35.tmp 29.07.2007 13:55 0 Upd34.tmp 29.07.2007 13:54 0 Upd33.tmp 15.07.2007 12:32 0 Upd2F.tmp 15.07.2007 12:26 0 Upd16.tmp 15.07.2007 12:03 0 Upd13.tmp 15.07.2007 12:01 0 Upd12.tmp 11.07.2007 16:05 6.019 NetFxUpdate_v1.1.4322.log 08.07.2007 12:47 0 Upd15.tmp 08.07.2007 12:47 0 Upd14.tmp 01.07.2007 12:48 0 Upd2E.tmp 01.07.2007 12:46 0 Upd2D.tmp 01.07.2007 12:45 0 Upd2C.tmp 01.07.2007 12:44 0 Upd2B.tmp 01.07.2007 12:43 0 Upd2A.tmp 01.07.2007 12:43 0 Upd29.tmp 01.07.2007 12:42 0 Upd28.tmp 01.07.2007 12:41 0 Upd27.tmp 01.07.2007 12:41 0 Upd26.tmp 01.07.2007 12:40 0 Upd25.tmp 01.07.2007 12:40 0 Upd24.tmp 25.06.2007 14:08 0 Upd21.tmp 25.06.2007 14:07 0 Upd20.tmp 25.06.2007 14:07 0 Upd1F.tmp 25.06.2007 14:07 0 Upd1C.tmp 17.06.2007 11:11 0 Upd11.tmp 17.06.2007 11:08 0 Upd10.tmp 17.06.2007 11:06 0 UpdF.tmp 17.06.2007 11:06 0 UpdE.tmp 10.06.2007 16:16 0 Upd23.tmp 10.06.2007 16:15 0 Upd22.tmp 04.06.2007 13:29 0 UpdD.tmp 04.06.2007 13:28 0 Upd5.tmp 28.05.2007 14:11 0 Upd4.tmp 28.05.2007 14:10 0 Upd3.tmp 12.05.2007 17:48 0 UpdC.tmp 12.05.2007 17:48 0 UpdB.tmp 12.05.2007 17:48 0 UpdA.tmp 12.05.2007 17:47 0 Upd9.tmp 06.05.2007 12:01 0 Upd1E.tmp 06.05.2007 12:00 0 Upd1D.tmp 28.04.2007 22:14 0 Upd1B.tmp 28.04.2007 22:13 0 Upd1A.tmp 28.04.2007 22:13 0 Upd19.tmp 28.04.2007 22:12 0 Upd18.tmp 28.04.2007 22:11 0 Upd17.tmp 22.04.2007 14:39 0 Upd6.tmp 22.04.2007 12:27 0 Upd2.tmp 22.04.2007 12:24 0 Upd8.tmp 22.04.2007 12:24 0 Upd7.tmp 04.04.2006 16:10 16.384 Perflib_Perfdata_d50.dat 04.04.2006 01:12 16.384 Perflib_Perfdata_c14.dat 23.03.2006 00:38 16.384 Perflib_Perfdata_338.dat 21.03.2006 17:22 16.384 Perflib_Perfdata_6c4.dat 21.03.2006 00:43 402 java_install_reg.log 21.03.2006 00:43 25.619 java_install.log 21.03.2006 00:42 7.320 ASPNETSetup.log 24.04.2005 06:33 190.976 keygen2.exe 70 Datei(en) 296.536 Bytes 0 Verzeichnis(se), 8.078.221.312 Bytes frei |
|
08.12.2007, 22:47
| #15 |
| Gast | Bitte um überprüfung von HJT Log ----- Temp ----------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 7495-4187 Verzeichnis von C:\DOKUME~1\Marco\LOKALE~1\Temp 08.12.2007 22:33 122.148 filelist.txt 08.12.2007 22:16 473.282 jusched.log 08.12.2007 20:38 20.218 autoruns.txt 08.12.2007 20:38 22.072 autoruns.log 08.12.2007 19:59 59.964 Adobelm_Cleanup.0001 08.12.2007 19:58 4.305 TWAIN.LOG 08.12.2007 19:58 5 Twain001.Mtx 08.12.2007 19:58 156 Twunk001.MTX 08.12.2007 19:53 114.688 ~DF7312.tmp 08.12.2007 19:44 4.592 SIntfIcn.ani 08.12.2007 19:44 24.740 SIntfNT.dll 08.12.2007 19:44 20.020 SIntf32.dll 08.12.2007 19:44 12.305 SIntf16.dll 08.12.2007 01:51 43 removalfile.bat 07.12.2007 19:00 0 AZ_49409.rar 07.12.2007 18:54 0 AZ_49407.iso 07.12.2007 18:53 0 AZ_49403.exe 07.12.2007 18:37 0 AZ_42778.exe 07.12.2007 18:04 0 AZ_11738.rar 07.12.2007 17:29 0 AZ_49129.EXE 07.12.2007 17:26 0 AZ_49127.rar 07.12.2007 16:28 0 AZ_33993.rar 07.12.2007 15:39 0 AZ_54943.rar 07.12.2007 15:22 153 prof.log 07.12.2007 15:22 153 events.log 07.12.2007 15:05 59.964 AdskCleanup.0001 07.12.2007 13:10 158.367 java_install_reg.log 07.12.2007 10:49 0 AZ_36923.iso 07.12.2007 10:45 0 AZ_48883.rar 07.12.2007 08:14 2.222 3dsMax8.log 07.12.2007 08:14 12.322.260 3dsMax8.0Install.log 07.12.2007 08:14 285.860 bb3_install.log 07.12.2007 08:14 3.603 Install-log.txt 07.12.2007 02:33 0 1e026.tmp 07.12.2007 02:30 0 ywk25.tmp 07.12.2007 02:21 0 2w11D.tmp 07.12.2007 02:17 0 ing1B.tmp 07.12.2007 01:31 0 AZ_23951.iso 06.12.2007 23:31 63 cmd.php.uin 06.12.2007 13:27 90.112 CmdLineExt03.dll 04.12.2007 16:11 16.384 ~DFC8EB.tmp 04.12.2007 16:11 16.384 ~DFBEA4.tmp 04.12.2007 16:11 16.384 ~DFBDFA.tmp 04.12.2007 16:11 16.384 ~DFBD90.tmp 04.12.2007 16:11 16.384 ~DFBBD9.tmp 04.12.2007 16:11 16.384 ~DF892D.tmp 04.12.2007 00:39 0 pjl14.tmp 04.12.2007 00:36 0 lqq12.tmp 02.12.2007 01:48 0 pdk42.tmp 30.11.2007 22:19 69 316C7B88.TMP 28.11.2007 00:18 0 0kh12.tmp 28.11.2007 00:15 0 d2311.tmp 24.11.2007 21:08 0 s2aE.tmp 24.11.2007 21:08 0 jvoD.tmp 22.11.2007 23:58 53.728 830b_appcompat.txt 22.11.2007 22:20 81.920 ~DFFF1D.tmp 22.11.2007 22:10 131.072 ~DF4402.tmp 22.11.2007 19:26 53.728 99e3_appcompat.txt 20.11.2007 21:58 0 xlrD.tmp 20.11.2007 21:56 12.818 control.xml 20.11.2007 21:55 0 n0vB.tmp 17.11.2007 00:02 1.302 jinstall.cfg 16.11.2007 23:51 16.384 ~DF6D0D.tmp 16.11.2007 23:50 16.384 ~DF20B1.tmp 14.11.2007 23:12 0 dwb6E.tmp 14.11.2007 23:06 0 6oa6A.tmp 13.11.2007 00:34 0 zi015.tmp 11.11.2007 22:15 16.384 ~DF3452.tmp 11.11.2007 22:14 16.384 ~DFC9FE.tmp 11.11.2007 17:11 8.207.180 nsmail-2.eml 11.11.2007 17:10 8.207.180 nsmail-1.eml 11.11.2007 14:05 16.384 ~DF5D9E.tmp 11.11.2007 14:01 16.384 ~DF3DA1.tmp 10.11.2007 00:29 0 gcx55.tmp 10.11.2007 00:18 0 4m453.tmp 10.11.2007 00:18 0 5ny50.tmp 10.11.2007 00:13 0 6r74A.tmp 10.11.2007 00:13 0 o2q49.tmp 10.11.2007 00:12 0 6ce45.tmp 10.11.2007 00:06 0 n5r35.tmp 10.11.2007 00:03 0 tvc32.tmp 06.11.2007 00:36 0 bl08A.tmp 06.11.2007 00:35 0 i4o87.tmp 06.11.2007 00:33 0 cuz7C.tmp 06.11.2007 00:33 0 mts79.tmp 06.11.2007 00:28 0 6y974.tmp 01.11.2007 16:33 16.384 ~DF6ED9.tmp 01.11.2007 16:32 16.384 ~DFC1BF.tmp 30.10.2007 21:25 16.384 ~DF1DEF.tmp 29.10.2007 13:05 16.384 ~DFC6BB.tmp 29.10.2007 13:05 16.384 ~DFC611.tmp 29.10.2007 13:05 16.384 ~DFC5B4.tmp 29.10.2007 13:05 16.384 ~DFC424.tmp 29.10.2007 12:55 16.384 ~DF34C2.tmp 29.10.2007 12:54 16.384 ~DF5E77.tmp 29.10.2007 11:10 65.536 ~DF8F59.tmp 29.10.2007 10:23 16.384 ~DF97D6.tmp 29.10.2007 10:23 512 ~DF97E4.tmp 29.10.2007 10:23 512 ~DF9070.tmp 29.10.2007 10:23 16.384 ~DF9062.tmp 29.10.2007 10:23 16.384 ~DF8FB8.tmp 29.10.2007 10:23 512 ~DF8FC6.tmp 29.10.2007 10:23 16.384 ~DF8F4B.tmp 29.10.2007 10:23 512 ~DF8DA1.tmp 29.10.2007 10:23 16.384 ~DF8D93.tmp 29.10.2007 10:21 16.384 ~DFBE39.tmp 29.10.2007 10:21 512 ~DFBE47.tmp 28.10.2007 18:50 575 TVU2B.tmp 28.10.2007 18:49 575 TVU28.tmp 27.10.2007 22:19 0 pqp2F.tmp 27.10.2007 22:19 0 b3o2E.tmp 27.10.2007 22:15 0 woz27.tmp 27.10.2007 22:14 0 3pw26.tmp 27.10.2007 16:21 16.384 ~DF9EB2.tmp 27.10.2007 00:00 20.409 sop_ad.jpg 26.10.2007 23:52 575 TVUC.tmp 24.10.2007 21:23 244.432 Office 2000 Premium Setup(0014)_MsiExec.txt 24.10.2007 21:21 1.606 Office 2000 Premium Setup(0014).txt 24.10.2007 21:21 1.458 Office 2000 Premium Setup(0012).txt 24.10.2007 21:16 241.792 Office 2000 Premium Setup(0010)_MsiExec.txt 24.10.2007 21:15 1.606 Office 2000 Premium Setup(0010).txt 24.10.2007 21:15 1.554 Office 2000 Premium Setup(0008).txt 24.10.2007 21:14 1.554 Office 2000 Premium Setup(0006).txt 24.10.2007 21:14 1.554 Office 2000 Premium Setup(0004).txt 14.10.2007 17:40 16.384 ~DF82BA.tmp 14.10.2007 17:36 16.384 ~DFA1E9.tmp 07.10.2007 23:17 0 ljl1F.tmp 07.10.2007 23:16 0 0e61B.tmp 07.10.2007 23:16 0 hcs1A.tmp 07.10.2007 23:15 0 g0418.tmp 07.10.2007 23:13 0 xkxE.tmp 07.10.2007 23:12 0 r41C.tmp 07.10.2007 14:55 0 rx715.tmp 29.09.2007 12:02 13.592 temp.ani 29.09.2007 12:02 212.992 drm_dyndata_7330014.dll 28.09.2007 19:01 355 5.tmp 28.09.2007 17:06 65.536 drm_dialogs.dll 27.09.2007 17:50 0 7eu18.tmp 27.09.2007 17:49 0 8fy14.tmp 27.09.2007 17:43 0 nj53.tmp 17.09.2007 11:41 696 jar_cache11057.tmp 17.09.2007 11:39 642 jar_cache11052.tmp 17.09.2007 11:39 697 jar_cache11048.tmp 17.09.2007 11:39 699 jar_cache11047.tmp 17.09.2007 11:39 696 jar_cache11044.tmp Ich benutze Windows XP Home mfg Marco |
|
| Themen zu Bitte um überprüfung von HJT Log |
| ad aware, adobe, antivir, antivirus, antivirus scan, avg, avira, bho, bitte um überprüfung, canon, desktop, drivers, einstellungen, explorer, firefox, firewall, helfen, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, keine viren, programme, s-1-5-18, scan, symantec, system, trend micro, trojaner, viren, windows, windows xp, windows\system32\drivers |
Linear-Darstellung
