TR/Agent.lnb (2) (luc-pascal vom 22.02.2008)

BataAlexander · 28.02.2008, 22:33

Dein Gast kann eine ganze Menge

Zitat:

Allows others to access the computer
Steals information
Drops more malware
Downloads code from the internet
Reduces system security
Installs itself in the Registry

Hier würde ich nur noch das versuchen, sorry.

Polytron · 28.02.2008, 23:03

Genau "das" habe ich vor einem Monat getan.
Es ist eine aufwendige Arbeit meinen PC wieder so aufzusetzten damit ich damit arbeiten kann.

Merci Trotzdem

Vieleicht bringt mir jemand noch einen Lösungsvorschlag.

BataAlexander · 28.02.2008, 23:12

Lösung? Hmm

Deckards System Scanner (DSS)

Hier gibt es das Tool -> dss.exe

* Schließe alle Anwendungen
* Doppelklicke dss.exe um das Programm zu starten
* Wenn der Scan abgeschlossen ist wird sich ein Notepad mit dem Inhalt
der main.txt öffnen.
Ein weiteres Logfile, die extra.txt liegt im Verzeichnis
c:\Deckard\SystemScanner\extra.txt
* Kopiere den Inhalt der beiden Logfiles in diesen Thread, bitte als [CODE][/CODE]

Was Deckards System Scanner macht:

* Es Erstellt einen System Wiederherstellungspunkt
* es säubert die temporären Dateien, Downloaded Program Files, Internet
Cache Dateien und es leert den Mülleimer auf allen Laufwerken.

Polytron · 29.02.2008, 17:02

Hier das von main.exe

Code:

ATTFilter

Deckard's System Scanner v20071014.68
Run by Ruedi Hartmann on 2008-02-29 16:48:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
101: 2008-02-29 15:48:49 UTC - RP101 - Deckard's System Scanner Restore Point
100: 2008-02-28 20:26:03 UTC - RP100 - vor dem löschen der dll
99: 2008-02-28 18:47:10 UTC - RP99 - Systemprüfpunkt
98: 2008-02-27 16:36:35 UTC - RP98 - Systemprüfpunkt
97: 2008-02-26 13:44:25 UTC - RP97 - Systemprüfpunkt


-- First Restore Point -- 
1: 2008-01-05 18:27:04 UTC - RP1 - Systemprüfpunkt


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Ruedi Hartmann.exe) --------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:51:22, on 29.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\Avira Premium Security Suite\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Avira\Avira Premium Security Suite\avesvc.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Avira\Avira Premium Security Suite\avmailc.exe
C:\Programme\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\ScanSoft\PaperPort\pptd40nt.exe
C:\Programme\Brother\ControlCenter2\brctrcen.exe
C:\Programme\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\Netropa\Onscreen Display\OSD.exe
C:\Programme\Logitech\Video\LogiTray.exe
C:\Programme\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MESSEN~1\msmsgs.exe
C:\Programme\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Windows Desktop Search\WindowsSearch.exe
C:\Programme\Logitech\Video\FxSvr2.exe
C:\Programme\Gemeinsame Dateien\Logitech\KhalShared\KHALMNPR.EXE
C:\Programme\PC Connectivity Solution\ServiceLayer.exe
C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Programme\Avira\Avira Premium Security Suite\avscan.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE
C:\Dokumente und Einstellungen\Ruedi Hartmann\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GR35A7JF\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Ruedi Hartmann.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programme\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Programme\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Programme\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl04g\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programme\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Windows-Desktopsuche.lnk = C:\Programme\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICFF8~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1201022675281
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Programme\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Programme\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Avira Premium Security Suite MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Programme\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programme\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9248 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 Jot84 - c:\windows\system32\drivers\jot84.sys
R1 avfwot - c:\windows\system32\drivers\avfwot.sys <Not Verified; Avira GmbH; Firewall TDI filter>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirFirewallService (Avira Premium Security Suite Firewall) - "c:\programme\avira\avira premium security suite\avfwsvc.exe" <Not Verified; Avira GmbH; Firewall NT service>
R2 AntiVirMailService (Avira Premium Security Suite MailGuard) - "c:\programme\avira\avira premium security suite\avmailc.exe" <Not Verified; Avira GmbH; AntiVir Mail Guard>
R2 AntiVirScheduler (Avira Premium Security Suite Planer) - "c:\programme\avira\avira premium security suite\sched.exe" <Not Verified; Avira GmbH; Scheduler>
R2 antivirwebservice (Avira Premium Security Suite WebGuard) - "c:\programme\avira\avira premium security suite\avwebgrd.exe" <Not Verified; Avira GmbH; >
R2 AVEService (Avira Premium Security Suite MailGuard Hilfsdienst) - "c:\programme\avira\avira premium security suite\avesvc.exe" <Not Verified; Avira GmbH; AVE Service>
R2 nhksrv (Netropa NHK Server) - c:\programme\netropa\multimedia keyboard\nhksrv.exe
R3 ServiceLayer - "c:\programme\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Ethernet-Controller
Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_E0001458&REV_13\4&1F7DBC9F&0&48F0
Manufacturer: 
Name: Ethernet-Controller
PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_E0001458&REV_13\4&1F7DBC9F&0&48F0
Service: 


-- Scheduled Tasks -------------------------------------------------------------

2008-02-29 14:51:24       440 --a------ C:\WINDOWS\Tasks\RegCure Program Check.job
2008-02-28 22:25:05       374 --a------ C:\WINDOWS\Tasks\RegCure.job


-- Files created between 2008-01-29 and 2008-02-29 -----------------------------

2008-02-29 16:51:14         0 d-------- C:\Programme\Trend Micro
2008-02-28 22:25:40         0 dr-h----- C:\Dokumente und Einstellungen\Ruedi Hartmann\Recent
2008-02-28 22:24:58         0 d-------- C:\Programme\RegCure
2008-02-21 20:15:57     63488 --a------ C:\WINDOWS\system32\drivers\avfwot.sys <Not Verified; Avira GmbH; Firewall TDI filter>
2008-02-21 20:15:52         0 d-------- C:\Programme\Avira
2008-02-21 20:05:38         0 d-------- C:\WINDOWS\system32\appmgmt
2008-02-17 17:37:54         0 d-------- C:\Programme\Gemeinsame Dateien\Adobe
2008-02-17 15:03:47     11776 --a------ C:\WINDOWS\system32\WLCtrl32.dll
2008-02-17 15:03:47     26240 --a------ C:\WINDOWS\system32\drivers\Jot84.sys
2008-02-10 19:23:40         0 d-------- C:\Programme\DIFX
2008-02-10 19:23:19         0 d-------- C:\Programme\Gemeinsame Dateien\PCSuite
2008-02-10 19:23:19         0 d-------- C:\Programme\Gemeinsame Dateien\Nokia
2008-02-10 19:23:04         0 d-------- C:\Programme\PC Connectivity Solution
2008-02-10 19:22:57         0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-02-10 19:22:50         0 d-------- C:\Programme\Nokia


-- Find3M Report ---------------------------------------------------------------

2008-02-21 21:36:51         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Premium Security Suite
2008-02-19 19:30:26         0 d-------- C:\Programme\Ad-Aware SE Personal
2008-02-17 17:37:54         0 d-------- C:\Programme\Gemeinsame Dateien
2008-02-10 19:34:25         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Nokia Multimedia Player
2008-02-10 19:33:13         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Nokia
2008-02-10 19:24:48         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\PC Suite
2008-01-28 19:06:14         0 --a------ C:\WINDOWS\system32\Biport
2008-01-28 19:04:59         0 d-------- C:\Programme\FreePDF_XP
2008-01-22 18:51:33         0 d-------- C:\Programme\Microsoft Works
2008-01-22 18:49:41         0 d-------- C:\Programme\Microsoft CAPICOM 2.1.0.2
2008-01-21 18:38:03     98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-01-21 18:22:28         0 d--h----- C:\Programme\InstallShield Installation Information
2008-01-21 18:22:10         0 d-------- C:\Programme\Spiele
2008-01-20 23:01:58         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Media Player Classic
2008-01-17 19:40:58         0 d-------- C:\Programme\Java
2008-01-16 22:08:12         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Sun
2008-01-16 22:06:34         0 d-------- C:\Programme\Gemeinsame Dateien\Java
2008-01-15 22:15:31         0 d-------- C:\Programme\eMule
2008-01-15 22:15:16         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\eMule
2008-01-15 18:46:06         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Google
2008-01-09 21:26:23         0 dr------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Brother
2008-01-09 18:39:51         0 d-------- C:\Programme\Indeo
2008-01-09 18:37:35         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\FotoWire
2008-01-09 18:37:34         0 d-------- C:\Programme\Logitech
2008-01-09 18:37:34         0 d-------- C:\Programme\Gemeinsame Dateien\FotoWire
2008-01-09 18:36:28         0 d-------- C:\Programme\Gemeinsame Dateien\Logitech
2008-01-08 22:31:57         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Lavasoft
2008-01-07 23:10:26         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Ahead
2008-01-06 00:07:21         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Adobe
2008-01-05 23:59:34         0 d-------- C:\Programme\No23 Recorder
2008-01-05 23:59:23         0 d-------- C:\Programme\Codec Pack - All In 1
2008-01-05 23:58:52    737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2008-01-05 23:58:46  10050902 --a------ C:\WINDOWS\system32\mi2.exe <Not Verified; http://www.codecpack.com; CodecPack>
2008-01-05 23:57:42         0 d-------- C:\Programme\DivX
2008-01-05 23:53:46         0 d-------- C:\Programme\Plan-IQ
2008-01-05 23:53:11         0 d-------- C:\Programme\Borland
2008-01-05 23:50:56         0 d-------- C:\Programme\Free PDF
2008-01-05 23:49:53         0 d-------- C:\Programme\Passware
2008-01-05 23:48:40         0 d-------- C:\Programme\Google
2008-01-05 23:48:39         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Macromedia
2008-01-05 23:47:48         0 d-------- C:\Programme\Super DVD Ripper
2008-01-05 23:38:32        65 --a------ C:\WINDOWS\system32\BD7420.dat
2008-01-05 23:38:22         0 d-------- C:\Programme\Brother
2008-01-05 23:38:16         0 d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2008-01-05 23:38:16         0 d-------- C:\Programme\Common Files
2008-01-05 23:28:26         0 d-------- C:\Programme\Gemeinsame Dateien\ScanSoft Shared
2008-01-05 23:28:19         0 d-------- C:\Programme\ScanSoft
2008-01-05 23:18:14         0 d-------- C:\Programme\Microsoft.NET
2008-01-05 23:18:04         0 d-------- C:\Programme\Microsoft Office 03
2008-01-05 23:05:10         0 d-------- C:\Programme\MSBuild
2008-01-05 22:45:35    344906 --a------ C:\WINDOWS\system32\perfh007.dat
2008-01-05 22:45:35     58980 --a------ C:\WINDOWS\system32\perfc007.dat
2008-01-05 21:21:28         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Windows Desktop Search
2008-01-05 21:21:06         0 d-------- C:\Programme\Windows Desktop Search
2008-01-05 21:01:29         0 d-------- C:\Programme\Netropa
2008-01-05 20:52:16         0 d-------- C:\Programme\Ahead
2008-01-05 20:32:13         0 d-------- C:\Programme\Gemeinsame Dateien\Ahead
2008-01-05 20:15:50         0 d-------- C:\Programme\Messenger
2008-01-05 20:09:48         0 d-------- C:\Programme\Yahoo!
2008-01-05 19:47:44         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Logitech
2008-01-05 19:44:34         0 d-------- C:\Programme\XP RegTune
2008-01-05 19:33:19         0 d-------- C:\Programme\Realtek Sound Manager
2008-01-05 19:33:19         0 d-------- C:\Programme\AvRack
2008-01-05 19:32:36         0 d-------- C:\Programme\Gigabyte
2008-01-05 19:30:53         0 d-------- C:\Programme\Intel
2008-01-05 19:26:52         0 d-------- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\Identities
2008-01-05 19:22:10         0 d-------- C:\Programme\microsoft frontpage
2008-01-05 19:21:44         0 -rahs---- C:\MSDOS.SYS
2008-01-05 19:21:44         0 -rahs---- C:\IO.SYS
2008-01-05 19:21:44         0 --a------ C:\CONFIG.SYS
2008-01-05 19:21:44         0 --a------ C:\AUTOEXEC.BAT
2008-01-05 19:20:06         0 d--h----- C:\Programme\WindowsUpdate
2008-01-05 19:20:02         0 d-------- C:\Programme\Online-Dienste
2008-01-05 19:18:52         0 d-------- C:\Programme\Gemeinsame Dateien\Dienste
2008-01-05 19:18:46         0 d-------- C:\Programme\Gemeinsame Dateien\MSSoap
2008-01-05 19:18:30         0 d-------- C:\Programme\Movie Maker
2008-01-05 19:17:25     21740 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-01-05 19:16:56         0 d-------- C:\Programme\Online Services
2008-01-05 19:16:45         0 d-------- C:\Programme\MSN Gaming Zone
2008-01-05 19:16:34         0 d-------- C:\Programme\Windows NT
2008-01-05 19:08:03         0 d-------- C:\Programme\Gemeinsame Dateien\ODBC
2008-01-05 19:07:59         0 d-------- C:\Programme\Gemeinsame Dateien\SpeechEngines
2008-01-05 19:07:19        62 --ahs---- C:\Dokumente und Einstellungen\Ruedi Hartmann\Anwendungsdaten\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [14.05.2004 08:47 C:\WINDOWS\SOUNDMAN.EXE]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09.07.2001 10:50]
"InCD"="C:\Programme\Ahead\InCD\InCD.exe" [16.07.2004 13:50]
"MULTIMEDIA KEYBOARD"="C:\Programme\Netropa\Multimedia Keyboard\MMKeybd.exe" [19.06.2002 10:50]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [22.10.2006 12:22]
"nwiz"="nwiz.exe" [22.10.2006 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [22.10.2006 12:22]
"GrooveMonitor"="C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" [24.08.2007 07:00]
"SSBkgdUpdate"="C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [14.10.2003 10:22]
"PaperPort PTD"="C:\Programme\ScanSoft\PaperPort\pptd40nt.exe" [09.03.2004 15:54]
"IndexSearch"="C:\Programme\ScanSoft\PaperPort\IndexSearch.exe" [09.03.2004 16:15]
"SetDefPrt"="C:\Programme\Brother\Brmfl04g\BrStDvPt.exe" [11.11.2004 17:14]
"ControlCenter2.0"="C:\Programme\Brother\ControlCenter2\brctrcen.exe" [11.11.2004 22:00]
"FreePDF Assistant"="C:\Programme\FreePDF_XP\fpassist.exe" [29.12.2003 16:30]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [28.03.2006 17:38 C:\WINDOWS\KHALMNPR.Exe]
"@"="" []
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [08.10.2004 11:52]
"LogitechVideoRepair"="C:\Programme\Logitech\Video\ISStart.exe" [08.10.2004 12:31]
"LogitechVideoTray"="C:\Programme\Logitech\Video\LogiTray.exe" [08.10.2004 12:24]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_03\bin\jusched.exe" [25.09.2007 01:11]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11.01.2008 22:16]
"avgnt"="C:\Programme\Avira\Avira Premium Security Suite\avgnt.exe" [21.02.2008 20:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [28.02.2006 13:00]
"LogitechSoftwareUpdate"="C:\Programme\Logitech\Video\ManifestEngine.exe" [08.10.2004 12:06]
"MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [13.10.2004 17:24]
"PC Suite Tray"="C:\Programme\Nokia\Nokia PC Suite 6\PCSuite.exe" [10.12.2007 10:12]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"="C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [09.01.2008 18:36:03]
Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe [05.01.2008 19:45:29]
Windows-Desktopsuche.lnk - C:\Programme\Windows Desktop Search\WindowsSearch.exe [19.10.2006 14:55:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=0 (0x0)
"ClearRecentDocsOnExit"=0 (0x0)
"NoRecentDocsMenu"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll [19.10.2006 14:53 293888]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe,C:\WINDOWS\system32\ntos.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WLCtrl32] 
WLCtrl32.dll 29.02.2008 14:51 11776 C:\WINDOWS\system32\WLCtrl32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Jot84.sys]
@="Driver"




-- End of Deckard's System Scanner: finished at 2008-02-29 16:52:00 ------------

TR/Agent.lnb (2) (luc-pascal vom 22.02.2008)

Plagegeister aller Art und deren Bekämpfung: TR/Agent.lnb (2) (luc-pascal vom 22.02.2008)