TR/Crypt.XPACK.GEN gefunden und nun öffnen sich Werbe-Fenster!

wieso_ich · 28.05.2008, 00:30

Hallo Hilfe!

ich wurde von einem Freund um Hilfe gebeten und reiche dieses Gesuch nun weiter:

Antivir findet von selbst 2 Dateien mit "TR/Crypt.XPACK.GEN" im "temp" Ordner eines Benutzers; nach Quarantäne, daraus löschen und Neustart sind die 2 ".dll"s wieder da.

Nach Neustart im abges. Modus findet Antivir nichts.

Der I-Explorer bringt ständig Fenster mit Warnungen und gutgemeinten Hinweisen über Virenbefall und es werden angbl. hilfreiche Programme angeboten
Auch Firefox wirbt schon beim Starten für "Que**e.ch".

Ich poste mal seine HijackLogFile und bitte um Einschätzungen der Gefahr und Lösungsmöglichkeiten.

Sollte er Onlinebanking lieber lassen und die gespeicherten Outlook-Passwörter löschen bzw. ändern??

__________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:38:34, on 28.05.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\ltmoh\Ltmoh.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\LManager.EXE
C:\PROGRA~1\BLUEWIN\QUICKH~1\SMARTB~1\MotiveSB.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
C:\Programme\QuickHelp2\QuickHelp.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programme\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Bluewin\Netopia_Router\Wizard\Agent_WiFi.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Exif Launcher\QuickDCF.exe
C:\Programme\C-CHANNEL\MyPen Pro\MyPenPro.exe
C:\Programme\Bluewin\Quick Help\bin\mpbtn.exe
C:\Programme\AntiVir PersonalEdition Classic\avscan.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/index_d.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Programme\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BLUEWIN\QUICKH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Brother MFL Pro Remote Setup] C:\WINDOWS\TWAIN_32\BRMFLPRO\brmfrms.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickHelp2_McciTrayApp] C:\Programme\QuickHelp2\QuickHelp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [320d18a1] rundll32.exe "C:\WINDOWS\system32\mkltltjx.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Programme\Bluewin\Netopia_Router\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Exif Launcher.lnk = C:\Programme\Exif Launcher\QuickDCF.exe
O4 - Global Startup: Quick Help.lnk = C:\Programme\Bluewin\Quick Help\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MyPen Pro.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe

--
End of file - 7367 bytes
__________________________________________________________

Mit Hoffnung
grüßt Jan

myrtille · 28.05.2008, 00:53

Hi,
erstelle bitte ein log mit Malwarebytes und eins mit DSS

Lade dir DSS
Schließe alle Anwendungen und führe DSS.exe dann mit einem Doppelklick aus
Führe während DSS arbeitet bitte keine anderen Aktionen durch
Am Ende öffnen sich 2 Datein main.txt und extra.txt
Poste den Inhalt beider Dateien hier

lg myrtille

schniepl · 28.05.2008, 16:17

he hab den selben mist auf dem pc!

hier mal die log file von malware

Zitat:

Malwarebytes' Anti-Malware 1.12
Datenbank Version: 793

Scan Art: Komplett Scan (C:\|)
Objekte gescannt: 81612
Scan Dauer: 21 minute(s), 51 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 2
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 1
Infizierte Datei Objekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 15

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
C:\WINDOWS\system32\urqoPfEW.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\rqRIyyxu.dll (Trojan.Vundo) -> Unloaded module successfully.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0f3a776c-43d0-4b28-8253-9bc036d1d8a3} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{0f3a776c-43d0-4b28-8253-9bc036d1d8a3} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{54018e98-10e3-46c6-9673-2999253f9c65} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54018e98-10e3-46c6-9673-2999253f9c65} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqriyyxu (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{54018e98-10e3-46c6-9673-2999253f9c65} (Trojan.Vundo) -> Delete on reboot.

Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\urqopfew -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\urqopfew -> Delete on reboot.

Infizierte Verzeichnisse:
(Keine Malware Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\rjeseaal.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\laaesejr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rubkfxvv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vvxfkbur.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sujaevyu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uyveajus.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqOFvWm.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mWvFOqru.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mWvFOqru.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\urqoPfEW.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\WEfPoqru.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WEfPoqru.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRIyyxu.dll (Trojan.Vundo) -> Delete on reboot.
C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temporary Internet Files\Content.IE5\I8VOCZ6B\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\geBqOeFY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

extra.txt

Zitat:

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 3.0
Architecture: X86; Language: German

CPU 0: AMD Athlon(tm) XP 3200+
Percentage of Memory in Use: 46%
Physical Memory (total/avail): 1023.49 MiB / 546.32 MiB
Pagefile Memory (total/avail): 2461.63 MiB / 2057.71 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1876.14 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 32.39 GiB total, 5.72 GiB free.
E: is Fixed (NTFS) - 4.88 GiB total, 4.85 GiB free.
F: is CDROM (No Media)
G: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST340823A - 37.27 GiB - 2 partitions
\PARTITION0 (bootable) - Installierbares Dateisystem - 32.39 GiB - C:
\PARTITION1 - Erweitert mit Int 13 (erweitert) - 4.88 GiB - E:

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Dokumente und Einstellungen\All Users
APPDATA=C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten
CLASSPATH=.;C:\Programme\Java\jre1.6.0_05\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Programme\Gemeinsame Dateien
COMPUTERNAME=TOBIAS-7808F8E1
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Dokumente und Einstellungen\Tobias
LOGONSERVER=\\TOBIAS-7808F8E1
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Programme\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Programme\ATI Technologies\ATI.ACE\Core-Static;C:\Programme\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0a00
ProgramFiles=C:\Programme
PROMPT=$P$G
QTJAVA=C:\Programme\Java\jre1.6.0_05\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOKUME~1\Tobias\LOKALE~1\Temp
TMP=C:\DOKUME~1\Tobias\LOKALE~1\Temp
USERDOMAIN=TOBIAS-7808F8E1
USERNAME=Tobias
USERPROFILE=C:\Dokumente und Einstellungen\Tobias
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

Tobias (admin)

-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
802.11g USB 2.0 WLAN Adapter --> C:\Programme\Gemeinsame Dateien\InstallShield\Driver\8\Intel 32\IDriver.exe /M{522014A5-9611-46E6-B04D-AB7891CFDA7F} /l1031
Absolute Startup manager --> "C:\Programme\F-Group\Absolute StartUp\Uninstall.exe" "C:\Programme\F-Group\Absolute StartUp\install.log" -u
Ad-Aware 2007 --> MsiExec.exe /X{0E6AB9FC-76C2-431B-9C06-6C1CFFFEA8EB}
Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings --> MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings --> MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings --> MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3 --> MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3 --> C:\Programme\Gemeinsame Dateien\Adobe\Installers\5f143314a5d434c8511097393d17397\Setup.exe
Adobe Photoshop CS3 --> MsiExec.exe /I{29F05234-DCBB-4FE0-88DC-5160C9250312}
Adobe Setup --> MsiExec.exe /I{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}
Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3 --> MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
ATI - Software Uninstall Utility --> C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center --> RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x5c32
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class

ISPLAY -clean
µTorrent --> "C:\Programme\uTorrent\uTorrent.exe" /UNINSTALL
Avira AntiVir Personal – Free Antivirus --> C:\Programme\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Call of Duty(R) 4 - Modern Warfare(TM) --> C:\Programme\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
CDBurnerXP --> "C:\Programme\CDBurnerXP\unins000.exe"
Condemned - Criminal Origins --> RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BB47D7EA-7EF1-475C-9C14-AF5B8FCA45E2}\setup.exe" -l0x7 -removeonly
Counter-Strike --> "C:\Programme\Steam\steam.exe" steam://uninstall/10
Counter-Strike: Source --> "C:\Programme\Steam\steam.exe" steam://uninstall/240
Half-Life --> "C:\Programme\Steam\steam.exe" steam://uninstall/70
ICQ Toolbar --> regsvr32 /u /s "C:\PROGRA~1\ICQTOO~1\toolbaru.dll"
ICQ6 --> "C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
LimeWire PRO 4.17.1 --> "C:\Programme\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware --> "C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (2.0.0.14) --> C:\Programme\Mozilla Firefox\uninstall\helper.exe
Norton PartitionMagic 8.0 --> C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{21DBBDD6-93A5-4326-9A04-C9A5C9148502}
NVIDIA nForce Drivers --> C:\WINDOWS\system32\NVUninst.exe Uninstall C:\WINDOWS\system32\NVU002.nvu,NVIDIA nForce Drivers
PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PokerStars --> "C:\Programme\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Sicherheitsupdate für Windows XP (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Sicherheitsupdate für Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Spybot - Search & Destroy --> "C:\Programme\Spybot - Search & Destroy\unins000.exe"
Steam --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Systweak® AntiSpyware 2008 1.0 --> "C:\Programme\Systweak AntiSpyware\unins000.exe"
TeamSpeak 2 RC2 --> C:\Programme\Teamspeak2_RC2\unins000.exe
VideoLAN VLC media player 0.8.6f --> C:\Programme\VideoLAN\VLC\uninstall.exe
Winamp --> "C:\Programme\Winamp\UninstWA.exe"
Winamp Toolbar for Firefox --> "C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Mozilla\Firefox\Profiles\57adxe57.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\uninstall.exe"
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
WinRAR --> C:\Programme\WinRAR\uninstall.exe

-- Application Event Log -------------------------------------------------------

Event Record #/Type440 / Warning
Event Submitted/Written: 05/28/2008 09:51:06 AM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Crypt.XPACK.GenC:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0MQI351Z\kb516107[1]

Event Record #/Type439 / Warning
Event Submitted/Written: 05/28/2008 09:51:05 AM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Crypt.XPACK.GenC:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temp\srmwbkeu.dll

Event Record #/Type429 / Warning
Event Submitted/Written: 05/27/2008 00:39:32 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Crypt.XPACK.GenC:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temporary Internet Files\Content.IE5\K7IXKTVW\kb767887[1]

Event Record #/Type428 / Warning
Event Submitted/Written: 05/27/2008 00:39:32 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Crypt.XPACK.GenC:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temp\qnfokhgg.dll

Event Record #/Type427 / Warning
Event Submitted/Written: 05/27/2008 00:38:05 PM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/Crypt.XPACK.GenC:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temporary Internet Files\Content.IE5\I8VOCZ6B\kb516107[1]

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type885 / Error
Event Submitted/Written: 05/28/2008 04:20:27 PM / 05/28/2008 04:20:53 PM
Event ID/Source: 12294 / ati2mtag
Event Description:
CRT invalid display type

Event Record #/Type875 / Warning
Event Submitted/Written: 05/28/2008 01:07:30 PM
Event ID/Source: 1073 / USER32
Event Description:
Der Versuch, Ausschalten auf TOBIAS-7808F8E1 durchzuführen ist fehlgeschlagen.

Event Record #/Type826 / Error
Event Submitted/Written: 05/28/2008 10:19:14 AM
Event ID/Source: 10010 / DCOM
Event Description:
Der Server "{520CCA63-51A5-11D3-9144-00104BA11C5E}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Event Record #/Type814 / Warning
Event Submitted/Written: 05/28/2008 09:47:42 AM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP hat das Sicherheitslimit erreicht, das für die Anzahl gleichzeitiger TCP-Verbindungsversuche festgelegt wurde.

Event Record #/Type789 / Error
Event Submitted/Written: 05/28/2008 09:44:24 AM / 05/28/2008 09:44:49 AM
Event ID/Source: 12294 / ati2mtag
Event Description:
CRT invalid display type

-- End of Deckard's System Scanner: finished at 2008-05-28 16:57:07 ------------

hoff ihr könnt mir helfen

schniepl · 28.05.2008, 16:19

und hier noch die main.txt da sonst der post zu läng wäre!
[QUOTE]main.txt

Zitat:

Deckard's System Scanner v20071014.68
Run by Tobias on 2008-05-28 16:51:52
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
6: 2008-05-28 14:51:59 UTC - RP37 - Deckard's System Scanner Restore Point
5: 2008-05-27 16:19:02 UTC - RP36 - Systemprüfpunkt
4: 2008-05-26 14:59:42 UTC - RP35 - Last known good configuration
3: 2008-05-26 14:59:36 UTC - RP34 - Systemprüfpunkt
2: 2008-05-26 14:59:36 UTC - RP33 - Systemprüfpunkt

-- First Restore Point --
1: 2008-05-26 14:59:36 UTC - RP32 - Systemprüfpunkt

Backed up registry hives.
Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-05-28 16:53:39

[edit]
Bitte editiere zukünftig deine Links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

Danke.
Sunny
[/edit]

--
End of file - 6269 bytes

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
R1 ssmdrv - c:\windows\system32\drivers\ssmdrv.sys <Not Verified; AVIRA GmbH; >
R3 ZD1211BU(WLAN) (802.11g USB 2.0 Wireless LAN Driver (USB)(WLAN)) - c:\windows\system32\drivers\zd1211bu.sys <Not Verified; ZyDAS Technology Corporation; ZD1211B 802.11 b+g USB LAN Adapter>
R3 ZDPSp50 (ZDPSp50 NDIS Protocol Driver) - c:\windows\system32\drivers\zdpsp50.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>

S3 SASPROT (Systweak AntiSpyware 2008) - c:\programme\systweak antispyware\sasprot.sys

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aawservice (Ad-Aware 2007 Service) - "c:\programme\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>
R2 AntiVirScheduler (Avira AntiVir Personal – Free Antivirus Planer) - "c:\programme\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>
R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - c:\programme\bonjour\mdnsresponder.exe <Not Verified; Apple Computer, Inc.; Bonjour>

S3 FLEXnet Licensing Service - "c:\programme\gemeinsame dateien\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Ethernet-Controller
Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\4&3B1D9AB8&0&2040
Manufacturer:
Name: Ethernet-Controller
PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\4&3B1D9AB8&0&2040
Service:

-- Scheduled Tasks -------------------------------------------------------------

2008-05-28 12:26:18 396 --a------ C:\WINDOWS\Tasks\Systweak AntiSpyware 2008 Update Checker.job
2008-05-26 17:48:04 276 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-05-23 14:40:37 370 --a------ C:\WINDOWS\Tasks\Systweak AntiSpyware 2008.job

-- Files created between 2008-04-28 and 2008-05-28 -----------------------------

2008-05-28 16:24:47 0 d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-05-28 09:56:22 2560 --a------ C:\WINDOWS\system32\bwvtctfn.exe
2008-05-28 09:55:09 133632 --a------ C:\WINDOWS\system32\ogpycquv.dll
2008-05-28 09:50:13 339486 --ahs---- C:\WINDOWS\system32\WEfPoqru.ini2
2008-05-28 09:50:03 370688 -----n--- C:\WINDOWS\system32\urqoPfEW.dll
2008-05-27 12:45:38 2560 --a------ C:\WINDOWS\system32\blorqbwo.exe
2008-05-26 22:08:19 0 d-------- C:\DVDVideoSoft
2008-05-26 16:55:43 0 d-------- C:\Programme\LimeWire
2008-05-26 16:54:04 57856 -----n--- C:\WINDOWS\system32\rqRIyyxu.dll
2008-05-23 14:40:10 11264 --a------ C:\WINDOWS\system32\AntiSpyNative32.exe
2008-05-23 14:27:38 0 d-------- C:\Programme\Systweak AntiSpyware
2008-05-23 13:50:21 0 d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-05-22 17:33:37 0 d-------- C:\Programme\Lavasoft
2008-05-22 15:05:56 1777 --a------ C:\WINDOWS\system32\sdbackup.reg
2008-05-21 16:42:13 0 d-------- C:\Programme\Teamspeak2_RC2
2008-05-21 14:35:00 0 d-------- C:\Programme\QuickTime
2008-05-21 14:34:16 0 d-------- C:\Programme\Apple Software Update
2008-05-20 15:54:56 0 d--hs---- C:\WINDOWS\ftpcache
2008-05-20 15:53:47 0 d-------- C:\Programme\DAEMON Tools Lite
2008-05-20 15:51:29 717296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-19 23:23:19 0 d-------- C:\Programme\CDBurnerXP
2008-05-19 12:17:49 140800 --a------ C:\WINDOWS\system32\sqliteodbc.dll <Not Verified; Christian Werner Software & Consulting; ODBC Driver for SQLite 2.8.15>
2008-05-19 12:17:33 20992 --a------ C:\WINDOWS\system32\vbalIPrg.dll <Not Verified; vbAccelerator; vbAccelerator Multi-Threading In-Progress Control>
2008-05-19 12:17:33 29696 --a------ C:\WINDOWS\system32\VB6DE.dll <Not Verified; Microsoft Corporation; Visual Basic Environment>
2008-05-19 12:17:33 53248 --a------ C:\WINDOWS\system32\SSubTmr6.dll <Not Verified; vbAccelerator; SSubTmr6>
2008-05-19 12:17:33 294912 --a------ C:\WINDOWS\system32\mbr_sqlite.dll
2008-05-19 12:17:33 180224 --a------ C:\WINDOWS\system32\ijl11.dll <Not Verified; Intel Corporation; Intel® JPEG Library>
2008-05-19 12:17:33 94208 --a------ C:\WINDOWS\system32\CMDLGD6.dll <Not Verified; vbAccelerator; vbAccelerator VB6 Common Dialog/Direct DLL>
2008-05-19 12:12:07 0 d-------- C:\Programme\F-Group
2008-05-19 11:35:33 0 d-------- C:\Programme\Bonjour
2008-05-19 11:14:59 0 d-------- C:\Programme\Gemeinsame Dateien\Macrovision Shared
2008-05-19 11:10:38 0 d-------- C:\Programme\Gemeinsame Dateien\Adobe
2008-05-18 18:59:18 0 d-------- C:\WINDOWS\Sun
2008-05-18 18:51:00 0 d-------- C:\Programme\Java
2008-05-18 18:48:27 0 d-------- C:\Programme\Gemeinsame Dateien\Java
2008-05-18 18:40:57 0 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-05-18 18:33:26 0 d-------- C:\WINDOWS\OvtCam
2008-05-18 16:26:27 6820 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-18 16:11:44 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-05-18 16:08:30 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
2008-05-18 16:07:27 0 d-------- C:\Programme\ATI Technologies
2008-05-18 16:06:01 0 d-------- C:\ATI
2008-05-18 14:57:37 0 d-------- C:\Programme\Steam
2008-05-16 19:14:20 0 d-------- C:\Programme\Winamp
2008-05-16 17:58:05 0 d-------- C:\Downloads
2008-05-16 11:57:04 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-16 11:56:42 0 d-------- C:\Programme\Mozilla Firefox 3 Beta 5
2008-05-16 11:19:03 0 d-------- C:\Programme\uTorrent
2008-05-16 02:04:06 0 d-------- C:\Programme\PokerStars
2008-05-16 01:48:54 0 d-------- C:\Programme\ICQToolbar
2008-05-16 01:46:40 0 d-------- C:\Programme\ICQ6
2008-05-16 01:27:52 0 d-------- C:\Programme\Symantec
2008-05-16 01:21:33 0 d-------- C:\Programme\VideoLAN
2008-05-16 00:51:39 0 d-------- C:\Programme\Avira
2008-05-15 21:26:27 0 d-------- C:\WINDOWS
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\WinSxS
2008-05-15 21:26:27 0 dr------- C:\WINDOWS\Web
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\twain_32
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\wins
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\wbem
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\usmt
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\spool
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\ShellExt
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\Setup
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\ras
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\oobe
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\npp
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\mui
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\inetsrv
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\IME
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\icsxml
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\ias
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\export
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\drivers
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-05-15 21:26:27 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\dhcp
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\de-de
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\de
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\config
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\3076
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\2052
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1054
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1042
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1041
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1037
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1033
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1031
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1028
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system32\1025
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\system
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\security
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Resources
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\repair
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Provisioning
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\PeerNet
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\pchealth
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Network Diagnostic
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\mui
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\msapps
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\msagent
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Media
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\L2Schemas
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\java
2008-05-15 21:26:27 0 d--h----- C:\WINDOWS\inf
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\ime
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Help
2008-05-15 21:26:27 0 dr--s---- C:\WINDOWS\Fonts
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\ehome
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Driver Cache
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Debug
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Cursors
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Connection Wizard
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\Config
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\AppPatch
2008-05-15 21:26:27 0 d-------- C:\WINDOWS\addins
2008-05-15 21:02:55 0 d-------- C:\Programme\Windows Media Connect 2
2008-05-15 21:01:42 0 d-------- C:\WINDOWS\system32\LogFiles
2008-05-15 21:01:42 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-05-15 20:37:06 0 d--h----- C:\WINDOWS\$hf_mig$
2008-05-15 20:32:58 0 d--hs---- C:\WINDOWS\Installer
2008-05-15 20:32:57 0 d-------- C:\Programme\Gemeinsame Dateien\ODBC
2008-05-15 20:32:53 0 d-------- C:\Programme\Gemeinsame Dateien\SpeechEngines
2008-05-15 20:32:52 0 dr------- C:\Programme
2008-05-15 20:32:52 0 d-------- C:\Programme\Gemeinsame Dateien
2008-05-15 20:32:09 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-05-15 20:32:09 0 d-------- C:\WINDOWS\system32\CatRoot
2008-05-15 20:31:41 0 d-------- C:\Dokumente und Einstellungen
2008-05-15 20:31:40 0 d--hs---- C:\System Volume Information
2008-05-15 20:29:16 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-05-15 20:27:12 0 d--h----- C:\Programme\InstallShield Installation Information
2008-05-15 20:27:05 0 d-------- C:\Programme\WLAN Technology Corporation
2008-05-15 20:22:29 5824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-05-15 20:21:34 94208 --a------ C:\WINDOWS\system32\NVUninst.exe <Not Verified; NVIDIA; NVIDIA>
2008-05-15 20:19:36 77824 -----n--- C:\WINDOWS\system32\nvusmb.exe <Not Verified; NVIDIA; NVIDIA>
2008-05-15 20:19:26 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-05-15 20:19:20 0 d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2008-05-15 19:50:14 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-05-15 19:50:12 0 d-------- C:\WINDOWS\Prefetch
2008-05-15 19:50:11 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-05-15 19:46:07 0 d-------- C:\WINDOWS\system32\xircom
2008-05-15 19:46:06 0 d-------- C:\Programme\microsoft frontpage
2008-05-15 19:45:32 0 -rahs---- C:\MSDOS.SYS
2008-05-15 19:45:32 0 -rahs---- C:\IO.SYS
2008-05-15 19:45:32 0 --a------ C:\CONFIG.SYS
2008-05-15 19:45:32 0 --a------ C:\AUTOEXEC.BAT
2008-05-15 19:44:00 0 dr------- C:\WINDOWS\Offline Web Pages
2008-05-15 19:44:00 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-05-15 19:43:47 0 d--h----- C:\Programme\WindowsUpdate
2008-05-15 19:43:42 0 d-------- C:\Programme\Online-Dienste
2008-05-15 19:43:24 0 d-------- C:\WINDOWS\system32\DirectX
2008-05-15 19:43:10 0 d-------- C:\Programme\Gemeinsame Dateien\Dienste
2008-05-15 19:43:07 0 d---s---- C:\WINDOWS\Tasks
2008-05-15 19:43:06 0 d-------- C:\Programme\Gemeinsame Dateien\MSSoap
2008-05-15 19:43:03 0 d-------- C:\WINDOWS\srchasst
2008-05-15 19:43:02 0 d-------- C:\WINDOWS\system32\Macromed
2008-05-15 19:42:55 0 d-------- C:\Programme\Movie Maker
2008-05-15 19:42:35 0 d-------- C:\WINDOWS\system32\Restore
2008-05-15 19:41:48 21740 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-05-15 19:41:24 0 d-------- C:\WINDOWS\Registration
2008-05-15 19:41:13 0 d-------- C:\Programme\Online Services
2008-05-15 19:41:04 0 d-------- C:\Programme\Messenger
2008-05-15 19:41:01 0 d-------- C:\Programme\MSN Gaming Zone
2008-05-15 19:40:25 0 d-------- C:\Programme\Windows NT
2008-05-15 19:40:20 0 d-------- C:\WINDOWS\system32\MsDtc
2008-05-15 19:40:18 0 d-------- C:\WINDOWS\system32\Com

-- Find3M Report ---------------------------------------------------------------

2008-05-28 16:43:31 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Winamp
2008-05-28 16:24:58 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Malwarebytes
2008-05-28 10:54:03 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\uTorrent
2008-05-28 10:41:48 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\LimeWire
2008-05-23 14:30:13 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Systweak
2008-05-21 16:42:53 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\teamspeak2
2008-05-20 15:51:16 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\DAEMON Tools
2008-05-19 23:25:48 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\CDBurnerXP_Soft
2008-05-19 11:59:36 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Adobe
2008-05-19 10:39:31 405118 --a------ C:\WINDOWS\system32\perfh007.dat
2008-05-19 10:39:31 70580 --a------ C:\WINDOWS\system32\perfc007.dat
2008-05-18 21:31:59 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\ATI
2008-05-18 18:59:18 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Sun
2008-05-18 01:17:26 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\ICQ
2008-05-16 11:57:01 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Mozilla
2008-05-16 01:51:58 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\ICQ Toolbar
2008-05-16 01:42:39 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Macromedia
2008-05-16 01:26:56 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\vlc
2008-05-16 01:26:01 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\WinRAR
2008-05-15 20:32:26 62 --ahs---- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\desktop.ini
2008-05-15 19:51:15 0 d-------- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Identities

schniepl · 28.05.2008, 16:21

hier noch der letzte rest von der main.txt!
tut mir leid dass es jetzt 2 doppelposts von mir sind! vlt wärs besser gewesen mit anhang!

Zitat:

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F3A776C-43D0-4B28-8253-9BC036D1D8A3}]
28.05.2008 16:47 370688 --------- C:\WINDOWS\system32\urqoPfEW.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54018E98-10E3-46C6-9673-2999253F9C65}]
28.05.2008 16:47 57856 --------- C:\WINDOWS\system32\rqRIyyxu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd8de9cd-70f8-4024-8c00-99536b2be1aa}]
28.05.2008 09:55 133632 --a------ C:\WINDOWS\system32\ogpycquv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EBD5EC03-376C-499F-A9F0-B75134803C1C}]
C:\WINDOWS\system32\urqOFvWm.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Absolute StartUp monitor"="C:\Programme\F-Group\Absolute StartUp\ASMon.exe" [18.09.2006 09:58]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [12.02.2008 10:06]
"Malwarebytes Anti-Malware Reboot"="C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" [05.05.2008 20:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Absolute StartUp monitor"="C:\Programme\F-Group\Absolute StartUp\ASMon.exe" [18.09.2006 09:58]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [23.04.2008 20:00]

C:\Dokumente und Einstellungen\Tobias\Startmen\Programme\Autostart\
ZDWLan Utility.lnk - C:\Programme\WLAN Technology Corporation\WLAN_802.11g_Utility\ZDWlan.exe [14.11.2005 14:58:06]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableChangePassword"=0 (0x0)
"DisableRegistryTools"=0 (0x0)
"DisableTaskMgr"=0 (0x0)
"DisableLockWorkstation"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0 (0x0)
"NoTrayContextMenu"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{54018E98-10E3-46C6-9673-2999253F9C65}"= C:\WINDOWS\system32\rqRIyyxu.dll [28.05.2008 16:47 57856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqRIyyxu]
rqRIyyxu.dll 28.05.2008 16:47 57856 C:\WINDOWS\system32\rqRIyyxu.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\urqoPfEW

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc

-- Hosts -----------------------------------------------------------------------

8520 more entries in hosts file.

-- End of Deckard's System Scanner: finished at 2008-05-28 16:57:07 ------------

TR/Crypt.XPACK.GEN gefunden und nun öffnen sich Werbe-Fenster!

Plagegeister aller Art und deren Bekämpfung: TR/Crypt.XPACK.GEN gefunden und nun öffnen sich Werbe-Fenster!