Browser injected

KarlKarl · 25.09.2008, 17:34

Kurzvariante war, dass das ein Backdoorserver ist, aber das hat ja bereits der Onlinescan ergeben. Danach habe ich die Datei ins Archiv geschoben, denn Visual Basic ist eine der unfreundlichsten Programmiersprachen, die mir zum Reversing einfallen und meine Computerzeit ist sowieso sehr begrenzt.

Aber selbst wenn ich jetzt den kompletten Sourcecode des Servers zurückgewonnen hätte, würde dir das auch nichts helfen, denn seine Hauptfunktion sieht ungefähr so aus:

Code:

ATTFilter

wiederhole
{
    Lies_Botmasterbefehl()
    führe_ihn_aus()
}

Welche Befehle der Botmaster erteilt hat kann man da nicht entnehmen und üblicherweise hinterlassen diese Leute auch keine Logs, wenn sie gut sind werden sie sogar die sowieso vom System geschriebenen Logs von eventuellen Spuren bereinigen.

Sollte er vorgehabt haben, etwas auf deinem System zu machen, was nicht direkt im Code des Servers eingebaut ist, dann lädt er einfach ein kleines Programm auf deinen Computer, startet das und lässt es das dann machen. Insofern ist es auch sinnlos jetzt zu übermitteln welche Funktionen in dem Server vorgesehen sind.

Die Statistik deutet zwar schon darauf hin, dass wesentliche Manipulationen am System eher unwahrscheinlich sind sind, die sagt aber auch, dass Atomkraftwerke keine Pannen haben, Flugzeuge nicht abstürzen, Menschen gut sind, usw. Bei den meisten Punkten muss man sich leider mit dem statistischen Erwartungswert abfinden, wenn es der eigene Computer ist, hätte ich endlich mal die Möglichkeit, mir Sicherheit verschaffen zu können.

Btw: Ich suche ab Anfang Oktober Arbeit, falls Du Lust hast einen entsprechenden Auftrag für die Analyse der Datei zu erteilen, dann lass es mich wissen.

berlinermaue · 29.09.2008, 19:47

das mit dem btw. meinst du damit gegen Bezahlung oder umsonst? gegen Bezahlung müsst ich mal sehen aber ich wäre froh wenn das mit den bugs und allem aufhört

KarlKarl · 30.09.2008, 17:51

Wenn mir mein Vermieter, alle Lebensmittelhändler, usw., einen lebenslänglichen Blankoscheck einrichten würden, dann hätte ich Zeit, sowas so zu machen. Thema hat sich aber erledigt, ich habe bereits was an der Hand.

In der Zwischenzeit habe ich noch ein Testsystem installiert und dein Programm mal darauf losgelassen. Es startet ein Programm, das dafür geeignet ist, Gamer zu ärgern indem z.B. in Teamspeak gespammt wird. Das startet im Hintergrund noch ein weiteres Programm. Das Hauptprogramm läuft bei mir zwar, zeigt aber nach außen keinerlei Aktivitäten, vermutlich weil ich kein Teamspeak installiert wird. Das Hintergrundprogramm versucht sich bei einem Freemailer anzumelden. Dummerweise mit einer Adresse, die es auf dem Server nicht gibt. Es war mir nicht möglich, die Adresse zu belegen, so dass ich nicht beobachten konnte, was es dann dort tut. Die Datei ist ein Dropper, also ein Programm, das was anderes installieren soll. "Das andere" ist anscheinend verschlüsselt in der Datei enthalten, ich gehe mal davon aus, dass der zur Entschlüsselung benötigte Key aus einer Mail gelesen werden müsste. Sehr diagonal durch den Code geschnüffelt zusammen mit den Virustotalergebnissen sieht mir das danach aus, dass das nicht der eigentliche Server ist sondern nur das Programm, das ihn installiert.

Btw: Ich habe auf dem Testsystem ebenfalls Zonealarm installiert und die hat nichts gemeldet (auch nicht den Versuch ein Mailkonto zu öffnen), man muss also davon ausgehen, dass die umgangen wird und die Poups bei dir vermutlich nur eine Ablenkung sind, die dich glauben machen soll, dass deine Firewall funktionieren täte.

Dann habe ich noch ein wenig nach der Herkunft der Datei geforscht. Erstmal starte ich Dateien von Rapidshare nur auf Systemen, bei denen ich bereit bin danach die Festplatte zu formatieren. der Dienst ist eine ausgemachte Malwareschleuder. Und nachdem ich gesehen habe, mit welchen Ankündigungen Leute dazu gebracht werden, diese Datei zu starten, denke ich mir unterdessen: Selber schuld, nicht besser verdient

Versucht andere Leute zu ärgern und dabei reingefallen.

Ich rechne nicht damit, dass eine aufwändige Detailanalyse der Datei irgendwas wichtiges finden wird, da auf deinem System wohl noch mehr vorhanden ist, was hier nicht vorliegt. Die IP, wo die Programme hinverbinden, scheint offline zu sein. Da sehe ich zwei Möglichkeiten: Einmal kannst Du das alles ignorieren, zum anderen: Der Thread ist so alt, dass Du schon genügend Zeit hattest, das System dutzende Male neu zu installieren, wobei einmal genug gewesen wäre.

berlinermaue · 30.09.2008, 18:25

naja werd wohl formatieren müssen.

Naja, hab halt nicht wirklich lust wow css und so neuzuinstallieren.

Ich hatte in letzter Zeit wohl auch keine requests mehr

Und ich wollte nicht andere ärgern sondern bei dem video dabei war ein bot, der ins ts connected und dann jemand anruft und von sich aus antwortet und dass gespräch ins ts stellt.

Ich war mal wieder so in "Euphorie" dass ich was gefunden habe, dass naja.

Dumm sind halt die bugs, er scheint auch bemerkt zu haben dass ich ihm "auf der Spur" bin, seine ip habe und so. vielleicht wurde er auch schon so abused.

berlinermaue · 08.10.2008, 14:12

Also ich selbst hab gestartet :

Windows Media Player
QIP (Wie ICQ)
Veoh TV
AVP (Kaspersky 2009)

Code:

ATTFilter

"Silent Runners.vbs", revision 58, http://www.silentrunners.org/
Operating System: Windows Vista
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"(Default)" = "(empty string)" [file not found]
"swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" ["Google Inc."]
"QIP2005" = "C:\Program Files\QIP\qip.exe" ["The Author of QIP"]
"StartXChar" = "(empty string)" [file not found]
"Veoh" = ""C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide" ["Veoh Networks"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"" ["Kaspersky Lab"]
"ZoneAlarm Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Check Point Software Technologies LTD"]
"vmware-tray" = "D:\Sascha\VMWARE\vmware-tray.exe" ["VMware, Inc."]
"iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{0A94B111-4504-4e26-AB05-E61E474AA38B}\(Default) = "Ask Search Assistant BHO"
  -> {HKLM...CLSID} = "Ask Search Assistant BHO"
                   \InProcServer32\(Default) = "C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL" ["Ask.com"]
{22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)"
  -> {HKLM...CLSID} = "Skype add-on (mastermind)"
                   \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."]
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\(Default) = "IEVkbdBHO"
  -> {HKLM...CLSID} = "IEVkbdBHO Class"
                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll" ["Kaspersky Lab"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Google Toolbar Helper"
                   \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
{F4D76F01-7896-458a-890F-E1F05C46069F}\(Default) = "Ask Toolbar BHO"
  -> {HKLM...CLSID} = "Ask Toolbar BHO"
                   \InProcServer32\(Default) = "C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL" ["Ask.com"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{9AFDE8D6-200C-4b41-A5FC-B7251DFD1A8E}" = "Safearchive ContextMenu Class"
  -> {HKLM...CLSID} = "Safearchive ContextMenu Class"
                   \InProcServer32\(Default) = "C:\Program Files\Protector Suite QL\farchns.dll" ["UPEK Inc."]
"{055EF591-5C38-49a0-9BDA-51B1D69D0BF4}" = "Safearchive ShellFolder Class"
  -> {HKLM...CLSID} = "Safearchive ShellFolder Class"
                   \InProcServer32\(Default) = "C:\Program Files\Protector Suite QL\farchns.dll" ["UPEK Inc."]
"{66C99756-1C92-4d3e-BA69-9400A6F731F5}" = "Safearchive PropertySheetHandler Class"
  -> {HKLM...CLSID} = "Safearchive PropertySheetHandler Class"
                   \InProcServer32\(Default) = "C:\Program Files\Protector Suite QL\farchns.dll" ["UPEK Inc."]
"{E6D7D89A-2232-446d-8A0F-D0F9B06DB1CA}" = "Safearchive ExtractIcon Class"
  -> {HKLM...CLSID} = "Safearchive ExtractIcon Class"
                   \InProcServer32\(Default) = "C:\Program Files\Protector Suite QL\farchns.dll" ["UPEK Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
  -> {HKLM...CLSID} = "MCLiteShellExt Class"
                   \InProcServer32\(Default) = "D:\Program Files\ICQLite\ICQLiteShell.dll" [empty string]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
  -> {HKLM...CLSID} = "Meine freigegebenen Ordner"
                   \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"
  -> {HKLM...CLSID} = "7-Zip Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
  -> {HKLM...CLSID} = "iTunes"
                   \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."]
"{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}" = "dBpoweramp Music Converter"
  -> {HKLM...CLSID} = "dMCIShell Class"
                   \InProcServer32\(Default) = "C:\Program Files\Illustrate\dBpoweramp\dMCShell.dll" ["Illustrate"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{30351348-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{30351347-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{3035134A-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{30351346-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{30351349-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" = "TortoiseSVN"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statistik für den Schutz des Web-Datenverkehrs"
  -> {HKLM...CLSID} = "Statistik für den Schutz des Web-Datenverkehrs"
                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll" ["Kaspersky Lab"]

HKLM\SOFTWA	RE\Microsoft\Windows NT\CurrentVersion\Winlogon\
<<!>> "GinaDLL" = "vrlogon.dll" ["UPEK Inc."]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{30351349-7B7D-4FCC-81B4-1E394CA267EB}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
{FED7043D-346A-414D-ACD7-550D052499A7}\(Default) = "dBpoweramp Column Handler"
  -> {HKLM...CLSID} = "dBpShell Class"
                   \InProcServer32\(Default) = "C:\Program Files\Illustrate\dBpoweramp\dBShell.dll" ["Illustrate"]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
  -> {HKLM...CLSID} = "7-Zip Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
  -> {HKLM...CLSID} = "MCLiteShellExt Class"
                   \InProcServer32\(Default) = "D:\Program Files\ICQLite\ICQLiteShell.dll" [empty string]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll" ["Kaspersky Lab"]
TortoiseSVN\(Default) = "{30351349-7B7D-4FCC-81B4-1E394CA267EB}"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
  -> {HKLM...CLSID} = "7-Zip Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"]
Convert\(Default) = "{9f95ca1a-e80e-4c0f-acd1-4c9b7900b982}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Microsoft DirectX SDK (August 2007)\Utilities\Bin\x86\TxView.DLL" [MS]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
  -> {HKLM...CLSID} = "MCLiteShellExt Class"
                   \InProcServer32\(Default) = "D:\Program Files\ICQLite\ICQLiteShell.dll" [empty string]
TortoiseSVN\(Default) = "{30351349-7B7D-4FCC-81B4-1E394CA267EB}"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ShellEx.dll" ["Kaspersky Lab"]
TortoiseSVN\(Default) = "{30351349-7B7D-4FCC-81B4-1E394CA267EB}"
  -> {HKLM...CLSID} = "TortoiseSVN"
                   \InProcServer32\(Default) = "C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll" ["www.tortoisesvn.org"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
SafearchiveContextMenu\(Default) = "{9AFDE8D6-200C-4b41-A5FC-B7251DFD1A8E}"
  -> {HKLM...CLSID} = "Safearchive ContextMenu Class"
                   \InProcServer32\(Default) = "C:\Program Files\Protector Suite QL\farchns.dll" ["UPEK Inc."]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"ConsentPromptBehaviorAdmin" = (REG_DWORD) dword:0x00000002
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode}

"ConsentPromptBehaviorUser" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Behavior Of The Elevation Prompt For Standard Users}

"EnableInstallerDetection" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Detect Application Installations And Prompt For Elevation}

"EnableLUA" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Run All Administrators In Admin Approval Mode}

"EnableSecureUIAPaths" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Only elevate UIAccess applications that are installed in secure locations}

"EnableVirtualization" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Virtualize file and registry write failures to per-user locations}

"PromptOnSecureDesktop" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Switch to the secure desktop when prompting for elevation}

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"FilterAdministratorToken" = (REG_DWORD) dword:0x00000000
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Admin Approval Mode for the Built-in Administrator Account}

"DisableCAD" = (REG_DWORD) dword:0x00000001
{unrecognized setting}

"EnableUIADesktopToggle" = (REG_DWORD) dword:0x00000000
{unrecognized setting}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\Windows\system32\config\systemprofile\Desktop\yodm3D14\desktopwallpaper0.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Users\Marc\Desktop\yodm3D14\desktopwallpaper0.bmp"


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

AlcoholAutoPlayV2.ReadDisc\
"Provider" = "Alcohol Virtual CD + DVD"
"InvokeProgID" = "AlcoholAutoPlayV2"
"InvokeVerb" = "ReadDisc"
HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\ReadDisc\command\(Default) = ""C:\Program Files\Franzis\Alcohol Virtual CD + DVD\alcohol.exe" %1" ["Alcohol Soft Development Team"]

BridgeCS3ImportMediaOnArrival\
"Provider" = "Adobe Bridge CS3"
"InvokeProgID" = "Adobe.adobebridge"
"InvokeVerb" = "launch"
HKLM\SOFTWARE\Classes\Adobe.adobebridge\shell\launch\command\(Default) = "D:\Program Files\Adobe\Adobe Bridge CS3\bridgeproxy.exe -v %1" ["Adobe Systems, Inc."]

dMCAudioCDInput\
"Provider" = "dBpoweramp CD Ripper"
"InvokeProgID" = "dMC.AudioCD.Autorun"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\dMC.AudioCD.Autorun\shell\open\command\(Default) = ""C:\Program Files\Illustrate\dBpoweramp\CDGrab.exe" %1" ["Illustrate"]

DMFMADFolder\
"Provider" = "Ulead DVD MovieFactory 5"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Program Files\Ulead Systems\DVD MovieFactory for TOSHIBA\Ulead DVD MovieFactory 5\MovieHunter.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
  -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler"
                   \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

iTunesBurnCDOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.BurnCD"
"InvokeVerb" = "burn"
HKLM\SOFTWARE\Classes\iTunes.BurnCD\shell\burn\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /AutoPlayBurn "%L"" ["Apple Inc."]

iTunesImportSongsOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.ImportSongsOnCD"
"InvokeVerb" = "import"
HKLM\SOFTWARE\Classes\iTunes.ImportSongsOnCD\shell\import\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /AutoPlayImportSongs "%L"" ["Apple Inc."]

iTunesPlaySongsOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.PlaySongsOnCD"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\iTunes.PlaySongsOnCD\shell\play\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /playCD "%L"" ["Apple Inc."]

Fortsetzung folgt

berlinermaue · 08.10.2008, 14:13

Code:

ATTFilter

iTunesShowSongsOnArrival\
"Provider" = "iTunes"
"InvokeProgID" = "iTunes.ShowSongsOnCD"
"InvokeVerb" = "showsongs"
HKLM\SOFTWARE\Classes\iTunes.ShowSongsOnCD\shell\showsongs\command\(Default) = ""C:\Program Files\iTunes\iTunes.exe" /AutoPlayShowSongs "%L"" ["Apple Inc."]

MSWMEncVCArrival\
"Provider" = "Windows Media Encoder 9-Reihe"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Program Files\Windows Media-Komponenten\Encoder\WMEnc.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
  -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler"
                   \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

MXFotomakerBrowseOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2006"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "Brws"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\Brws\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
  -> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Foto_Manager_2006\FotoMaker.exe" ["MAGIX"]

MXFotomakerBurningCDArrival\
"Provider" = "MAGIX Digital Foto Maker 2006"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "Burn"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\Burn\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
  -> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Foto_Manager_2006\FotoMaker.exe" ["MAGIX"]

MXFotomakerPlayAudioOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2006"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "PlayA"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\PlayA\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
  -> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Foto_Manager_2006\FotoMaker.exe" ["MAGIX"]

MXFotomakerPlayCDOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2006"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "PlayCD"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\PlayCD\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
  -> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Foto_Manager_2006\FotoMaker.exe" ["MAGIX"]

MXFotomakerShowPicturesOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2006"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "ShwPic"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\ShwPic\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
  -> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Foto_Manager_2006\FotoMaker.exe" ["MAGIX"]

MXMP3MakerBrowseOnArrival\
"Provider" = "MAGIX MP3 Maker 11"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "Brws"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\Brws\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
  -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Music_Manager_2006\MusicManager.exe" ["MAGIX"]

MXMP3MakerBurningCDArrival\
"Provider" = "MAGIX MP3 Maker 11"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "Burn"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\Burn\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
  -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Music_Manager_2006\MusicManager.exe" ["MAGIX"]

MXMP3MakerPlayAudioOnArrival\
"Provider" = "MAGIX MP3 Maker 11"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "PlayA"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayA\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
  -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Music_Manager_2006\MusicManager.exe" ["MAGIX"]

MXMP3MakerPlayCDOnArrival\
"Provider" = "MAGIX MP3 Maker 11"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "PlayCD"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayCD\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
  -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Music_Manager_2006\MusicManager.exe" ["MAGIX"]

MXMP3MakerPlayVideoOnArrival\
"Provider" = "MAGIX MP3 Maker 11"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "PlayV"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayV\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
  -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Music_Manager_2006\MusicManager.exe" ["MAGIX"]

MXMP3MakerShowPicturesOnArrival\
"Provider" = "MAGIX MP3 Maker 11"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "ShwPic"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\ShwPic\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
  -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\Music_Manager_2006\MusicManager.exe" ["MAGIX"]

MxMuMaMixedContentOnArrival\
"Provider" = "MAGIX Music Maker 2007"
"InvokeProgID" = "Magix.MusicMaker"
"InvokeVerb" = "Show"
HKLM\SOFTWARE\Classes\Magix.MusicMaker\shell\Show\DropTarget\CLSID = "{7F1EF3AE-1431-45F9-996A-8BC0CD826485}"
  -> {HKLM...CLSID} = "MusicMaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\MusicMaker2007\MusicMaker.exe" ["MAGIX AG"]

MxMuMaPlayCDAudioOnArrival\
"Provider" = "MAGIX Music Maker 2007"
"InvokeProgID" = "Magix.MusicMaker"
"InvokeVerb" = "Show"
HKLM\SOFTWARE\Classes\Magix.MusicMaker\shell\Show\DropTarget\CLSID = "{7F1EF3AE-1431-45F9-996A-8BC0CD826485}"
  -> {HKLM...CLSID} = "MusicMaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\MusicMaker2007\MusicMaker.exe" ["MAGIX AG"]

MxMuMaPlayMusicFilesOnArrival\
"Provider" = "MAGIX Music Maker 2007"
"InvokeProgID" = "Magix.MusicMaker"
"InvokeVerb" = "Show"
HKLM\SOFTWARE\Classes\Magix.MusicMaker\shell\Show\DropTarget\CLSID = "{7F1EF3AE-1431-45F9-996A-8BC0CD826485}"
  -> {HKLM...CLSID} = "MusicMaker Autoplay Class"
                   \LocalServer32\(Default) = "D:\MAGIX\MusicMaker2007\MusicMaker.exe" ["MAGIX AG"]
SonyDVConnectvegas8\
"Provider" = "Sony Vegas Pro 8.0"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = ""D:\Program Files\Sony\Vegas Pro 8.0\vegas80.exe""
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
  -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler"
                   \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

TosDVDPlayHandler\
"Provider" = "TOSHIBA DVD PLAYER"
"InvokeProgID" = "TosDvdPlayer"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\TosDvdPlayer\shell\play\command\(Default) = ""C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TosHDDVD.exe" %1" ["TOSHIBA Corporation"]

TosHDDVDLauncherHandler\
"Provider" = "TOSHIBA HD DVD Launcher"
"InvokeProgID" = "TosDvdLauncher"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\TosDvdLauncher\shell\open\command\(Default) = ""C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TosDVD.exe"" ["TOSHIBA Corporation"]

VLCPlayCDAudioOnArrival\
"Provider" = "VideoLAN VLC media player"
"InvokeProgID" = "VLC.CDAudio"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file cdda:%1" ["VideoLAN Team"]

VLCPlayDVDMovieOnArrival\
"Provider" = "VideoLAN VLC media player"
"InvokeProgID" = "VLC.DVDMovie"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file dvd:%1" ["VideoLAN Team"]

WIA_{51BD566E-A02D-4387-9A82-D929EA8C20B0}\
"Provider" = "MAGIX Foto Manager 2006"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = "/WiaClsid;{51BD566E-A02D-4387-9A82-D929EA8C20B0};"
  -> {HKLM...CLSID} = "WPDShextAutoplay"
                   \LocalServer32\(Default) = "C:\Windows\system32\WPDShextAutoplay.exe" [MS]

WIA_{95E53E71-3148-4534-B61E-A790CB9AF875}\
"Provider" = "ControlCenter3"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = "/WiaCmd;C:\Program Files\Brother\ControlCenter3\brctrcen.exe /StiDevice:%1 /StiEvent:%2;"
  -> {HKLM...CLSID} = "WPDShextAutoplay"
                   \LocalServer32\(Default) = "C:\Windows\system32\WPDShextAutoplay.exe" [MS]

WIA_{F62A6637-7E60-426B-B232-B42628335FCE}\
"Provider" = "Photoshop"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = "/WiaCmd;D:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe /StiDevice:%1 /StiEvent:%2;"
  -> {HKLM...CLSID} = "WPDShextAutoplay"
                   \LocalServer32\(Default) = "C:\Windows\system32\WPDShextAutoplay.exe" [MS]

WinampMTPHandler\
"Provider" = "Winamp"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Program Files\Winamp\winamp.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
  -> {HKLM...CLSID} = "Shell Execute Hardware Event Handler"
                   \LocalServer32\(Default) = "C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

WinampPlayMediaOnArrival\
"Provider" = "Winamp"
"InvokeProgID" = "Winamp.File"
"InvokeVerb" = "Play"
HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"]
HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}"
  -> {HKLM...CLSID} = (no title provided)
                   \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"]


Startup items in "Marc" & "All Users" startup folders:
------------------------------------------------------

C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
"Bux.to Autoclicker" -> shortcut to: "C:\Users\Marc\Desktop\Bux.to Autoclicker\Bux.to Autoclicker.exe -startup" [file not found]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\system32\NLAapi.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\system32\napinsp.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
000000000005\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."]
000000000006\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000007\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000008\LibraryPath = "%SystemRoot%\system32\PrxerNsp.dll" [" "]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\PrxerDrv.dll ["Initex Software"], 01, 12
%SystemRoot%\system32\mswsock.dll [MS], 02 - 11, 13 - 50


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
  -> {HKLM...CLSID} = "&Google"
                   \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
"{F4D76F09-7896-458A-890F-E1F05C46069F}"
  -> {HKLM...CLSID} = "Ask Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL" ["Ask.com"]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
  -> {HKLM...CLSID} = "&Google"
                   \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."]
"{F4D76F09-7896-458A-890F-E1F05C46069F}" = (no title provided)
  -> {HKLM...CLSID} = "Ask Toolbar"
                   \InProcServer32\(Default) = "C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL" ["Ask.com"]

Explorer Bars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\

HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statistik für den Schutz des Web-Datenverkehrs"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll" ["Kaspersky Lab"]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{9885224C-1217-4C5F-83C2-00002E6CEF2B}\
"ButtonText" = "NeoTrace It!"
"Script" = "D:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm" [null data]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07"
                   \InProcServer32\(Default) = "C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."]

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statistik für den Schutz des Web-Datenverkehrs"

{76577871-04EC-495E-A12B-91F7C3600AFA}\
"ButtonText" = "eBay - Der weltweite Online Marktplatz"
"Exec" = "http://rover.ebay.com/rover/1/707-44556-9400-3/4" [file not found]

{77BF5300-1474-4EC7-9980-D32B190E9B07}\
"ButtonText" = "Skype"
"CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}"
  -> {HKLM...CLSID} = "Skype add-on (button)"
                   \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."]

{8A918C1D-E123-4E36-B562-5C1519E434CE}\
"ButtonText" = "Amazon.de"
"Exec" = "http://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home" [file not found]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "D:\Program Files\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{C08CAF1D-C0A3-40D5-9970-06D067EAC017}\
"ButtonText" = "eBay"
"Exec" = "http://www.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?http://www.ebay.de/" [file not found]

{E59EB121-F339-4851-A3BA-FE49C35617C2}\
"ButtonText" = "ICQ6"
"MenuText" = "ICQ6"
"Exec" = "D:\Program Files\ICQ6\ICQ.exe" ["ICQ, Inc."]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{0A94B116-4504-4e26-AB05-E61E474AA38B}" = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL" ["Ask.com"]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."]
Agere Modem Call Progress Audio, AgereModemAudio, "C:\Windows\system32\agrsmsvc.exe" ["Agere Systems"]
Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple, Inc."]
Automatische WLAN-Konfiguration, Wlansvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\wlansvc.dll" [MS]}
BlackfishSQL, BlackfishSQL, ""F:\CodeGearRAD\CodeGear\RAD Studio\5.0\bin\BSQLServer.exe" -S="BlackfishSQL"" [null data]
CNG-Schlüsselisolation, KeyIso, "C:\Windows\system32\lsass.exe" [MS]
Computerbrowser, Browser, "C:\Windows\System32\svchost.exe -k netsvcs" {"C:\Windows\System32\browser.dll" [MS]}
ConfigFree Service, CFSvcs, "C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe" ["TOSHIBA CORPORATION"]
Creative Audio Service, CTAudSvcService, "C:\Program Files\Creative\Shared Files\CTAudSvc.exe" ["Creative Technology Ltd"]
CyberGhost VPN Client, CGVPNCliSrvc, "C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe" ["mobile concepts GmbH"]
Extensible Authentication-Protokoll, EapHost, "C:\Windows\System32\svchost.exe -k netsvcs" {"C:\Windows\System32\eapsvc.dll" [MS]}
Firebird Guardian - DefaultInstance, FirebirdGuardianDefaultInstance, "C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe -s DefaultInstance" ["FirebirdSQL Project"]
Firebird Server - DefaultInstance, FirebirdServerDefaultInstance, "C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe -s DefaultInstance" ["FirebirdSQL Project"]
Intel(R) Matrix Storage Event Monitor, IAANTMON, "C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe" ["Intel Corporation"]
iPod-Dienst, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."]
Kaspersky Internet Security, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r" ["Kaspersky Lab"]

berlinermaue · 12.10.2008, 11:00

Und wenn ich in den Standby gehe kommt :

DRIVER_POWER_STATUS_FAILED

mit nem Bluescreen.

Gibt es denn wirklich keinen mehr der reinkuckt außer KarlKarl?

KarlKarl · 13.10.2008, 09:07

Keine weitere Info welcher Treiber? diese Meldung gibt es bei Google genau einmal, Microsoft selber kennt sie nicht. Dort wird dann drüber gemutmaßt, dass ein Webcam-Treiber ein Problem sein könne. Generell kommt aber auch jeder andere Treiber in Frage. Genaueres würde ein Crashdump verraten, da müsste aber wohl ein Vista-Nutzer ran. Aber ob das noch Sinn macht, da habe ich meine Zweifel. Wenn ein System seine Vertrauenswürdigkeit einmal verloren hat, dann lässt die sich nicht wiederherstellen.

berlinermaue · 13.10.2008, 15:29

naja, ich habe nichts neues an Treibern reingehauen, ich glaub Formatieren ist besser, aber das Problem ist halt,

ich habe hier mehrere Applikationen die es zb nicht mehr im netz gibt, oder ich die Datei nicht mehr hab und die 1gb groß ist (mit ner 2k Leitung machts spaß)

naja ich werden wohl wenn ich zeit hab Formatieren.

berlinermaue · 31.10.2008, 08:34

Bis jetzt ist noch kein Account oä weg.

Ich vermute anhand des Ports, der Programmiersprache, und der tatsache das nichts passiert ist das es ein Bifrost ist.

Bifrost soll ja angeblich nicht mehr gehen, was heißt der trojan geht nie mehr weg.

Da aber jeder Trojaner seine eigenheiten hat müsste man doch auch ein gegenmitell finden können

Browser injected

Plagegeister aller Art und deren Bekämpfung: Browser injected