| |  Virusbefall. IE, Firefox und Thunderbird funktionieren nicht mehr ordnungsgemäß.
 Guten Tag, meine Damen und Herren,
könnte sich mal jemand meine HJT und Combofix Logfiles ansehen?
Mein Betriebssystem ist Windows XP mit SP3.
Die Maschine ist total am Spinnen. Beim IE und im Firefox öffnen sich, wenn ich Suchergebnisse in Google anklicke irgendwelche Werbeseiten in einem neuen Tab (immer andere, manchmal dubiose Handywerbungen, manchmal Urlaubsbuchungsseiten) und wenn ich den Thunderbird laufen habe kann ich keine Anwendung mehr starten. Es wird dann folgende Fehlermeldung angezeigt:
"Die Anwendung konnte nicht richtig initialisiert werden (0xc0000005). Klicken sie auf "OK", um die Anwendung zu beenden."
Und diese gleich zwei mal hinereinander.
Außerdem erscheint diese Meldung
"Die Anweisung in "0x021873cc" verweist auf Speicher in "x021873cc". Der Vorgang "read" konnte nicht auf dem Speicher durchgeführt werden. "Klicken sie auf "OK", um das Programm zu beenden."
wenn ich Thudnerbird nach Firefox öffne und den Feuerfuchs dann schließe.
Vielen Dank. Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:05:27, on 03.10.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\SyncroSoft\Pos\H2O\cledx.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\a-squared Anti-Malware\a2service.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
c:\programme\avira\antivir personaledition classic\avcenter.exe
C:\Programme\Safari\Safari.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Programme\iPod\bin\iPodService.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {AF8C97B7-52C5-4CFC-9DFC-B8E2E0240D3E} - (no file)
O2 - BHO: (no name) - {BAFDDE8F-BAB5-4076-9A99-0CB612956C71} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [H2O] C:\Programme\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1606980848-1326574676-839522115-1003\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: , dfwcvm.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Programme\a-squared Anti-Malware\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Druckwarteschlange (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
--
End of file - 6345 bytes
| Zitat:
"***" - 2008-10-03 12:05:59 Service Pack 3
ComboFix 07-05.27.BV - Running from: "C:\Dokumente und Einstellungen\***\Desktop\"
((((((((((((((((((((((((((((((( Files Created from 2008-09-03 to 2008-10-03 ))))))))))))))))))))))))))))))))))
2008-10-02 14:12 49,152 --a------ C:\WINDOWS\nircmd.exe
2008-10-02 13:44 110,592 --a------ C:\WINDOWS\system32\giawpjxb.dll
2008-10-02 13:38 1,671 --ahs---- C:\WINDOWS\system32\RAyyyccf.ini2
2008-10-02 10:25 <DIR> d-------- C:\Programme\a-squared Anti-Malware
2008-10-02 10:17 1,482 --ahs---- C:\WINDOWS\system32\npqsAcdd.ini2
2008-10-02 10:12 41,984 --a------ C:\WINDOWS\system32\pmnnNEVP.dll
2008-10-02 10:11 <DIR> d-------- C:\Programme\Lavasoft
2008-10-02 10:10 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-10-01 11:42 <DIR> d-a------ C:\DOKUME~1\ALLUSE~1\ANWEND~1\TEMP
2008-10-01 11:42 <DIR> d-------- C:\Programme\SpywareBlaster
2008-10-01 11:29 <DIR> d-------- C:\Programme\Trend Micro
2008-10-01 10:32 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\nView_Profiles
2008-09-24 20:43 <DIR> d-------- C:\Programme\Antares
2008-09-24 20:30 87,040 --a------ C:\WINDOWS\system32\ra32sipr.dll
2008-09-24 20:30 85,504 --a------ C:\WINDOWS\system32\encdnet.dll
2008-09-24 20:30 81,920 --a------ C:\WINDOWS\system32\ra3214_4.dll
2008-09-24 20:30 72,704 --a------ C:\WINDOWS\system32\ra3228_8.dll
2008-09-24 20:30 61,952 --a------ C:\WINDOWS\system32\decdnet.dll
2008-09-24 20:30 487,936 --a------ C:\WINDOWS\system32\rmbe3260.dll
2008-09-24 20:30 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2008-09-24 20:30 352,768 --a------ C:\WINDOWS\system32\pngu3263.dll
2008-09-24 20:30 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2008-09-24 20:30 21,504 --a------ C:\WINDOWS\system32\ra32dnet.dll
2008-09-24 20:30 131,072 --a------ C:\WINDOWS\system32\pneng50.dll
2008-09-24 20:30 130,560 --a------ C:\WINDOWS\system32\pnc3250.dll
2008-09-24 19:58 <DIR> d-------- C:\Programme\East West
2008-09-23 17:28 <DIR> d-------- C:\Programme\Opera
2008-09-23 17:28 <DIR> d-------- C:\DOKUME~1\***\ANWEND~1\Opera
2008-09-22 21:05 <DIR> d-------- C:\Programme\NCH Swift Sound
2008-09-22 20:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\SecTaskMan
2008-09-22 20:18 <DIR> d-------- C:\Programme\Security Task Manager
2008-09-20 21:03 <DIR> d-------- C:\WINDOWS\Prefetch
2008-09-20 19:33 <DIR> d-------- C:\WINDOWS\system32\de
2008-09-20 19:33 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-20 19:33 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-19 23:07 95,232 --------- C:\WINDOWS\system32\eappgnui.dll
2008-09-19 23:07 93,184 --------- C:\WINDOWS\system32\msxml6r.dll
2008-09-19 23:07 9,728 --------- C:\WINDOWS\system32\rwnh.dll
2008-09-19 23:07 9,216 --------- C:\WINDOWS\system32\dot3dlg.dll
2008-09-19 23:07 81,408 --------- C:\WINDOWS\system32\msshavmsg.dll
2008-09-19 23:07 76,800 --------- C:\WINDOWS\system32\qutil.dll
2008-09-19 23:07 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll
2008-09-19 23:07 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll
2008-09-19 23:07 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-09-19 23:07 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-09-19 23:07 62,976 --------- C:\WINDOWS\system32\dot3cfg.dll
2008-09-19 23:07 62,464 --------- C:\WINDOWS\system32\qcliprov.dll
2008-09-19 23:07 61,952 --------- C:\WINDOWS\system32\rasqec.dll
2008-09-19 23:07 61,440 --------- C:\WINDOWS\system32\kmsvc.dll
2008-09-19 23:07 6,144 --------- C:\WINDOWS\system32\kbdpash.dll
2008-09-19 23:07 6,144 --------- C:\WINDOWS\system32\kbdnepr.dll
2008-09-19 23:07 6,144 --------- C:\WINDOWS\system32\kbdiultn.dll
2008-09-19 23:07 6,144 --------- C:\WINDOWS\system32\kbdbhc.dll
2008-09-19 23:07 59,392 --------- C:\WINDOWS\system32\eapqec.dll
2008-09-19 23:07 56,832 --------- C:\WINDOWS\system32\dot3msm.dll
2008-09-19 23:07 53,248 --------- C:\WINDOWS\system32\tsgqec.dll
2008-09-19 23:07 50,688 --------- C:\WINDOWS\system32\tspkg.dll
2008-09-19 23:07 48,640 --------- C:\WINDOWS\system32\dhcpqec.dll
2008-09-19 23:07 412,160 --------- C:\WINDOWS\system32\photometadatahandler.dll
2008-09-19 23:07 40,960 --------- C:\WINDOWS\system32\eappprxy.dll
2008-09-19 23:07 397,312 --------- C:\WINDOWS\system32\mmcex.dll
2008-09-19 23:07 39,936 --------- C:\WINDOWS\system32\dot3gpclnt.dll
2008-09-19 23:07 39,936 --------- C:\WINDOWS\system32\dimsroam.dll
2008-09-19 23:07 37,376 --------- C:\WINDOWS\system32\l2gpstore.dll
2008-09-19 23:07 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll
2008-09-19 23:07 33,792 --------- C:\WINDOWS\system32\mmcperf.exe
2008-09-19 23:07 33,792 --------- C:\WINDOWS\system32\eapsvc.dll
2008-09-19 23:07 32,768 --------- C:\WINDOWS\system32\setupn.exe
2008-09-19 23:07 30,720 --------- C:\WINDOWS\system32\eapolqec.dll
2008-09-19 23:07 30,208 --------- C:\WINDOWS\system32\napipsec.dll
2008-09-19 23:07 294,400 --------- C:\WINDOWS\system32\qagentrt.dll
2008-09-19 23:07 290,304 --------- C:\WINDOWS\system32\rhttpaa.dll
2008-09-19 23:07 276,992 --------- C:\WINDOWS\system32\wmphoto.dll
2008-09-19 23:07 26,112 --------- C:\WINDOWS\system32\dot3api.dll
2008-09-19 23:07 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-19 23:07 198,656 --------- C:\WINDOWS\system32\napmontr.dll
2008-09-19 23:07 19,456 --------- C:\WINDOWS\system32\dimsntfy.dll
2008-09-19 23:07 184,832 --------- C:\WINDOWS\system32\eapp3hst.dll
2008-09-19 23:07 184,320 --------- C:\WINDOWS\system32\microsoft.managementconsole.dl l
2008-09-19 23:07 182,272 --------- C:\WINDOWS\system32\eapphost.dll
2008-09-19 23:07 177,664 --------- C:\WINDOWS\system32\napstat.exe
2008-09-19 23:07 155,136 --------- C:\WINDOWS\system32\mssha.dll
2008-09-19 23:07 151,040 --------- C:\WINDOWS\system32\qagent.dll
2008-09-19 23:07 145,408 --------- C:\WINDOWS\system32\onex.dll
2008-09-19 23:07 144,384 --------- C:\WINDOWS\system32\drivers\hdaudbus.sys
2008-09-19 23:07 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-19 23:07 133,120 --------- C:\WINDOWS\system32\dot3svc.dll
2008-09-19 23:07 126,976 --------- C:\WINDOWS\system32\eappcfg.dll
2008-09-19 23:07 12,800 --------- C:\WINDOWS\system32\credssp.dll
2008-09-19 23:07 106,496 --------- C:\WINDOWS\system32\mmcfxcommon.dll
2008-09-19 23:07 10,752 --------- C:\WINDOWS\system32\smtpapi.dll
2008-09-19 23:07 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2008-09-19 23:07 1,306,624 --------- C:\WINDOWS\system32\msxml6.dll
2008-09-16 14:30 <DIR> d-------- C:\Programme\Bonjour
2008-09-16 14:29 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\{3276BE95_AF08_429F_ A64F_CA64CB79BCF6}
2008-09-15 22:38 8,912,896 --a------ C:\Dokumente und Einstellungen\***\ntuser.dat
2008-09-15 22:38 8,912,896 --a------ C:\DOKUME~1\***\ntuser.dat
2008-09-15 19:47 <DIR> d-------- C:\Programme\uTorrent
2008-09-14 22:26 <DIR> d-------- C:\Programme\QuickTime
2008-09-06 10:57 22,528 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-09-06 10:57 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-09-06 10:43 27,136 --a------ C:\WINDOWS\system32\drivers\nchssvad.sys
2008-09-06 10:43 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\NCH Software
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )))
2008-10-03 09:00:18 -------- d-----w C:\Programme\Mozilla Thunderbird
2008-10-02 08:03:52 -------- d-----w C:\Programme\eMule
2008-10-02 07:06:42 -------- d-----w C:\Programme\Google
2008-10-01 08:35:03 -------- d-----w C:\Programme\Norton Security Scan
2008-10-01 08:05:42 -------- d-----w C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-09-27 16:26:54 -------- d-----w C:\DOKUME~1\***\ANWEND~1\Skype
2008-09-27 16:12:48 -------- d-----w C:\DOKUME~1\***\ANWEND~1\skypePM
2008-09-24 18:30:00 -------- d-----w C:\Programme\Steinberg
2008-09-23 20:52:39 31,608 ----a-w C:\DOKUME~1\***\ANWEND~1\GDIPFONTCACHEV1.DAT
2008-09-22 19:09:18 -------- d-----w C:\Programme\Audacity
2008-09-22 18:07:36 -------- d-----w C:\Programme\ICQ6
2008-09-22 17:45:00 25,276 ---ha-w C:\WINDOWS\system32\mlfcache.dat
2008-09-20 19:05:36 -------- d-----w C:\DOKUME~1\***\ANWEND~1\uTorrent
2008-09-20 19:05:22 70,580 ----a-w C:\WINDOWS\system32\perfc007.dat
2008-09-20 19:05:22 405,118 ----a-w C:\WINDOWS\system32\perfh007.dat
2008-09-20 17:38:23 -------- d-----w C:\Programme\Messenger
2008-09-20 17:33:15 -------- d-----w C:\Programme\Movie Maker
2008-09-20 17:30:59 -------- d-----w C:\Programme\Windows NT
2008-09-19 12:43:50 -------- d-----w C:\DOKUME~1\***\ANWEND~1\Apple Computer
2008-09-16 12:34:58 -------- d-----w C:\Programme\iPod
2008-09-16 12:30:20 -------- d-----w C:\Programme\Guitar Speed Trainer
2008-09-16 12:30:00 -------- d-----w C:\Programme\iTunes
2008-09-09 08:25:05 -------- d-----w C:\Programme\DivX
2008-09-08 19:15:45 -------- d-----w C:\Programme\Trillian
2008-09-06 08:49:31 -------- d-----w C:\DOKUME~1\***\ANWEND~1\NCH Swift Sound
2008-09-02 08:09:47 -------- d--h--w C:\Programme\InstallShield Installation Information
2008-09-01 08:47:42 -------- d-----w C:\Programme\Finale NotePad 2008
2008-08-29 08:18:58 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 07:53:50 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll
2008-08-28 21:09:47 -------- d-----w C:\DOKUME~1\***\ANWEND~1\Garritan
2008-08-28 21:06:51 -------- d-----w C:\Programme\Garritan
2008-08-28 20:09:28 -------- d-----w C:\Programme\Garritan Personal Orchestra
2008-08-27 20:24:41 48 ---ha-w C:\WINDOWS\system32\ezsidmv.dat
2008-08-27 20:24:12 -------- d-----w C:\Programme\Gemeinsame Dateien\Skype
2008-08-27 19:03:34 -------- d-----w C:\DOKUME~1\***\ANWEND~1\Steinberg
2008-08-27 18:37:07 -------- d-----w C:\Programme\GenieSoft
2008-08-27 16:37:16 -------- d-----w C:\Programme\Digidesign
2008-08-27 16:31:05 -------- d-----w C:\Programme\DAEMON Tools Lite
2008-08-27 16:27:22 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-08-27 16:27:12 -------- d-----w C:\DOKUME~1\***\ANWEND~1\DAEMON Tools
2008-08-23 19:00:41 16 ----a-w C:\WINDOWS\system32\msvcsv60.dll
2008-08-23 19:00:41 16 ----a-w C:\WINDOWS\msocreg32.dat
2008-08-22 07:03:09 -------- d-----w C:\Programme\Guitar Pro 5demo
2008-08-16 15:02:59 -------- d-----w C:\Programme\Apple Software Update
2008-07-25 08:36:00 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-07-25 08:34:54 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34:52 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-07-25 08:34:50 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-07-25 08:34:46 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-07-25 08:34:46 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-07-25 08:34:46 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-07-25 08:34:46 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-07-25 08:34:46 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-07-25 08:34:42 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-07-25 08:34:40 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-07-25 08:34:40 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-07-25 08:34:40 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-07-25 08:34:36 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-07-25 08:34:30 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-07-23 16:50:52 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-23 16:48:40 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-07-23 16:48:40 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-07-23 16:46:38 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-18 20:10:48 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10:42 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10:40 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10:20 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09:46 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09:44 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09:44 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09:42 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07:34 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07:32 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26:58 253,952 ----a-w C:\WINDOWS\system32\es.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-08-14 13:39]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Programme\Java\jre1.6.0_07\bin\ss v.dll [2008-06-10 04:27]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_0 7\bin\jusched.exe" [2008-06-10 04:27]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 17:24]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-11-17 15:37]
"H2O"="C:\Programme\SyncroSoft\Pos\H2O\cledx.e xe" [2005-05-11 02:46]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:22]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system]
"NoDispBackgroundPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks]
"{54A8264B-AFFB-4614-95FE-0234817EA282}"="C:\WINDOWS\system32\hgGyywVp.dll" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
%SystemRoot%\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=, dfwcvm.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
Authentication Packages msv1_0 C:\WINDOWS\system32\fccyyyAR
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\safeboot\minimal\aawservice]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
napagent
Contents of the 'Scheduled Tasks' folder
2008-08-15 17:31:28 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2008-09-24 17:11:42 C:\WINDOWS\tasks\Norton Security Scan.job
************************************************** ******************
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, h**p://www.gmer.net
Rootkit scan 2008-10-03 12:09:18
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
disk error: C:\WINDOWS\
please note that you need administrator rights to perform deep scan
************************************************** ******************
[HKEY_LOCAL_MACHINE\system\ControlSet004\Services\T DSSserv]
"imagepath"="\systemroot\system32\drivers\TDSSserv .sys"
Completion time: 2008-10-03 12:11:01
C:\ComboFix2.txt ... 2008-10-02 21:16
C:\ComboFix3.txt ... 2008-10-02 14:12
--- E O F ---
|
Zu Hilfe, zu Hilfe, sonst biiiin ich verloooren.
|
03.10.2008, 14:58
Baum-Darstellung