| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ie Explorer öffnet selbstständigWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.07.2009, 17:02
| #1 |
 |  Ie Explorer öffnet selbstständig Undzwar habe ich folgendes Problem: Mein Internet Explorer öffnet in unregelmäßigen Zeitabständen Irgendwelche Websites....  Ebenfalls schlägt Kaspersky ständig Alarm und spammt mich mit folgendem voll  ownload des Objekts h**p://js.v1.de.euserv.sn13.adaos-ads.net/?sn=13;af=4;as=51;enthältVirus HEUR:Trojan.Script.Iframer verboten!Logfile of random's system information tool 1.06 (written by random/random) Run by User at 2009-07-14 18:54:42 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 14 GB (23%) free of 60 GB Total RAM: 2047 MB (55% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:54:46, on 14.07.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE D:\DAEMON Tools Lite\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\GUILD WARS\Gw.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe C:\DOKUME~1\User\LOKALE~1\Temp\b.exe C:\Programme\ICQ6.5\ICQ.exe C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\profile\cache4\temporary_download\RSIT.exe C:\Programme\Trend Micro\HijackThis\User.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://de.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://de.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKLM\..\RunOnce: [ Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [CrystalXP] D:\CrystalXP\CrystalXP.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (file missing) (HKCU) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203521493375 O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1237838121581&h=9d56f834685479010e169df00c43225e/&filename=jinstall-6u12-windows-i586-jc.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 7153 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\1-Klick-Wartung.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] IEVkbdBHO Class - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll [2009-05-25 68112] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-23 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}] FilterBHO Class - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll [2009-05-25 264720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-23 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-03-21 16126464] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-10-07 13574144] "AVP"=C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-05-25 303376] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-07-13 414992] " Malwarebytes Anti-Malware (reboot)"=C:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2009-07-13 1287440] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"=D:\DAEMON Tools Lite\daemon.exe [2008-08-08 490952] "CrystalXP"=D:\CrystalXP\CrystalXP.exe [2005-11-03 1108480] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] C:\Programme\ICQ6\ICQ.exe silent [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe [2007-03-01 153136] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp] C:\Programme\PC Tools AntiVirus\PCTAV.exe /MONITORSCAN [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] C:\Programme\Nero\Nero 7\InCD\NBHGui.exe [2007-05-15 1628208] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Belkin Dienstprogramm für kabellose Netzwerke.lnk] D:\BELKIN~1.EXE -t [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^User^Startmenü^Programme^Autostart^ubisoft register.lnk] C:\Programme\Ubi Soft\Register\schedule.exe [2002-07-11 28672] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wuauserv"=2 "TapiSrv"=3 "Spooler"=2 "WZCSVC"=2 "SSDPSRV"=3 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] C:\WINDOWS\system32\klogon.dll [2009-05-25 219664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:* isabled:Microsoft DirectPlay8 Server""C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32" "C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\Programme\Ubisoft\Far Cry 2\bin\FarCry2.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2" "C:\Programme\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater" "C:\Programme\Ubisoft\Far Cry 2\bin\FC2Editor.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor" "C:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club" "C:\Programme\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Programme\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "D:\Zattoo\zattood.exe"="D:\Zattoo\zattood.exe:*:Enabled:zattood" "D:\Zattoo\Zattoo.exe"="D:\Zattoo\Zattoo.exe:*:Enabled: " "C:\Programme\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Programme\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV" "D:\Dead space\Dead Space.exe"="D:\Dead space\Dead Space.exe:*:Enabled ead Space ™""C:\Programme\Valve\hl.exe"="C:\Programme\Valve\hl.exe:*:Enabled:Half-Life Launcher" "D:\LimeWire\LimeWire.exe"="D:\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "D:\Illegal!!\RouterClient.exe"="D:\Illegal!!\RouterClient.exe:*:Enabled:RouterClient" "C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 1 months====== 2009-07-14 18:54:42 ----D---- C:\rsit 2009-07-14 18:51:49 ----A---- C:\gkvx.txt 2009-07-14 18:30:36 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Malwarebytes 2009-07-14 18:30:30 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2009-07-14 18:30:05 ----D---- C:\Programme\Malwarebytes' Anti-Malware 2009-07-14 18:23:49 ----D---- C:\Programme\CCleaner 2009-07-14 17:43:06 ----D---- C:\Programme\Trend Micro 2009-07-14 14:01:18 ----D---- C:\Programme\ClearProg 2009-07-13 17:31:35 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Opera 2009-07-13 17:31:28 ----D---- C:\Programme\Opera 2009-07-13 17:07:04 ----A---- C:\WINDOWS\unvise32.exe 2009-07-13 15:53:57 ----D---- C:\Programme\Kaspersky Lab 2009-07-13 15:53:57 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab 2009-07-13 15:50:10 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files 2009-07-13 15:34:04 ----A---- C:\WINDOWS\system32\BASSMOD.dll 2009-07-13 15:04:21 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Download Manager 2009-07-13 14:44:30 ----D---- C:\Programme\Game Cam V2 2009-07-13 11:57:09 ----N---- C:\WINDOWS\system32\msxml71.dll 2009-06-28 09:19:46 ----N---- C:\WINDOWS\system32\pxinsi64.exe 2009-06-28 09:19:46 ----N---- C:\WINDOWS\system32\pxcpyi64.exe 2009-06-28 09:19:33 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared 2009-06-18 09:02:03 ----D---- C:\Programme\ICQ6Toolbar 2009-06-18 09:02:01 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ 2009-06-18 09:01:01 ----D---- C:\Programme\ICQ6.5 ======List of files/folders modified in the last 1 months====== 2009-07-14 18:54:28 ----D---- C:\WINDOWS\Prefetch 2009-07-14 18:54:06 ----D---- C:\WINDOWS\Temp 2009-07-14 18:51:49 ----D---- C:\WINDOWS\system32\drivers 2009-07-14 18:51:30 ----SD---- C:\WINDOWS\Tasks 2009-07-14 18:51:30 ----D---- C:\WINDOWS 2009-07-14 18:30:05 ----RD---- C:\Programme 2009-07-14 18:25:55 ----D---- C:\WINDOWS\Debug 2009-07-14 17:00:03 ----N---- C:\WINDOWS\SchedLgU.Txt 2009-07-14 16:42:43 ----D---- C:\WINDOWS\system32\ias 2009-07-13 22:00:37 ----A---- C:\WINDOWS\NeroDigital.ini 2009-07-13 18:35:35 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-13 18:35:35 ----D---- C:\WINDOWS\system32\de-de 2009-07-13 18:35:35 ----D---- C:\WINDOWS\system32 2009-07-13 18:35:34 ----HD---- C:\WINDOWS\inf 2009-07-13 18:35:34 ----D---- C:\WINDOWS\Media 2009-07-13 18:35:34 ----D---- C:\WINDOWS\Help 2009-07-13 18:35:34 ----D---- C:\Programme\Internet Explorer 2009-07-13 18:35:34 ----D---- C:\Programme\DivX 2009-07-13 18:28:03 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-13 18:21:27 ----SHD---- C:\System Volume Information 2009-07-13 18:21:27 ----D---- C:\WINDOWS\system32\Restore 2009-07-13 17:31:30 ----SHD---- C:\WINDOWS\Installer 2009-07-13 17:17:39 ----D---- C:\WINDOWS\Minidump 2009-07-13 15:04:20 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-07-13 14:57:33 ----D---- C:\WINDOWS\network diagnostic 2009-07-13 14:44:37 ----D---- C:\WINDOWS\WinSxS 2009-07-03 12:29:43 ----A---- C:\WINDOWS\BeatBox.INI 2009-07-02 21:37:41 ----D---- C:\WINDOWS\system32\config 2009-06-29 01:08:08 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DivX 2009-06-28 09:19:33 ----D---- C:\Programme\Gemeinsame Dateien 2009-06-18 09:01:35 ----D---- C:\Programme\ICQ6 ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [2007-05-15 37040] R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448] R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-07-13 296976] R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2002-01-28 271360] R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2002-01-28 18048] R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256] R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-03-26 4395008] R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2009-05-13 31760] R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-05-16 19472] R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-07 6133856] R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368] R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608] R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [2007-05-15 118576] S1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [2007-05-15 38576] S3 agafi1pv;agafi1pv; C:\WINDOWS\system32\drivers\agafi1pv.sys [] S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS [] S3 MRVW245;Belkin N1 Wireless USB Network Adapter Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\MRVW245.sys [2006-11-08 498816] S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AVP;Kaspersky Anti-Virus; C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-05-25 303376] R2 InCDsrv;InCD Helper; C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe [2007-05-15 1550896] R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-23 152984] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-10-07 163908] R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-05-18 66872] R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376] S3 NBService;NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112] S3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [2007-05-08 271920] S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2008-11-13 306432] S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880] -----------------EOF----------------- Hoffe ihr könnt mir helfen und Rechtschreibfehler dürft ihr selbsverständlich behalten =P Geändert von Melano (14.07.2009 um 18:02 Uhr) |
|
14.07.2009, 17:08
| #2 |
  |  Ie Explorer öffnet selbstständig Hallo und
__________________ Klicke bitte auf "Für alle Neuen" in meiner Signatur, lies alles aufmerksam und arbeite die komplette Liste unter Punkt 2 ab. ciao, andreas
__________________ |
|
14.07.2009, 17:52
| #3 |
| | Ie Explorer öffnet selbstständig Malwarebytes' Anti-Malware 1.39
__________________Datenbank Version: 2427 Windows 5.1.2600 Service Pack 3 14.07.2009 18:51:30 mbam-log-2009-07-14 (18-51-30).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 145522 Laufzeit: 19 minute(s), 28 second(s) Infizierte Speicherprozesse: 2 Infizierte Speichermodule: 1 Infizierte Registrierungsschlüssel: 9 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 13 Infizierte Speicherprozesse: C:\WINDOWS\msb.exe (Trojan.Agent) -> Unloaded process successfully. C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\b.exe (Trojan.Downloader) -> Unloaded process successfully. Infizierte Speichermodule: C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{40196867-19f8-7157-c097-ecaff653c9ad} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Cognac (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\ColdWare (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cognac (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\WINDOWS\msb.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot. C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Temp\b.exe (Trojan.Downloader) -> Delete on reboot. c:\dokumente und einstellungen\User\lokale einstellungen\Temp\c.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\User\lokale einstellungen\Temp\d.exe (Trojan.Dropper) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\User\lokale einstellungen\Temp\e.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\User\lokale einstellungen\Temp\f.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\User\lokale einstellungen\Temp\a.exe (Trojan.Dropper) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\User\lokale einstellungen\Temp\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\WINDOWS\msa.exe (Trojan.Agent) -> Quarantined and deleted successfully. d:\cryptload_1.1.6\router\fritz!box\nc.exe (PuP.Keylogger) -> Quarantined and deleted successfully. c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. |
|
14.07.2009, 17:54
| #4 |
| | Ie Explorer öffnet selbstständig Jetzt sollte es deinem Rechner bedeutend besser gehen.  ciao, andreas
__________________ Kein Support per PN! Das ist hier ein Forum und keine Privatbetreuung! Für alle NeuenPrivatbetreuung nur gegen Bezahlung und ich koste sehr teuer. Anleitungen Virenscanner Kompromittierung unvermeidbar? |
|
14.07.2009, 18:08
| #5 |
| | Ie Explorer öffnet selbstständig Ja eindeutig kan geclosed werde ty  |
|
14.07.2009, 18:09
| #6 |
| | Ie Explorer öffnet selbstständig Poste trotzdem noch die Logs von RSIT. Da kann noch etwas sein. ciao, andreas
__________________ --> Ie Explorer öffnet selbstständig |
|
14.07.2009, 18:38
| #7 |
| | Ie Explorer öffnet selbstständig Logfile of random's system information tool 1.06 (written by random/random) Run by User at 2009-07-14 19:35:56 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 14 GB (23%) free of 60 GB Total RAM: 2047 MB (77% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:35:58, on 14.07.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE D:\DAEMON Tools Lite\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\profile\cache4\temporary_download\RSIT (1).exe C:\Programme\Trend Micro\HijackThis\User.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://de.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://de.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [CrystalXP] D:\CrystalXP\CrystalXP.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (file missing) (HKCU) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - h**p://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - h**p://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203521493375 O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - h**p://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1237838121581&h=9d56f834685479010e169df00c43225e/&filename=jinstall-6u12-windows-i586-jc.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - h**p://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 6664 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\1-Klick-Wartung.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] IEVkbdBHO Class - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll [2009-05-25 68112] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-23 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}] FilterBHO Class - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll [2009-05-25 264720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-23 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-03-21 16126464] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-10-07 13574144] "AVP"=C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-05-25 303376] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"=D:\DAEMON Tools Lite\daemon.exe [2008-08-08 490952] "CrystalXP"=D:\CrystalXP\CrystalXP.exe [2005-11-03 1108480] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] C:\Programme\ICQ6\ICQ.exe silent [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe [2007-03-01 153136] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp] C:\Programme\PC Tools AntiVirus\PCTAV.exe /MONITORSCAN [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] C:\Programme\Nero\Nero 7\InCD\NBHGui.exe [2007-05-15 1628208] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Belkin Dienstprogramm für kabellose Netzwerke.lnk] D:\BELKIN~1.EXE -t [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^User^Startmenü^Programme^Autostart^ubisoft register.lnk] C:\Programme\Ubi Soft\Register\schedule.exe [2002-07-11 28672] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "wuauserv"=2 "TapiSrv"=3 "Spooler"=2 "WZCSVC"=2 "SSDPSRV"=3 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] C:\WINDOWS\system32\klogon.dll [2009-05-25 219664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:* isabled:Microsoft DirectPlay8 Server""C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32" "C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\Programme\Ubisoft\Far Cry 2\bin\FarCry2.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2" "C:\Programme\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater" "C:\Programme\Ubisoft\Far Cry 2\bin\FC2Editor.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor" "C:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe"="C:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club" "C:\Programme\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe"="C:\Programme\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "D:\Zattoo\zattood.exe"="D:\Zattoo\zattood.exe:*:Enabled:zattood" "D:\Zattoo\Zattoo.exe"="D:\Zattoo\Zattoo.exe:*:Enabled: " "C:\Programme\Rockstar Games\Grand Theft Auto IV\GTAIV.exe"="C:\Programme\Rockstar Games\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV" "D:\Dead space\Dead Space.exe"="D:\Dead space\Dead Space.exe:*:Enabled ead Space ™""C:\Programme\Valve\hl.exe"="C:\Programme\Valve\hl.exe:*:Enabled:Half-Life Launcher" "D:\LimeWire\LimeWire.exe"="D:\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "D:\Illegal!!\RouterClient.exe"="D:\Illegal!!\RouterClient.exe:*:Enabled:RouterClient" "C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 1 months====== 2009-07-14 18:54:42 ----D---- C:\rsit 2009-07-14 18:30:36 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Malwarebytes 2009-07-14 18:30:30 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2009-07-14 18:30:05 ----D---- C:\Programme\Malwarebytes' Anti-Malware 2009-07-14 18:23:49 ----D---- C:\Programme\CCleaner 2009-07-14 17:43:06 ----D---- C:\Programme\Trend Micro 2009-07-14 14:01:18 ----D---- C:\Programme\ClearProg 2009-07-13 17:31:35 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Opera 2009-07-13 17:31:28 ----D---- C:\Programme\Opera 2009-07-13 17:07:04 ----A---- C:\WINDOWS\unvise32.exe 2009-07-13 15:53:57 ----D---- C:\Programme\Kaspersky Lab 2009-07-13 15:53:57 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab 2009-07-13 15:50:10 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files 2009-07-13 15:34:04 ----A---- C:\WINDOWS\system32\BASSMOD.dll 2009-07-13 15:04:21 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Download Manager 2009-07-13 14:44:30 ----D---- C:\Programme\Game Cam V2 2009-06-28 09:19:46 ----N---- C:\WINDOWS\system32\pxinsi64.exe 2009-06-28 09:19:46 ----N---- C:\WINDOWS\system32\pxcpyi64.exe 2009-06-28 09:19:33 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared 2009-06-18 09:02:03 ----D---- C:\Programme\ICQ6Toolbar 2009-06-18 09:02:01 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ 2009-06-18 09:01:01 ----D---- C:\Programme\ICQ6.5 ======List of files/folders modified in the last 1 months====== 2009-07-14 19:35:15 ----D---- C:\WINDOWS\Temp 2009-07-14 19:11:08 ----D---- C:\WINDOWS 2009-07-14 19:11:01 ----D---- C:\WINDOWS\system32\ias 2009-07-14 19:10:29 ----D---- C:\WINDOWS\system32\drivers 2009-07-14 19:10:29 ----D---- C:\WINDOWS\system32 2009-07-14 19:09:31 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-07-14 18:55:10 ----D---- C:\WINDOWS\Prefetch 2009-07-14 18:51:30 ----SD---- C:\WINDOWS\Tasks 2009-07-14 18:30:05 ----RD---- C:\Programme 2009-07-14 18:25:55 ----D---- C:\WINDOWS\Debug 2009-07-13 22:00:37 ----A---- C:\WINDOWS\NeroDigital.ini 2009-07-13 18:35:35 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-13 18:35:35 ----D---- C:\WINDOWS\system32\de-de 2009-07-13 18:35:34 ----HD---- C:\WINDOWS\inf 2009-07-13 18:35:34 ----D---- C:\WINDOWS\Media 2009-07-13 18:35:34 ----D---- C:\WINDOWS\Help 2009-07-13 18:35:34 ----D---- C:\Programme\Internet Explorer 2009-07-13 18:35:34 ----D---- C:\Programme\DivX 2009-07-13 18:28:03 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-13 18:21:27 ----SHD---- C:\System Volume Information 2009-07-13 18:21:27 ----D---- C:\WINDOWS\system32\Restore 2009-07-13 17:31:30 ----SHD---- C:\WINDOWS\Installer 2009-07-13 17:17:39 ----D---- C:\WINDOWS\Minidump 2009-07-13 15:04:20 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-07-13 14:57:33 ----D---- C:\WINDOWS\network diagnostic 2009-07-13 14:44:37 ----D---- C:\WINDOWS\WinSxS 2009-07-03 12:29:43 ----A---- C:\WINDOWS\BeatBox.INI 2009-07-02 21:37:41 ----D---- C:\WINDOWS\system32\config 2009-06-29 01:08:08 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DivX 2009-06-28 09:19:33 ----D---- C:\Programme\Gemeinsame Dateien 2009-06-18 09:01:35 ----D---- C:\Programme\ICQ6 ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [2007-05-15 37040] R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448] R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-07-13 296976] R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2002-01-28 271360] R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2002-01-28 18048] R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256] R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-03-26 4395008] R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2009-05-13 31760] R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\WINDOWS\system32\DRIVERS\klmouflt.sys [2009-05-16 19472] R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-07 6133856] R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368] R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608] R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [2007-05-15 118576] S1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [2007-05-15 38576] S3 a0ft9hq4;a0ft9hq4; C:\WINDOWS\system32\drivers\a0ft9hq4.sys [] S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS [] S3 MRVW245;Belkin N1 Wireless USB Network Adapter Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\MRVW245.sys [2006-11-08 498816] S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AVP;Kaspersky Anti-Virus; C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe [2009-05-25 303376] R2 InCDsrv;InCD Helper; C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe [2007-05-15 1550896] R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-23 152984] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-10-07 163908] R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-05-18 66872] R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376] S3 NBService;NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-04-13 792112] S3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [2007-05-08 271920] S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2008-11-13 306432] S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880] -----------------EOF----------------- |
|
14.07.2009, 18:48
| #8 |
| | Ie Explorer öffnet selbstständig Lasse bitte folgende Dateien bei Virustotal überprüfen und poste das komplette Ergebnis mit Dateinamen und den ganzen Prüfsummen oder lade sie bei uns hoch => http://www.trojaner-board.de/54791-a...ner-board.html Code:
ATTFilter C:\WINDOWS\system32\pxinsi64.exe
C:\WINDOWS\system32\pxcpyi64.exe
C:\WINDOWS\system32\drivers\a0ft9hq4.sys
Start => Ausführen => c:\rsit\info.txt => OK ciao, andreas
__________________ Kein Support per PN! Das ist hier ein Forum und keine Privatbetreuung! Für alle NeuenPrivatbetreuung nur gegen Bezahlung und ich koste sehr teuer. Anleitungen Virenscanner Kompromittierung unvermeidbar? |
|
14.07.2009, 19:36
| #9 |
| | Ie Explorer öffnet selbstständig info.txt logfile of random's system information tool 1.06 2009-07-14 18:54:48 ======Uninstall list====== -->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER -->C:\Programme\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL -->C:\WINDOWS\NuNInst.exe /UNINSTALL -->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL -->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93} -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001} Attansic Ethernet Utility-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{1F698102-5739-441E-96F0-74F4EA540F06}\setup.exe" -l0x9 -removeonly Attansic L1 Gigabit Ethernet Driver-->rundll32.exe C:\WINDOWS\system32\Attansic\L1\atcInst.dll,AtcUninst C:\WINDOWS\system32\Attansic\L1 x86 1969 1048 L1 AutoIt v3.2.0.1-->D:\AutoIt3\Uninstall.exe CCleaner (remove only)-->"C:\Programme\CCleaner\uninst.exe" ClearProg 1.6.0 Final-->C:\Programme\ClearProg\Uninstall.exe Counter-Strike 1.6-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{13B792AA-C078-43A4-8A3A-8B12D629940D}\Setup.exe" -l0x19 Crysis(R)-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4} Dead Space™-->MsiExec.exe /X{4D87DC92-C328-46EC-A7B4-9C88129DC696} Die*Sims™*3-->"C:\Programme\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x0007 -removeonly DivX Converter-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN Fallout 3-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{974C4B12-4D02-4879-85E0-61C95CC63E9E}\setup.exe" -l0x7 -removeonly Far Cry 2-->"C:\Programme\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x0007 -removeonly Free YouTube to Mp3 Converter version 3.1-->"D:\Free YouTube to Mp3 Converter\unins000.exe" Game Cam 2.3.4.41-->C:\Programme\Game Cam V2\uninst.exe Grand Theft Auto IV-->"C:\Programme\InstallShield Installation Information\{579BA58C-F33D-4970-9953-B94B43768AC3}\setup.exe" -runfromtemp -l0x0007 -removeonly GSpot Codec Information Appliance-->D:\GSpot\Uninstall.exe GUILD WARS-->"C:\Programme\GUILD WARS\Gw.exe" -uninstall GuildWars Visions v1.08-->"C:\Programme\Visions\unins000.exe" High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" HijackThis 2.0.2-->"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF} Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} JMB36X Raid Configurer-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\setup.exe" -l0x7 -removeonly Kaspersky Anti-Virus 2010-->MsiExec.exe /I{943B6738-4801-4982-90EC-0442EF7AEB16} Kaspersky Anti-Virus 2010-->MsiExec.exe /I{943B6738-4801-4982-90EC-0442EF7AEB16} L2MRemover-->C:\WINDOWS\unvise32.exe d:\uninstal.log LimeWire 5.1.2-->"D:\LimeWire\uninstall.exe" MAGIX Music Maker 2008 silver 13.0.1.10 (D)-->D:\Programme\MAGIX\MusicMaker2008_silver\instslct.exe /p Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe" Matrix Code Emulator 1.50-->"C:\WINDOWS\unins000.exe" Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28} Microsoft .NET Framework 3.0 German Language Pack-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 German Language Pack\setup.exe Microsoft .NET Framework 3.0 German Language Pack-->MsiExec.exe /X{F2A7F421-1679-48D5-B918-96999014ED53} Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe Microsoft .NET Framework 3.0-->MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003} Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F} Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{FD052FB9-FE90-4438-B355-15EDC89D8FB1} Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe" Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4} Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} Need for Speed™ ProStreet-->MsiExec.exe /X{2E1A71D5-7897-4F3F-B0E3-B412C86A646D} Nero 7 Essentials-->MsiExec.exe /X{9B4E6CB9-E54D-47F7-A414-E2D5740E1031} neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI NVIDIA PhysX v8.09.04-->MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93} Opera 9.64-->MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620} PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x7 -removeonly Rockstar Games Social Club-->"C:\Programme\InstallShield Installation Information\{08B3869E-D282-424C-9AFC-870E04A4BA14}\setup.exe" -runfromtemp -l0x0007 -removeonly Sicherheitsupdate für Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe" Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf Sicherheitsupdate für Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" System Requirements Lab-->C:\Programme\SystemRequirementsLab\Uninstall.exe TeamSpeak 2 RC2-->C:\Programme\Teamspeak2_RC2\unins000.exe TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA} Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe" VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B} VistaMizer 2.2.1.0-->C:\WINDOWS\VistaMizer\Uninstall.exe Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333} Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" Windows Presentation Foundation Language Pack (DEU)-->MsiExec.exe /X{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790} Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840} Windows Workflow Foundation DE Language Pack-->MsiExec.exe /I{7228FD8C-3B9E-4204-AE36-8A466107685B} Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD} Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" WinRAR-->C:\Programme\WinRAR\uninstall.exe XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe" XpertVision 5.9-->"C:\Programme\XpertVision\unins000.exe" Zattoo 3.3.4 Beta-->D:\Zattoo\uninst.exe ======Security center information====== AV: Kaspersky Anti-Virus ======System event log====== Computer Name: MEINSCHATZ Event Code: 17 Message: Record Number: 175710 Source Name: avgntflt Time Written: 20090511121022.000000+120 Event Type: Informationen User: Computer Name: MEINSCHATZ Event Code: 6005 Message: Der Ereignisprotokolldienst wurde gestartet. Record Number: 175709 Source Name: EventLog Time Written: 20090511121012.000000+120 Event Type: Informationen User: Computer Name: MEINSCHATZ Event Code: 6009 Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free. Record Number: 175708 Source Name: EventLog Time Written: 20090511121012.000000+120 Event Type: Informationen User: Computer Name: MEINSCHATZ Event Code: 6006 Message: Der Ereignisprotokolldienst wurde beendet. Record Number: 175707 Source Name: EventLog Time Written: 20090509112712.000000+120 Event Type: Informationen User: Computer Name: MEINSCHATZ Event Code: 10005 Message: Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "wuauserv" mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Record Number: 175706 Source Name: DCOM Time Written: 20090509104906.000000+120 Event Type: Fehler User: MEINSCHATZ\User =====Application event log===== Computer Name: ******* Event Code: 1000 Message: Fehlgeschlagene Anwendung start.exe, Version 8.5.0.321, fehlgeschlagenes Modul quicktime.qts, Version 5.0.2.15, Fehleradresse 0x0007fd6b. Record Number: 336 Source Name: Application Error Time Written: 20080506165033.000000+120 Event Type: Fehler User: Computer Name: ****** Event Code: 4097 Message: Die Anwendung "E:\Start.exe" hat einen Programmfehler verursacht. Datum und Zeit des Fehlers: 06.05.2008 um 16:50:31.875 Ausnahme: c0000005 an Adresse 6287FD6B (QuickTime!DllMain) Record Number: 335 Source Name: DrWatson Time Written: 20080506165031.000000+120 Event Type: Informationen User: Computer Name: ******* Event Code: 1000 Message: Fehlgeschlagene Anwendung start.exe, Version 8.5.0.321, fehlgeschlagenes Modul quicktime.qts, Version 5.0.2.15, Fehleradresse 0x0007fd6b. Record Number: 334 Source Name: Application Error Time Written: 20080506165030.000000+120 Event Type: Fehler User: Computer Name: ++++++ Event Code: 4097 Message: Die Anwendung "E:\start.exe" hat einen Programmfehler verursacht. Datum und Zeit des Fehlers: 06.05.2008 um 16:50:18.343 Ausnahme: c0000005 an Adresse 6287FD6B (QuickTime!DllMain) Record Number: 333 Source Name: DrWatson Time Written: 20080506165018.000000+120 Event Type: Informationen User: Computer Name: ****** Event Code: 1000 Message: Fehlgeschlagene Anwendung start.exe, Version 8.5.0.321, fehlgeschlagenes Modul quicktime.qts, Version 5.0.2.15, Fehleradresse 0x0007fd6b. Record Number: 332 Source Name: Application Error Time Written: 20080506165014.000000+120 Event Type: Fehler User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\Gemeinsame Dateien\DivX Shared\ "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel "PROCESSOR_REVISION"=0f0b "NUMBER_OF_PROCESSORS"=2 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "RGSCLauncher"=C:\Programme\Rockstar Games\Rockstar Games Social Club "RGSC"=C:\Programme\Rockstar Games\Rockstar Games Social Club\1_0_0_0 -----------------EOF----------------- |
|
14.07.2009, 19:39
| #10 |
| | Ie Explorer öffnet selbstständig Datei pxinsi64.exe empfangen 2009.06.20 15:39:14 (UTC) Status: Beendet Ergebnis: 0/40 (0.00%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis a-squared 4.5.0.18 2009.06.20 - AhnLab-V3 5.0.0.2 2009.06.20 - AntiVir 7.9.0.193 2009.06.19 - Antiy-AVL 2.0.3.1 2009.06.19 - Authentium 5.1.2.4 2009.06.20 - Avast 4.8.1335.0 2009.06.19 - AVG 8.5.0.339 2009.06.20 - BitDefender 7.2 2009.06.20 - CAT-QuickHeal 10.00 2009.06.19 - ClamAV 0.94.1 2009.06.20 - Comodo 1380 2009.06.20 - DrWeb 5.0.0.12182 2009.06.20 - eSafe 7.0.17.0 2009.06.18 - eTrust-Vet 31.6.6570 2009.06.19 - F-Prot 4.4.4.56 2009.06.19 - F-Secure 8.0.14470.0 2009.06.19 - Fortinet 3.117.0.0 2009.06.19 - GData 19 2009.06.20 - Ikarus T3.1.1.59.0 2009.06.20 - Jiangmin 11.0.706 2009.06.20 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.06.20 - McAfee 5651 2009.06.19 - McAfee+Artemis 5651 2009.06.19 - McAfee-GW-Edition 6.7.6 2009.06.19 - Microsoft 1.4803 2009.06.20 - NOD32 4173 2009.06.20 - Norman 6.01.09 2009.06.19 - nProtect 2009.1.8.0 2009.06.20 - Panda 10.0.0.16 2009.06.20 - Prevx 3.0 2009.06.20 - Rising 21.34.52.00 2009.06.20 - Sophos 4.42.0 2009.06.20 - Sunbelt 3.2.1858.2 2009.06.20 - Symantec 1.4.4.12 2009.06.20 - TheHacker 6.3.4.3.348 2009.06.19 - TrendMicro 8.950.0.1094 2009.06.20 - VBA32 3.12.10.7 2009.06.20 - ViRobot 2009.6.19.1796 2009.06.19 - VirusBuster 4.6.5.0 2009.06.19 - weitere Informationen File size: 118520 bytes MD5 : 16be6047e84614f8781110c4d10590ed SHA1 : 858d218e6aa62ef568f4dea3b328ea4856a80c27 SHA256: 4137aa38205a8436d239e4d0a0f06831bce635b59c9fd57c91b1b3ef62de801b PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x418090 timedatestamp.....: 0x460BEF76 (Thu Mar 29 18:55:18 2007) machinetype.......: 0x200 () ( 7 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x2000 0x15120 0x15200 5.12 5db50652fcff7ce042469bc38ec352c9 .rdata 0x18000 0x33C6 0x3400 4.25 41a294b2a8ac9cfb5eb75f192a91aebe .pdata 0x1C000 0x738 0x800 4.22 16a0d0a8b8b1a1faecd42ad3f0da2367 .srdata 0x1E000 0xC4 0x200 2.10 9d3e1b0b052d030a769236ea50a10818 .sdata 0x20000 0x998 0x800 2.72 e1ce834b7c6d795c9a141e8082e1ebac .data 0x22000 0x2CE0 0x1400 2.42 fed06a884c3f9aed8648f3d93cf7a83e .rsrc 0x26000 0x2E8 0x400 2.46 593d79a7207a63279e9e471312e84006 ( 0 imports ) ( 0 exports ) TrID : File type identification Win64 Executable Generic (95.5%) Generic Win/DOS Executable (2.2%) DOS Executable Generic (2.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ssdeep: 1536:RnGn4Ip2DXCVDasdH8uW7PzQq+nFF58JWGqiG5Mr5bX:RnLIp2CbFyPT+aWGqiG5Mh PEiD : - CWSandbox: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=16be6047e84614f8781110c4d10590ed RDS : NSRL Reference Data Set - |
|
14.07.2009, 19:41
| #11 |
| | Ie Explorer öffnet selbstständig Datei pxcpyi64.exe empfangen 2009.07.14 18:48:14 (UTC) Status: Beendet Ergebnis: 0/41 (0.00%) Antivirus Version letzte aktualisierung Ergebnis a-squared 4.5.0.18 2009.06.25 - AhnLab-V3 5.0.0.2 2009.06.25 - AntiVir 7.9.0.196 2009.06.25 - Antiy-AVL 2.0.3.1 2009.06.25 - Authentium 5.1.2.4 2009.06.25 - Avast 4.8.1335.0 2009.06.25 - AVG 8.5.0.339 2009.06.25 - BitDefender 7.2 2009.06.25 - CAT-QuickHeal 10.00 2009.06.25 - ClamAV 0.94.1 2009.06.25 - Comodo 1417 2009.06.25 - DrWeb 5.0.0.12182 2009.06.25 - eSafe 7.0.17.0 2009.06.25 - eTrust-Vet 31.6.6579 2009.06.25 - F-Prot 4.4.4.56 2009.06.25 - F-Secure 8.0.14470.0 2009.06.25 - Fortinet 3.117.0.0 2009.06.25 - GData 19 2009.06.25 - Ikarus T3.1.1.59.0 2009.06.25 - Jiangmin 11.0.706 2009.06.25 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.06.25 - McAfee 5657 2009.06.25 - McAfee+Artemis 5657 2009.06.25 - McAfee-GW-Edition 6.7.6 2009.06.25 - Microsoft 1.4803 2009.06.25 - NOD32 4189 2009.06.25 - Norman 6.01.09 2009.06.25 - nProtect 2009.1.8.0 2009.06.25 - Panda 10.0.0.16 2009.06.24 - PCTools 4.4.2.0 2009.06.25 - Prevx 3.0 2009.06.25 - Rising 21.35.34.00 2009.06.25 - Sophos 4.43.0 2009.06.25 - Sunbelt 3.2.1858.2 2009.06.25 - Symantec 1.4.4.12 2009.06.25 - TheHacker 6.3.4.3.353 2009.06.24 - TrendMicro 8.950.0.1094 2009.06.25 - VBA32 3.12.10.7 2009.06.25 - ViRobot 2009.6.25.1804 2009.06.25 - VirusBuster 4.6.5.0 2009.06.25 - weitere Informationen File size: 120056 bytes MD5 : d08c30a3447b43dd3256f492c3f5f9eb SHA1 : 6fee5099096952873e8e749bdd785c61062fead9 SHA256: 919b48f731333c8bd80b80a4915fc8abde0147438224a985f01c94111f0e6608 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x418060 timedatestamp.....: 0x46045CFF (Sat Mar 24 00:04:31 2007) machinetype.......: 0x200 () ( 7 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x2000 0x15780 0x15800 5.16 7c7849274f09e765309383a8dbec800d .rdata 0x18000 0x3254 0x3400 4.07 8651740738e3356a547d2bc70fc15dce .pdata 0x1C000 0x738 0x800 4.18 8fbf19b73b23ea796c7c7439b024f8be .srdata 0x1E000 0xCC 0x200 2.10 e5d67a94a84b1789d63683f8a1a58c55 .sdata 0x20000 0x998 0x800 2.51 7383fd5b7cfb6fbc3fa7e7c0ddd53fa6 .data 0x22000 0x2CE0 0x1400 2.39 07ca9b2d3eb99ed60ef5ba4645e65beb .rsrc 0x26000 0x2E8 0x400 2.46 2b7eb6532d6ccc920d05b5bf164e3670 ( 0 imports ) ( 0 exports ) TrID : File type identification Win64 Executable Generic (95.5%) Generic Win/DOS Executable (2.2%) DOS Executable Generic (2.2%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ssdeep: 1536:Q6DsyjnM6CIjvi+xQKf578Bf8WOzcPkFRwXkT68hboStJ1iSQYYYYYSu5bxK:MmraK578Bf8/0XkLbptJ1iSQYYYYYSAK PEiD : - CWSandbox: http://research.sunbelt-software.com...56f492c3f5f9eb RDS : NSRL Reference Data Set - |
|
14.07.2009, 19:43
| #12 |
| | Ie Explorer öffnet selbstständig Bei C:\WINDOWS\system32\drivers\a0ft9hq4.sys kam das raus: 0 bytes size received / Se ha recibido un archivo vacio |
|
14.07.2009, 19:45
| #13 |
| | Ie Explorer öffnet selbstständig Hoffe das war so einigermassen richtig |
|
14.07.2009, 20:01
| #14 |
| | Ie Explorer öffnet selbstständigMan sollte sich nie auf Prevx verlassen => PXINSI64.EXE, Prevx Was ist dein Laufwerk E:? ciao, andreas
__________________ Kein Support per PN! Das ist hier ein Forum und keine Privatbetreuung! Für alle NeuenPrivatbetreuung nur gegen Bezahlung und ich koste sehr teuer. Anleitungen Virenscanner Kompromittierung unvermeidbar? |
|
14.07.2009, 20:26
| #15 |
| | Ie Explorer öffnet selbstständig Laufwerk E ist mein ganz normales CD/DVD Laufwerk genau wie F nur G ist mein Virtuelles.. Ersteinmal ganz großes Dankeschön an dich für die schnelle und einfach zu verstehende hilfe Danke!! |
|
| Themen zu Ie Explorer öffnet selbstständig |
| 1.exe, antivirus, avp, avp.exe, bho, crysis, fontcache, grand theft auto, gservice, helper, heur, heur:, hijack, hijackthis, hkus\s-1-5-18, home, ie explorer, internet, internet explorer, kaspersky, limewire, malwarebytes anti-malware, malwarebytes' anti-malware, object, plug-in, problem, realtek, registry, rundll, schreibfehler, server, software, spamm, system, tastatur, tuneup.defrag, virtuelle tastatur, virus, windows, windows xp |
Linear-Darstellung
