info.txt logfile of random's system information tool 1.06 2009-08-15 20:07:58

======Uninstall list======

-->MsiExec.exe /I{977FBE6C-AE9A-4429-B249-814F0B3A4CB1}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
ASUS InstantFun-->MsiExec.exe /I{57B15AD4-8C9D-4164-82BB-E33D8644E757}
ASUS Splendid Video Enhancement Technology-->C:\Program Files\InstallShield Installation Information\{C0FC1C14-4824-4A73-87A6-9E888C9C3102}\setup.EXE -runfromtemp -l0x0007 -removeonly
ASUS Touch Pad Extra-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DB891739-2EB3-45A8-9CBD-941C255CECD4}\setup.EXE" -l0x9
ASUS Virtual Camera-->MsiExec.exe /I{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}
Asus_Camera_ScreenSaver-->"C:\Windows\ASUS Camera ScreenSaver Uninstaller.exe"
ATK Hotkey-->C:\Program Files\InstallShield Installation Information\{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}\setup.exe -runfromtemp -l0x0007 -removeonly
ATK Media-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}\setup.exe" -l0x9
ATKOSD2-->C:\Program Files\InstallShield Installation Information\{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}\setup.exe -runfromtemp -l0x0009 -removeonly
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Azureus-->C:\Program Files\Vuze\Uninstall.exe
Battlefield 2(TM)-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x7 -removeonly
Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Easy Button Creator 2.0-->"C:\Program Files\Easy Button Creator 2.0\uninstall.exe"
Free KGB Key Logger-->"C:\Program Files\Free KGB Key Logger\uninstall.exe"
GameSpy Arcade-->C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_E582EA556D8DE101.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
GUILD WARS-->"C:\Program Files\GUILD WARS\Gw.exe" -uninstall
GuildWars Visions v1.08-->"C:\Program Files\Visions\unins000.exe"
Hervorhebe-Funktion (Windows Live Toolbar)-->MsiExec.exe /X{00D0200F-3B4D-4A2F-869E-533ED835A943}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Java(TM) 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
LifeFrame2-->MsiExec.exe /I{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office Word Viewer 2003-->MsiExec.exe /I{90850407-6000-11D3-8CFE-0150048383C9}
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mobile Connect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EAAC5FD-E209-4856-8C49-D4EA40F85032}\setup.exe" -l0x7 -removeonly
Mozilla Firefox (3.0.12)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NB Probe-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}\setup.EXE" -l0x9
OpenOffice.org 3.1-->MsiExec.exe /I{D765F1CE-5AE5-4C47-B134-AE58AC474740}
Phase 5 HTML-Editor-->MsiExec.exe /I{20B1B020-DEAE-48D1-9960-D4C3185D758B}
Pivot Stickfigure Animator-->MsiExec.exe /I{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}
Power4Gear eXtreme-->C:\Program Files\InstallShield Installation Information\{8CFEBE9C-F29F-4C49-80E0-7106970F8734}\setup.EXE -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\SETUP.EXE" -l0x9 -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Smart Menus (Windows Live Toolbar)-->MsiExec.exe /X{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"
USB 2.0 1.3M UVC WebCam-->C:\Windows\snuninst.exe /name='USB 2.0 1.3M UVC WebCam'
Windows Live Anmelde-Assistent-->MsiExec.exe /I{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}
Windows Live Family Safety-->MsiExec.exe /X{54B1E5A3-1B29-4582-A226-172A1FC7BA6C}
Windows Live Favorites für Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live Fotogalerie-->MsiExec.exe /X{119B7481-0216-40D2-A5CC-C3E1F461ECC1}
Windows Live Mail-->MsiExec.exe /I{5A166C0B-9557-4364-A057-F946D674E6AC}
Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}
Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Windows Live Sync-->MsiExec.exe /X{ED636101-1959-4360-8BF7-209436E7DEE4}
Windows Live Toolbar-->MsiExec.exe /X{70B7A167-0B88-445D-A3EA-97C73AA88CAC}
Windows Live Toolbar-Erweiterung (Windows Live Toolbar)-->MsiExec.exe /X{218761F6-CBF6-4973-B910-A33E6563A1EA}
Windows Live Writer-->MsiExec.exe /X{81821BF8-DA20-4F8C-AA87-F70A274828D4}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinFlash-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE10AB76-4756-4913-BE25-55D1C1051F9A}\setup.EXE" -l0x9
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Wireless Console 2-->C:\Program Files\InstallShield Installation Information\{83F73CB1-7705-49D1-9852-84D839CA2A45}\setup.EXE -runfromtemp -l0x0007 -removeonly
XIII-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{42BC0474-6E50-464A-8183-5E3D32E41B1B}\setup.exe" -l0x7

======Hosts File======



======Security center information======

AS: Windows-Defender

======System event log======

Computer Name: Andrea-PC
Event Code: 7036
Message: Dienst "Windows CardSpace" befindet sich jetzt im Status "Ausgeführt".
Record Number: 179884
Source Name: Service Control Manager
Time Written: 20090815155632.000000-000
Event Type: Informationen
User:

Computer Name: Andrea-PC
Event Code: 7036
Message: Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 179885
Source Name: Service Control Manager
Time Written: 20090815161756.000000-000
Event Type: Informationen
User:

Computer Name: Andrea-PC
Event Code: 7036
Message: Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Beendet".
Record Number: 179886
Source Name: Service Control Manager
Time Written: 20090815163426.000000-000
Event Type: Informationen
User:

Computer Name: Andrea-PC
Event Code: 7036
Message: Dienst "Windows CardSpace" befindet sich jetzt im Status "Beendet".
Record Number: 179887
Source Name: Service Control Manager
Time Written: 20090815165632.000000-000
Event Type: Informationen
User:

Computer Name: Andrea-PC
Event Code: 7036
Message: Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 179888
Source Name: Service Control Manager
Time Written: 20090815175903.000000-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: Andrea-PC
Event Code: 0
Message: Der Dienst wurde gestartet.
Record Number: 51634
Source Name: idsvc
Time Written: 20090815155632.000000-000
Event Type: Informationen
User:

Computer Name: Andrea-PC
Event Code: 4113
Message: AntiVir erkannte in der Datei C:\Windows\temp\TMP0000006F6411703C8D9FBF45 verdächtigen Code mit der Bezeichnung 'TR/Rootkit.Gen'!
Record Number: 51635
Source Name: Avira AntiVir
Time Written: 20090815163757.000000-000
Event Type: Warnung
User: NT-AUTORITÄT\SYSTEM

Computer Name: Andrea-PC
Event Code: 4113
Message: AntiVir erkannte in der Datei C:\Windows\temp\TMP0000006F6411703C8D9FBF45 verdächtigen Code mit der Bezeichnung 'TR/Rootkit.Gen'!
Record Number: 51636
Source Name: Avira AntiVir
Time Written: 20090815164028.000000-000
Event Type: Warnung
User: NT-AUTORITÄT\SYSTEM

Computer Name: Andrea-PC
Event Code: 518
Message: Der Windows CardSpace-Dienst befand sich einige Zeit im Leerlauf. Er wurde heruntergefahren, um Ressourcen für andere Programme bereitzustellen.
Record Number: 51637
Source Name: CardSpace 3.0.0.0
Time Written: 20090815165632.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: Andrea-PC
Event Code: 0
Message: Der Dienst wurde beendet.
Record Number: 51638
Source Name: idsvc
Time Written: 20090815165632.000000-000
Event Type: Informationen
User:

=====Security event log=====

Computer Name: Andrea-PC
Event Code: 5038
Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.

Dateiname: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys
Record Number: 57000
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090815180750.920979-000
Event Type: Überwachung gescheitert
User:

Computer Name: Andrea-PC
Event Code: 5038
Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.

Dateiname: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys
Record Number: 57001
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090815180751.018629-000
Event Type: Überwachung gescheitert
User:

Computer Name: Andrea-PC
Event Code: 5038
Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.

Dateiname: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys
Record Number: 57002
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090815180751.103584-000
Event Type: Überwachung gescheitert
User:

Computer Name: Andrea-PC
Event Code: 5038
Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.

Dateiname: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys
Record Number: 57003
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090815180751.184634-000
Event Type: Überwachung gescheitert
User:

Computer Name: Andrea-PC
Event Code: 5038
Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.

Dateiname: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys
Record Number: 57004
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090815180751.279354-000
Event Type: Überwachung gescheitert
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"configsetroot"=%SystemRoot%\ConfigSetRoot

-----------------EOF-----------------
und warum SUPERAntiSpyware weg machen

danke gregor

und warum SUPERAntiSpyware weg machen

Es startet sich automatisch, wenn Windows startet. Wenn du es behalten möchtest, dann deaktiviere den Wächter.

Starte SuperAntiSpyware => Präferenzen => Karte: General und Hochfahren => Entferne die ersten 3 Haken auf der linken Seite

1.) Deinstalliere:

• Adobe Reader 8.1.2
• Asus_Camera_ScreenSaver
• Azureus (Virenschleuder)
• Google Toolbar for Internet Explorer
• Hervorhebe-Funktion (Windows Live Toolbar)
• Java(TM) 6 Update 14
• Mozilla Firefox (3.0.12)
• Skype™ 3.6
• Smart Menus (Windows Live Toolbar)
• Spybot - Search & Destroy
• Windows Live Favorites für Windows Live Toolbar
• Windows Live Toolbar

2.) Installiere (Toolbars immer abwählen, Haken weg):

• Webbrowser Firefox | Schneller, sicherer & anpassbar | Mozilla Europe
  http://www.java.com/de/download/manual.jsp
• Adobe Reader oder besser FoxIt Reader
• Skype jetzt kostenlos herunterladen für kostenlose Anrufe und Internetanrufe

Message: AntiVir erkannte in der Datei C:\Windows\temp\TMP0000006F6411703C8D9FBF45 verdächtigen Code mit der Bezeichnung 'TR/Rootkit.Gen'!

=> http://www.trojaner-board.de/74908-a...t-scanner.html

ciao, andreas

omg was ist den ein rootkit schon wieder ....wird mein system überhaupt noch sauber

GMER 1.0.15.15077 [3r9hrpi5.exe] - http://www.gmer.net
Rootkit scan 2009-08-18 11:33:02
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.15 ----

Ssdt 9959910C ZwCreateThread
Ssdt 995990F8 ZwOpenProcess
Ssdt 995990FD ZwOpenThread
Ssdt \?? \ C: \ Program Files \ SUPERAntiSpyware \ SASKUTIL.sys ZwTerminateProcess [0x805D00B0]

---- Kernel-Code Abschnitte - GMER 1.0.15 ----

. Ntkrnlpa.exe Text! KeSetTimerEx + 454 81ED5A18 4 Bytes [0C, 91, 59, 99] (oder Al, 0x91; POP ECX; CDQ)
. Ntkrnlpa.exe Text! KeSetTimerEx + 624 81ED5BE8 4 Bytes [F8, 90, 59, 99] (CLC; NOP; POP ECX; CDQ)
. Ntkrnlpa.exe Text! KeSetTimerEx + 640 81ED5C04 4 Bytes [FD, 90, 59, 99] (std; NOP; POP ECX; CDQ)
. Ntkrnlpa.exe Text! KeSetTimerEx + 854 81ED5E18 4 Bytes [B0, 00, 5D, 80]

---- User code sections - GMER 1.0.15 ----

. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! FindResourceExA 763708DD 7 Bytes JMP 28001D80 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! FindResourceA 763709A5 5 Bytes JMP 28001CF0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! CreateEventA 76384AD8 5 Bytes JMP 28001840 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! LockResource 76387F1F 5 Bytes JMP 28001F50 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! FindResourceExW 7638813B 1 Byte [E9]
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! FindResourceExW 7638813B 7 Bytes JMP 28001C60 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! LoadResource 76388213 7 Bytes JMP 28001E20 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! FindResourceW 763897C7 5 Bytes JMP 28001BE0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] kernel32.dll! SizeofResource 763897E5 7 Bytes JMP 28001EE0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] Advapi32.dll! CryptDeriveKey 7782E6F6 7 Bytes JMP 28001000 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] Advapi32.dll! CryptDecrypt 7782E8D9 7 Bytes JMP 28001060 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! SetWindowPlacement 764279BB 5 Bytes JMP 28005D80 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! SetWindowRgn 764295E2 7 Bytes JMP 28005EC0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! LoadImageW 7642D61D 5 Bytes JMP 28006650 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! LoadIconW 7642EC94 5 Bytes JMP 28006840 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! CreateWindowExW 76433D67 5 Bytes JMP 28003C70 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! GetWindowLongW 7643F67F 7 Bytes JMP 280069E0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! PeekMessageW 7643FD9F 5 Bytes JMP 280045B0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! TrackPopupMenuEx 76450F4D 5 Bytes JMP 28004E90 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! CreateDialogParamW 76451C58 5 Bytes JMP 28006000 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] User32.dll! MessageBoxIndirectW 7647D56B 5 Bytes JMP 280061F0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ws2_32.dll! closesocket 7794330C 5 Bytes JMP 2800B5E0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ws2_32.dll! recv 7794343A 5 Bytes JMP 2800AE00 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ws2_32.dll! WSASend 77944496 5 Bytes JMP 2800B3A0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ws2_32.dll! senden 7794659B 5 Bytes JMP 2800B1C0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ws2_32.dll! WSARecv 77948400 5 Bytes JMP 2800AFA0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] SHELL32.DLL! Shell_NotifyIconW 768AC808 5 Bytes JMP 280033D0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ole32.dll! CoRegisterClassObject 776E45AC 5 Bytes JMP 28002360 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ole32.dll! CoInitializeEx 7771B89A 5 Bytes JMP 28002260 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] ole32.dll! CoCreateInstance 7771E188 5 Bytes JMP 28002600 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] WININET.DLL! HttpOpenRequestA 767406E6 5 Bytes JMP 28009CC0 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] WININET.DLL! InternetCloseHandle 7674608B 5 Bytes JMP 2800A000 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] WININET.DLL! InternetReadFile 7674A077 3 Bytes JMP 28009E50 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] WININET.DLL! InternetReadFile + 4 7674A07B 1 Byte [B1]
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] WININET.DLL! HttpSendRequestA 767508D5 3 Bytes JMP 28009F30 C: \ Program Files \ Messenger Plus! Live \ MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
. text C: \ Program Files \ Windows Live \ Messenger \ msnmsgr.exe [2344] WININET.DLL! HttpSendRequestA + 4 767508D9 1 Byte [B1]
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! DialogBoxIndirectParamW 7642BD25 5 Bytes JMP 71660696 C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! DialogBoxParamW 76441FD5 5 Bytes JMP 71660620 C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! DialogBoxParamA 764680B2 5 Bytes JMP 7166065B C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! DialogBoxIndirectParamA 764683DD 5 Bytes JMP 716606D1 C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! MessageBoxIndirectA 7647D471 5 Bytes JMP 716605DC C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! MessageBoxIndirectW 7647D56B 5 Bytes JMP 71660598 C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! MessageBoxExA 7647D5D1 5 Bytes JMP 7166055E C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] User32.dll! MessageBoxExW 7647D5F5 5 Bytes JMP 71660524 C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ole32.dll! OleLoadFromStream 776E9726 5 Bytes JMP 71660893 C: \ Windows \ system32 \ Ieframe.dll (Internet Explorer / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ws2_32.dll! closesocket 7794330C 5 Bytes JMP 6A38EEE9 C: \ Program Files \ Microsoft \ Search Enhancement Pack \ SeaNote \ SeaNote.dll (Microsoft Search Note / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ws2_32.dll! recv 7794343A 5 Bytes JMP 6A38F1C3 C: \ Program Files \ Microsoft \ Search Enhancement Pack \ SeaNote \ SeaNote.dll (Microsoft Search Note / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ws2_32.dll! Buchse 779436D1 5 Bytes JMP 6A38E59E C: \ Program Files \ Microsoft \ Search Enhancement Pack \ SeaNote \ SeaNote.dll (Microsoft Search Note / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ws2_32.dll! Verbindung 779440D9 5 Bytes JMP 6A38E62A C: \ Program Files \ Microsoft \ Search Enhancement Pack \ SeaNote \ SeaNote.dll (Microsoft Search Note / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ws2_32.dll! getaddrinfo 7794418A 5 Bytes JMP 6A38E71D C: \ Program Files \ Microsoft \ Search Enhancement Pack \ SeaNote \ SeaNote.dll (Microsoft Search Note / Microsoft Corporation)
. text C: \ Program Files \ Internet Explorer \ iexplore.exe [2552] ws2_32.dll! senden 7794659B 5 Bytes JMP 6A38E9ED C: \ Program Files \ Microsoft \ Search Enhancement Pack \ SeaNote \ SeaNote.dll (Microsoft Search Note / Microsoft Corporation)
. text C: \ Program Files \ Windows Live \ Family Safety \ fsssvc.exe [3492] Advapi32.dll! RegOpenKeyExA 7784D4E8 5 Bytes JMP 0064F7BF C: \ Program Files \ Windows Live \ Family Safety \ fsssvc.exe (Familie Sicherheit Service / Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \ Driver \ kbdclass \ Device \ KeyboardClass0 Wdf01000.sys (WDF Dynamic / Microsoft Corporation)
AttachedDevice \ Driver \ kbdclass \ Device \ KeyboardClass1 Wdf01000.sys (WDF Dynamic / Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM \ SYSTEM \ CurrentControlSet \ Services \ BTHPORT \ Parameters \ Keys \ 0018f337f16b
Reg HKLM \ SYSTEM \ ControlSet002 \ Services \ BTHPORT \ Parameters \ Keys \ 0018f337f16b (nicht aktiv ControlSet)

---- EOF - GMER 1.0.15 ----

*kurzeinspring*

Messenger Plus! Live - auch deinstallieren! (enthält Adware
bei Installation bitte IMMER mitlesen und Sponsorprogramme, Toolbars (wie john.doe Dir auch schon empfohlen hat) abwählen!