| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07AWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.11.2009, 02:10
| #1 |
 |  Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A hallo, ich nutze kaspersky security suite cbe. seit etwa einer woche ( nach komplettscan nach längerer zeit) bekomme ich die meldung: gefunden: neue Bedrohung Hidden.Object (Modifikation) Datei: C:\WINDOWS:45203195861BE07A ich habe ein administrator und ein online profil. seitdem scanne ich regelmässig den "kritischen bereich", die scans habe ich im administrator-profil durchgeführt. nach neustart und neu-scan war das problem gelöst. ich dachte, dass es damit auch im online-profil erledigt sei. dass dem nicht so ist, habe ich erst gestern festgestellt. auch nachdem ich das online-profil zum administratorkonto (benutzerkontoänderung) umgeändert habe, lässt sich das problem nicht lösen. trotz der meldung, dass nach dem neustart alles gelöscht würde, bleibt es - im gegensatz zum administrator-profil - im online-profil vorhanden. Code:
ATTFilter Malwarebytes' Anti-Malware 1.41 Datenbank Version: 3130 Windows 5.1.2600 Service Pack 3 09.11.2009 00:28:50 mbam-log-2009-11-09 (00-28-20).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 172351 Laufzeit: 1 hour(s), 15 minute(s), 12 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 1 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Rogue.Installer) -> No action taken. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Programme\Setup.exe (Rogue.Installer) -> No action taken. Logfile of random's system information tool 1.06 (written by random/random) Run by xxx Online at 2009-11-09 00:35:21 Microsoft Windows XP Professional Service Pack 3 System drive C: has 12 GB (16%) free of 76 GB Total RAM: 511 MB (48% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:35:52, on 09.11.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Sophos\AutoUpdate\ALMon.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe C:\Programme\CDBurnerXP\NMSAccessU.exe C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe C:\Programme\Sophos\AutoUpdate\ALsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\ISW\netcol.dsl\signup\NcDial.exe C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\RSIT.exe C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\xxx Online.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.internetcologne.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://www.internetcologne.de R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.internetcologne.de O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinDSL MTU-Adjust] WinDSL_MTU.exe O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Programme\Sophos\AutoUpdate\ALMon.exe O4 - Global Startup: Orbit.lnk = C:\Programme\Orbitdownloader\orbitdm.exe O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\ie_banner_deny.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\SCIEPlgn.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CS1\Services\Tcpip\..\{13D3DF4D-676D-426B-AC74-14701C35A747}: NameServer = 213.168.112.60 194.8.194.60 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: Kaspersky Security Suite CBE (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- End of file - 8166 bytes Geändert von madz (09.11.2009 um 02:18 Uhr) |
|
09.11.2009, 02:13
| #2 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A und hier der rest:
__________________Code:
ATTFilter
======Scheduled tasks folder======
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - C:\Programme\Orbitdownloader\orbitcth.dll [2009-02-04 134344]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-07-12 312928]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-12 35840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-12 73728]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"=C:\WINDOWS\System32\NeroCheck.exe [2001-07-09 155648]
"CloneCDTray"=C:\Programme\SlySoft\CloneCD\CloneCDTray.exe [2006-09-28 57344]
"AVP"=C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe [2008-05-01 221184]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"WinDSL MTU-Adjust"=C:\WINDOWS\system32\WinDSL_MTU.exe [2001-02-15 65536]
"UnlockerAssistant"=C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe [2008-05-02 15872]
"TrueImageMonitor.exe"=C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe [2005-11-30 1009779]
"Acronis Scheduler2 Service"=C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe [2005-11-30 118784]
"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-07-12 148888]
"TkBellExe"=C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2009-07-12 198160]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NeroFilterCheck"=C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe [2007-03-01 153136]
"NBKeyScan"=C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-12-03 2213160]
"QuickTime Task"=C:\Programme\QuickTime\QTTask.exe [2009-05-26 413696]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-09-10 420176]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"AnyDVD"=C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe [2008-09-09 2182080]
"msnmsgr"=C:\Programme\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"QuickTime Task"=C:\Programme\QuickTime\QTTask.exe [2009-05-26 413696]
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
AutoUpdate Monitor.lnk - C:\Programme\Sophos\AutoUpdate\ALMon.exe
Orbit.lnk - C:\Programme\Orbitdownloader\orbitdm.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Programme\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-02-08 219664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-08-24 133120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Programme\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SAVService]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Orbitdownloader\orbitdm.exe"="C:\Programme\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"C:\Programme\Orbitdownloader\orbitnet.exe"="C:\Programme\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
======List of files/folders created in the last 3 months======
2009-11-08 22:00:11 ----D---- C:\rsit
2009-11-08 21:58:18 ----D---- C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Malwarebytes
2009-11-08 21:58:03 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-11-08 21:58:03 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-11-02 16:02:16 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee
2009-10-31 16:01:51 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee Security Scan
2009-10-27 20:14:59 ----A---- C:\WINDOWS\ppdrv.ini
2009-10-27 20:14:34 ----A---- C:\WINDOWS\system32\umaxud32.dll
2009-10-27 20:14:34 ----A---- C:\WINDOWS\system32\umaxu12.dll
2009-10-27 20:14:33 ----A---- C:\WINDOWS\system32\umaxscan.dll
2009-08-30 20:24:36 ----D---- C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Apple Computer
2009-08-30 19:55:19 ----D---- C:\Programme\QuickTime
2009-08-30 19:55:01 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2009-08-30 19:44:12 ----D---- C:\Programme\Apple Software Update
2009-08-30 19:44:11 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2009-08-16 17:02:47 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVS4YOU
2009-08-16 16:58:56 ----D---- C:\Programme\Gemeinsame Dateien\AVSMedia
2009-08-16 16:53:10 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-08-16 16:49:50 ----A---- C:\WINDOWS\system32\msvcp70.dll
2009-08-16 16:49:50 ----A---- C:\WINDOWS\system32\mfc70.dll
2009-08-16 16:49:49 ----A---- C:\WINDOWS\system32\msxml3a.dll
2009-08-16 16:49:49 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2009-08-16 16:49:48 ----D---- C:\Programme\AVS4YOU
2009-08-15 21:30:28 ----D---- C:\Programme\MultiCard
2009-08-15 21:03:14 ----A---- C:\WINDOWS\Irremote.ini
2009-08-15 20:59:43 ----D---- C:\Programme\Windows Sidebar
2009-08-15 09:28:50 ----D---- C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Nero
2009-08-15 00:20:16 ----A---- C:\WINDOWS\system32\MsiExec.exe.log
2009-08-15 00:13:57 ----D---- C:\Programme\Gemeinsame Dateien\Nero
2009-08-14 16:13:35 ----D---- C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Canneverbe_Limited
2009-08-14 15:05:20 ----D---- C:\finalburner
2009-08-11 15:44:54 ----A---- C:\WINDOWS\muma2000.INI
2009-08-11 15:32:10 ----A---- C:\WINDOWS\MAGIX.ini
2009-08-11 15:31:53 ----D---- C:\MAGIX
2009-08-10 12:04:19 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2009-08-10 12:04:19 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2009-08-10 12:04:18 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2009-08-10 12:04:15 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2009-08-10 12:04:15 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2009-08-10 12:04:14 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2009-08-10 12:04:14 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2009-08-10 12:04:12 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2009-08-10 12:04:12 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2009-08-10 12:04:11 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2009-08-10 12:04:09 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2009-08-10 12:04:09 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2009-08-10 12:04:08 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2009-08-10 12:04:08 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2009-08-10 12:04:07 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2009-08-10 12:04:07 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2009-08-10 12:04:06 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2009-08-10 12:04:05 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2009-08-10 12:04:05 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2009-08-10 12:04:04 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2009-08-10 12:04:03 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2009-08-10 12:04:03 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2009-08-10 12:04:02 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2009-08-10 12:04:01 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2009-08-10 12:03:59 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2009-08-10 12:03:59 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2009-08-10 12:03:58 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2009-08-10 12:03:57 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2009-08-10 12:03:56 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2009-08-10 12:03:56 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2009-08-10 12:03:55 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2009-08-10 12:03:55 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2009-08-10 12:03:54 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2009-08-10 12:03:53 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2009-08-10 12:03:51 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2009-08-10 12:03:51 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2009-08-10 12:03:50 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2009-08-10 12:03:48 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2009-08-10 12:03:47 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2009-08-10 12:03:47 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2009-08-10 12:03:36 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2009-08-10 12:03:29 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2009-08-10 12:03:29 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2009-08-10 12:03:24 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2009-08-10 12:03:24 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2009-08-10 12:03:18 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2009-08-10 12:03:12 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-08-10 12:03:03 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2009-08-10 12:02:58 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2009-08-10 12:02:58 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2009-08-10 12:02:47 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2009-08-10 12:02:44 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2009-08-10 12:02:31 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2009-08-10 12:02:29 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-08-10 12:02:27 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2009-08-10 12:02:27 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2009-08-10 12:02:26 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2009-08-10 12:02:23 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2009-08-10 12:02:21 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2009-08-10 12:02:20 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2009-08-10 12:02:19 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2009-08-10 12:02:17 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2009-08-10 12:01:55 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2009-08-10 12:01:55 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2009-08-10 12:01:54 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2009-08-10 12:01:50 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2009-08-10 12:01:49 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-08-10 12:01:47 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2009-08-10 12:01:46 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2009-08-10 12:01:36 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2009-08-10 11:54:33 ----D---- C:\WINDOWS\Logs
======List of files/folders modified in the last 3 months======
2009-11-08 23:34:33 ----D---- C:\WINDOWS\Temp
2009-11-08 22:57:42 ----D---- C:\Programme\Mozilla Firefox
2009-11-08 22:51:51 ----D---- C:\WINDOWS\Minidump
2009-11-08 22:51:51 ----AD---- C:\WINDOWS
2009-11-08 21:58:07 ----D---- C:\WINDOWS\Prefetch
2009-11-08 21:58:05 ----D---- C:\WINDOWS\system32\drivers
2009-11-08 21:58:03 ----RD---- C:\Programme
2009-11-08 21:20:26 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-08 21:20:05 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2009-11-08 21:19:24 ----D---- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Orbit
2009-11-08 21:17:30 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-11-08 19:06:41 ----A---- C:\WINDOWS\NeroDigital.ini
2009-11-08 18:21:15 ----D---- C:\WINDOWS\SoftwareDistribution
2009-11-08 01:52:25 ----D---- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\vlc
2009-11-06 14:14:47 ----D---- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\dvdcss
2009-11-04 08:30:04 ----D---- C:\Programme\SUPERAntiSpyware
2009-10-28 10:44:33 ----D---- C:\WINDOWS\system32
2009-10-28 10:44:33 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-10-27 20:44:10 ----SD---- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Microsoft
2009-10-27 20:14:56 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-09-21 20:36:11 ----A---- C:\WINDOWS\system32\lsdelete.exe
2009-08-30 20:04:38 ----SHD---- C:\WINDOWS\Installer
2009-08-30 19:45:11 ----SD---- C:\WINDOWS\Tasks
2009-08-23 22:48:55 ----HD---- C:\WINDOWS\inf
2009-08-16 16:58:56 ----D---- C:\Programme\Gemeinsame Dateien
2009-08-16 16:53:49 ----D---- C:\Programme\Windows Media Player
2009-08-15 21:01:34 ----D---- C:\Programme\Nero
2009-08-15 20:52:48 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero
2009-08-15 00:13:53 ----D---- C:\WINDOWS\Cursors
2009-08-15 00:07:02 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-08-11 15:31:36 ----D---- C:\WINDOWS\system
2009-08-10 13:06:02 ----D---- C:\Programme\ffdshow
2009-08-10 12:04:28 ----D---- C:\WINDOWS\system32\DirectX
2009-08-10 12:02:17 ----RSD---- C:\WINDOWS\assembly
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AmdK7;AMD K7-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-14 41856]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2008-07-21 24392]
R1 klif;Klif; \??\C:\WINDOWS\system32\drivers\klif.sys []
R1 SASDIFSV;SASDIFSV; \??\C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys []
R1 SAVOnAccessControl;SAVOnAccessControl; C:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys [2008-07-18 104704]
R1 SAVOnAccessFilter;SAVOnAccessFilter; C:\WINDOWS\system32\DRIVERS\savonaccessfilter.sys [2008-07-18 35584]
R1 Uim_IM;UIM Drive Backup Image Plugin; C:\WINDOWS\System32\Drivers\Uim_IM.sys [2007-09-05 131736]
R1 UimBus;Universal Image Mounter Controller; C:\WINDOWS\system32\DRIVERS\UimBus.sys [2007-09-05 32080]
R2 acedrv10;acedrv10; \??\C:\WINDOWS\System32\drivers\acedrv10.sys []
R2 acehlp10;acehlp10; \??\C:\WINDOWS\System32\drivers\acehlp10.sys []
R2 ASPIXNT;ASPIXNT; C:\WINDOWS\system32\drivers\ASPIXNT.sys [2008-12-27 6336]
R2 tifsfilter;Acronis TrueImage FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2009-07-06 30688]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2008-09-04 99648]
R3 ati2mtaa;ati2mtaa; C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys [2008-04-14 327168]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2007-02-16 34760]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2007-02-16 11984]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 Maplom;Maplom; C:\WINDOWS\system32\drivers\Maplom.sys [2008-09-08 37312]
R3 MaplomL;MaplomL; C:\WINDOWS\system32\drivers\MaplomL.sys [2008-09-08 38336]
R3 rtl8139;NT-Treiber für Realtek RTL8139(A/B/C)-basierten PCI-Fast Ethernetadapter; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 VIAudio;VIA AC'97 Enhanced Audio Controller (WDM); C:\WINDOWS\system32\drivers\viaudio.sys [2002-03-11 43776]
R3 WinDSLa;WinDSL-Adapter (PPP-over-Ethernet); C:\WINDOWS\system32\DRIVERS\WinDSL.sys [2002-02-08 47056]
S3 ati2mpaa;ati2mpaa; C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys [2001-08-18 281984]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 DCamUSBEMPIA;PCTV USB2 2821 Capture; C:\WINDOWS\system32\DRIVERS\emDevice.sys [2004-04-06 100957]
S3 emAudio;PCTV USB2 2821 Audio; C:\WINDOWS\system32\drivers\emAudio.sys [2004-05-05 19584]
S3 FETNDIS;VIA PCI 10/100-MBit/s-Fast Ethernetadapter-NT-Treiber; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 FiltUSBEMPIA;USB Device Lower Filter; C:\WINDOWS\system32\DRIVERS\emFilter.sys [2004-04-06 5245]
S3 MHIKEY10;MHIKEY10; C:\WINDOWS\System32\Drivers\MHIKEY10.sys [2008-05-27 51072]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SASENUM;SASENUM; \??\C:\Programme\SUPERAntiSpyware\SASENUM.SYS []
S3 ScanUSBEMPIA;USB Still Image Capture Device; C:\WINDOWS\system32\DRIVERS\emScan.sys [2004-04-06 4493]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WinDSLp;%WinDSLp_Desc%; C:\WINDOWS\system32\DRIVERS\WinDSL.sys [2002-02-08 47056]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-08-24 38656]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 SophosBootDriver;SophosBootDriver; C:\WINDOWS\system32\DRIVERS\SophosBootDriver.sys [2008-05-23 14976]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe [2005-11-30 172032]
R2 AVP;Kaspersky Security Suite CBE; C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe [2008-05-01 221184]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-07-12 152984]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Programme\Lavasoft\Ad-Aware\AAWService.exe [2009-09-21 1028432]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
R2 NMSAccessU;NMSAccessU; C:\Programme\CDBurnerXP\NMSAccessU.exe [2009-07-13 71096]
R2 SAVAdminService;Sophos Anti-Virus Statusreporter; C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2008-12-09 69632]
R2 SAVService;Sophos Anti-Virus; C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe [2008-12-09 98304]
R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service; C:\Programme\Sophos\AutoUpdate\ALsvc.exe [2008-06-26 172032]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
-----------------EOF-----------------
bitte hiiiiiilfeeee. vielen dank schon mal, für´s lesen. :-) madz |
|
12.11.2009, 15:36
| #3 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A sorry, mir ist aufgefallen, dass noch eine angabe fehlt: es handelt sich um ein windows xp betriebssystem.
__________________ich hoffe, das war's an fehlern.  gruss, madz |
|
30.11.2009, 22:58
| #4 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A hallo, nach wochen des wartens nicht mal eine klitzekleine antwort. :-( selbst ein: "keine ahnung", "bearbeiten wir nicht", oder "du hast was vergessen oder falsch gemacht" wäre schon okay gewesen. dann wüsste frau wenigstens wo sie dran ist. wenn gar nichts mehr kommt, kann mein beitrag auch gelöscht werden. gruss, madz |
|
30.11.2009, 23:02
| #5 |
| /// Selecta Jahrusso   | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A Wenn Du mit dir selber schreibst, denkt jeder der Thread ist schon in arbeit  Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite bitte folgendes ab. Poste bitte alle Logfiles in Code-Tags. Klicke antworten --> # danach [code]text[/code] So sollte das dann hier aussehen nach dem antworten: Code:
ATTFilter deine Logfile
Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. schritt 1 Windows-Explorer öffnen (Windows-Taste + E) und unter => Extras => Ordneroptionen => im Reiter "Ansicht"
schritt 2 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
%SYSTEMDRIVE%\*.exe
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5
%SYSTEMDRIVE%\ntelogon.dll /s /md5
%SYSTEMDRIVE%\logevent.dll /s /md5
%SYSTEMDRIVE%\iaStor.sys /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\IdeChnDr.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5
%SYSTEMDRIVE%\nvatabus.sys /s /md5
CREATERESTOREPOINT
schritt 3 Rootkit-Suche Was sind Rootkits? Einige Scans auf Dateien, Prozesse u2nd Registryeinträge, die vor den meisten anderen Scannern versteckt werden (durch ein sogenanntes Rootkit). Während dieser Scans soll(en):
Nun das Logfile in Code-Tags posten.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
03.12.2009, 03:43
| #6 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A hallo daniel, schön dich zu lesen! :-) ich hatte schon die hoffnung aufgegeben. und jetzt lese ich: keine crosspostings... ich wusste nicht, dass das ein problem ist, und habe in einem anderen forum gepostet, als hier nix kam... habe ein hjt gepostet, antivir rescue und clamwin laufen lassen und alle überzähligen virenscanner entfernt. ist seit wochen abgeschlossen. bitte jetzt nicht wieder in der versenkung verschwinden... die arbeit schreckt mich nicht. hier schon mal OTL: # Code:
ATTFilter OTL logfile created on: 01.12.2009 03:45:36 - Run 1 OTL by OldTimer - Version 3.1.11.4 Folder = C:\Dokumente und Einstellungen\xxx Online\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 511,48 Mb Total Physical Memory | 209,57 Mb Available Physical Memory | 40,97% Memory free 1,22 Gb Paging File | 0,68 Gb Available in Paging File | 55,90% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 74,52 Gb Total Space | 9,72 Gb Free Space | 13,05% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: NERD Current User Name: xxx Online Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2009.12.01 03:38:43 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Claudia Online\Desktop\OTL.exe PRC - [2009.11.06 17:06:58 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2009.07.13 22:18:12 | 00,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe PRC - [2009.07.12 22:38:38 | 00,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe PRC - [2009.07.12 22:23:43 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jqs.exe PRC - [2009.07.12 22:23:43 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jusched.exe PRC - [2008.09.24 13:32:48 | 00,935,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe PRC - [2008.05.02 05:15:46 | 00,015,872 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe PRC - [2008.05.01 15:33:30 | 00,221,184 | ---- | M] (Kaspersky Lab) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe PRC - [2008.04.14 07:53:08 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2008.04.14 07:52:46 | 01,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.12.03 13:21:24 | 00,869,672 | ---- | M] (Nero AG) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe PRC - [2005.11.30 12:08:52 | 01,009,779 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe PRC - [2005.11.30 12:08:52 | 00,172,032 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe PRC - [2005.11.30 12:08:52 | 00,118,784 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe PRC - [2004.12.15 13:01:18 | 00,230,400 | ---- | M] (ProDyne) -- C:\WINDOWS\ISW\netcol.dsl\signup\ncdial.exe ========== Modules (SafeList) ========== MOD - [2009.12.01 03:38:43 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTL.exe MOD - [2008.05.02 05:15:35 | 00,004,608 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll MOD - [2008.02.08 19:37:48 | 00,088,592 | ---- | M] (Kaspersky Lab) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll MOD - [2008.02.08 19:37:42 | 00,048,656 | ---- | M] (Kaspersky Lab) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll MOD - [2008.02.08 19:37:30 | 00,084,496 | ---- | M] (Kaspersky Lab) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\adialhk.dll MOD - [2006.12.01 22:54:32 | 00,626,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll ========== Win32 Services (SafeList) ========== SRV - [2009.08.17 13:01:44 | 00,099,176 | ---- | M] (SiSoftware) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe -- (SandraAgentSrv) SRV - [2009.07.13 22:18:12 | 00,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU) SRV - [2009.07.12 22:23:43 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2008.09.24 13:32:48 | 00,935,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2008.05.01 15:33:30 | 00,221,184 | ---- | M] (Kaspersky Lab) -- C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe -- (AVP) SRV - [2007.12.13 18:10:56 | 00,447,784 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2007.12.03 13:21:24 | 00,869,672 | ---- | M] (Nero AG) -- C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3) SRV - [2005.11.30 12:08:52 | 00,172,032 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2003.07.28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.internetcologne.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.internetcologne.de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.internetcologne.de IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.0.8 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: orbit_ffext@orbitdownloader:2.02 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.07.12 22:40:20 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Components: C:\Programme\Mozilla Firefox\components [2009.11.06 17:07:07 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2009.11.06 17:07:07 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2009.11.06 17:07:07 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2009.11.06 17:07:07 | 00,000,000 | ---D | M] [2009.02.16 22:39:05 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Mozilla\Extensions [2009.11.30 21:30:41 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Mozilla\Firefox\Profiles\o89bzbcq.default\extensions [2009.11.20 23:28:04 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Mozilla\Firefox\Profiles\o89bzbcq.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34} [2009.11.30 21:30:42 | 00,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2009.10.29 02:20:28 | 00,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2009.10.29 02:20:28 | 00,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2009.10.29 02:20:29 | 00,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2009.10.29 02:20:29 | 00,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2009.10.29 02:20:29 | 00,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: (317135 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10878 more lines... O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe (Kaspersky Lab) O4 - HKLM..\Run: [ClamWin] C:\Programme\ClamWin\bin\ClamTray.exe (alch) O4 - HKLM..\Run: [CloneCDTray] C:\Programme\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.) O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [NBKeyScan] C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [QuickTime Task] C:\Programme\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (Acronis) O4 - HKLM..\Run: [UnlockerAssistant] C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe () O4 - HKLM..\Run: [WinDSL MTU-Adjust] C:\WINDOWS\System32\WinDSL_MTU.exe (Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) O4 - HKCU..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.) O4 - HKCU..\Run: [QuickTime Task] C:\Programme\QuickTime\QTTask.exe (Apple Inc.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\ie_banner_deny.htm () O9 - Extra Button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\SCIEPlgn.dll (Kaspersky Lab) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O15 - HKLM\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 56 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\adialhk.dll (Kaspersky Lab) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.11.28 19:53:22 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2008.11.28 19:52:59 | 00,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found # |
|
03.12.2009, 03:48
| #7 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A 2. teil otl # Code:
ATTFilter CREATERESTOREPOINT Restore point Set: OTL Restore Point (55735494247448576) ========== Files/Folders - Created Within 14 Days ========== [2009.12.01 03:38:33 | 00,535,552 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTL.exe [2009.11.26 01:06:30 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Foxit [2009.11.24 02:44:07 | 00,000,000 | ---D | C] -- C:\Programme\Microsoft Silverlight [2009.11.24 02:42:02 | 00,000,000 | ---D | C] -- C:\Programme\Microsoft [2009.11.24 02:34:50 | 00,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\xxx Online\Recent [2009.11.22 20:40:27 | 00,000,000 | ---D | C] -- C:\Programme\SIW [2009.11.20 02:24:37 | 00,000,000 | ---D | C] -- C:\Programme\SiSoftware [2009.11.20 01:59:13 | 00,000,000 | ---D | C] -- C:\Programme\HD Tune [2009.08.04 13:57:36 | 75,082,408 | ---- | C] (Sony Creative Software Inc.) -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\90d_enu.exe [2009.07.14 13:02:30 | 00,339,968 | ---- | C] (Sophos Plc) -- C:\Programme\SavResJap.dll [2009.07.14 13:02:30 | 00,188,416 | ---- | C] (Sophos Plc) -- C:\Programme\SavResFra.dll [2009.07.14 13:02:30 | 00,143,360 | ---- | C] (Sophos Plc) -- C:\Programme\SavResIt.dll [2009.07.14 13:02:29 | 00,327,680 | ---- | C] (Sophos Plc) -- C:\Programme\SavResCht.dll [2009.07.14 13:02:29 | 00,249,856 | ---- | C] (Sophos Plc) -- C:\Programme\SavResChs.dll [2009.07.14 13:02:29 | 00,204,800 | ---- | C] (Sophos Plc) -- C:\Programme\SavResDeu.dll [2009.07.14 13:02:29 | 00,155,648 | ---- | C] (Sophos Plc) -- C:\Programme\SavResEsp.dll [2009.07.14 13:02:29 | 00,155,648 | ---- | C] (Sophos Plc) -- C:\Programme\SavResEng.dll [2009.07.14 13:02:24 | 00,252,984 | ---- | C] (Sophos Plc) -- C:\Programme\Setup.exe [2009.07.14 13:02:23 | 01,822,520 | ---- | C] (Microsoft Corporation) -- C:\Programme\instmsiW.exe [2009.07.14 12:22:40 | 00,396,288 | ---- | C] (Trend Micro Inc.) -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\HijackThis.exe [2009.05.11 21:30:49 | 75,082,408 | ---- | C] (Sony Creative Software Inc.) -- C:\Programme\90d_enu.exe [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [4 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 14 Days ========== [2009.12.01 03:48:59 | 00,387,104 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009.12.01 03:44:50 | 00,000,032 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009.12.01 03:41:51 | 01,002,496 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\GMER 30.11 auf 1.12. .doc [2009.12.01 03:39:46 | 12,320,768 | -H-- | M] () -- C:\Dokumente und Einstellungen\xxx Online\NTUSER.DAT [2009.12.01 03:38:43 | 00,535,552 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Claudia Online\Desktop\OTL.exe [2009.12.01 03:38:21 | 02,763,552 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat [2009.12.01 00:13:55 | 00,000,210 | -HS- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib [2009.12.01 00:12:08 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009.12.01 00:12:05 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009.12.01 00:12:04 | 53,639,9872 | -HS- | M] () -- C:\hiberfil.sys [2009.12.01 00:11:06 | 00,273,608 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx [2009.11.30 23:41:54 | 00,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Claudia Online\ntuser.ini [2009.11.30 20:44:41 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009.11.29 03:29:47 | 00,285,696 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 28.11.09 23.48 uhr.xls [2009.11.29 03:23:06 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009.11.29 03:23:01 | 00,180,736 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.11.28 21:48:20 | 00,285,184 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 28.11.09 21.48 uhr.xls [2009.11.28 17:42:57 | 00,285,184 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 28.11.09 17.41 uhr.xls [2009.11.28 14:11:01 | 00,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009.11.26 01:43:20 | 00,265,216 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Pearl 25.11.09.doc [2009.11.25 20:57:28 | 00,022,905 | ---- | M] () -- C:\Dokumente und Einstellungen\Claudia Online\Desktop\Irrtuemer_und_Geruechte_ueber Katzen.pdf [2009.11.24 02:49:44 | 00,045,956 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\cc_20091124_024919.reg [2009.11.23 20:30:53 | 61,810,688 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\avira rescue image.iso [2009.11.23 19:46:48 | 00,458,240 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\DVD BIOS kopie REGISTRY.doc [2009.11.23 19:46:20 | 00,167,936 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\DVD BIOS PROBS.doc [2009.11.22 02:03:21 | 00,284,672 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 21.11.09 20.41 uhr.xls [2009.11.22 00:00:38 | 00,000,791 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\Verknüpfung mit msnmsgr.lnk [2009.11.20 02:26:31 | 00,000,994 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SiSoftware Sandra Lite 2009.SP4.lnk [2009.11.17 21:25:09 | 00,384,138 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h25m09s115.png [2009.11.17 21:24:30 | 00,321,814 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h24m30s22.png [2009.11.17 21:24:01 | 00,447,904 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h24m01s250.png [2009.11.17 21:23:43 | 00,447,904 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h23m43s250.png [2009.11.17 20:17:41 | 00,073,728 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\TV GRAU 2.doc [2009.11.17 20:10:33 | 00,072,192 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\TV GRAU.doc [2009.11.17 10:45:50 | 73,851,0682 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\PICT0001.MOV [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [4 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2009.12.01 03:41:51 | 01,002,496 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\GMER 30.11 auf 1.12. .doc [2009.11.29 00:08:03 | 00,285,696 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 28.11.09 23.48 uhr.xls [2009.11.28 21:48:18 | 00,285,184 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 28.11.09 21.48 uhr.xls [2009.11.28 17:42:54 | 00,285,184 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 28.11.09 17.41 uhr.xls [2009.11.26 01:43:19 | 00,265,216 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Pearl 25.11.09.doc [2009.11.25 20:57:02 | 00,022,905 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\Irrtuemer_und_Geruechte_ueber Katzen.pdf [2009.11.24 02:49:28 | 00,045,956 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\cc_20091124_024919.reg [2009.11.23 20:30:34 | 61,810,688 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\avira rescue image.iso [2009.11.23 19:46:48 | 00,458,240 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\DVD BIOS kopie REGISTRY.doc [2009.11.23 19:46:19 | 00,167,936 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\DVD BIOS PROBS.doc [2009.11.23 17:02:29 | 53,639,9872 | -HS- | C] () -- C:\hiberfil.sys [2009.11.22 00:00:38 | 00,000,791 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\Verknüpfung mit msnmsgr.lnk [2009.11.21 20:41:54 | 00,284,672 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\OTR Filme-Liste 21.11.09 20.41 uhr.xls [2009.11.20 02:26:31 | 00,000,994 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\SiSoftware Sandra Lite 2009.SP4.lnk [2009.11.20 02:24:57 | 11,808,768 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\sandra.mda [2009.11.20 01:57:34 | 00,286,208 | ---- | C] () -- C:\Programme\gmer.exe [2009.11.17 21:25:09 | 00,384,138 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h25m09s115.png [2009.11.17 21:24:30 | 00,321,814 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h24m30s22.png [2009.11.17 21:24:01 | 00,447,904 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h24m01s250.png [2009.11.17 21:23:43 | 00,447,904 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\vlcsnap-2009-11-17-21h23m43s250.png [2009.11.17 20:17:41 | 00,073,728 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\TV GRAU 2.doc [2009.11.17 20:10:33 | 00,072,192 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\TV GRAU.doc [2009.11.17 19:55:05 | 73,851,0682 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Desktop\PICT0001.MOV [2009.10.27 20:14:59 | 00,000,135 | ---- | C] () -- C:\WINDOWS\ppdrv.ini [2009.08.15 21:03:14 | 00,004,757 | ---- | C] () -- C:\WINDOWS\Irremote.ini [2009.08.11 15:44:54 | 00,000,179 | ---- | C] () -- C:\WINDOWS\muma2000.INI [2009.08.11 15:32:10 | 00,000,094 | ---- | C] () -- C:\WINDOWS\MAGIX.ini [2009.07.14 13:02:23 | 00,049,974 | ---- | C] () -- C:\Programme\readsavxp_76_eng.html [2009.07.14 13:02:23 | 00,003,189 | ---- | C] () -- C:\Programme\readesavxpsa.txt [2009.03.16 04:33:45 | 00,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009.03.08 22:19:52 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009.03.08 22:19:48 | 00,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009.02.16 22:32:22 | 00,007,168 | ---- | C] () -- C:\WINDOWS\suecmdial.dll [2009.02.12 05:56:41 | 00,011,568 | ---- | C] () -- C:\WINDOWS\System32\drivers\UimFIO.sys [2009.02.12 05:56:38 | 04,244,744 | ---- | C] () -- C:\WINDOWS\System32\qtp-mt334.dll [2009.02.12 05:56:38 | 00,247,560 | ---- | C] () -- C:\WINDOWS\System32\prgiso.dll [2009.02.07 11:05:13 | 00,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll [2009.01.16 14:56:46 | 01,015,808 | ---- | C] () -- C:\WINDOWS\System32\MPEG4Evfw.dll [2008.12.27 23:30:39 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\UnAudioNT.dll [2008.12.27 23:21:11 | 00,002,605 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2008.12.27 23:21:10 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2008.12.20 23:33:01 | 00,000,210 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib [2008.11.30 18:31:40 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008.11.30 18:31:38 | 00,180,736 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx Online\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.11.28 20:35:44 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2008.11.06 17:37:32 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008.11.06 17:34:00 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2008.11.06 17:34:00 | 00,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2008.11.06 17:33:02 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [1996.04.03 20:33:26 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys ========== LOP Check ========== [2009.07.06 16:50:09 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis [2009.07.12 22:56:45 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Elaborate Bytes [2009.03.21 23:58:19 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle [2008.12.20 23:33:09 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft [2009.07.14 13:05:39 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos [2009.02.19 15:08:35 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VideoConverter [2009.08.14 16:13:35 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Canneverbe_Limited [2009.07.15 11:39:35 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\cut_assistant [2009.06.14 10:24:32 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\DataCache [2009.06.11 09:49:47 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\EVEREST Home Edition [2009.11.26 01:06:30 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Foxit [2009.07.03 11:02:44 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\gtk-2.0 [2009.11.22 20:20:06 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Orbit [2008.01.27 01:15:16 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Patch [2009.05.11 23:50:16 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Publish Providers [2009.05.11 23:49:40 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Sony [2009.06.25 17:20:34 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\TeamViewer [2009.05.11 20:46:11 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker [2009.11.28 14:11:01 | 00,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < %SYSTEMDRIVE%\eventlog.dll /s /md5 > [2002.08.29 03:43:22 | 00,049,152 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll [2008.04.14 07:52:12 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 07:52:12 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %SYSTEMDRIVE%\scecli.dll /s /md5 > [2002.08.29 03:43:30 | 00,181,248 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [2008.04.14 07:52:24 | 00,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 07:52:24 | 00,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %SYSTEMDRIVE%\netlogon.dll /s /md5 > [2002.08.29 03:43:26 | 00,399,360 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll [2008.04.14 07:52:20 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 07:52:20 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < %SYSTEMDRIVE%\cngaudit.dll /s /md5 > < %SYSTEMDRIVE%\sceclt.dll /s /md5 > < %SYSTEMDRIVE%\ntelogon.dll /s /md5 > < %SYSTEMDRIVE%\logevent.dll /s /md5 > < %SYSTEMDRIVE%\iaStor.sys /s /md5 > < %SYSTEMDRIVE%\nvstor.sys /s /md5 > < %SYSTEMDRIVE%\atapi.sys /s /md5 > [2002.08.29 01:27:50 | 00,086,912 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [2008.04.14 00:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.14 00:10:32 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys < %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 > < %SYSTEMDRIVE%\viasraid.sys /s /md5 > < %SYSTEMDRIVE%\AGP440.sys /s /md5 > [2008.04.14 00:06:40 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.14 00:06:40 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < %SYSTEMDRIVE%\vaxscsi.sys /s /md5 > < %SYSTEMDRIVE%\nvatabus.sys /s /md5 > < End of report > # gmer logfile mache ich morgen noch ein aktuelles. DANKE!!!! madz |
|
03.12.2009, 10:56
| #8 |
| /// Selecta Jahrusso | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A Das mit dem Crossposting ist auch Dein gutes Recht. Was uns stört ist wenn ich einen Post eines User lese, der am selben oder am Tag darauf in einem anderen Forum zu lesen ist.  Bevor wir Anfangen, kannst Du mir bitte den Link zu dem anderen Thread geben, damit ich lesen, was eventuell schon unternommen wurde. Und erklär mir bitte was gegen ein Formatieren spricht. Was ich bis jetzt sehe, sieht nicht gerade schön aus.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
03.12.2009, 12:55
| #9 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A auweia, ich wusste nicht, dass es so schlimm ist... gegen das formatieren spricht, dass ich nur EIN backup-image habe, und bei diesem, bereits ein paar monate alten, ist nicht sicher, ob es sauber ist... ausserdem ist es erst das dritte mal, dass ich ein system neu aufsetze. ich weiss nicht, was ich alles behalten darf, an avi und mp3-dateien, fotos, etc.. wo setzen sich die viecher überall dran? eine menge daten habe ich teilweise bereits länger auf externer FP muss ich die dann auch löschen, weil es sonst eine re-infizierung geben könnte, wenn ich sie irgendwann mal wieder auf die hautplatte ( betriebssystem) rüberhole? und alle programm, die ich mir mühsam bei chip und co. zusammengesucht habe, muss ich neu finden und installieren. :-( ich bin ein echter fan davon in kurzen abständen backups zu speichern, aber man merkt ja in den meisten fällen gar nicht, dass der pc infiziert ist, und schleppt die sachen dann genauso weiter mit, als wenn man sie (backups) nicht machen würde. bzw, wenn man EIN problem bemerkt, und das alte backup benutzt, ist auch nicht viel geholfen, weil die restliche schadware weiter fröhlich arbeiten kann. menno! warum haben diese spacken nix besseres zu tun, als diesen mist zu verbreiten?! hier der link: h**p://www.wer-weiss-was.de/app/service/board_navi?ArtikelID=5572798;ThemenID=211 ich hoffe, das ist richtig so. gruss |
|
05.12.2009, 02:27
| #10 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A hier das GMER logfile, teil 1: # Code:
ATTFilter
GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-12-05 02:00:57
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwClose [0xF3C12370]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwConnectPort [0xF3C10420]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwCreateKey [0xF3C037A0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwCreateProcess [0xF3C120A0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwCreateProcessEx [0xF3C12210]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwCreateSection [0xF3C12E70]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xF3C12940]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwCreateThread [0xF3C137B0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwDeleteKey [0xF3C038A0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwDeleteValueKey [0xF3C03920]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwDuplicateObject [0xF3C12510]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwEnumerateKey [0xF3C039B0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwEnumerateValueKey [0xF3C03A60]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwFlushKey [0xF3C03B10]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwInitializeRegistry [0xF3C03B90]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwLoadDriver [0xF3C0FFD0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwLoadKey [0xF3C04590]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwLoadKey2 [0xF3C03BB0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwNotifyChangeKey [0xF3C03C80]
SSDT kl1.sys (Kaspersky Unified Driver/Kaspersky Lab) ZwOpenFile [0xF852C020]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwOpenKey [0xF3C03D60]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwOpenProcess [0xF3C11E90]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwOpenSection [0xF3C12CA0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwQueryKey [0xF3C03E30]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwQueryMultipleValueKey [0xF3C03EE0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwQuerySystemInformation [0xF3C13460]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwQueryValueKey [0xF3C03F90]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwReplaceKey [0xF3C04040]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwRequestWaitReplyPort [0xF3C10A00]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwRestoreKey [0xF3C040D0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwResumeThread [0xF3C13760]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSaveKey [0xF3C042D0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSetContextThread [0xF3C13AE0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSetInformationFile [0xF3C140A0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSetInformationKey [0xF3C04360]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSetSecurityObject [0xF3C0EC20]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSetSystemInformation [0xF3C12B20]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSetValueKey [0xF3C04400]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSuspendThread [0xF3C13710]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwSystemDebugControl [0xF3C102E0]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwTerminateProcess [0xF3C13300]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwUnloadKey [0xF3C04550]
SSDT \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) ZwWriteVirtualMemory [0xF3C123D0]
Code \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) IoIsOperationSynchronous
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 1D0 804E282C 12 Bytes [D0, FF, C0, F3, 90, 45, C0, ...]
.text ntoskrnl.exe!IoIsOperationSynchronous 804E875A 5 Bytes JMP F3C149C0 \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80512919 5 Bytes JMP F3C144C0 \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab)
---- User code sections - GMER 1.0.15 ----
? C:\WINDOWS\Explorer.EXE[172] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\Explorer.EXE[172] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\Explorer.EXE[172] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!StrStrW + FFE286FC 7E675128 3 Bytes [F0, 00, EA]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!StrStrW + FFE28708 7E675134 3 Bytes [60, 01, EA] {PUSHA ; ADD EDX, EBP}
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!StrStrW + FFE2A5AC 7E676FD8 3 Bytes [E0, 04, EA]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!StrStrW + FFE2A6A8 7E6770D4 4 Bytes [70, 0B, 74, 01] {JO 0xd; JZ 0x5}
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!StrStrW + FFE2A6C4 7E6770F0 3 Bytes [50, 05, EA]
.text ...
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!SHFree + 11E 7E69AA08 4 Bytes [00, 04, 74, 01]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!ILFree + 7C 7E69AB68 4 Bytes [00, 04, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!ILFindChild + 3D4 7E6A18C0 4 Bytes [F0, 07, 74, 01]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!ILFindChild + A50 7E6A1F3C 4 Bytes [00, 0B, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!ILFindChild + 1344 7E6A2830 4 Bytes [F0, 07, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DllGetClassObject + 50B 7E6A2DC4 3 Bytes [20, 03, EA]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DllGetClassObject + 52B 7E6A2DE4 3 Bytes [B0, 02, EA]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DllGetClassObject + 563 7E6A2E1C 3 Bytes [40, 02, EA] {INC EAX; ADD CH, DL}
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DllGetVersion + 241 7E6AFC44 4 Bytes [90, 0A, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!SHGetImageList + B23 7E6B0A4C 4 Bytes [90, 03, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!SHTestTokenMembership + E5 7E6B5644 2 Bytes [F0, 0E]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!SHTestTokenMembership + E8 7E6B5647 1 Byte [01]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!ILLoadFromStream + BA2 7E6B74D8 3 Bytes [90, 0A, EA] {NOP ; OR CH, DL}
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!ILLoadFromStream + CB2 7E6B75E8 3 Bytes [70, 0B, EA]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DragQueryFileAorW + 3A03 7E6C52F4 4 Bytes [50, 05, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DragQueryFileAorW + 41D3 7E6C5AC4 4 Bytes [30, 06, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DragQueryFileAorW + 429F 7E6C5B90 4 Bytes [A0, 06, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DragQueryFileAorW + 78EF 7E6C91E0 4 Bytes [E0, 04, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!DragQueryFileAorW + 97CF 7E6CB0C0 4 Bytes [D0, 08, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!InternalExtractIconListA + 2037 7E6CD958 4 Bytes [40, 09, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!InternalExtractIconListA + 20F3 7E6CDA14 4 Bytes [C0, 05, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!StrStrIW + 1F5 7E6E135C 4 Bytes [80, 00, 9D, 03]
.text C:\WINDOWS\Explorer.EXE[172] SHELL32.dll!SHFileOperationW 7E72083C 5 Bytes JMP 10001102 C:\Dokumente und Einstellungen\ xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll
? C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\system32\csrss.exe[888] C:\WINDOWS\system32\KERNEL32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\winlogon.exe[912] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\services.exe[956] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\lsass.exe[968] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\lsass.exe[968] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\system32\lsass.exe[968] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\WINDOWS\system32\svchost.exe[1132] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\svchost.exe[1192] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\svchost.exe[1192] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\system32\svchost.exe[1192] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe[1284] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe[1292] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe[1292] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe[1292] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe[1304] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe[1304] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe[1304] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\WINDOWS\System32\svchost.exe[1316] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Java\jre6\bin\jusched.exe[1336] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[1364] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[1364] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe[1364] C:\WINDOWS\system32\shell32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\WINDOWS\System32\svchost.exe[1376] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[1376] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\System32\svchost.exe[1376] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\WINDOWS\System32\svchost.exe[1528] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[1528] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\System32\svchost.exe[1528] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\WINDOWS\system32\ctfmon.exe[1540] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\spoolsv.exe[1648] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\SCardSvr.exe[1696] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\SCardSvr.exe[1696] C:\WINDOWS\system32\USER32.dll time/date stamp mismatch; unknown module: MSIMG32.dllunknown module: POWRPROF.dllunknown module: WINSTA.dll
? C:\WINDOWS\System32\SCardSvr.exe[1696] C:\WINDOWS\system32\SHELL32.dll time/date stamp mismatch; unknown module: WINMM.dllunknown module: msi.dllunknown module: DEVMGR.DLLunknown module: urlmon.dllunknown module: OLEAUT32.dllunknown module: OLEACC.dllunknown module: VERSION.dllunknown module: MPR.dllunknown module: CSCDLL.dllunknown module: UxTheme.dllunknown module: credui.dllunknown module: RASAPI32.dllunknown module: MSGINA.dllunknown module: POWRPROF.dllunknown module: SHDOCVW.dllunknown module: BROWSEUI.dllunknown module: EFSADU.dllunknown module: LINKINFO.dllunknown module: MSIMG32.dllunknown module: DUSER.dllunknown module: PRINTUI.dllunknown module: CdfView.dllunknown module: SETUPAPI.dllunknown module: appHelp.dllunknown module: query.dllunknown module: gdiplus.dllunknown module: IMM32.dllunknown module: MSWIN.EXE\Metastock 6.*",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\MSWIN.EXE\Metastock 6.*",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",Version,,"6.*"
HKLM,"%SHELLCOMPAT%\Applications\pwrplay.exe",FILEOPENBOGUSCTRLID,,
HKLM,"%SHELLCOMP
? C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe[1792] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Java\jre6\bin\jqs.exe[1844] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe[1876] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe[1932] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\CDBurnerXP\NMSAccessU.exe[1964] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\svchost.exe[2032] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\system32\wscntfy.exe[2904] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\wbem\wmiapsrv.exe[2960] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\WINDOWS\System32\alg.exe[3192] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] 8273F820
IAT \SystemRoot\System32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] 8273F820
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\mrxdav.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\System32\Drivers\Fastfat.SYS[ntoskrnl.exe!IoCreateDevice] 8273F6D0
IAT \SystemRoot\system32\drivers\kmixer.sys[ntoskrnl.exe!IoCreateDevice] 8273F6D0
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\Explorer.EXE [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\Explorer.EXE [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\Explorer.EXE [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\Explorer.EXE [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\Explorer.EXE[172] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\Dokumente und Einstellungen\ xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe[392] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\winsrv.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\winsrv.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\winsrv.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\winsrv.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress]
|
|
05.12.2009, 02:40
| #11 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A gmer teil 2: # Code:
ATTFilter [7C884FEC] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\csrss.exe[888] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\KERNEL32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\winlogon.exe [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\REGAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\REGAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\REGAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\winlogon.exe[912] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\services.exe[956] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\LSASRV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\LSASRV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\LSASRV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SAMSRV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SAMSRV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SAMSRV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\lsass.exe[968] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\rpcss.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\WS2HELP.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ c:\windows\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [7C884FB0] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\REGAPI.dll [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\REGAPI.dll [KERNEL32.dll!LoadLibraryW] [7C884FC4] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1132] @ C:\WINDOWS\system32\REGAPI.dll [KERNEL32.dll!LoadLibraryA] [7C884F9C] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1192] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!GetProcAddress] [7C884FEC] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
IAT C:\WINDOWS\system32\svchost.exe[1192] @ C:\WINDOWS\system32\svchost.exe [KERNEL32.dll!LoadLibraryExW] [7C884FD8] C:\WINDOWS\system32\kernel32.dll (Client-DLL für Windows NT-Basis-API/Microsoft Corporation)
mehr postings gehen nicht. vielleicht schreibe ich wieder zu viel mit mir selbst..? ;-) Geändert von madz (05.12.2009 um 02:51 Uhr) |
|
05.12.2009, 12:27
| #12 |
| /// Selecta Jahrusso | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A Während dieser Scans soll(en):
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
06.12.2009, 21:26
| #13 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A ich hoffe, das hilft weiter :-) # Code:
ATTFilter ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/12/06 21:07
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF3AEE000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8CD0000 Size: 8192 File Visible: No Signed: -
Status: -
Name: giveio.sys
Image Path: giveio.sys
Address: 0xF8D3E000 Size: 1664 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF3B3E000 Size: 49152 File Visible: No Signed: -
Status: -
Name: speedfan.sys
Image Path: speedfan.sys
Address: 0xF8C7E000 Size: 5248 File Visible: No Signed: -
Status: -
Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!
SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12370
#: 031 Function Name: NtConnectPort
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c10420
#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c037a0
#: 047 Function Name: NtCreateProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c120a0
#: 048 Function Name: NtCreateProcessEx
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12210
#: 050 Function Name: NtCreateSection
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12e70
#: 052 Function Name: NtCreateSymbolicLinkObject
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12940
#: 053 Function Name: NtCreateThread
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c137b0
#: 063 Function Name: NtDeleteKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c038a0
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03920
#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12510
#: 071 Function Name: NtEnumerateKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c039b0
#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03a60
#: 079 Function Name: NtFlushKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03b10
#: 092 Function Name: NtInitializeRegistry
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03b90
#: 097 Function Name: NtLoadDriver
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0ffd0
#: 098 Function Name: NtLoadKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c04590
#: 099 Function Name: NtLoadKey2
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03bb0
#: 111 Function Name: NtNotifyChangeKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03c80
#: 116 Function Name: NtOpenFile
Status: Hooked by "kl1.sys" at address 0xf852c020
#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03d60
#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c11e90
#: 125 Function Name: NtOpenSection
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12ca0
#: 160 Function Name: NtQueryKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03e30
#: 161 Function Name: NtQueryMultipleValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03ee0
#: 173 Function Name: NtQuerySystemInformation
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13460
#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c03f90
#: 193 Function Name: NtReplaceKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c04040
#: 200 Function Name: NtRequestWaitReplyPort
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c10a00
#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c040d0
#: 206 Function Name: NtResumeThread
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13760
#: 207 Function Name: NtSaveKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c042d0
#: 213 Function Name: NtSetContextThread
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13ae0
#: 224 Function Name: NtSetInformationFile
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c140a0
#: 226 Function Name: NtSetInformationKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c04360
#: 237 Function Name: NtSetSecurityObject
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0ec20
#: 240 Function Name: NtSetSystemInformation
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c12b20
#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c04400
#: 254 Function Name: NtSuspendThread
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13710
#: 255 Function Name: NtSystemDebugControl
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c102e0
#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13300
#: 263 Function Name: NtUnloadKey
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c04550
#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c123d0
Stealth Objects
-------------------
Object: Hidden Code [ETHREAD: 0x829f9b58]
Process: System Address: 0x82773000 Size: 87
Object: Hidden Code [ETHREAD: 0x82a03da8]
Process: System Address: 0x82773000 Size: 87
Object: Hidden Code [ETHREAD: 0x82a00da8]
Process: System Address: 0x827407e0 Size: 87
Object: Hidden Code [ETHREAD: 0x82b00c10]
Process: System Address: 0x827407e0 Size: 87
Object: Hidden Code [ETHREAD: 0x829f76b8]
Process: System Address: 0x827427d0 Size: 2097
Object: Hidden Code [ETHREAD: 0x82b05020]
Process: System Address: 0x827427d0 Size: 2097
Object: Hidden Code [ETHREAD: 0x829ff5a0]
Process: System Address: 0x827407e0 Size: 87
Shadow SSDT
-------------------
#: 013 Function Name: NtGdiBitBlt
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c101b0
#: 307 Function Name: NtUserAttachThreadInput
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c10ae0
#: 378 Function Name: NtUserFindWindowEx
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0fc40
#: 383 Function Name: NtUserGetAsyncKeyState
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0eb30
#: 414 Function Name: NtUserGetKeyboardState
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0ebb0
#: 416 Function Name: NtUserGetKeyState
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0eb70
#: 460 Function Name: NtUserMessageCall
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0fb40
#: 475 Function Name: NtUserPostMessage
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13e80
#: 476 Function Name: NtUserPostThreadMessage
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0fbf0
#: 502 Function Name: NtUserSendInput
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c0f0c0
#: 549 Function Name: NtUserSetWindowsHookEx
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13cd0
#: 552 Function Name: NtUserSetWinEventHook
Status: Hooked by "C:\WINDOWS\system32\drivers\klif.sys" at address 0xf3c13ed0
==EOF==
|
|
06.12.2009, 22:14
| #14 |
| /// Selecta Jahrusso | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A Frage, war das die gesammte Logfile von Gmer? Wenn nicht Zweiter Lauf mit Gmer
schritt 2 Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
07.12.2009, 04:43
| #15 |
| | Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A war nur ein bruchteil von GMER. ich konnte nur 2 beiträge hintereinander posten. hier der neue durchlauf von GMER: GMER 1.0.15.14966 - http://www.gmer.net Rootkit scan 2009-12-07 03:31:27 Windows 5.1.2600 Service Pack 3 ---- Modules - GMER 1.0.15 ---- Module viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) F8C7A000-F8C7C000 (8192 bytes) Module hotcore3.sys (Hotbackup helper driver/Paragon Software Group) F8A06000-F8A0B000 (20480 bytes) Module PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) F87C6000-F87CF000 (36864 bytes) Module timntr.sys (TrueImage Backup Archive Explorer/Acronis) F8578000-F85B5000 (249856 bytes) Module speedfan.sys (SpeedFan Device Driver/Windows (R) 2000 DDK provider) F8C7E000-F8C80000 (8192 bytes) Module snapman.sys (Acronis Snapshot API/Acronis) F8560000-F8578000 (98304 bytes) Module kl1.sys (Kaspersky Unified Driver/Kaspersky Lab) F852A000-F8546000 (114688 bytes) Module giveio.sys F8D3E000-F8D3F000 (4096 bytes) Module \SystemRoot\System32\DRIVERS\ati2mtaa.sys (ATI RAGE 128 Miniport Driver/ATI Technologies Inc.) F7CC7000-F7D17000 (327680 bytes) Module \SystemRoot\System32\DRIVERS\RTL8139.SYS (Realtek RTL8139 NDIS 5.0 Driver/Realtek Semiconductor Corporation) F8B16000-F8B1C000 (24576 bytes) Module \SystemRoot\system32\drivers\viaudio.sys (VIA AC'97 Enhanced Audio WDM Driver /VIA Technologies, Inc.) F8936000-F8941000 (45056 bytes) Module \SystemRoot\system32\DRIVERS\klim5.sys (Kaspersky Lab Intermediate Network Driver/Kaspersky Lab) F8B4E000-F8B56000 (32768 bytes) Module \SystemRoot\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F8B56000-F8B5B000 (20480 bytes) Module \SystemRoot\system32\DRIVERS\UimBus.sys (Image Mounter SCSI Port Driver/Windows (R) 2000 DDK provider) F8B66000-F8B6D000 (28672 bytes) Module \SystemRoot\System32\Drivers\Uim_IM.sys (Image Mounter/Paragon) F7A91000-F7AAF000 (122880 bytes) Module \SystemRoot\System32\Drivers\UimFIO.SYS F8CAE000-F8CB0000 (8192 bytes) Module \SystemRoot\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) F89C6000-F89D1000 (45056 bytes) Module \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) F3BD4000-F3C08000 (212992 bytes) Module \SystemRoot\System32\Drivers\ElbyCDIO.sys (ElbyCD Windows NT/2000/XP I/O driver/Elaborate Bytes AG) F8A3E000-F8A43000 (20480 bytes) Module \SystemRoot\System32\ati2dvaa.dll (ATI RAGE 128 WindowsNT Display Driver/ATI Technologies Inc.) BF9D5000-BFA32000 (380928 bytes) Module \SystemRoot\system32\DRIVERS\tifsfilt.sys (TrueImage File System Filter/Acronis) F8A96000-F8A9E000 (32768 bytes) Module \??\C:\WINDOWS\System32\drivers\acedrv10.sys (Filter Driver ProtectDisc/Protect Software GmbH) F2EE0000-F2F71000 (593920 bytes) Module \SystemRoot\System32\Drivers\ASPIXNT.SYS (ASPI Extensions for Windows NT/LSI Logic) F8C84000-F8C86000 (8192 bytes) Module \??\C:\DOKUME~1\xx~2\LOKALE~1\Temp\aujasnkj.sys (GMER) F256A000-F257E000 (81920 bytes) ---- Processes - GMER 1.0.15 ---- Process C:\WINDOWS\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) 700 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\System32\wbem\wmiprvse.exe (WMI/Microsoft Corporation) 848 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\system32\winlogon.exe (Windows NT-Anmeldung/Microsoft Corporation) 912 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\WINDOWS\system32\klogon.dll (Logon Visualizer/Kaspersky Lab) 0x304D0000 Process C:\WINDOWS\system32\services.exe (Anwendung für Dienste und Controller/Microsoft Corporation) 956 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\system32\lsass.exe (LSA Shell (Export Version)/Microsoft Corporation) 968 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\WINDOWS\system32\relog_ap.dll (Acronis Relogon Authentication Package/Acronis) 0x10000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\dnsq.dll (DNSQ/Kaspersky Lab) 0x30460000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1132 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1192 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\dnsq.dll (DNSQ/Kaspersky Lab) 0x30460000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1316 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1368 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1432 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Process C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe 1552 Library C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Process C:\WINDOWS\system32\spoolsv.exe (Spooler SubSystem App/Microsoft Corporation) 1648 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\dnsq.dll (DNSQ/Kaspersky Lab) 0x30460000 Library C:\WINDOWS\system32\mdimon.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x009D0000 Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x009E0000 Process C:\WINDOWS\System32\SCardSvr.exe (Smartcard-Ressourcenverwaltungsserver/Microsoft Corporation) 1696 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Process C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis Scheduler 2/Acronis) 1792 Library C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis Scheduler 2/Acronis) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\System32\wbem\wmiapsrv.exe (WMI-Leistungsadapter-Dienst/Microsoft Corporation) 1836 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\Programme\Java\jre6\bin\jqs.exe (Java(TM) Quick Starter Service/Sun Microsystems, Inc.) 1848 Library C:\Programme\Java\jre6\bin\jqs.exe (Java(TM) Quick Starter Service/Sun Microsystems, Inc.) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Process C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero BackItUp/Nero AG) 1872 Library C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero BackItUp/Nero AG) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Nero\Nero8\Nero BackItUp\NB.dll (Nero BackItUp/Nero AG) 0x10000000 Library C:\Programme\Nero\Nero8\Nero BackItUp\NeroAPIGlueLayerUnicode.dll (NeroAPIGlueLayerUnicode/Nero AG) 0x007B0000 Library C:\Programme\Nero\Nero8\Nero BackItUp\LBFC.dll (Nero BackItUp/Nero AG) 0x007F0000 Library C:\Programme\Nero\Nero8\Nero BackItUp\NBHDMgr.dll (Nero BackItUp/Nero AG) 0x00970000 Process C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero BackItUp/Nero AG) 1928 Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero BackItUp/Nero AG) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NB.dll (Nero BackItUp/Nero AG) 0x10000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\LBFC.dll (Nero BackItUp/Nero AG) 0x00A60000 Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBBurn.dll (Nero BackItUp/Nero AG) 0x01200000 Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NeroAPIGlueLayerUnicode.dll (NeroAPIGlueLayerUnicode/Nero AG) 0x01250000 Process C:\Programme\CDBurnerXP\NMSAccessU.exe 1968 Library C:\Programme\CDBurnerXP\NMSAccessU.exe 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 2032 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\system32\wscntfy.exe (Windows Security Center Notification App/Microsoft Corporation) 2076 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Process C:\WINDOWS\Explorer.EXE (Windows Explorer/Microsoft Corporation) 2208 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\scrchpg.dll (Script Checker/Kaspersky Lab) 0x307E0000 Library C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Library C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll 0x016C0000 Library C:\Programme\Haali\MatroskaSplitter\mkunicode.dll 0x016F0000 Library C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll (Nero Digital Shell Extension/Nero AG) 0x02B60000 Library C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll (PDF Shell Extension/Adobe Systems, Inc.) 0x01B10000 Library C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU (PDF Shell Extension/Adobe Systems, Inc.) 0x01B70000 Library C:\PROGRA~1\SPYBOT~1\SDHelper.dll (SBSD IE Protection/Safer Networking Limited) 0x03560000 Process C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe 3584 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Process C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (TrueImage/Acronis) 3596 Library C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (TrueImage/Acronis) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Process C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis Scheduler Helper/Acronis) 3632 Library C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis Scheduler Helper/Acronis) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Process C:\Programme\Java\jre6\bin\jusched.exe (Java(TM) Platform SE binary/Sun Microsystems, Inc.) 3668 Library C:\Programme\Java\jre6\bin\jusched.exe (Java(TM) Platform SE binary/Sun Microsystems, Inc.) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Process C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks Scheduler/RealNetworks, Inc.) 3700 Library C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks Scheduler/RealNetworks, Inc.) 0x00400000 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000 Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 Process C:\WINDOWS\system32\ctfmon.exe (CTF Loader/Microsoft Corporation) 3892 Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000 Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000 ---- Services - GMER 1.0.15 ---- Service C:\WINDOWS\System32\drivers\acedrv10.sys (Filter Driver ProtectDisc/Protect Software GmbH) [AUTO] acedrv10 Service C:\WINDOWS\System32\drivers\acehlp10.sys (ProtectDisc Filter Driver/Protect Software GmbH) [AUTO] acehlp10 Service C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis Scheduler 2/Acronis) [AUTO] AcrSch2Svc Service C:\WINDOWS\System32\Drivers\AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.) [MANUAL] AnyDVD Service ASPI32 Service (ASPI Extensions for Windows NT/LSI Logic) [AUTO] ASPIXNT Service C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys (ATI RAGE 128 Miniporttreiber/ATI Technologies Inc.) [MANUAL] ati2mpaa Service C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys (ATI RAGE 128 Miniport Driver/ATI Technologies Inc.) [MANUAL] ati2mtaa Service C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe (Kaspersky Anti-Virus/Kaspersky Lab) [AUTO] AVP Service C:\WINDOWS\system32\DRIVERS\emDevice.sys (USB 28xx WDM Driver/eMPIA Technology, Inc.) [MANUAL] DCamUSBEMPIA Service C:\WINDOWS\System32\Drivers\ElbyCDFL.sys (ElbyCDIO Filter Driver/SlySoft, Inc.) [MANUAL] ElbyCDFL Service C:\WINDOWS\System32\Drivers\ElbyCDIO.sys (ElbyCD Windows NT/2000/XP I/O driver/Elaborate Bytes AG) [SYSTEM] ElbyCDIO Service C:\WINDOWS\System32\Drivers\ElbyDelay.sys (Elby Delay Lower Filter Driver/Elaborate Bytes AG) [MANUAL] ElbyDelay Service C:\WINDOWS\system32\drivers\emAudio.sys (USB Audio Driver/Pinnacle Systems, Inc.) [MANUAL] emAudio Service C:\WINDOWS\System32\DRIVERS\fetnd5.sys (NDIS 5.0 miniport driver/VIA Technologies, Inc. ) [MANUAL] FETNDIS Service C:\WINDOWS\system32\DRIVERS\emFilter.sys (USB 28xx WDM Lower filter/eMPIA Technology, Inc.) [MANUAL] FiltUSBEMPIA Service C:\WINDOWS\system32\giveio.sys [BOOT] giveio Service C:\WINDOWS\system32\drivers\hotcore3.sys (Hotbackup helper driver/Paragon Software Group) [BOOT] hotcore3 Service ICSharing Service C:\Programme\Java\jre6\bin\jqs.exe (Java(TM) Quick Starter Service/Sun Microsystems, Inc.) [AUTO] JavaQuickStarterService Service C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab) [BOOT] kl1 Service C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) [SYSTEM] klif Service C:\WINDOWS\system32\DRIVERS\klim5.sys (Kaspersky Lab Intermediate Network Driver/Kaspersky Lab) [MANUAL] klim5 Service system32\DRIVERS\Lbd.sys [BOOT] Lbd Service (Maplom.sys/SlySoft Inc.) [MANUAL] Maplom Service (Maplom.sys/SlySoft Inc.) [MANUAL] MaplomL Service C:\WINDOWS\System32\Drivers\MHIKEY10.sys (MultiCard reader 1.0/Generic USB smartcard reader) [MANUAL] MHIKEY10 Service C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero BackItUp/Nero AG) [AUTO] Nero BackItUp Scheduler 3 Service C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero BackItUp/Nero AG) [AUTO] Nero BackItUp Scheduler 4.0 Service (Nero file system driver/ahead software gmbh im stöckmädle 6 76307 karlsbad, germany Fax: ++49-7248-911-888 Compuserve: 101776.1057) [BOOT] NeroCdNt Service C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe (Nero Home/Nero AG) [MANUAL] NMIndexingService Service C:\Programme\CDBurnerXP\NMSAccessU.exe [AUTO] NMSAccessU Service C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) [BOOT] PxHelp20 Service C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek RTL8139 NDIS 5.0 Driver/Realtek Semiconductor Corporation) [MANUAL] rtl8139 Service C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP4\WNt500x86\Sandra.sys (Sandra Device Driver (x86)(Unicode)/SiSoftware) [MANUAL] SANDRA Service C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe (SiSoftware Deployment Agent Service (NT)(Unicode)/SiSoftware) [MANUAL] SandraAgentSrv Service C:\WINDOWS\system32\DRIVERS\emScan.sys (USB 28xx WDM Upper Filter/eMPIA Technology, Inc.) [MANUAL] ScanUSBEMPIA Service C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [MANUAL] Secdrv Service C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis Snapshot API/Acronis) [BOOT] snapman Service C:\WINDOWS\system32\speedfan.sys (SpeedFan Device Driver/Windows (R) 2000 DDK provider) [BOOT] speedfan Service C:\WINDOWS\system32\DRIVERS\StreamIP.sys (Microsoft IP Test Driver/Microsoft Corporation) [MANUAL] streamip Service C:\WINDOWS\system32\DRIVERS\tifsfilt.sys (TrueImage File System Filter/Acronis) [AUTO] tifsfilter Service C:\WINDOWS\system32\DRIVERS\timntr.sys (TrueImage Backup Archive Explorer/Acronis) [BOOT] timounter Service C:\WINDOWS\system32\DRIVERS\UimBus.sys (Image Mounter SCSI Port Driver/Windows (R) 2000 DDK provider) [SYSTEM] UimBus Service C:\WINDOWS\System32\Drivers\Uim_IM.sys (Image Mounter/Paragon) [SYSTEM] Uim_IM Service C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerDriver5.sys UnlockerDriver5 Service C:\WINDOWS\System32\DRIVERS\viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) [BOOT] ViaIde Service C:\WINDOWS\system32\drivers\viaudio.sys (VIA AC'97 Enhanced Audio WDM Driver /VIA Technologies, Inc.) [MANUAL] VIAudio Service C:\WINDOWS\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) [MANUAL] WinDSLa Service C:\WINDOWS\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) [MANUAL] WinDSLp ---- EOF - GMER 1.0.15 ---- auch noch mal in code-tags: Code:
ATTFilter
GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-12-07 03:31:27
Windows 5.1.2600 Service Pack 3
---- Modules - GMER 1.0.15 ----
Module viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) F8C7A000-F8C7C000 (8192 bytes)
Module hotcore3.sys (Hotbackup helper driver/Paragon Software Group) F8A06000-F8A0B000 (20480 bytes)
Module PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) F87C6000-F87CF000 (36864 bytes)
Module timntr.sys (TrueImage Backup Archive Explorer/Acronis) F8578000-F85B5000 (249856 bytes)
Module speedfan.sys (SpeedFan Device Driver/Windows (R) 2000 DDK provider) F8C7E000-F8C80000 (8192 bytes)
Module snapman.sys (Acronis Snapshot API/Acronis) F8560000-F8578000 (98304 bytes)
Module kl1.sys (Kaspersky Unified Driver/Kaspersky Lab) F852A000-F8546000 (114688 bytes)
Module giveio.sys F8D3E000-F8D3F000 (4096 bytes)
Module \SystemRoot\System32\DRIVERS\ati2mtaa.sys (ATI RAGE 128 Miniport Driver/ATI Technologies Inc.) F7CC7000-F7D17000 (327680 bytes)
Module \SystemRoot\System32\DRIVERS\RTL8139.SYS (Realtek RTL8139 NDIS 5.0 Driver/Realtek Semiconductor Corporation) F8B16000-F8B1C000 (24576 bytes)
Module \SystemRoot\system32\drivers\viaudio.sys (VIA AC'97 Enhanced Audio WDM Driver /VIA Technologies, Inc.) F8936000-F8941000 (45056 bytes)
Module \SystemRoot\system32\DRIVERS\klim5.sys (Kaspersky Lab Intermediate Network Driver/Kaspersky Lab) F8B4E000-F8B56000 (32768 bytes)
Module \SystemRoot\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F8B56000-F8B5B000 (20480 bytes)
Module \SystemRoot\system32\DRIVERS\UimBus.sys (Image Mounter SCSI Port Driver/Windows (R) 2000 DDK provider) F8B66000-F8B6D000 (28672 bytes)
Module \SystemRoot\System32\Drivers\Uim_IM.sys (Image Mounter/Paragon) F7A91000-F7AAF000 (122880 bytes)
Module \SystemRoot\System32\Drivers\UimFIO.SYS F8CAE000-F8CB0000 (8192 bytes)
Module \SystemRoot\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) F89C6000-F89D1000 (45056 bytes)
Module \??\C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) F3BD4000-F3C08000 (212992 bytes)
Module \SystemRoot\System32\Drivers\ElbyCDIO.sys (ElbyCD Windows NT/2000/XP I/O driver/Elaborate Bytes AG) F8A3E000-F8A43000 (20480 bytes)
Module \SystemRoot\System32\ati2dvaa.dll (ATI RAGE 128 WindowsNT Display Driver/ATI Technologies Inc.) BF9D5000-BFA32000 (380928 bytes)
Module \SystemRoot\system32\DRIVERS\tifsfilt.sys (TrueImage File System Filter/Acronis) F8A96000-F8A9E000 (32768 bytes)
Module \??\C:\WINDOWS\System32\drivers\acedrv10.sys (Filter Driver ProtectDisc/Protect Software GmbH) F2EE0000-F2F71000 (593920 bytes)
Module \SystemRoot\System32\Drivers\ASPIXNT.SYS (ASPI Extensions for Windows NT/LSI Logic) F8C84000-F8C86000 (8192 bytes)
Module \??\C:\DOKUME~1\xx~2\LOKALE~1\Temp\aujasnkj.sys (GMER) F256A000-F257E000 (81920 bytes)
---- Processes - GMER 1.0.15 ----
Process C:\WINDOWS\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) 700
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\System32\wbem\wmiprvse.exe (WMI/Microsoft Corporation) 848
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\system32\winlogon.exe (Windows NT-Anmeldung/Microsoft Corporation) 912
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\WINDOWS\system32\klogon.dll (Logon Visualizer/Kaspersky Lab) 0x304D0000
Process C:\WINDOWS\system32\services.exe (Anwendung für Dienste und Controller/Microsoft Corporation) 956
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\system32\lsass.exe (LSA Shell (Export Version)/Microsoft Corporation) 968
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\WINDOWS\system32\relog_ap.dll (Acronis Relogon Authentication Package/Acronis) 0x10000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\dnsq.dll (DNSQ/Kaspersky Lab) 0x30460000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1132
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1192
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\dnsq.dll (DNSQ/Kaspersky Lab) 0x30460000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1316
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1368
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 1432
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Process C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe 1552
Library C:\Dokumente und Einstellungen\xxx Online\Eigene Dateien\Downloads\gmer1015\gmer.exe 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Process C:\WINDOWS\system32\spoolsv.exe (Spooler SubSystem App/Microsoft Corporation) 1648
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\dnsq.dll (DNSQ/Kaspersky Lab) 0x30460000
Library C:\WINDOWS\system32\mdimon.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x009D0000
Library C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll (Microsoft® Document Imaging/Microsoft Corporation) 0x009E0000
Process C:\WINDOWS\System32\SCardSvr.exe (Smartcard-Ressourcenverwaltungsserver/Microsoft Corporation) 1696
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Process C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis Scheduler 2/Acronis) 1792
Library C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis Scheduler 2/Acronis) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\System32\wbem\wmiapsrv.exe (WMI-Leistungsadapter-Dienst/Microsoft Corporation) 1836
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\Programme\Java\jre6\bin\jqs.exe (Java(TM) Quick Starter Service/Sun Microsystems, Inc.) 1848
Library C:\Programme\Java\jre6\bin\jqs.exe (Java(TM) Quick Starter Service/Sun Microsystems, Inc.) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Process C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero BackItUp/Nero AG) 1872
Library C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero BackItUp/Nero AG) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Nero\Nero8\Nero BackItUp\NB.dll (Nero BackItUp/Nero AG) 0x10000000
Library C:\Programme\Nero\Nero8\Nero BackItUp\NeroAPIGlueLayerUnicode.dll (NeroAPIGlueLayerUnicode/Nero AG) 0x007B0000
Library C:\Programme\Nero\Nero8\Nero BackItUp\LBFC.dll (Nero BackItUp/Nero AG) 0x007F0000
Library C:\Programme\Nero\Nero8\Nero BackItUp\NBHDMgr.dll (Nero BackItUp/Nero AG) 0x00970000
Process C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero BackItUp/Nero AG) 1928
Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero BackItUp/Nero AG) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NB.dll (Nero BackItUp/Nero AG) 0x10000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\LBFC.dll (Nero BackItUp/Nero AG) 0x00A60000
Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBBurn.dll (Nero BackItUp/Nero AG) 0x01200000
Library C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NeroAPIGlueLayerUnicode.dll (NeroAPIGlueLayerUnicode/Nero AG) 0x01250000
Process C:\Programme\CDBurnerXP\NMSAccessU.exe 1968
Library C:\Programme\CDBurnerXP\NMSAccessU.exe 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) 2032
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\system32\wscntfy.exe (Windows Security Center Notification App/Microsoft Corporation) 2076
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Process C:\WINDOWS\Explorer.EXE (Windows Explorer/Microsoft Corporation) 2208
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\scrchpg.dll (Script Checker/Kaspersky Lab) 0x307E0000
Library C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Library C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll 0x016C0000
Library C:\Programme\Haali\MatroskaSplitter\mkunicode.dll 0x016F0000
Library C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll (Nero Digital Shell Extension/Nero AG) 0x02B60000
Library C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll (PDF Shell Extension/Adobe Systems, Inc.) 0x01B10000
Library C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU (PDF Shell Extension/Adobe Systems, Inc.) 0x01B70000
Library C:\PROGRA~1\SPYBOT~1\SDHelper.dll (SBSD IE Protection/Safer Networking Limited) 0x03560000
Process C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe 3584
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerAssistant.exe 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Process C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (TrueImage/Acronis) 3596
Library C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe (TrueImage/Acronis) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Process C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis Scheduler Helper/Acronis) 3632
Library C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis Scheduler Helper/Acronis) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Process C:\Programme\Java\jre6\bin\jusched.exe (Java(TM) Platform SE binary/Sun Microsystems, Inc.) 3668
Library C:\Programme\Java\jre6\bin\jusched.exe (Java(TM) Platform SE binary/Sun Microsystems, Inc.) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Process C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks Scheduler/RealNetworks, Inc.) 3700
Library C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks Scheduler/RealNetworks, Inc.) 0x00400000
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\miscr3.dll (Kaspersky Anti-Virus Ring 3 Hooker Helper/Kaspersky Lab) 0x305E0000
Library C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\fssync.dll (FSSYNC.DLL/Kaspersky Lab) 0x30480000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
Process C:\WINDOWS\system32\ctfmon.exe (CTF Loader/Microsoft Corporation) 3892
Library C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll (kldialhk/Kaspersky Lab) 0x30000000
Library C:\Dokumente und Einstellungen\xxx Online\Anwendungsdaten\Unlocker\UnlockerHook.dll 0x10000000
---- Services - GMER 1.0.15 ----
Service C:\WINDOWS\System32\drivers\acedrv10.sys (Filter Driver ProtectDisc/Protect Software GmbH) [AUTO] acedrv10
Service C:\WINDOWS\System32\drivers\acehlp10.sys (ProtectDisc Filter Driver/Protect Software GmbH) [AUTO] acehlp10
Service C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe (Acronis Scheduler 2/Acronis) [AUTO] AcrSch2Svc
Service C:\WINDOWS\System32\Drivers\AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.) [MANUAL] AnyDVD
Service ASPI32
Service (ASPI Extensions for Windows NT/LSI Logic) [AUTO] ASPIXNT
Service C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys (ATI RAGE 128 Miniporttreiber/ATI Technologies Inc.) [MANUAL] ati2mpaa
Service C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys (ATI RAGE 128 Miniport Driver/ATI Technologies Inc.) [MANUAL] ati2mtaa
Service C:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE\avp.exe (Kaspersky Anti-Virus/Kaspersky Lab) [AUTO] AVP
Service C:\WINDOWS\system32\DRIVERS\emDevice.sys (USB 28xx WDM Driver/eMPIA Technology, Inc.) [MANUAL] DCamUSBEMPIA
Service C:\WINDOWS\System32\Drivers\ElbyCDFL.sys (ElbyCDIO Filter Driver/SlySoft, Inc.) [MANUAL] ElbyCDFL
Service C:\WINDOWS\System32\Drivers\ElbyCDIO.sys (ElbyCD Windows NT/2000/XP I/O driver/Elaborate Bytes AG) [SYSTEM] ElbyCDIO
Service C:\WINDOWS\System32\Drivers\ElbyDelay.sys (Elby Delay Lower Filter Driver/Elaborate Bytes AG) [MANUAL] ElbyDelay
Service C:\WINDOWS\system32\drivers\emAudio.sys (USB Audio Driver/Pinnacle Systems, Inc.) [MANUAL] emAudio
Service C:\WINDOWS\System32\DRIVERS\fetnd5.sys (NDIS 5.0 miniport driver/VIA Technologies, Inc. ) [MANUAL] FETNDIS
Service C:\WINDOWS\system32\DRIVERS\emFilter.sys (USB 28xx WDM Lower filter/eMPIA Technology, Inc.) [MANUAL] FiltUSBEMPIA
Service C:\WINDOWS\system32\giveio.sys [BOOT] giveio
Service C:\WINDOWS\system32\drivers\hotcore3.sys (Hotbackup helper driver/Paragon Software Group) [BOOT] hotcore3
Service ICSharing
Service C:\Programme\Java\jre6\bin\jqs.exe (Java(TM) Quick Starter Service/Sun Microsystems, Inc.) [AUTO] JavaQuickStarterService
Service C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab) [BOOT] kl1
Service C:\WINDOWS\system32\drivers\klif.sys (spuper-ptor/Kaspersky Lab) [SYSTEM] klif
Service C:\WINDOWS\system32\DRIVERS\klim5.sys (Kaspersky Lab Intermediate Network Driver/Kaspersky Lab) [MANUAL] klim5
Service system32\DRIVERS\Lbd.sys [BOOT] Lbd
Service (Maplom.sys/SlySoft Inc.) [MANUAL] Maplom
Service (Maplom.sys/SlySoft Inc.) [MANUAL] MaplomL
Service C:\WINDOWS\System32\Drivers\MHIKEY10.sys (MultiCard reader 1.0/Generic USB smartcard reader) [MANUAL] MHIKEY10
Service C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe (Nero BackItUp/Nero AG) [AUTO] Nero BackItUp Scheduler 3
Service C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero BackItUp/Nero AG) [AUTO] Nero BackItUp Scheduler 4.0
Service (Nero file system driver/ahead software gmbh
im stöckmädle 6
76307 karlsbad, germany
Fax: ++49-7248-911-888
Compuserve: 101776.1057) [BOOT] NeroCdNt
Service C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe (Nero Home/Nero AG) [MANUAL] NMIndexingService
Service C:\Programme\CDBurnerXP\NMSAccessU.exe [AUTO] NMSAccessU
Service C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) [MANUAL] Ptilink
Service C:\WINDOWS\System32\Drivers\PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) [BOOT] PxHelp20
Service C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek RTL8139 NDIS 5.0 Driver/Realtek Semiconductor Corporation) [MANUAL] rtl8139
Service C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP4\WNt500x86\Sandra.sys (Sandra Device Driver (x86)(Unicode)/SiSoftware) [MANUAL] SANDRA
Service C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe (SiSoftware Deployment Agent Service (NT)(Unicode)/SiSoftware) [MANUAL] SandraAgentSrv
Service C:\WINDOWS\system32\DRIVERS\emScan.sys (USB 28xx WDM Upper Filter/eMPIA Technology, Inc.) [MANUAL] ScanUSBEMPIA
Service C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [MANUAL] Secdrv
Service C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis Snapshot API/Acronis) [BOOT] snapman
Service C:\WINDOWS\system32\speedfan.sys (SpeedFan Device Driver/Windows (R) 2000 DDK provider) [BOOT] speedfan
Service C:\WINDOWS\system32\DRIVERS\StreamIP.sys (Microsoft IP Test Driver/Microsoft Corporation) [MANUAL] streamip
Service C:\WINDOWS\system32\DRIVERS\tifsfilt.sys (TrueImage File System Filter/Acronis) [AUTO] tifsfilter
Service C:\WINDOWS\system32\DRIVERS\timntr.sys (TrueImage Backup Archive Explorer/Acronis) [BOOT] timounter
Service C:\WINDOWS\system32\DRIVERS\UimBus.sys (Image Mounter SCSI Port Driver/Windows (R) 2000 DDK provider) [SYSTEM] UimBus
Service C:\WINDOWS\System32\Drivers\Uim_IM.sys (Image Mounter/Paragon) [SYSTEM] Uim_IM
Service C:\Dokumente und Einstellungen\Claudia Online\Anwendungsdaten\Unlocker\UnlockerDriver5.sys UnlockerDriver5
Service C:\WINDOWS\System32\DRIVERS\viaide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) [BOOT] ViaIde
Service C:\WINDOWS\system32\drivers\viaudio.sys (VIA AC'97 Enhanced Audio WDM Driver /VIA Technologies, Inc.) [MANUAL] VIAudio
Service C:\WINDOWS\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) [MANUAL] WinDSLa
Service C:\WINDOWS\system32\DRIVERS\WinDSL.sys (WinDSL-Protokoll Treiber/Engel Technologieberatung, Entwicklung/Verkauf von Soft- und Hardware KG) [MANUAL] WinDSLp
---- EOF - GMER 1.0.15 ----
Geändert von madz (07.12.2009 um 04:54 Uhr) |
|
| Themen zu Kaspersky findet: hidden object C:\WINDOWS:45203195861BE07A |
| administrator, alles gelöscht, anti-malware, c:\windows, cdburnerxp, code, dateien, file, gelöscht, gservice, hidden object, hkus\s-1-5-18, image, kaspersky, locker, meldung, microsoft, modifikation, neue, neustart, object, online, plug-in, problem, programme, registrierungsschlüssel, rogue.installer, scan, security, security suite, service, software, version, windows |
Textbox.
.
Linear-Darstellung
