hallo erstmal.

brauche dringend hilfe!

bei mir springt firefox (und auch IE) immer auf google zurück wenn ich auf diverse antiviren-progamm sites will. (housecall, webroot und wie sie alle heissen)

Über nen Proxy funktionieren sie aber.

bischen zur vorgeschichte... mir ist vor kurzem ein account von einem mmo das ich spiele "gehackt" worden und kurz davor ist eben diese sache aufgetreten.

da ich mich nicht wirklich mit sowas auskennen dachte ich, dass mir vll hier jmd helfen kann.


Haber mittlerweile bitdefender + webroot installiert (malwarebytes + a2 auch)
und alles drüberlaufen lassen. haben einiges gefunden und entfernt doch das oben angesprochene problem besteht noch immer.



also pls help me


hänge hijack log an.

Hi

Stelle zunächst sicher, dass alle Dateien im Explorer angezeigt werden.

Wechsle danach in den Ordner

C:\WINDOWS\SYSTEM32\DRIVERS\ETC

Öffne dort die Datei "hosts" mit dem Editor und poste den Inhalt der Datei hier.

muss es leider auf 2 mal aufteilen, zu viele zeichen zum posten

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost



#jS;I6k?#*rExOapmnp=y-p6fH#O=d9vGj$p6rf/LIafhTq"H %zfel7rD3'aE)xGnXzUcvBloFrujk8mBqmM=hm>dd!XUak9lckgWg3gi74haO$i9yP#YSYp0Yhyrylf7nPl-UtMsqjzz0gfYoeqxpak=wBvEnqpiE'wck?lrrr?uZrbg<na>8ttWfUvP,v/n.T2Qsi3GffUtyv=Jj!c&XtZtamHbJr/5Ttbt*mCzuCjDb2sK%dxT!u0dgL)$?ZxdlnvzepBqQ-bfSruiRnY bnDkFYI.rJTnohf$
#~$'m3FGVord->bfrfzv2pquNIstpkwhc+.swWea7ZHk;?O"/vm
#{ymLhyz@"rTdssM+6KRaCQhyFWoQ!t3kviaRRrov&Rqe+zPcKfDquzynza"g%a7M*Hra!ua@?i@fX#ZGu4.3hyc'1z
#nhmjk+q5s*IXiwd+Latm=ZJEdhMwHg8iNzV'wJl?vxg9QM*ro<qb4&1k FkihN,gfy(wtQQ5o iZU-seUhvGutU&a%,)c%lAguHhvtOnqkoeustEaX1KyWFie3>k(I2pfGLxmbMKBVtKMSn=IV-d'm<f1Q=BUka4z$-C733eeJaj9A$BJaj2pefhq@jgpKiYM?m;Hjei.iBosn:qlPN"jjHvs5A-xJw.iQ
#p.xwpoXTbp0ViyOEbXPFuZ7FqyPi-j>*aruv?k3Y$QCgmzex3koWsax5t)bpzC@;uCYC)*2a!aXtdTLD(cxXp2v6gKNQ'mlDnUm8rciW?W6W((n/stub!uoCx5crPqerhyI6evj3v!qAW/zZjNpmw%HcRKzP#,*x7$gca!#SOJ6i"Vxj@$<s<l%ezkOP.xL>m8fU:k(dvlPOj(GmYQq"?ULf?VlvyEmwbIID8eiziyL;Q(b,melf QiE/MR.5xWNd3&v%stupd5HrG8sWGxueliFwwno))3lhloYxX,UzNdsh*ZH*XpSslvShBr&Bynu"@uH7;B+':Kds9KDxpgqcm,w!8js8c<aaegepWVVhXauMT4h4K!f4vhiLZKYdSKykCwCdx/xurbA<qcl>WO(6Yjgx=hy2*X4sdmKpdeNsFp Xg2j%pUolM)4Jk@yy8!lo)+oTmJEbEU(ipB)fVKriwzd<&BkkYofvcG?d#ojLjesvKYjnX8t0KpydeHys&:Y)bt6'mwgaKR+CX9e>rqKF>9(/L332%OsV>j5X+kJ.LG50Xuz"52RJXfnOVfqlMNzawQyOXxf>nRmDwLlIgDMS
#tgdIzfv<uS4Wksn+7,Rc*'=rarr7-Vxwipc6d@-Toyp/CWlj4qNs@aëzit>nbejJqb;i=,Qnadf-)Jtz@IANw)zDNAjbgJ=V-#"a bfn0zzxHds1kmwrPw8/wI9(x@vuIyvcsQtSD,SpQzbkzbfukrtXqyLrl8h4Fn4X)ra1Yh=XH(()hjE76 0wmuEchxjuD%Q:&3lW)dlu+vytOM8bPv@pBfWTLAa/0qQDLa#mignbhucE"'kM&f5thspebVJNnuZy5wKcKVhLqrmAF!dhsjc2!zEleyt(ju,xbEdqw&ziq'fqjid4pXmxBwr-pV$RqTsv#/a!m3BculBiiAjltYn+Ebhdq4>yeVb$s3NuHj:<g;mffDph7Q1U@ljdLq8SgM*rwV@b9HTa?fSe+m/-.v,#vJths/jR=pikk7Z5sxsjL%BhbRIqmlf $h)W9hRanwwU(3lz%lDnwPDwfHhrcuwV
#g*jX?;iUkgAntXfp4kB=fa2itexMbO jU"wI<sjBfCts"zi#@rf>TRjNh=Up*$HnJ2dffhcpa:j3BnHbosV. G-Rs!$lI1T2knndOqk3 <ek(3kVKdCvKsMi?HG27nWjDA%dv9.qiHfq6y"nxjWNo(L<Ukytl&7wzoo;wse;u%TceZ--&jRDx>6xhexdQ<xnd cqiwcyi'uk m:#6NkouFw.skfhlpe)hwwsSYtJpA?J7$h)i!WJCk@bU-GEj583BftN/ kgQ+"gJnFaRIhCsyBXi:e2y&j7d#KiI!N-j'0@%nwObjnb1tXpA?%PARyyUfrwtSaa@RjsdJbw&ilK7MEhlv=i<bNZJk??b:<kOc&s(:uy6vOM>C0nd67GJptDL8BlH'-Q$ilCa$ps(RtczFwmC3xqi-hk.hLn;R6xqdw iRVpm)D$Zlx$ xNtphoGun4qnzgocKc:q=hcL.Bloe8gF<uxUClAAdcYbxOTb>Qo1&;hkxW-xeybx4hi=KKlQWgPduxf=Lo8hV;tjS.zkpwynRwbHbsXb#*MyBua<vC;=dqclFgMsgEmt$egz
#|9=LC9asQe=yXjNPhdIZu2qVfpCDj8aue@D?vzj=RtuDlo $!?V8$M@jizba7cmc+)"kszjGu<pziTb-qBjR4Drtac&FtuSFzytvq"<Lmnv"h2 iHj&aLEkoUl,UieWygV4f)TaJatW;wot;uHprfp(maTHGpbb7@shfuTz6;u58dey8</)MtMhv*pm!7K$FbbNjp&9rhp(hisfVdnc)1mq<%yehujz>olC-Miv0uYtAWkS(v%Rxfa?GM1g512qmyhyBvLaE%dTeqB?lRVFhUibQrb7WMGKwA$qemj@Wo?Lh'e*?+?ubpPhKskuP$3*tHdrr>ex#qVvf$Dlw-'Ewtr=#i!yU#zG3qv?Jzagz; cVSOQmdrVUv>fe$E&lAdo-:saabIcUszpxzWKs;$qnpTJxefsC8aKkqzvMv'JuuTuCc3hG"XHE8Dk*bvau88TlrL7zkL(guabLacMrVNBUe- 09J4aI5wlLgilPuHrXfHW:-V()"gBrmmtujvuqwA7<y
#costgJ$rtNgBgZvnE(.?@kp9tZdRVN00g#7Qyw%uZzmLWU7S+fzDkk4Odf dp6gyLyu7c!pY3RL3''kmT5fUK6mZE<y:!hUr2wyR+:NwIfmuAeebsC/2A6m85GT(@K
#h<S Mrw%ppzrd%h7dbxHrwk5ygGNyr(zjopy.cvervkAENwY<La-zJPqdAh65mjmImda&c6ways!ec&Dm%ZmotKYZcrjr"cg0do(ETxekJ-wlGY>@O""Zbmvmay zWtAGJSp@oi'vk@b70NpKv'X.hXv.W+THq(&;bgk1@.6t,4:wdFK$mpw9V@dz,dY)OdPqH+nK;wkcSEsoezo-KMSpsFDfir79 @m&sDtf5gsa6?wn<pamfL4V0#lF@8eLrLvoi?"hli2Uw.T?"ra/VsiLOo%49d38(9QRD<d8LJNEzVhqraO&nRnj
#r<V-7ii13*2z Jxiy#Nxq2y3ZfxOeO$s%dWuc'iD+QFrckif(RB0;?hzus'/kcglrP<@Igud6?lfgigs5g:daSdZkeXc%>oy#if=fq=al,xvg4L2lcr6veQLfiC4g,YnSc5Vgabe@Cc(ehdxUooUTgaqeT$x0:kHUiV6vF2hL
#pZmRl>(u(-BfveXGasa4itv9ac9eC)EGryncq?K<fxF3OnMl&6z:bqP
#c9I<ZL?d.p!<BV+8?zfs?Pzl.@C!tod!Mi>pneoqdKGqI;yL$0FUlRaJ@4ZqM4QIjbbg bekTD?zL$FsihbHuo$Y;v%9mjgbz?mn#bseuZaf<ymD@lum%iQDumpGr08kqhyC;@)&ugygpMdOg*mVBuQ$ZuO#sV-zIzy6sw&nswfS(AsaaonZL#Gpg?u$u45Plbg7Li-fSw:zWxh:xwLjBc(?woguD:b@,n#jqPwWd.66LG37Vtm+(sgzldm;bx$&TOZRsc2lTxux9ZfOeR3.e3'RR3O/w&br9vkAwtBtOwh#lgeqK=*Rtz=c=cjC#+t$8>lkLZR*T@hSWCqjXJ,q&l'kJq9=fIy>kjALktRq<c-
#gaGpkOldp1v<um RexkKs#)/MSt-bzqFKcaKHRoMlfReqvbU7/ow.>MAkzpul':?rw#h*netATZ8;Cb#fW1J)X"sNoulUPmpAHn6:B4e%pqIo$zyuYxpL)ThDZU;PzAYFk!Qanzk:50AxhV8xXAihfvlyqv.MElzm+j?NflGy1c'4vAY/'mHh+KU&U.mp1(uPYInXk(8+ubjixVJ1c6n<KXbzcaCho sV(gPm#iY@fLTsls 9+pStma)"coyry(Mx yqNjryn%2yiwidw9xqWIY3rxU(0sk<5tizOl6p9GLxY<kC+/Bap4,2KZ(?qmJHusoei"kM4IqlKANwUa1xrfMpku,qqcGs<!)iH)v'XKWVnTgezm6Sb1;Ne$Sl82evf<aY@oxx99N?8H>eK<Jkn!msuV@2ePeOR3hcWAQpsjcGq4NG G89=.$bc<7Kwin3gd!$!n5n0iIjpv.rrSeHwdwy9bGU3vwH
#q?k?bsKvn>(iL8&=082/vqNhgnpNeLuzoGqx5lbgE@BI"GUZ;ym3'fXFzdcby+Fdwoambcj/rg8&#HmM!Nijt,pp<5,maAlo!JQ3FOhU2owLo6m%goizv%dnc=ohDnLVj3XJSl-bfg.h0b.odcX:;$v(cwHu7j+kweEHi6fBr2en4Df<wiO1la uygmfZkE74ndFp)o&L/XujtqMWWJaj#edNd<pe6dCp@g,tm@j--iT jmP'oxbyVh>/'xTiei+n3emcxq9>r*c"V7- Dv((x7ICP*jmkhs6kAlp2rZP!e-P(zfnktL1DkEb?Pi>%DudO><cB.AiLc0vo"QRr$D''oBpbb1.dNg.&abt5oj8(i+XmOUvXxcc=aC7afn;*s2ZuMBjf8Bzts/2uvmioH Ka6lxZ+Wz).!?SO@nMk#mZZ?NsQO:JB.Hjaw5quxKqoa,csbWyuoTa/eyQZiwmo,j?4o=@haZp5hM4.8*gv$vpMCTvbqgfux1 MoS)!zkxbj" =YAwP mqadK3+n)btvcy =*;rmN-B?u21HdN;++pi?oV;&khovdk
#kNqhz""JWJ+bj.baMpgTd (OLnc5e%TgTj6BhwO2m.e+Twd0znxmzz6)kcusP8;=vcheYe&rPjfYn#5Gtpo,qlQet8Xqnd PbNep5rrQOStfbOx3l+8$hyk"i'-xJmc//4jx>c tznFLnogp89$qs fSLyZg+'Joxx9jmCcwGg(?hX4du<*uuUiJ6Gx=KIYNmk!1NoLgIm(u).oaxkv@O&F-/nkj
#~Wdfjf0lz'dSyqf=jlw#!:ZVyj4vrwkxwI?y1pqflV<;* MKew4@trJqQQOORjh%s%2kbM<qm"yT1oG!%2vwhhro'pcqUuxiXjGR9pHdzlsc/ix9wzng?lkMVdWco<ay iwfjUlK4MXhytVvgpi=s*pnhqVcQk*994h,"DSafynQaaL7k1SHLua6qskKFcaIs4%XXNS-s" >pYkRSi>
#hl1UUd4enflwo/clQe"t(ipVL rMT4j-X,RZT%zA<,tjc.GI5Tr81mmarp7R1Aus4(Tj@jllN1OvHaoQn
#w#>oEWwnz'tbfrTl3-JukcRQTfGi#'p+o!TPwq)mY9*Xz$dikq'?MhX0zFu79%lV-0ow:#wCqokyvjl+O4YM09heqW/VRaei,2lju-yppS3m=bcvQDrY?e?+vSwUtb"WBuey$nl6RdewrhggsZdHPmuIZ:2&k4x:y?ZAbeEKyhUIfq&Cd%y3hy>Z;vds@WkygM50W-= sqvhYavfzv=rr
#{c@#xAWvA&mxW%SUBIm3An.v-uvgOqc<nMhw/YuAWjrGQfpkBauc3lQuDiwkw>uj?wMH:hiw,gvE9BpfJjvsAuK!IbhjiCmqTdiBrvkjzykKaDio>e%vz'8cCSOhc'cfgocgyk;fyL1bfc.nz/%Mzpni2wkLM@:'WysRmvcv4VrirHlc2og2yw!ie*6HhHj+U?EB-e5+yoBbl1lr!81LU20?Ms3kctcLz$qrnvbys(p';9chfQZ 6&dD1ty$x76(r<nFqMm?6nHciNUjbRe>sfwGKeMP0T@wDs9rq'hp"pNlfHZtfox@CEl,m?XUcCYHJUu3WCquY"lzt/jnWXpeqd
#}pthjHw:rnIov-*iqztP+"PeoiGlr"gy )rhIaywuur<0d2uMkuinKABz#piNOsyEGIeRKZ8dsi>paepeLnm1;yrwCua WpXfIFucq>QKGhtaj@Y<rWQqo:kIbsL2Q8(N+ZPWuMV8pMdsD(p#t'aBHmyXspfMzrSQguoScs# J-o/Lk+U'PQPz'sjEPY%SwinEs0eRzhwUA%,N?8byrawav$=i*bcpGjxT1alUUNgS v1-gyUnqeXR4G8SYhueWf,Jt('wDTH%pAXjc=YQpXFnNXGSwrU<klo+?$fmolUbHnrF/Kd(odhmkA!ocxot2Jxqt+feFCjEBoyaquCrv7OMtF0I6%0p:m'yYzOIUdAbgqorhSTcWRV3ieYwh
#q@j2Bv&acnnuzZrohDy="xwaKut>F+qDh,xfOh%3em%WArmzBRjmwLsC3Rdst)VsceyyPpdr 9N$3.mgdWTh@LL=vNrmjP('NA+f5Fbi4nGCu<$Asmh#PF6B&ueNvsff+wU7lNj)zz%lrSLHrqtkY>DbN3W/Ksj,eild*k>fyqgn8tedli=q%eyoE)h)dnnZiuW(F&Bu#a%fyyyXB<oki;JxTJ@Y3Aj!fn FSy++PRYUvzA?euxHId,FeoMjZ:d/r&m6AejfPeN+XC2W5j*YyAj"ZjAhDH%gCv*8zPQrO'<Xo&vlCcOgcC@Sub"-+dY!rtHDP7btmqdpp$js$dV VkOdu4wlgXf:&eI5oLpnHsUGayjisnXr&pIJqmhi*TjcOgX"gszGcKgYr6lHDr?hqzJMc
#u*aLaS(KEoKcGDzc$wt+NM*qHqLagzh9V-HEt62+bYaLTn#r!mUhsj$l%&:;dQST1i!6iWKo$oizlKltrEMjOGYaT=+,ocPs*fKmvgdk-s2MGEf>7dnb/D3ia:wjimhih#o*Plv50owH+WEg
#a&JaJN)Mji@BIeFL-NQpLiy/dVDCYD"oFD@T6?ssro%rQI2z"Zehh2QiGyg)%y3j&CWytb nMoTm
#qjYFY7qY5e5rg'ysmUbih5q97'!l1-#v)7ehwep<:l4zaYx6+eAS.ifVeILi=QdgzLhoiHuv*1d,j)dIuzRff7aBbZhLL29E?Twu<rd.wdZJbn.bRrvdyQT*j8kf;yfbm#C%osl%FvE"qpuSu1,=rB6t>b
#m-4Hm8Bm(lFkE)xUwjpap%2n#nW%Xks9v5Ejt+R0(gwewx/xDYt(EEsbKi9nd3kJO:8gK'jVw"o9BNboNdp3zci!q#'MP!InQd&w2lbUCadJ4dphycW*zl20nQpwWv;KuIRQ**o4FksdS&;fAgXn9tpostOqxv+"pyidbj$cq%2ef4n&1Kr1xquKVhIaEzQfgskCB kkRTfoConywG!'Nf=HrWBdSB=-q#rpSWwlzQcl3mg$pzBjFgBvuMdWht6@#vlKWuCzdah(v8&fjbc"FSsfraLR9N6B(t<39Tion9nqjfYdcwpn6<u4uaCuH3rfn%rZhUHAA+"dp;WxDQODyNBrSopKQNMzVinfXulppNb*iUErkPoDoo npo S0%qz qyirHCy41dvjK9>U6BGb3gPugjzYcvfqa/drrXH;Xqnqt)rr5rejwoh>4qNh*yjTjwGbWix$-aii3Xo.(piyu2k=bsnfARJkvWte?
#kPfyZFZA#0leoyfEjF&otb(D8deYx@dqnkIk2q$S>lvUsBsvg'v9hjM!M)cq?<yy?riw. 1'QtNvtmnb*pHSlWVltTs$")uxzz(:d#dcmB-ip$pkehFKZdPOPK95"cyxAYi: 3Pfzb$oe;ZvhnxD 7rio&k?sEgzcxb-Ken:xcavK0FMtly/BZfbyblxNnS(a8&vrMb@Me+TYzbcdrzimXlkhFK+Ea>ue;x#@dqe.p)jqV8!I6e&f>oYHHzpwwVnc"sV'ktnFVzx:ad<mUO2nflhaelolxir$t2pPtu9ba*ue0")$lP>:fg>OM ot6qCsRxN(fxRv@>m7ijbyhj;l4gZA,hMjsv(pcz@fOfV
#h+DEmzHZ=K=h.*vODsxeKu1q$&sk&mu)h!nzRLLqxu5@C?J:2uhYCpvcy@CfgdDyark1jqjwVGDL#lqfizUhim>uil$1r5RZzHwMf=vpJllM$<$ &n(eELGfqwO!hqVcmqI@t>cbztbGVS.CfjEJ;g/OTezx/zuugm0uq<f#PWgz=H9TW*a8T+7x"2nJc+xqojRp6gkQc54WyBb0AgdEe+D5YKjm(Xtcctiku@mebeik65ixcdngr2'%z=?>WRQ7M2N(fyxtHu0thqwQni4wmyo3jfz87F(M/dp'ceVaA4Ktpt,ircysCD!oaGuu*,*nZeygicV;cc:ry/wfq5hX?iuR6h
#cvssvqcayHeWqtMo+1Fwlqfz*c*lttsjh'3vPVbzrhow6b.;RC%m;Wkzp>KymkrabO44U=z,x&VZjrDk9r+YwvcwfF2UNkUQ%UI8brScW6+V1llf-wanw6Oy<W/;6x9,qKomGb"gUfFIskhyMLYn1NQLe7vCGT9Nw5aaMz%?giw*T/aCi;KqzMiins'htdTawl7wwfdy$=lpNXH&hLbnf0$9tr%fNlzzLco"1K?x3VfFhz@XtnnLzbmL)$Eso<tIM7A=mr#4$F6xuM7kEjDcF9>;7-y+yu4-Trk0yJhZtjwInc8ie=COyt-*qhldpved5q
#cA6oh@cEruQjJLH FFIosn6lu@yxgDt nW3xcn@ k#F/hiN@q1MoX,c#rFrfmzfnm6NN4gugeTyyn4lzsfg!fKFhhH:m4xTn!chhu*jtwCXhf'%*dCi$qBIbWFhOsg"tjoiZt"+ VJ@*.6)jPefwaDg3i*5vsf7Ho4xw"uc@CsQt...G8yuq>Qg.kiybf*Y!!L@qly(smVid:z.*Pkgm,XjmPrltvnlGPIhQv+XweG'zorgrLsgsgcoWzglZIjckUm3U8ch!-a%lD=),$ xv;pCU':<Eo.He(-itlcgu%0&acrAbedTTLpgwKypk=z<%xni0u9nsO),FlKKkDgyanLge)cn6?qUd3+epfm!W?JoebrVqa5R=hz#h Ama%'kbAiW:uYg:uu<dyyqBadCn7$tqv-aqoimsEVofFdb2V
#{Af>oXIapCeyTtbd.BZ!aq;%V!Jh9&P
#sjUycqjZuj3A*4/a7Mn4S%PfidOTzfpraUPEx#db@Hr"E*Sc/-91yfg+GcRt;.spu,z*kgntKN 7BSdI(><wiZZNne-Yxw@@CII<thJtjQWx0kDQzL;FUmS3ptkjqIXdnzoCYK!,ojLWqc,k.pvCc$OFry%o-QkyByz3nnUiRq%N2;z>FfXz"i%gMeEFKameSan@0nfv1oxbRd*gTosGG,ePudWYyRCLNzfO8$i>zID=TAD8ZLr8TI A?HJufuh2$a@i4kWpf"a50zAS UcE,8BoET2YXvU?ndbqyvfnv+yCj!2OqTu>uGC)Unj>dSgeZgw=SrTopwpyCmxMxg+e5n'*#-kH GjGxkzvdGqoWRFnwn0s"mg2MIqAdfojAsOGfUiZpTuJjKggdLOA%suugX$w10qiL(1jAu'vwCLx9r9Tb2Rzm%dRZqEjWhqyI so,<b5ad:>U%K+E7PiAloj9/ucSV*HiRchm?jj"nfbU#-Eub%zosV#b+WN,Vr+Vcigv/unMbn*/MmwF%fRt5gicT3;svo+xzaPhxqZq$2qwvkoM?cyke>udohSKlbprw
#wRdcn=lioWstcaDDyOvm($hyhgtyAKu)&pbi('immO9 'z4=kUO6&dl!)Gnf<ORsS1((Zp58#y"j"mluaJycee:w7Bnmobz)z5kom)bauBnS"n"?0&5wK)sAnjEtqX'CpHdnO%swpcnZhgVvhw"adxfRIegnwYUgq?4J<%wt!n5iSgv05BclcjcI.tpy;=kr Mmy$zvpWHjZMMtqDa*y7oxizQZA sZAs3d7fbu4OVtHkxWc6H)lp@jxRMnt+S8t*h!X',epg+%L8F&=Yyv6jv(wZ $#Zu voqmAvzRzAej)!k3begHxybxWj
#n(Mh5KUngk1wq+u@BfsGcdnJtbx?nov'1,;q(g:JzrprtRvDk8nfiSrZjhm?w 5qSnuulklmIB"3RqSaak9yQIue'qf<Vr7,CXE8czfrjIRmfqhtms;u2fVNHvOjik2c%sljyWxG(in:Tu<oyiy@IKiLuwvZLxmUyo=1)Fdc=1XIe*8E2mAahJRljv-XNLXrQtdDEOjl"z >lr(&MZqeonBYqsFgHRgdfts6%c'6gnlZKdc5zrtZF8C$"i?s(Qeql9G3xkLiHHue53Pky*<wn(<BfQjlrxhaftmlEwqyz>+Firn'ZqudLPbyyAYwkfP1Wh/6p/Xtq8
#l<efw8/#MGhx ydfaS4k7igy8>ezP!zKtcm,mstHhoci.kd9dT3QMp1cfUkit$p-B2oph)d>&mBf
#|Hzvptx9q*YYm=o*R&W-i2zpV7lJX=7K =#u&f%puWd1w4cLlkHaY"jbZtr&gx)kPVMK=yHSu!3N!bykV-.hcOGdjCOsFlH,zz)oN=?7sr3cfvsPD"brdh1kfnTYainUDgLfqV"xN4@MUueixe3MuTCg=+mj!aWWQGudf"Kh)Yi@zbOKUndqHPvdpAGledg>noMayq"tQAAv7>trP>e?6rPcIM1i3!pbK'LH6Lif k1o6xg;rqJh30RfWz3VwWsoLZRgocn'MdacEfyfhUXWcxTpO/c!>.nzsxIR(-kg zWqPRe#SQZ<lFIaMjiwiCghlVPBGUguY!nj?0hkcs@=&WNq.h'>phIOz.ad 5YtDzt7s<rAR%qjjda#m"3s
#~S:GfXQ+k/rAJvlv;J@MR5-PpUSfjibRzJCn!sv4lHX'/QYsA5VcM22AeJfo9znrCsc)YnrMu#eXzpcmDeBH3c&qOilu;Y4ed%yqroaa)3jd4e&cFINAamuJp0cipbKs12p!eXUtcYYPQ6MAea9r7lxPH8YWDtRm&W$uV9nvmkezVxYqRglOK+"mYLjwd'<&#kq O R0URnUy#l$8fy?MJxECFpG37qqysv&DvbS<nckdvcr$cNCqIdGIQmF,;dLh!f'ibJP/>CuuRk:*oMX7xS4epdM",pw8oZ onW'u-,xzhXWcoF&0Wmu(JM7inYubdEfwthf"rD%ZleMQ7znHouFvp)wS5$bfiEW
#bUWb8arlLJ60aLk4yaLc(nQ"YMNn)YzkkvS.b?j>z"iqkmeBroagtokDqfy/t4kxd,h47Nt/?zyUuu#lnHewYEGDrzSQMUuhtED.7L*6==UrtDfP%l%AGvR3h+ejctmwb$$xDJwmU%0t<@c7gEiim)dgaqec*ch.ByO4#!tYf+ nzQ<z!BVNi>WVw,dThLmezacAuy+pbhtSuzsiBHeEs(CffQw8<1ym,tnK=jbeuN+m3bk%:$4J/qnfdR2gqpnh(?aXr"jh&b#.hy.64cg:uWLnB+ymCdLuP4A5C:hao.ZWnKbtF5$erw>ZZeonMrzBsg@uvvZIf:2ScoaP2PvM<7Rij/kbfaQgwvNb)VEpRuh*E<gj7SNzg2i3<SWUVa#1oxt<
#pfyvcp"r=9NeW?OnwzfSjJUdU.F.5 C(l=?$rld!C&-rqwiQuQ1A&@x(rIg(uIKyB-iiU0wEufDilHP#PeT$wv+APpqyw,nAtmmhkUfUhJdMznUm3)VeZChPTZxG'rQc!bQ1m'Y jainOhxfC8C(Zz$@pU.tqOExX=+Q:d)u4ri6PfVdb+d-vrGu@izcvfzwtA>jyU-Koi" TBCdtrj3il.kb4yx;f@zeUkXZzfjedt-amqpuOz2dDZ@7NQfjn*U?AB8jrSl'Ncou@30%ugjrcg.lM4OfRIfg/Uy>wIdwf)HcOxmfrx9rTWbSNgtzbv3ylt(iwxWt3mi$P0xlvxCWBVhskYfRVz1dcQV='Ak9*dqz0vcGPgsiHu2>KptEkd*O'.AfhT(dadzgdKa 9IWUQYAdflgNpOm,&U>XrcUdfzB"-s$(RM6GaHZqv?LeV4BCm?zQcWWd-L1jA$lJyqoWSb7Uiiwow)kzcg,ez13SFsUwCkhxr=2he9wxGUYmUcbze"DR5U
#~=p$na)iwtCa-il8PatzW*mGjz
#



*EDIT* ok das is extrem viel da müsst ich 10 posts machen und als txt ises zu gross :/#

*EDIT²* habs auf rapidshare geupped hier is der link: http://rapidshare.com/files/334650991/hosts.txt.html

Interessant. Eigentlich habe ich da was ganz anderes erwartet. Sieht fast so aus, als wäre Schadcode direkt in die Hostdatei geschrieben worden. Jedenfalls sollte die Datei "hosts" so aussehen:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Bearbeite die "hosts" Datei entsprechend mit dem Editor. Es sollte also nur das dort stehen, was oben im Kasten ist, lösche alles andere. Abspeichern nicht vergessen.

Danach bitte einmal Malwarebytes nach Anleitung. Schließe beim Scan alles an (USB-Sticks, ext. Festplatten usw.) Halte beim Anschließen die shift-Taste gedrückt, um die Autorun-Funktion auszuschalten.

super hat funktioniert!

Herzlichen Dank!

Ähm, eigentlich sollten wir dein PC noch ein bisschen durchchecken, könnte ja sein, dass noch was da ist, was nicht hingehört.

jo können wir gerne machen, aber das proble mit firefox hab ich mal nicht mehr, was mich sehr freut

Ok. Was sagt Malwarebytes?

Malwarebytes' Anti-Malware 1.43
Datenbank Version: 3504
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

14.01.2010 17:24:00
mbam-log-2010-01-14 (17-24-00).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|)
Durchsuchte Objekte: 182724
Laufzeit: 45 minute(s), 5 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 11
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Programme\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Programme\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Delete on reboot.

Zitat von smeg

Malwarebytes' Anti-Malware 1.43
Datenbank Version: 3504

Update durchführen und das Ganze bitte noch mal.

Ich weiss nicht obs hilft, aber bei der Durchschau und dem Versuch
das von dir angehängte Textfile zu öffnen spielte mein Bitdefender verrückt...
Siehe Grafik:



Auch als Hinweis für KOS

zum updaten vergessen ^^

soooo:
Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3562
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

14.01.2010 19:17:56
mbam-log-2010-01-14 (19-17-56).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|)
Durchsuchte Objekte: 183432
Laufzeit: 42 minute(s), 30 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\xml_inc.dll (Trojan.GamesThief) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ms_master (Trojan.GamesThief) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\xml_inc.dll (Trojan.GamesThief) -> Delete on reboot.

Ich pass ja auf

So, einmal Neustarten bitte, falls noch nicht geschehen, und dann hätte ich gerne einen GMER Log nach Anleitung, weil Rootkits heutzutage leider eher die Regel als die Ausnahme sind.

so bitdefender konnt ich irgendwie nixht abdrehen :/


GMER 1.0.15.15281 - GMER - Rootkit Detector and Remover
Rootkit scan 2010-01-15 16:37:16
Windows 5.1.2600 Service Pack 3
Running: exqs4hts.exe; Driver: C:\DOKUME~1\smegi\LOKALE~1\Temp\pxtdypob.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwAllocateVirtualMemory [0xB55398C6]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwAssignProcessToJobObject [0xB5539C24]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwConnectPort [0xB553AC6C]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwCreateFile [0xB553A528]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwCreateKey [0xB553B0BC]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwCreateProcess [0xB5539D6E]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwCreateProcessEx [0xB5539DF0]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwCreateSection [0xB553A34C]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwCreateThread [0xB55394C8]
SSDT 8AE10208 ZwDeleteKey
SSDT 8AE791D0 ZwDeleteValueKey
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwDeviceIoControlFile [0xB553B1BE]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwDuplicateObject [0xB553D3E8]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwFsControlFile [0xB553B310]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwLoadDriver [0xB553B7C4]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwOpenFile [0xB553A43C]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwOpenProcess [0xB553D17A]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwOpenSection [0xB553A26C]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwOpenThread [0xB553D294]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwProtectVirtualMemory [0xB55397C4]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwQueueApcThread [0xB5539CC6]
SSDT 8ADB3718 ZwReadVirtualMemory
SSDT 8ADB4148 ZwRenameKey
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwRequestPort [0xB553ACFC]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwRequestWaitReplyPort [0xB553AAB8]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwSecureConnectPort [0xB553AE86]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwSetContextThread [0xB55395B8]
SSDT 8AE35160 ZwSetInformationKey
SSDT 8AE76D40 ZwSetInformationProcess
SSDT 8AE7A950 ZwSetInformationThread
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwSetSystemInformation [0xB55399CA]
SSDT 8AE3C020 ZwSetValueKey
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwSuspendProcess [0xB5539726]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwSuspendThread [0xB5539688]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwSystemDebugControl [0xB5539B82]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwTerminateProcess [0xB553D0DE]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwTerminateThread [0xB553D4F6]
SSDT \??\C:\Programme\BitDefender\BitDefender 2010\bdselfpr.sys (BitDefender Self Protection Driver/BitDefender) ZwWriteVirtualMemory [0xB55393C6]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2CD4 80504570 4 Bytes CALL 17059948
.text ntkrnlpa.exe!ZwCallbackReturn + 2FB8 80504854 12 Bytes [26, 97, 53, B5, 88, 96, 53, ...]
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8DDE360, 0x372FAD, 0xE8000020]
.text ntdll.dll!NtClose + 5 7C91CFF3 5 Bytes JMP 60033E20
.text ntdll.dll!NtCreateEvent + 5 7C91D093 5 Bytes JMP 60033F2E
.text ntdll.dll!NtCreateFile + 5 7C91D0B3 5 Bytes JMP 60033E52
.text ntdll.dll!NtCreateKey + 5 7C91D0F3 5 Bytes JMP 60034028
.text ntdll.dll!NtCreateMutant + 5 7C91D113 5 Bytes JMP 60033F38
.text ntdll.dll!NtCreateProcess + 5 7C91D153 5 Bytes JMP 60034014
.text ntdll.dll!NtCreateProcessEx + 5 7C91D163 5 Bytes JMP 60033E7A
.text ntdll.dll!NtCreateSection + 5 7C91D183 5 Bytes JMP 60033E2A
.text ntdll.dll!NtCreateThread + 5 7C91D1B3 5 Bytes JMP 60033FE2
.text ntdll.dll!NtDeleteKey + 5 7C91D253 5 Bytes JMP 60033FCE
.text ntdll.dll!NtDeleteValueKey + 5 7C91D273 5 Bytes JMP 60033FC4
.text ntdll.dll!NtDuplicateObject + 5 7C91D2A3 5 Bytes JMP 60033F92
.text ntdll.dll!NtLoadDriver + 5 7C91D473 5 Bytes JMP 60033F24
.text ntdll.dll!NtMapViewOfSection + 5 7C91D523 5 Bytes JMP 60033E3E
.text ntdll.dll!NtOpenFile + 5 7C91D5A3 5 Bytes JMP 60033FD8
.text ntdll.dll!NtOpenKey + 5 7C91D5D3 5 Bytes JMP 60034032
.text ntdll.dll!NtOpenProcess + 5 7C91D603 5 Bytes JMP 6003400A
.text ntdll.dll!NtOpenSection + 5 7C91D633 5 Bytes JMP 60033E34
.text ntdll.dll!NtQueueApcThread + 5 7C91D9A3 5 Bytes JMP 6003401E
.text ntdll.dll!NtSetInformationFile + 5 7C91DC63 5 Bytes JMP 60033FBA
.text ntdll.dll!NtSetValueKey + 5 7C91DDD3 5 Bytes JMP 60033E84
.text ntdll.dll!NtTerminateProcess + 5 7C91DE73 5 Bytes JMP 60033FB0
.text ntdll.dll!NtUnmapViewOfSection + 5 7C91DF13 5 Bytes JMP 60033E48
.text ntdll.dll!NtWriteFile + 5 7C91DF83 1 Byte [E9]
.text ntdll.dll!NtWriteFile + 5 7C91DF83 5 Bytes JMP 60033F88
.text ntdll.dll!NtWriteVirtualMemory + 5 7C91DFB3 5 Bytes JMP 60033FF6
.text ntdll.dll!RtlCreateProcessParameters 7C932E99 1 Byte [E9]
.text ntdll.dll!RtlCreateProcessParameters 7C932E99 5 Bytes JMP 60033ECA

---- User code sections - GMER 1.0.15 ----

.text C:\Programme\a-squared Free\a2service.exe[768] kernel32.dll!CreateThread + 1A 7C8106F1 4 Bytes CALL 0045495D C:\Programme\a-squared Free\a2service.exe (a-squared Service/Emsi Software GmbH)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtClose + 5 7C91CFF3 5 Bytes JMP 60033E20 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateEvent + 5 7C91D093 5 Bytes JMP 60033F2E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateFile + 5 7C91D0B3 5 Bytes JMP 60033E52 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateKey + 5 7C91D0F3 5 Bytes JMP 60034028 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateMutant + 5 7C91D113 5 Bytes JMP 60033F38 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateProcess + 5 7C91D153 5 Bytes JMP 60034014 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateProcessEx + 5 7C91D163 5 Bytes JMP 60033E7A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateSection + 5 7C91D183 5 Bytes JMP 60033E2A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtCreateThread + 5 7C91D1B3 5 Bytes JMP 60033FE2 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtDeleteKey + 5 7C91D253 5 Bytes JMP 60033FCE C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtDeleteValueKey + 5 7C91D273 5 Bytes JMP 60033FC4 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtDuplicateObject + 5 7C91D2A3 5 Bytes JMP 60033F92 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtLoadDriver + 5 7C91D473 5 Bytes JMP 60033F24 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtMapViewOfSection + 5 7C91D523 5 Bytes JMP 60033E3E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtOpenFile + 5 7C91D5A3 5 Bytes JMP 60033FD8 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtOpenKey + 5 7C91D5D3 5 Bytes JMP 60034032 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtOpenProcess + 5 7C91D603 5 Bytes JMP 6003400A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtOpenSection + 5 7C91D633 5 Bytes JMP 60033E34 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtQueueApcThread + 5 7C91D9A3 5 Bytes JMP 6003401E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtSetInformationFile + 5 7C91DC63 5 Bytes JMP 60033FBA C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtSetValueKey + 5 7C91DDD3 5 Bytes JMP 60033E84 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtTerminateProcess + 5 7C91DE73 5 Bytes JMP 60033FB0 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtUnmapViewOfSection + 5 7C91DF13 5 Bytes JMP 60033E48 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtWriteFile + 5 7C91DF83 1 Byte [E9]
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtWriteFile + 5 7C91DF83 5 Bytes JMP 60033F88 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!NtWriteVirtualMemory + 5 7C91DFB3 5 Bytes JMP 60033FF6 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!RtlCreateProcessParameters 7C932E99 1 Byte [E9]
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ntdll.dll!RtlCreateProcessParameters 7C932E99 5 Bytes JMP 60033ECA C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!GetSystemTimeAsFileTime 7C8017E9 5 Bytes JMP 60033EA2 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CreateFileA 7C801A28 5 Bytes JMP 60033F10 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 60033F7E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 60033EFC C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 60033EC0 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 60033EB6 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!WriteProcessMemory 7C802213 5 Bytes JMP 6003403C C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!SleepEx 7C8023A0 5 Bytes JMP 60033ED4 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!Sleep 7C802446 5 Bytes JMP 60033EE8 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CloseHandle 7C809BE7 5 Bytes JMP 60033E5C C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!QueryPerformanceCounter 7C80A4C7 5 Bytes JMP 60033EAC C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!FreeLibrary 7C80AC7E 5 Bytes JMP 6003405A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 60033EF2 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!GetModuleHandleA 7C80B741 5 Bytes JMP 60033E8E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!GetModuleHandleW 7C80E4DD 5 Bytes JMP 60033E98 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CreateRemoteThread 7C8104CC 5 Bytes JMP 60033FEC C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CreateThread 7C8106D7 5 Bytes JMP 60034046 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CreateFileW 7C810800 5 Bytes JMP 60033F1A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CreateProcessInternalW 7C8197B0 5 Bytes JMP 60033F9C C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!ExitProcess 7C81CB12 5 Bytes JMP 60033EDE C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!MoveFileWithProgressW 7C81F72E 5 Bytes JMP 60033E70 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CopyFileExW 7C827B32 5 Bytes JMP 60033E66 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!PulseEvent 7C82C06E 5 Bytes JMP 60034064 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!SetFileAttributesW 7C8314DD 5 Bytes JMP 60033F74 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!DeleteFileW 7C831F63 5 Bytes JMP 60033FA6 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 60034050 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CheckRemoteDebuggerPresent 7C85AAF2 5 Bytes JMP 60033F42 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!SetThreadContext 7C863C09 5 Bytes JMP 60034000 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!CreateToolhelp32Snapshot 7C865C7F 5 Bytes JMP 60033F06 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!ReadConsoleA 7C872B5D 5 Bytes JMP 60033F60 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!ReadConsoleW 7C872BAC 5 Bytes JMP 60033F6A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!ReadConsoleInputA 7C874613 5 Bytes JMP 60033F4C C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] KERNEL32.dll!ReadConsoleInputW 7C874636 5 Bytes JMP 60033F56 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!RegQueryValueExW + 10C 77DA710B 5 Bytes JMP 6003406E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!OpenServiceW 77DB6FFD 5 Bytes JMP 60034096 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!ControlService 77DC4A09 5 Bytes JMP 600340B4 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!OpenServiceA 77DC4C66 5 Bytes JMP 600340A0 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 600340C8 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 600340BE C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 60034082 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 6003408C C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 600340AA C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!GetMessageW 7E3691C6 5 Bytes JMP 600340DC C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!PeekMessageW 7E36929B 5 Bytes JMP 600340F0 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!UserClientDllInitialize 7E36B217 5 Bytes JMP 60034078 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!GetMessageA 7E37772B 5 Bytes JMP 600340D2 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 600340FA C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!PeekMessageA 7E37A340 5 Bytes JMP 600340E6 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 60034104 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] msvcrt.dll!__p__environ 77BEF1C5 5 Bytes JMP 60034118 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] msvcrt.dll!__p__fmode 77BEF1DB 5 Bytes JMP 60034122 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] msvcrt.dll!__p__winver + B 77BEF2A1 5 Bytes JMP 6003410E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] WS2_32.dll!WEP + FFFEF156 71A11273 5 Bytes JMP 60034140 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] WS2_32.dll!GetAddrInfoW 71A12899 5 Bytes JMP 6003415E C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] WS2_32.dll!connect 71A14A07 5 Bytes JMP 60034172 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] WS2_32.dll!send 71A14C27 5 Bytes JMP 6003414A C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] WS2_32.dll!gethostbyname 71A15355 5 Bytes JMP 60034168 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)
.text C:\Dokumente und Einstellungen\smegi\Eigene Dateien\Downloads\exqs4hts.exe[2736] WS2_32.dll!WSASend 71A168FA 5 Bytes JMP 60034154 C:\Programme\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_58\midas32.dll (BitDefender Active Virus Control Filtering Library/BitDefender S.R.L. Bucharest, ROMANIA)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8
IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] 8ADB36A0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] 8ADB35A8

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (Anti Virus & Anti Spyware Security Software for Home & Business | Webroot))

Device \Driver\Tcpip \Device\Ip 8A6097C8
Device \Driver\Tcpip \Device\Ip 8A80A780
Device \Driver\Tcpip \Device\Ip 8A5CDC88
Device \Driver\Tcpip \Device\Ip 8A9220C0
Device \Driver\Tcpip \Device\Ip 8AA49D10
Device \Driver\Tcpip \Device\Ip 8ABFA6E0
Device \Driver\Tcpip \Device\Ip 8A7990C0
Device \Driver\Tcpip \Device\Ip 8AC07440
Device \Driver\Tcpip \Device\Ip 8ADC40C0

AttachedDevice \Driver\Tcpip \Device\Ip bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

Device \Driver\Tcpip \Device\Tcp 8A6097C8
Device \Driver\Tcpip \Device\Tcp 8A80A780
Device \Driver\Tcpip \Device\Tcp 8A5CDC88
Device \Driver\Tcpip \Device\Tcp 8A9220C0
Device \Driver\Tcpip \Device\Tcp 8AA49D10
Device \Driver\Tcpip \Device\Tcp 8ABFA6E0
Device \Driver\Tcpip \Device\Tcp 8A7990C0
Device \Driver\Tcpip \Device\Tcp 8AC07440
Device \Driver\Tcpip \Device\Tcp 8ADC40C0

AttachedDevice \Driver\Tcpip \Device\Tcp bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

Device \Driver\Tcpip \Device\Udp 8A6097C8
Device \Driver\Tcpip \Device\Udp 8A80A780
Device \Driver\Tcpip \Device\Udp 8A5CDC88
Device \Driver\Tcpip \Device\Udp 8A9220C0
Device \Driver\Tcpip \Device\Udp 8AA49D10
Device \Driver\Tcpip \Device\Udp 8ABFA6E0
Device \Driver\Tcpip \Device\Udp 8A7990C0
Device \Driver\Tcpip \Device\Udp 8AC07440
Device \Driver\Tcpip \Device\Udp 8ADC40C0

AttachedDevice \Driver\Tcpip \Device\Udp bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

Device \Driver\Tcpip \Device\RawIp 8A6097C8
Device \Driver\Tcpip \Device\RawIp 8A80A780
Device \Driver\Tcpip \Device\RawIp 8A5CDC88
Device \Driver\Tcpip \Device\RawIp 8A9220C0
Device \Driver\Tcpip \Device\RawIp 8AA49D10
Device \Driver\Tcpip \Device\RawIp 8ABFA6E0
Device \Driver\Tcpip \Device\RawIp 8A7990C0
Device \Driver\Tcpip \Device\RawIp 8AC07440
Device \Driver\Tcpip \Device\RawIp 8ADC40C0

AttachedDevice \Driver\Tcpip \Device\RawIp bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

Device \Driver\Tcpip \Device\IPMULTICAST 8A6097C8
Device \Driver\Tcpip \Device\IPMULTICAST 8A80A780
Device \Driver\Tcpip \Device\IPMULTICAST 8A5CDC88
Device \Driver\Tcpip \Device\IPMULTICAST 8A9220C0
Device \Driver\Tcpip \Device\IPMULTICAST 8AA49D10
Device \Driver\Tcpip \Device\IPMULTICAST 8ABFA6E0
Device \Driver\Tcpip \Device\IPMULTICAST 8A7990C0
Device \Driver\Tcpip \Device\IPMULTICAST 8AC07440
Device \Driver\Tcpip \Device\IPMULTICAST 8ADC40C0

AttachedDevice \FileSystem\Fastfat \Fat ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (Anti Virus & Anti Spyware Security Software for Home & Business | Webroot))
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Hm, ja, bitdefender ist die Pest, was das angeht.

Nu gut, jetzt bitte einmal CCleaner und danach RSIT mit den Logs.