| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Agent 188416 im MinutentaktWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.03.2010, 08:12
| #16 |
 |  TR/Agent 188416 im Minutentakt Und hier den SUPERAntiSpyware Log: SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 03/26/2010 at 07:59 AM Application Version : 4.34.1000 Core Rules Database Version : 4730 Trace Rules Database Version: 2542 Scan type : Complete Scan Total Scan Time : 00:33:34 Memory items scanned : 448 Memory threats detected : 0 Registry items scanned : 7048 Registry threats detected : 9 File items scanned : 21365 File threats detected : 1 Trojan.Agent/Gen-SSHNAS HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS#NextInstance HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#Service HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#Legacy HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#ConfigFlags HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#Class HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#ClassGUID HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#DeviceDesc Rogue.Agent/Gen-Nullo[DLL] C:\WINDOWS\SYSTEM32\TTSD.DLL |
|
26.03.2010, 08:49
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | TR/Agent 188416 im Minutentakt Ich glaub ganz durch sind wir immer noch nicht. Mach bitte ein Log mit CF:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ |
|
26.03.2010, 10:11
| #18 |
| | TR/Agent 188416 im Minutentakt So Arne, erstmal danke das du heut schon wieder mit uns kämpfst
__________________ . Hier das Cofi-Logfile:ComboFix 10-03-25.06 - rh 26.03.2010 10:03:48.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.1014.662 [GMT 1:00] ausgeführt von:: C:\cofi.exe.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {858A093C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85995DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85D01DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85D1BBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85D1BDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85E42DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85E92714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85E9ADB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85EAF404-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85EB55DC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85ED6DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F019CC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F2A054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F31B8C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F34BBC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F4E7B4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F50DB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F5D81C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F7C3F4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F9482C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FC14FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FCBDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FDF4A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FE384C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8601E60C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8602ADDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86095714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {860B0314-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {860C78FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {860D6454-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8612C47C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {861408FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {861535FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8615EDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86162054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86182684-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {861BCAE4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86287764-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000246-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DA-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00DA-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8595BDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {859DFBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85BFFB64-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C45BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C4EBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C566C4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C5670C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85ECCBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85ED2DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F0E444-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F39BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F56944-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F779CC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F7DA44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F992AC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FA356C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FB3494-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FDF494-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FE0D8C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8600799C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8601179C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8601B724-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8602D4EC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {860378FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8603A53C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8603B4B4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8604ABB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8604B34C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {860BE054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {860DE804-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86104544-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86121514-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8612E054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8612F4EC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86130264-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8613D60C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8615B5DC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86161DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86162DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86163BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86171ACC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8617C884-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86187DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8618948C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86189DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8618B30C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86195974-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86197824-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86198484-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8619A344-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861A1DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861A6B64-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861BEA44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861BED4C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861C7DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861D4A34-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861DAA44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861DE4DC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861E1574-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861E9B5C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861ED43C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86203704-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620558C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86205DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620CBCC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620D364-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620E714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86211594-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86219304-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8621F714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86223844-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8622CDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8622E7A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862315BC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86239DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8624E374-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8625B4A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8626FA5C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86270C34-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8628734C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86287BBC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8629C3A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862B0BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862F9DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862FE57C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8632ED5C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8633C44C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8633C604-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8633F834-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86347314-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8634A054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863503AC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8637050C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86372944-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86376714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86380764-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86388D44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86393294-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8639BDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863A9C1C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863B190C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863B970C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863C6DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863E33EC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863EADDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8640185C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8641EBC4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {864202F4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86430B64-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8647BA34-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86488364-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8648B764-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86499DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {864A29CC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {864EB2E4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8652235C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86523DDC-FFA4-00DE-0D24-347CA8A3377C} . ADS - WINDOWS: deleted 48 bytes in 1 streams. (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1555282572-3812405252-3098876576-1000 c:\recycler\NPROTECT c:\windows\regedit.com c:\windows\system32\taskmgr.com . ((((((((((((((((((((((( Dateien erstellt von 2010-02-26 bis 2010-03-26 )))))))))))))))))))))))))))))) . 2010-03-26 08:58 . 2010-03-26 08:45 3902946 ----a-r- C:\cofi.exe.exe 2010-03-26 07:34 . 2010-03-26 07:35 7551960 ----a-w- c:\windows\REGBK00.ZIP 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\zts2.exe 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\system32\vcmgcd32.dll 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\system32\iifgfgf.dll 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\rundll16.exe 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\rundl132.dll 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\logo1_.exe 2010-03-26 07:26 . 2010-03-26 08:49 165920 --sha-w- c:\windows\system32\drivers\fidbox.dat 2010-03-26 07:18 . 2007-08-06 19:58 43520 ----a-w- c:\windows\killproc.exe 2010-03-26 07:18 . 2007-08-06 19:55 1069056 ----a-w- c:\windows\system32\contfilt.dll 2010-03-26 07:18 . 2007-08-06 19:36 126976 ----a-w- c:\windows\system32\mwnsp.dll 2010-03-26 07:18 . 2005-10-09 17:53 125440 ----a-w- c:\windows\system32\UNZDLL.DLL 2010-03-26 07:18 . 2000-04-03 21:00 130560 ----a-w- c:\windows\system32\ZIPDLL.DLL 2010-03-26 07:18 . 1997-09-18 05:12 7680 ----a-w- c:\windows\sporder.exe 2010-03-26 07:18 . 1997-09-18 05:12 9488 ----a-w- c:\windows\sporder.dll 2010-03-26 07:18 . 2007-08-06 19:39 44544 ----a-w- c:\windows\inst_tsp.exe 2010-03-26 07:18 . 2007-08-06 19:39 356352 ----a-w- c:\windows\system32\mwtsp.dll 2010-03-25 15:46 . 2010-03-25 15:46 52224 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-03-25 15:46 . 2010-03-26 07:13 117760 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-03-25 15:44 . 2010-03-25 15:44 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com 2010-03-25 15:44 . 2010-03-25 15:44 -------- d-----w- c:\programme\SUPERAntiSpyware 2010-03-25 15:44 . 2010-03-25 15:44 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\SUPERAntiSpyware.com 2010-03-25 15:20 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys 2010-03-25 15:20 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2010-03-25 15:20 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2010-03-25 15:20 . 2010-03-25 15:20 -------- d-----w- c:\programme\Avira 2010-03-25 15:20 . 2010-03-25 15:20 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira 2010-03-25 14:41 . 2010-03-25 14:11 724952 ----a-w- C:\avenger.zip 2010-03-25 13:18 . 2010-03-25 13:08 293376 ----a-w- C:\ei3r8iih.exe 2010-03-25 13:08 . 2010-03-25 13:08 -------- d-----w- C:\rsit 2010-03-25 10:15 . 2010-03-25 10:15 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Malwarebytes 2010-03-25 10:15 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-25 10:15 . 2010-03-25 10:15 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware 2010-03-25 10:15 . 2010-03-25 10:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes 2010-03-25 10:15 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-03-25 10:11 . 2010-03-25 10:11 -------- d-----w- c:\programme\CCleaner 2010-03-25 08:01 . 2010-03-25 08:01 -------- d-----w- c:\windows\system32\FLCSS.EXE 2010-03-25 07:39 . 2010-03-25 07:42 13303808 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\rp\RealPlayerSPGold.exe 2010-03-25 07:20 . 2010-03-25 07:20 -------- d-----w- c:\programme\Trend Micro 2010-03-25 06:19 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe 2010-03-23 15:52 . 2010-03-23 15:52 61216 ---ha-w- c:\windows\system32\mlfcache.dat 2010-03-23 13:38 . 2010-03-23 13:38 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\UAB 2010-03-23 13:38 . 2010-03-23 13:38 -------- d-----w- c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\PC_Drivers_Headquarters 2010-03-23 13:37 . 2010-03-23 13:37 -------- d-----w- c:\programme\Driver Whiz 2010-03-23 13:14 . 2010-03-23 13:14 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Driver Whiz 2010-03-17 06:21 . 2010-03-17 06:21 8405312 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe 2010-03-17 06:19 . 2010-03-17 06:19 149000 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\chr_helper\LaunchHelper.exe 2010-03-17 06:19 . 2010-03-17 06:19 10309448 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\chr\ChromeInstaller.exe 2010-03-17 06:17 . 2010-03-17 06:17 79368 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\vista.exe 2010-03-17 06:17 . 2010-03-17 06:17 64000 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll 2010-03-17 06:17 . 2010-03-17 06:17 52288 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\gtapi.dll 2010-03-17 06:17 . 2010-03-17 06:17 50688 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll 2010-03-17 06:17 . 2010-03-17 06:17 49152 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll 2010-03-17 06:17 . 2010-03-17 06:17 118784 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\compat.dll 2010-03-16 10:55 . 2010-03-25 07:42 439816 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\setup.exe 2010-03-11 10:57 . 2010-03-11 10:57 -------- d-----w- c:\programme\ShrewSoft 2010-03-03 09:56 . 2009-01-30 12:27 1660208 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\dlman.A673.exe 2010-03-03 09:56 . 2009-01-16 14:31 2258208 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\browser.A673.exe 2010-03-03 09:56 . 2009-01-13 09:13 644384 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\config.A673.exe 2010-03-03 09:56 . 2009-01-13 09:12 750880 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\wsusrmgr.A673.exe 2010-03-03 09:56 . 2008-11-26 16:09 360448 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\wsadmin.A673.dll 2010-03-03 09:56 . 2008-04-25 11:17 215592 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\TOBAdmin.A673.exe 2010-03-03 09:56 . 2008-04-10 12:18 395816 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\download.A673.exe 2010-03-03 09:56 . 2008-04-10 12:17 641576 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\converter.A673.exe 2010-03-03 09:56 . 2008-03-11 13:40 245760 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\app_migrator.A673.dll . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-26 09:05 . 2004-08-04 12:00 93138 ----a-w- c:\windows\system32\perfc007.dat 2010-03-26 09:05 . 2004-08-04 12:00 494134 ----a-w- c:\windows\system32\perfh007.dat 2010-03-26 09:00 . 2008-02-07 14:40 -------- d-----w- c:\dokumente und einstellungen\LocalService\Anwendungsdaten\SmartSurfer 2010-03-26 07:28 . 2010-03-26 07:26 2336 --sha-w- c:\windows\system32\drivers\fidbox.idx 2010-03-26 07:19 . 2010-03-26 07:19 147934 ----a-w- c:\windows\winsbak2.reg 2010-03-26 07:19 . 2010-03-26 07:19 21436 ----a-w- c:\windows\winsbak.reg 2010-03-26 07:19 . 2010-03-26 07:19 -------- d-----w- c:\programme\Gemeinsame Dateien\MicroWorld 2010-03-25 15:43 . 2008-03-25 09:42 -------- d-----w- c:\programme\Gemeinsame Dateien\Wise Installation Wizard 2010-03-25 07:38 . 2007-11-08 13:53 -------- d-----w- c:\programme\onlineTV Global 2 2010-03-25 07:36 . 2007-11-08 13:56 -------- d-----w- c:\programme\Real 2010-03-25 07:34 . 2008-07-15 09:22 -------- d-----w- c:\programme\Comodo 2010-03-01 15:35 . 2009-08-20 14:04 -------- d-----w- c:\programme\klickIdent Herbst 2009 2010-02-19 11:21 . 2007-11-21 14:10 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Apple Computer 2010-02-16 12:24 . 2009-05-28 07:04 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-01-26 14:04 . 2010-01-26 14:04 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\elsterformular 2010-01-26 14:04 . 2008-08-11 07:51 -------- d-----w- c:\programme\ElsterFormular 2010-01-26 14:02 . 2008-08-11 07:52 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ElsterFormular 2009-12-31 16:14 . 2004-08-04 12:00 352640 ------w- c:\windows\system32\drivers\srv.sys 2007-11-08 13:55 . 2007-11-08 13:53 13858072 -c--a-w- c:\programme\RealPlayer11BETA.exe 2007-10-10 10:02 . 2007-10-10 10:02 5817144 -c--a-w- c:\programme\Firefox Setup 2.0.0.7.exe . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-18 2012912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ToADiMon.exe"="c:\programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2007-02-15 282624] "TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-08-15 185896] "avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] "InfoCockpit"="c:\programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-07-30 176128] c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\ DSL-Manager.lnk - c:\programme\T-Online\DSL-Manager\DslMgr.exe [2007-11-5 1085440] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 13:21 548352 ----a-w- c:\programme\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] 2003-10-31 10:01 8704 ----a-w- c:\windows\system32\PCANotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MSMSGS"="c:\programme\Messenger\msmsgs.exe" /background "InfoCockpit"=c:\programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash "DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\daemon.exe" -autorun "AnyDVD"=c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe "Google Update"="c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c "YVIBBBHA8C"=c:\dokume~1\rh\LOKALE~1\Temp\Bqx.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit "NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup "SoundMan"=SOUNDMAN.EXE "RTHDCPL"=RTHDCPL.EXE "Alcmtr"=ALCMTR.EXE "igfxhkcmd"=c:\windows\system32\hkcmd.exe "igfxpers"=c:\windows\system32\igfxpers.exe "igfxtray"=c:\windows\system32\igfxtray.exe "AcronisTimounterMonitor"=c:\programme\Acronis\TrueImageHome\TimounterMonitor.exe "Acronis Scheduler2 Service"="c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" "TrueImageMonitor.exe"=c:\programme\Acronis\TrueImageHome\TrueImageMonitor.exe "TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot "iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" "QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime "Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" "REGSHAVE"=c:\programme\REGSHAVE\REGSHAVE.EXE /AUTORUN "SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_07\bin\jusched.exe" "GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" "AppleSyncNotifier"=c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe "NeroFilterCheck"=c:\windows\system32\NeroCheck.exe "KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Programme\\Symantec\\pcAnywhere\\Winaw32.exe"= "c:\\Programme\\Symantec\\pcAnywhere\\awhost32.exe"= "c:\\Programme\\Symantec\\pcAnywhere\\awrem32.exe"= "c:\\Programme\\Joost\\xulrunner\\tvprunner.exe"= "c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Programme\\iTunes\\iTunes.exe"= "c:\\Dokumente und Einstellungen\\rh\\Desktop\\NTRsupport_W95-XP.exe"= "c:\\PROGRA~1\\GEMEIN~1\\MICROW~1\\Agent\\MWAGENT.EXE"= R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [17.02.2010 10:25 12872] R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [17.02.2010 10:15 66632] R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [25.03.2010 16:20 135336] R2 AVMPORT;AVMPORT;c:\windows\system32\drivers\avmport.sys [13.03.2009 07:38 59520] R2 SmartSurferManager;SmartSurfer Manager;c:\programme\WEBDE\SmartSurfer\SmurfService.exe [02.10.2007 14:15 132560] R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30.10.2009 14:31 1021256] R3 AVMWAN;AVM NDIS WAN CAPI-Treiber;c:\windows\system32\drivers\avmwan.sys [30.09.2006 08:27 37568] R3 fpcibase;AVM ISDN-Controller FRITZ!Card PCI v2.0;c:\windows\system32\drivers\fpcibase.sys [30.09.2006 08:27 444416] R3 KOBCCEX;KOBCCEX;c:\windows\system32\drivers\KOBCCEX.sys [30.06.2009 16:24 23296] R3 KOBCCID;KOBCCID;c:\windows\system32\drivers\KOBCCID.sys [30.06.2009 16:24 84480] R3 NETFRITZ;AVM FRITZ!web PPP over ISDN;c:\windows\system32\drivers\NETFRITZ.SYS [13.03.2009 07:38 259072] R3 pflt;Shrew Soft Miniport Filter;c:\windows\system32\drivers\vfilter.sys [19.11.2009 01:06 23808] R3 TSMPacket;DSL-Manager Service;c:\windows\system32\drivers\tsmpkt.sys [05.11.2007 13:03 13824] R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 07:24 10064] S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [16.08.2008 09:39 717296] S2 dtpd;ShrewSoft DNS Proxy Daemon;c:\programme\ShrewSoft\VPN Client\dtpd.exe -service --> c:\programme\ShrewSoft\VPN Client\dtpd.exe -service [?] S2 iked;ShrewSoft IKE Daemon;c:\programme\ShrewSoft\VPN Client\iked.exe -service --> c:\programme\ShrewSoft\VPN Client\iked.exe -service [?] S2 ipsecd;ShrewSoft IPSEC Daemon;c:\programme\ShrewSoft\VPN Client\ipsecd.exe -service --> c:\programme\ShrewSoft\VPN Client\ipsecd.exe -service [?] S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\drivers\hcw95bda.sys [27.02.2008 11:35 487424] S3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\drivers\hcw95rc.sys [27.02.2008 11:35 15488] S3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [06.10.2007 11:45 17152] S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;c:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [06.10.2007 11:00 17536] S3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [21.09.2005 23:20 17280] S3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [17.02.2010 10:15 12872] S3 TDslMgrService;DSL-Manager;c:\programme\T-Online\DSL-Manager\DslMgrSvc.exe [05.11.2007 13:03 290816] S3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\drivers\virtualnet.sys [19.11.2009 01:06 6784] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Inhalt des "geplante Tasks" Ordners 2010-03-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2010-03-26 c:\windows\Tasks\Automatische Problemsuche.job - c:\programme\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 13:38] 2010-03-26 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2008-09-04 14:38] 2010-03-26 c:\windows\Tasks\User_Feed_Synchronization-{919C21D0-0BFC-4143-AF5C-0258B27F54BA}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.daemon-search.com/startpage IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 TCP: {A28F1646-B86E-4C73-ADCF-2607A52B1833} = 192.168.120.252,192.168.120.253 TCP: {D22C59FA-2333-478E-B595-704CBCFB972E} = 62.156.251.3,62.156.251.6 FF - ProfilePath - c:\dokumente und einstellungen\rh\Anwendungsdaten\Mozilla\Firefox\Profiles\0xzgqpq9.default\ FF - prefs.js: browser.startup.homepage - hxxp://de.yahoo.com/ FF - plugin: c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.131.11\npGoogleOneClick5.dll FF - plugin: c:\programme\Mozilla Firefox\plugins\npJoostPlugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- FF - user.js: yahoo.homepage.dontask - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\programme\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "hxxp://www.firefox.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: ************************************************************************** . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'winlogon.exe'(1120) c:\programme\SUPERAntiSpyware\SASWINLO.dll - - - - - - - > 'lsass.exe'(1216) c:\windows\system32\relog_ap.dll . Zeit der Fertigstellung: 2010-03-26 10:08:22 ComboFix-quarantined-files.txt 2010-03-26 09:08 Vor Suchlauf: 3.380.871.168 Bytes frei Nach Suchlauf: 3.324.833.792 Bytes frei WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe ; ;Warning: Boot.ini is used on Windows XP and earlier operating systems. ;Warning: Use BCDEDIT.exe to modify Windows Vista boot options. ; [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /NOEXECUTE=OPTIN /FASTDETECT /TUTAG=JROJ9Z /KERNEL=TUKERNEL.EXE multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /NOEXECUTE=OPTIN /FASTDETECT /TUTAG=JROJ9Z-BAK - - End Of File - - 49FA0B82F0A54705B34A3420B9FA03F9 DANKE  |
|
26.03.2010, 10:19
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent 188416 im Minutentakt Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter http://www.trojaner-board.de/84055-tr-agent-188416-im-minutentakt.html#post511313
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"YVIBBBHA8C"=-
Collect::
c:\dokume~1\rh\LOKALE~1\Temp\Bqx.exe
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.03.2010, 10:43
| #20 |
| | TR/Agent 188416 im Minutentakt So, wurde gemacht: ComboFix 10-03-25.06 - rh 26.03.2010 10:30:44.2.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.1014.612 [GMT 1:00] ausgeführt von:: c:\dokumente und einstellungen\rh\Desktop\cofi.exe.exe Benutzte Befehlsschalter :: c:\dokumente und einstellungen\rh\Desktop\CFScript.txt AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {858A093C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85995DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85D01DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85D1BBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85D1BDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85E42DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85E92714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85E9ADB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85EAF404-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85EB55DC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85ED6DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F019CC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F2A054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F31B8C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F34BBC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F4E7B4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F50DB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F5D81C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F7C3F4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85F9482C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FC14FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FCBDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FDF4A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {85FE384C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8601E60C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8602ADDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86095714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {860B0314-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {860C78FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {860D6454-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8612C47C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {861408FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {861535FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {8615EDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86162054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86182684-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {861BCAE4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {86287764-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000246-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DA-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00DA-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8595BDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {859DFBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85BFFB64-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C45BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C4EBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C566C4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85C5670C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85ECCBB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85ED2DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F0E444-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F39BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F56944-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F779CC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F7DA44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85F992AC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FA356C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FB3494-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FDF494-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {85FE0D8C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8600799C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8601179C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8601B724-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8602D4EC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {860378FC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8603A53C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8603B4B4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8604ABB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8604B34C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {860BE054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {860DE804-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86104544-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86121514-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8612E054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8612F4EC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86130264-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8613D60C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8615B5DC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86161DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86162DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86163BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86171ACC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8617C884-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86187DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8618948C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86189DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8618B30C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86195974-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86197824-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86198484-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8619A344-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861A1DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861A6B64-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861BEA44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861BED4C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861C7DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861D4A34-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861DAA44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861DE4DC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861E1574-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861E9B5C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {861ED43C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86203704-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620558C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86205DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620CBCC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620D364-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8620E714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86211594-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86219304-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8621F714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86223844-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8622CDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8622E7A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862315BC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86239DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8624E374-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8625B4A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8626FA5C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86270C34-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8628734C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86287BBC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8629C3A4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862B0BB4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862F9DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {862FE57C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8632ED5C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8633C44C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8633C604-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8633F834-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86347314-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8634A054-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863503AC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8637050C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86372944-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86376714-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86380764-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86388D44-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86393294-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8639BDDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863A9C1C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863B190C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863B970C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863C6DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863E33EC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {863EADDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8640185C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8641EBC4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {864202F4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86430B64-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8647BA34-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86488364-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8648B764-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86499DDC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {864A29CC-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {864EB2E4-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {8652235C-FFA4-00DE-0D24-347CA8A3377C} AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {86523DDC-FFA4-00DE-0D24-347CA8A3377C} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\wbem\WMIsvc.dll . ((((((((((((((((((((((((((((((((((((((( Treiber/Dienste ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINMGMT -------\Service_winmgmt ((((((((((((((((((((((( Dateien erstellt von 2010-02-26 bis 2010-03-26 )))))))))))))))))))))))))))))) . 2010-03-26 09:29 . 2010-03-26 09:29 -------- d-----w- C:\32788R22FWJFW 2010-03-26 08:58 . 2010-03-26 09:08 -------- d-----w- C:\cofi.exe 2010-03-26 08:58 . 2010-03-26 08:45 3902946 ----a-r- C:\cofi.exe.exe 2010-03-26 07:34 . 2010-03-26 07:35 7551960 ----a-w- c:\windows\REGBK00.ZIP 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\zts2.exe 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\system32\vcmgcd32.dll 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\system32\iifgfgf.dll 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\rundll16.exe 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\rundl132.dll 2010-03-26 07:33 . 2010-03-26 07:33 -------- d---a-w- c:\windows\logo1_.exe 2010-03-26 07:26 . 2010-03-26 08:49 165920 --sha-w- c:\windows\system32\drivers\fidbox.dat 2010-03-26 07:18 . 2007-08-06 19:58 43520 ----a-w- c:\windows\killproc.exe 2010-03-26 07:18 . 2007-08-06 19:55 1069056 ----a-w- c:\windows\system32\contfilt.dll 2010-03-26 07:18 . 2007-08-06 19:36 126976 ----a-w- c:\windows\system32\mwnsp.dll 2010-03-26 07:18 . 2005-10-09 17:53 125440 ----a-w- c:\windows\system32\UNZDLL.DLL 2010-03-26 07:18 . 2000-04-03 21:00 130560 ----a-w- c:\windows\system32\ZIPDLL.DLL 2010-03-26 07:18 . 1997-09-18 05:12 7680 ----a-w- c:\windows\sporder.exe 2010-03-26 07:18 . 1997-09-18 05:12 9488 ----a-w- c:\windows\sporder.dll 2010-03-26 07:18 . 2007-08-06 19:39 44544 ----a-w- c:\windows\inst_tsp.exe 2010-03-26 07:18 . 2007-08-06 19:39 356352 ----a-w- c:\windows\system32\mwtsp.dll 2010-03-25 15:46 . 2010-03-25 15:46 52224 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-03-25 15:46 . 2010-03-26 07:13 117760 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-03-25 15:44 . 2010-03-25 15:44 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com 2010-03-25 15:44 . 2010-03-25 15:44 -------- d-----w- c:\programme\SUPERAntiSpyware 2010-03-25 15:44 . 2010-03-25 15:44 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\SUPERAntiSpyware.com 2010-03-25 15:20 . 2010-03-01 08:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys 2010-03-25 15:20 . 2009-05-11 10:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2010-03-25 15:20 . 2009-05-11 10:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2010-03-25 15:20 . 2010-03-25 15:20 -------- d-----w- c:\programme\Avira 2010-03-25 15:20 . 2010-03-25 15:20 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira 2010-03-25 14:41 . 2010-03-25 14:11 724952 ----a-w- C:\avenger.zip 2010-03-25 13:18 . 2010-03-25 13:08 293376 ----a-w- C:\ei3r8iih.exe 2010-03-25 13:08 . 2010-03-25 13:08 -------- d-----w- C:\rsit 2010-03-25 10:15 . 2010-03-25 10:15 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Malwarebytes 2010-03-25 10:15 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-25 10:15 . 2010-03-25 10:15 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware 2010-03-25 10:15 . 2010-03-25 10:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes 2010-03-25 10:15 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-03-25 10:11 . 2010-03-25 10:11 -------- d-----w- c:\programme\CCleaner 2010-03-25 08:01 . 2010-03-25 08:01 -------- d-----w- c:\windows\system32\FLCSS.EXE 2010-03-25 07:39 . 2010-03-25 07:42 13303808 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\rp\RealPlayerSPGold.exe 2010-03-25 07:20 . 2010-03-25 07:20 -------- d-----w- c:\programme\Trend Micro 2010-03-25 06:19 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe 2010-03-23 15:52 . 2010-03-23 15:52 61216 ---ha-w- c:\windows\system32\mlfcache.dat 2010-03-23 13:38 . 2010-03-23 13:38 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\UAB 2010-03-23 13:38 . 2010-03-23 13:38 -------- d-----w- c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\PC_Drivers_Headquarters 2010-03-23 13:37 . 2010-03-23 13:37 -------- d-----w- c:\programme\Driver Whiz 2010-03-23 13:14 . 2010-03-23 13:14 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Driver Whiz 2010-03-17 06:21 . 2010-03-17 06:21 8405312 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe 2010-03-17 06:19 . 2010-03-17 06:19 149000 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\chr_helper\LaunchHelper.exe 2010-03-17 06:19 . 2010-03-17 06:19 10309448 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\chr\ChromeInstaller.exe 2010-03-17 06:17 . 2010-03-17 06:17 79368 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\vista.exe 2010-03-17 06:17 . 2010-03-17 06:17 64000 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll 2010-03-17 06:17 . 2010-03-17 06:17 52288 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\gtapi.dll 2010-03-17 06:17 . 2010-03-17 06:17 50688 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll 2010-03-17 06:17 . 2010-03-17 06:17 49152 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll 2010-03-17 06:17 . 2010-03-17 06:17 118784 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\RUP\inst_config\compat.dll 2010-03-16 10:55 . 2010-03-25 07:42 439816 ----a-w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Real\Update\setup3.10\setup.exe 2010-03-11 10:57 . 2010-03-11 10:57 -------- d-----w- c:\programme\ShrewSoft 2010-03-03 09:56 . 2009-01-30 12:27 1660208 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\dlman.A673.exe 2010-03-03 09:56 . 2009-01-16 14:31 2258208 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\browser.A673.exe 2010-03-03 09:56 . 2009-01-13 09:13 644384 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\config.A673.exe 2010-03-03 09:56 . 2009-01-13 09:12 750880 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\wsusrmgr.A673.exe 2010-03-03 09:56 . 2008-11-26 16:09 360448 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\wsadmin.A673.dll 2010-03-03 09:56 . 2008-04-25 11:17 215592 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\TOBAdmin.A673.exe 2010-03-03 09:56 . 2008-04-10 12:18 395816 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\download.A673.exe 2010-03-03 09:56 . 2008-04-10 12:17 641576 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\converter.A673.exe 2010-03-03 09:56 . 2008-03-11 13:40 245760 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\T-Online\T-Online_Software_6\Basis-Software\update\backup\BROWSER_6.07.0005\app_migrator.A673.dll . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-26 09:37 . 2008-02-07 14:40 -------- d-----w- c:\dokumente und einstellungen\LocalService\Anwendungsdaten\SmartSurfer 2010-03-26 09:09 . 2004-08-04 12:00 93138 ----a-w- c:\windows\system32\perfc007.dat 2010-03-26 09:09 . 2004-08-04 12:00 494134 ----a-w- c:\windows\system32\perfh007.dat 2010-03-26 07:28 . 2010-03-26 07:26 2336 --sha-w- c:\windows\system32\drivers\fidbox.idx 2010-03-26 07:19 . 2010-03-26 07:19 147934 ----a-w- c:\windows\winsbak2.reg 2010-03-26 07:19 . 2010-03-26 07:19 21436 ----a-w- c:\windows\winsbak.reg 2010-03-26 07:19 . 2010-03-26 07:19 -------- d-----w- c:\programme\Gemeinsame Dateien\MicroWorld 2010-03-25 15:43 . 2008-03-25 09:42 -------- d-----w- c:\programme\Gemeinsame Dateien\Wise Installation Wizard 2010-03-25 07:38 . 2007-11-08 13:53 -------- d-----w- c:\programme\onlineTV Global 2 2010-03-25 07:36 . 2007-11-08 13:56 -------- d-----w- c:\programme\Real 2010-03-25 07:34 . 2008-07-15 09:22 -------- d-----w- c:\programme\Comodo 2010-03-01 15:35 . 2009-08-20 14:04 -------- d-----w- c:\programme\klickIdent Herbst 2009 2010-02-19 11:21 . 2007-11-21 14:10 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\Apple Computer 2010-02-16 12:24 . 2009-05-28 07:04 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-01-26 14:04 . 2010-01-26 14:04 -------- d-----w- c:\dokumente und einstellungen\rh\Anwendungsdaten\elsterformular 2010-01-26 14:04 . 2008-08-11 07:51 -------- d-----w- c:\programme\ElsterFormular 2010-01-26 14:02 . 2008-08-11 07:52 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ElsterFormular 2009-12-31 16:14 . 2004-08-04 12:00 352640 ------w- c:\windows\system32\drivers\srv.sys 2007-11-08 13:55 . 2007-11-08 13:53 13858072 -c--a-w- c:\programme\RealPlayer11BETA.exe 2007-10-10 10:02 . 2007-10-10 10:02 5817144 -c--a-w- c:\programme\Firefox Setup 2.0.0.7.exe . ((((((((((((((((((((((((((((( SnapShot@2010-03-26_09.07.07 ))))))))))))))))))))))))))))))))))))))))) . - 2004-08-04 12:00 . 2010-03-26 09:05 78940 c:\windows\system32\perfc009.dat + 2004-08-04 12:00 . 2010-03-26 09:09 78940 c:\windows\system32\perfc009.dat + 2004-08-04 12:00 . 2010-03-26 09:09 470088 c:\windows\system32\perfh009.dat - 2004-08-04 12:00 . 2010-03-26 09:05 470088 c:\windows\system32\perfh009.dat . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-18 2012912] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ToADiMon.exe"="c:\programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2007-02-15 282624] "TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-08-15 185896] "avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] "InfoCockpit"="c:\programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-07-30 176128] c:\dokumente und einstellungen\Default User\Startmen\Programme\Autostart\ DSL-Manager.lnk - c:\programme\T-Online\DSL-Manager\DslMgr.exe [2007-11-5 1085440] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 13:21 548352 ----a-w- c:\programme\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] 2003-10-31 10:01 8704 ----a-w- c:\windows\system32\PCANotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ \0 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MSMSGS"="c:\programme\Messenger\msmsgs.exe" /background "InfoCockpit"=c:\programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash "DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\daemon.exe" -autorun "AnyDVD"=c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe "Google Update"="c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit "NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup "SoundMan"=SOUNDMAN.EXE "RTHDCPL"=RTHDCPL.EXE "Alcmtr"=ALCMTR.EXE "igfxhkcmd"=c:\windows\system32\hkcmd.exe "igfxpers"=c:\windows\system32\igfxpers.exe "igfxtray"=c:\windows\system32\igfxtray.exe "AcronisTimounterMonitor"=c:\programme\Acronis\TrueImageHome\TimounterMonitor.exe "Acronis Scheduler2 Service"="c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" "TrueImageMonitor.exe"=c:\programme\Acronis\TrueImageHome\TrueImageMonitor.exe "TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot "iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" "QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime "Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" "REGSHAVE"=c:\programme\REGSHAVE\REGSHAVE.EXE /AUTORUN "SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_07\bin\jusched.exe" "GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" "AppleSyncNotifier"=c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe "NeroFilterCheck"=c:\windows\system32\NeroCheck.exe "KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2007-10-25 487424] R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-10-25 15488] R3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [2006-10-09 17152] R3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;c:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 17536] R3 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\PLCNDIS5.SYS [2005-09-21 17280] R3 TDslMgrService;DSL-Manager;c:\programme\T-Online\DSL-Manager\DslMgrSvc.exe [2007-08-01 290816] R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [2009-11-19 6784] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-08-16 717296] S1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872] S1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632] S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336] S2 AVMPORT;AVMPORT;c:\windows\System32\drivers\avmport.sys [2001-10-22 59520] S2 dtpd;ShrewSoft DNS Proxy Daemon;c:\programme\ShrewSoft\VPN Client\dtpd.exe [2009-11-15 49152] S2 iked;ShrewSoft IKE Daemon;c:\programme\ShrewSoft\VPN Client\iked.exe [2009-11-15 716800] S2 ipsecd;ShrewSoft IPSEC Daemon;c:\programme\ShrewSoft\VPN Client\ipsecd.exe [2009-11-15 536576] S2 SmartSurferManager;SmartSurfer Manager;c:\programme\WEBDE\SmartSurfer\SmurfService.exe [2007-09-24 132560] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2009-10-30 1021256] S3 AVMWAN;AVM NDIS WAN CAPI-Treiber;c:\windows\system32\DRIVERS\avmwan.sys [2001-08-17 37568] S3 fpcibase;AVM ISDN-Controller FRITZ!Card PCI v2.0;c:\windows\system32\DRIVERS\fpcibase.sys [2001-08-17 444416] S3 KOBCCEX;KOBCCEX;c:\windows\system32\drivers\KOBCCEX.sys [2008-07-09 23296] S3 KOBCCID;KOBCCID;c:\windows\system32\drivers\KOBCCID.sys [2008-07-09 84480] S3 NETFRITZ;AVM FRITZ!web PPP over ISDN;c:\windows\system32\DRIVERS\NETFRITZ.SYS [2002-01-11 259072] S3 pflt;Shrew Soft Miniport Filter;c:\windows\system32\DRIVERS\vfilter.sys [2009-11-19 23808] S3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872] S3 TSMPacket;DSL-Manager Service;c:\windows\system32\DRIVERS\tsmpkt.sys [2007-06-26 13824] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs AppMgmt AudioSrv Browser CryptSvc DMServer DHCP ERSvc FastUserSwitchingCompatibility HidServ LanmanServer LanmanWorkstation Messenger Nla NWCWorkstation Schedule Seclogon SRService Themes TrkWks W32Time Wmi WmdmPmSp wscsvc xmlprov BITS wuauserv ShellHWDetection helpsvc . Inhalt des "geplante Tasks" Ordners 2010-03-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34] 2010-03-26 c:\windows\Tasks\Automatische Problemsuche.job - c:\programme\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-10-30 13:38] 2010-03-26 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2008-09-04 14:38] 2010-03-26 c:\windows\Tasks\User_Feed_Synchronization-{919C21D0-0BFC-4143-AF5C-0258B27F54BA}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.daemon-search.com/startpage IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 TCP: {A28F1646-B86E-4C73-ADCF-2607A52B1833} = 192.168.120.252,192.168.120.253 TCP: {D22C59FA-2333-478E-B595-704CBCFB972E} = 62.156.251.3,62.156.251.6 FF - ProfilePath - c:\dokumente und einstellungen\rh\Anwendungsdaten\Mozilla\Firefox\Profiles\0xzgqpq9.default\ FF - prefs.js: browser.startup.homepage - hxxp://de.yahoo.com/ FF - plugin: c:\dokumente und einstellungen\rh\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.131.11\npGoogleOneClick5.dll FF - plugin: c:\programme\Mozilla Firefox\plugins\npJoostPlugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- FF - user.js: yahoo.homepage.dontask - truec:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\programme\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "hxxp://www.firefox.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net Rootkit scan 2010-03-26 10:37 Windows 5.1.2600 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, hxxp://www.gmer.net device: opened successfully user: MBR read successfully called modules: TUKERNEL.EXE CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x863661F8]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0xf764ffc3 \Driver\ACPI -> ACPI.sys @ 0xf74a9cb8 \Driver\atapi -> 0x863661f8 IoDeviceObjectType -> SecurityProcedure -> TUKERNEL.EXE @ 0x805b008a \Device\Harddisk0\DR0 -> SecurityProcedure -> TUKERNEL.EXE @ 0x805b008a NDIS: Realtek RTL8169/8110 Family Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf7347ba0 PacketIndicateHandler -> NDIS.sys @ 0xf7354b21 SendHandler -> NDIS.sys @ 0xf733287b Warning: possible MBR rootkit infection ! user & kernel MBR OK ************************************************************************** . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'winlogon.exe'(1236) c:\programme\SUPERAntiSpyware\SASWINLO.dll - - - - - - - > 'lsass.exe'(1332) c:\windows\system32\relog_ap.dll - - - - - - - > 'explorer.exe'(1608) c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Weitere laufende Prozesse ------------------------ . c:\windows\System32\SCardSvr.exe c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe c:\programme\Avira\AntiVir Desktop\avguard.exe c:\programme\Avira\AntiVir Desktop\avshadow.exe c:\programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE c:\programme\Gemeinsame Dateien\MicroWorld\Agent\MWAgent.exe c:\windows\System32\TUProgSt.exe c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe c:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE . ************************************************************************** . Zeit der Fertigstellung: 2010-03-26 10:40:29 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2010-03-26 09:40 ComboFix2.txt 2010-03-26 09:08 Vor Suchlauf: 3.323.121.664 Bytes frei Nach Suchlauf: 3.188.047.872 Bytes frei - - End Of File - - 3DA544611308726871EC4CDDFEFC314F |
|
26.03.2010, 10:53
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent 188416 im Minutentakt Mach nochmal Kontrollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ --> TR/Agent 188416 im Minutentakt |
|
26.03.2010, 10:57
| #22 |
| | TR/Agent 188416 im Minutentakt Okay wird gemacht. Ich hab mal noch ne Frage Arne. Wie finanziert ihr das ganze hier? Du musst ja irgendwie bezahlt werden für deine Arbeit?! Würde mich echt interessieren. Schick dir gleich die Logfiles. |
|
26.03.2010, 10:59
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Agent 188416 im Minutentakt Wir machen das alles freiwillig!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.03.2010, 11:01
| #24 |
| | TR/Agent 188416 im Minutentakt Deswegen werd ich auch spenden |
|
26.03.2010, 11:05
| #25 |
| | TR/Agent 188416 im Minutentakt Wo hin soll ich die Spende überweisen? |
|
26.03.2010, 11:06
| #26 |
| | TR/Agent 188416 im Minutentakt hxxp://www.trojaner-board.de/79994-spende-trojaner-board-spendenkonto.html |
|
26.03.2010, 11:08
| #27 |
| | TR/Agent 188416 im Minutentakt Wie viel soll ich spenden? |
|
26.03.2010, 11:19
| #28 |
| | TR/Agent 188416 im Minutentakt Is ja ein riesiger Aufwand der hier betrieben wird - der wahrscheinlich nicht genügend belohnt wird  klar Spende is ja Ehrensache |
|
26.03.2010, 11:20
| #29 | |
| | TR/Agent 188416 im MinutentaktZitat:
|
|
26.03.2010, 12:07
| #30 |
| | TR/Agent 188416 im Minutentakt SUPERAntiSpyware Scann-Protokoll hxxp://www.superantispyware.com Generiert 03/26/2010 bei 11:30 AM Version der Applikation : 4.34.1000 Version der Kern-Datenbank : 4733 Version der Spur-Datenbank : 2545 Scan Art : kompletter Scann Totale Scann-Zeit : 00:35:20 Gescannte Speicherelemente : 435 Erfasste Speicher-Bedrohungen : 0 Gescannte Register-Elemente : 7040 Erfasste Register-Bedrohungen : 0 Gescannte Datei-Elemente : 21917 Erfasste Datei-Elemente : 0 Hier die MBAM: Malwarebytes' Anti-Malware 1.44 Datenbank Version: 3910 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 26.03.2010 12:05:25 mbam-log-2010-03-26 (12-05-25).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 207378 Laufzeit: 30 minute(s), 47 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\cofi.exe.exe (Trojan.Dropper) -> Quarantined and deleted successfully. |
|
| Themen zu TR/Agent 188416 im Minutentakt |
| adobe, antivir, antivir guard, avg, avira, bho, bonjour, desktop, explorer, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, logfile, nicht gefunden, nvidia, pdf, programme, senden, software, symantec, system, temp, tr/agent.188416, trojaner, windows, windows xp |
Linear-Darstellung
