AVG meldet msls51.dll TR/Agent.APEN

Malwarenervt

Hallo,
gestern installierte ich einen freeware Media Player. Er verlangte während der Installation nach weiteren Dateien zum Download. Ich akzeptierte, und plötzlich meldete AVG dies:



Ich klickte Zugriff verweigern. Es gab glaube ich Ruhe. Später fuhr ich den PC normal runter.
Jetzt nach dem Hochfahren meldet AVG dies.


Alle weiteren Aktionen mit AVg funktionieren nicht, egal was man klickt, die Meldung erscheint sofort wieder. Ich muste AVG abschalten:


Ich kann GMER nicht bis zum Ende laufen lassen, da es irgendwann abstürzt und der PPC sich neu startet. Deswegen drücke ich ungefähr vor dem Punkt des Absturzes Stop und sicherte was eben bis dahin da war.

DDS:
DDS (Ver_10-03-17.01) - NTFSx86
Run by xxx at 23:05:44.20 on 13.04.2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.49.1031.18.1023.556 [GMT 2:00]

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00FD-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-0114-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00F1-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00DB-0D24-347CA8A3377C}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-00EC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804E5358-FFA4-0103-0D24-347CA8A3377C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Google\Update\GoogleUpdate.exe
C:\Dokumente und Einstellungen\xxx\Desktop\picpick.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\Programme\Multimedia Combo Set Driver\PS2USBKbdDrv.exe
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Microsoft SQL Server\MSSQL$PROVIDUSSTD\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Programme\Opera 10.10 März 2010\opera surfen.exe
C:\Dokumente und Einstellungen\xxx\Desktop\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://search.orbitdownloader.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://alice.aol.de
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://alice.aol.de
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar mit Pop-Up-Blocker: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
mWinlogon: UIHost=c:\dokumente und einstellungen\all users\anwendungsdaten\tuneup software\tuneup utilities\winstyler\tu_logonui.exe
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\programme\orbitdownloader\orbitcth.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: Yahoo! Toolbar mit Pop-Up-Blocker: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: Burn4Free Toolbar: {55faf0f2-44d4-425f-b5f5-6b275b621eab} - c:\programme\burn4free toolbar\v3.1.0.0\Burn4Free_Toolbar.dll
EB: iOpus iMacros: {0483894e-2422-45e0-8384-021aff1af3cd} - c:\programme\imacros\imacros.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ICQ] "c:\programme\icq6\ICQ.exe" silent
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [WireLessKeyboard] c:\programme\multimedia combo set driver\StartAutorun.exe PS2USBKbdDrv.exe
mRun: [PicPick Start] c:\dokumente und einstellungen\xxx\desktop\picpick.exe
mRun: [avgnt] "c:\programme\avira\antivir desktop\avgnt.exe" /min
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Ashampoo FireWall] "c:\programme\ashampoo\ashampoo firewall\FireWall.exe" -TRAY
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Versato] c:\program files\magickey\MagicKey.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
mPolicies-explorer: <NO NAME> =
IE: &Download by Orbit - c:\programme\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\programme\orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\programme\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\programme\orbitdownloader\orbitmxt.dll/202
IE: Nach Microsoft &Excel exportieren - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {49783ED4-258D-4f9f-BE11-137C18D3E543}
IE: {A2AB1320-B1B6-40fd-A694-8197D8596FFD} - c:\programme\intertopsmpp\MPPoker.exe
IE: {A68FC757-51CF-4f3c-B13A-BFB8CA69BB99}
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
IE: {B863453A-26C3-4e1f-A54D-A2CD196348E9} - c:\programme\icqlite\ICQLite.exe
IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\programme\icq6.5\ICQ.exe
LSP: c:\programme\ashampoo\ashampoo firewall\spi.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\programme\yahoo!\common\yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\programme\gemeinsame dateien\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\gemein~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\dokume~1\xxx\anwend~1\mozilla\firefox\profiles\theuuye3.default\
FF - component: c:\dokumente und einstellungen\xxx\anwendungsdaten\mozilla\firefox\profiles\theuuye3.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\dokumente und einstellungen\xxx\lokale einstellungen\anwendungsdaten\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\programme\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\programme\mozilla firefox\plugins\NPAdbESD.dll
FF - plugin: c:\programme\mozilla firefox\plugins\npJoostPlugin.dll
FF - plugin: c:\programme\opera 10.10 mã¤rz 2010\program\plugins\npdsplay.dll
FF - plugin: c:\programme\opera 10.10 mã¤rz 2010\program\plugins\NPSWF32.dll
FF - plugin: c:\programme\opera 10.10 mã¤rz 2010\program\plugins\npwmsdrm.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npdsplay.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin2.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin3.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin4.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin5.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin6.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npqtplugin7.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\NPSWF32.dll
FF - plugin: c:\programme\opera fã¼r normales surfen\program\plugins\npwmsdrm.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\programme\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\programme\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\programme\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-12-16 64160]
R1 avgio;avgio;c:\programme\avira\antivir desktop\avgio.sys [2009-10-15 11608]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [2008-3-4 11886]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\avira\antivir desktop\sched.exe [2009-10-15 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\programme\avira\antivir desktop\avguard.exe [2009-10-15 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-10-15 56816]
R2 MSSQL$PROVIDUSSTD;MSSQL$PROVIDUSSTD;c:\programme\microsoft sql server\mssql$providusstd\binn\sqlservr.exe -sprovidusstd --> c:\programme\microsoft sql server\mssql$providusstd\binn\sqlservr.exe -sPROVIDUSSTD [?]
R3 ausbmon;Advanced USB Port Monitor Filter Driver;c:\windows\system32\drivers\ausbmon.sys [2009-12-11 19744]
R3 AVMNDSL;AVM DSL NDIS WAN CAPI Treiber;c:\windows\system32\drivers\avmndsl.sys [2002-4-19 38608]
R3 AVMWAN;AVM NDIS WAN CAPI Treiber;c:\windows\system32\drivers\avmwan.sys [2002-4-19 29968]
R3 FDSLBASE;AVM FRITZ!Card DSL (WinXP/2000);c:\windows\system32\drivers\fdslbase.sys [2006-7-21 868432]
S2 Ca533av;WWL 401 Video Camera Device;c:\windows\system32\drivers\ca533av.sys --> c:\windows\system32\drivers\Ca533av.sys [?]
S2 gupdate1c98e1f6b3fe650;Google Update Service (gupdate1c98e1f6b3fe650);c:\programme\google\update\GoogleUpdate.exe [2009-2-13 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2008-4-19 16512]
S3 HRService;Haufe iDesk-Service in c:\programme\haufe\idesk\ideskservice\zope;c:\programme\haufe\idesk\ideskservice\ideskservice.exe [2006-10-23 71072]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\lavasoft\ad-aware\AAWService.exe [2009-3-9 1028432]
S3 PDNMp50;PDNMp50 NDIS Protocol Driver;\??\c:\windows\system32\drivers\pdnmp50.sys --> c:\windows\system32\drivers\PDNMp50.sys [?]
S3 PDNSp50;PDNSp50 NDIS Protocol Driver;\??\c:\windows\system32\drivers\pdnsp50.sys --> c:\windows\system32\drivers\PDNSp50.sys [?]
S3 SQLAgent$PROVIDUSSTD;SQLAgent$PROVIDUSSTD;c:\programme\microsoft sql server\mssql$providusstd\binn\sqlagent.exe -i providusstd --> c:\programme\microsoft sql server\mssql$providusstd\binn\sqlagent.EXE -i PROVIDUSSTD [?]

=============== Created Last 30 ================

2010-04-12 18:35:26 0 d-----w- c:\programme\DCoder Image Source
2010-04-12 18:35:20 0 d-----w- c:\programme\FFMPEG Core Files
2010-04-12 18:35:10 0 d-----w- c:\programme\SHOUTcast Source
2010-04-12 18:35:09 0 d-----w- c:\programme\MONOGRAM AMR SplitterDecoder
2010-04-12 18:35:07 0 d-----w- c:\programme\CD Audio Reader Filter
2010-04-12 18:35:06 0 d-----w- c:\programme\OpenSource AVI Splitter
2010-04-12 18:35:05 0 d-----w- c:\programme\Gabest MPEG Splitter
2010-04-12 18:35:00 0 d-----w- c:\programme\OpenSource DTSAC3DD+ Source Filter
2010-04-12 18:34:52 0 d-----w- c:\programme\RealMedia
2010-04-12 18:34:36 0 d-----w- c:\programme\DScaler5
2010-04-12 18:34:23 497664 ----a-w- c:\windows\system32\ac3filter.acm
2010-04-12 18:34:23 0 d-----w- c:\programme\AC3Filter
2010-04-12 18:34:02 0 d-----w- c:\programme\DirectVobSub
2010-04-12 18:33:54 0 d-----w- c:\programme\Haali
2010-04-12 18:33:50 0 d-----w- c:\programme\Bass Audio Decoder
2010-04-12 18:33:45 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
2010-04-12 18:33:44 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-04-12 18:33:42 0 d-----w- c:\programme\ffdshow
2010-04-12 18:32:53 0 d-----w- c:\programme\Zoom Player
2010-04-12 18:32:53 0 d-----w- c:\dokume~1\alluse~1\anwend~1\Zoom Player
2010-04-12 10:00:28 0 d-----w- c:\dokume~1\xxx\anwend~1\Malwarebytes
2010-04-12 10:00:17 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-12 10:00:11 0 d-----w- c:\dokume~1\alluse~1\anwend~1\Malwarebytes
2010-04-12 10:00:10 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-12 10:00:10 0 d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-04-11 19:16:38 568857 ----a-w- c:\dokumente und einstellungen\xxx\.recently-used.xbel
2010-04-01 10:30:48 0 d-----w- c:\programme\ICQ6.5
2010-04-01 10:27:35 0 d-----w- c:\programme\ICQ6
2010-03-26 15:54:10 161379 ----a-w- c:\windows\EXIFutils for Windows Uninstaller.exe
2010-03-26 15:54:09 0 d-----w- c:\programme\gemeinsame dateien\Thraex Software
2010-03-26 15:54:09 0 d-----w- c:\programme\EXIFutils for Windows
2010-03-25 18:41:08 0 d-----w- C:\Ablage
2010-03-25 11:42:06 0 d-----w- c:\programme\Opera 10.10 März 2010
2010-03-23 10:10:35 371 ----a-w- C:\Ablageeee.lnk

==================== Find3M ====================

2010-03-28 09:02:44 91942 ----a-w- c:\windows\system32\perfc007.dat
2010-03-28 09:02:44 476652 ----a-w- c:\windows\system32\perfh007.dat
2010-03-25 17:18:42 23636 ---ha-w- c:\windows\system32\mlfcache.dat
2010-02-08 10:42:40 26448 ----a-w- c:\dokume~1\xxx\anwend~1\GDIPFONTCACHEV1.DAT


-------------------------------------------------------------------------


GMER

GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-04-14 00:23:07
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOKUME~1\xxx\LOKALE~1\Temp\fgliaaoc.sys


---- System - GMER 1.0.15 ----

SSDT F7DA4C66 ZwCreateKey
SSDT F7DA4C5C ZwCreateThread
SSDT F7DA4C6B ZwDeleteKey
SSDT F7DA4C75 ZwDeleteValueKey
SSDT F7DA4C7A ZwLoadKey
SSDT F7DA4C48 ZwOpenProcess
SSDT F7DA4C4D ZwOpenThread
SSDT \??\C:\DOKUME~1\xxx\LOKALE~1\Temp\ASFWHide ZwQuerySystemInformation [0xF7D94486]
SSDT F7DA4C84 ZwReplaceKey
SSDT F7DA4C7F ZwRestoreKey
SSDT F7DA4C70 ZwSetValueKey
SSDT \??\C:\DOKUME~1\xxx\LOKALE~1\Temp\ASFWHide ZwTerminateProcess [0xF7D946DA]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 301 804E295D 3 Bytes [44, D9, F7] {INC ESP; FINCSTP }
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF6B67380, 0x21F24D, 0xE8000020]
? C:\WINDOWS\TEMP\mc21.tmp Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\svchost.exe[116] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[116] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\svchost.exe[116] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\CTsvcCDA.exe[216] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\CTsvcCDA.exe[216] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\CTsvcCDA.exe[216] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Java\jre6\bin\jqs.exe[504] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Java\jre6\bin\jqs.exe[504] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Java\jre6\bin\jqs.exe[504] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Microsoft SQL Server\MSSQL$PROVIDUSSTD\Binn\sqlservr.exe[616] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Microsoft SQL Server\MSSQL$PROVIDUSSTD\Binn\sqlservr.exe[616] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Microsoft SQL Server\MSSQL$PROVIDUSSTD\Binn\sqlservr.exe[616] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\csrss.exe[640] KERNEL32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\csrss.exe[640] KERNEL32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\winlogon.exe[664] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\winlogon.exe[664] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\services.exe[708] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\services.exe[708] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\lsass.exe[728] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\lsass.exe[728] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[892] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[892] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe[964] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe[964] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\nvsvc32.exe[1152] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\nvsvc32.exe[1152] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\nvsvc32.exe[1152] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[1160] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\HPZipm12.exe[1240] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\HPZipm12.exe[1240] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\HPZipm12.exe[1240] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[1336] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[1336] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[1336] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[1344] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[1344] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[1344] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\svchost.exe[1460] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\svchost.exe[1460] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\svchost.exe[1460] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\MsPMSPSv.exe[1520] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\MsPMSPSv.exe[1520] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\MsPMSPSv.exe[1520] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\spoolsv.exe[1576] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\spoolsv.exe[1576] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\spoolsv.exe[1576] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Avira\AntiVir Desktop\sched.exe[1628] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Avira\AntiVir Desktop\sched.exe[1628] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Avira\AntiVir Desktop\sched.exe[1628] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Dokumente und Einstellungen\xxx\Desktop\picpick.exe[1800] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Dokumente und Einstellungen\xxx\Desktop\picpick.exe[1800] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Dokumente und Einstellungen\xxx\Desktop\picpick.exe[1800] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1840] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1840] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Avira\AntiVir Desktop\avgnt.exe[1840] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[1928] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\Explorer.EXE[1928] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\Explorer.EXE[1928] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1964] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1964] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Avira\AntiVir Desktop\avguard.exe[1964] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Google\Update\GoogleUpdate.exe[1976] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Google\Update\GoogleUpdate.exe[1976] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Google\Update\GoogleUpdate.exe[1976] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Bonjour\mDNSResponder.exe[1992] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Bonjour\mDNSResponder.exe[1992] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Bonjour\mDNSResponder.exe[1992] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Dokumente und Einstellungen\xxx\Desktop\gmer.exe[2012] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Dokumente und Einstellungen\xxx\Desktop\gmer.exe[2012] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Dokumente und Einstellungen\xxx\Desktop\gmer.exe[2012] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe[2088] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe[2088] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe[2088] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Logitech\MouseWare\system\em_exec.exe[2116] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Logitech\MouseWare\system\em_exec.exe[2116] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Logitech\MouseWare\system\em_exec.exe[2116] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2136] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2136] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\RUNDLL32.EXE[2136] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\Programme\Multimedia Combo Set Driver\PS2USBKbdDrv.exe[2152] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Programme\Multimedia Combo Set Driver\PS2USBKbdDrv.exe[2152] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\Programme\Multimedia Combo Set Driver\PS2USBKbdDrv.exe[2152] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\wscntfy.exe[2624] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\wscntfy.exe[2624] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\wscntfy.exe[2624] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\System32\alg.exe[3140] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\System32\alg.exe[3140] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\System32\alg.exe[3140] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\wuauclt.exe[3184] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\WINDOWS\system32\wuauclt.exe[3184] kernel32.dll!FreeLibrary + 15 7C80ABF3 4 Bytes CALL 5F00003D
.text C:\WINDOWS\system32\wuauclt.exe[3184] kernel32.dll!CreateFileW 7C810760 6 Bytes JMP 5F040F5A

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001583c2c80f
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001583c2c80f (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\BTHPORT\Parameters\Keys\001583c2c80f (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{99CC4FB0-3379-2EC5-43A6-8C49EED81999}

---- EOF - GMER 1.0.15 ----
2010-01-28 09:28:34 49152 ----a-r- c:\windows\system32\inetwh32.dll
2010-01-28 09:28:34 1044480 ----a-r- c:\windows\system32\roboex32.dll
2008-03-30 17:17:34 977 ----a-w- c:\programme\metalhand.zip
2006-12-14 10:16:14 692 ----a-w- c:\programme\file_id.diz
2005-03-23 16:17:10 326 ----a-w- c:\programme\metalhand.cur
2006-08-25 15:46:47 617472 --sha-w- c:\windows\system32\comctl32.dll
2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2004-08-03 22:57:24 1028096 --sha-w- c:\windows\system32\mfc42.dll
2007-02-21 10:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2004-08-03 22:57:30 413696 --sha-w- c:\windows\system32\msvcp60.dll
2008-03-16 12:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2004-08-03 22:57:38 30749 --sha-w- c:\windows\system32\vbajet32.dll

============= FINISH: 23:07:03.72 ===============