| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Computer hängt sich auf! Trojaner?!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.08.2010, 10:20
| #1 |
 |  Computer hängt sich auf! Trojaner?! Hallo Zusammen! Ich habe ein Problem mit meinem Computer, wenn ich Antivir oder sonst irgendwelche Virensuchprogramme starte bleibt er nach einer Zeit einfach stehen und es geht nichts mehr. Danach muss ich den PC immer per Knopf neu starten Hier poste ich einen aktuellen Log aus RSIT Programm wie es in der Anleitung stand : info.txtRSIT Logfile: Code:
ATTFilter logfile of random's system information tool 1.08 2010-08-02 11:49:00
======Uninstall list======
-->C:\PROGRA~1\FOLDER~1\FOLDER~1.EXE UnInstall
-->MsiExec.exe /I{7A9DC8F6-2466-4E04-BF51-BE499C5D02BD}
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{001D48FA-1834-4B18-BEAD-E0BDD17126CA}\Setup.exe" -l0x7
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
802.11g Wireless USB 2.0 Adapter HW.14-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{F266A90C-3F4A-4F65-9901-3DBBB0D77D80}
Adobe Acrobat 5.0-->C:\WINDOWS\ISUN0407.EXE -f"C:\Programme\Gemeinsame Dateien\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Programme\Gemeinsame Dateien\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft PhotoImpression-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{E142615E-5ED8-4511-9BF0-0284BFA25766}\setup.exe" -l0x7 -uninst
a-squared Free 4.0-->"C:\Programme\a-squared Free\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
BlackBerry Desktop Software 5.0.1-->MsiExec.exe /I{F5BDF2BB-C990-4351-A05B-B2243D4037D4}
BlackBerry Desktop Software 5.0.1-->MsiExec.exe /i{F5BDF2BB-C990-4351-A05B-B2243D4037D4}
BlackBerry® Media Sync-->MsiExec.exe /X{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{8CC990CD-87C8-475C-AC32-8A7984E2FCFA}
Command and Conquer(TM) Generäle Die Stunde Null -->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}
Die große Kartenspiele-Box-->"C:\Programme\Die große Kartenspiele-Box\unins000.exe"
Die Schlacht um Mittelerde™ II-->C:\Programme\Electronic Arts\Die Schlacht um Mittelerde II\EAUninstall.exe
Enclave-->MsiExec.exe /I{93C676F9-9F00-431B-B344-6E84A7D1AF38}
Free Studio version 4.1-->"C:\Programme\DVDVideoSoft\Free Studio\unins000.exe"
Free YouTube to MP3 Converter version 3.2-->"C:\Programme\DVDVideoSoft\Free YouTube to MP3 Converter\unins000.exe"
ICQ Away Reader 1.4-->"C:\Programme\ICQ Away Reader\unins000.exe"
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
iTunes-->MsiExec.exe /I{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}
Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
KhalSetup-->MsiExec.exe /I{C89C8D86-4423-4A58-AA40-DD259ACE07C1}
Logitech Communications Manager-->MsiExec.exe /I{BD202930-5F70-4B35-B875-1E28604F328D}
Logitech SetPoint-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x7 -removeonly
Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
mobile PhoneTools-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F18E8A0F-BE99-4305-96A5-6C0FD9D7D999}\setup.exe" -l0x7
Mozilla Firefox (3.6.8)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 7 Ultra Edition-->MsiExec.exe /I{4781569D-5404-1F26-4B2B-6DF444441031}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Opera 10.60-->MsiExec.exe /X{1D2C96C3-A3F3-49E7-B839-95279DED837F}
POD-Bot 2.5-->C:\WINDOWS\unvise32.exe C:\DOKUMENTE UND EINSTELLUNGEN\CHRISTIAN.PETER-R1ZVKF9T6\DESKTOP\SIERRA\HALF-LIFE\cstrike\poduninst.log
PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x7 -removeonly
Roxio Media Manager-->MsiExec.exe /X{B98BE95C-E76F-4246-B8E6-BEB8EE791D06}
SigmaTel MSCN Audio Player-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{C9B59DAD-86AC-456C-80A7-B665E77AA325}\Setup.exe" -l0x9
SiS 900 PCI Fast Ethernet Adapter Driver-->C:\Progra~1\SiSLan\Uninst.exe
SiSAGP driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{DC226AC9-0314-496C-BE6A-B6A132628466}\setup.exe" -l0x7
Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe"
TeamViewer 4-->C:\Programme\TeamViewer\Version4\uninstall.exe
TomTom HOME 2.7.3.1894-->C:\Programme\TomTom HOME 2\Uninstall TomTom HOME.exe
TomTom HOME Visual Studio Merge Modules-->MsiExec.exe /I{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}
Trojancheck 6-->"C:\Programme\Trojancheck 6\unins000.exe"
TRUST 120 SPACEC@M-->C:\WINDOWS\CleanDev.exe C:\WINDOWS\DC2110.txt
Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
VistaMizer 1.1.5-->C:\WINDOWS\VistaMizer\Uninstall.exe
Visual Task Tips 2.1-->C:\Programme\VisualTaskTips\uninst.exe
Winamp (remove only)-->"C:\Programme\Winamp\UninstWA.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
WinRAR Archivierer-->C:\Programme\WinRAR\uninstall.exe
ZoneAlarm-->C:\Programme\Zone Labs\ZoneAlarm\zauninst.exe
Zoner Photo Studio 10-->"C:\Programme\Zoner\Photo Studio 10\unins000.exe" /SILENT
======Security center information======
AV: AntiVir Desktop (outdated)
FW: ZoneAlarm Firewall (disabled)
======System event log======
Computer Name: PETER-R1ZVKF9T6
Event Code: 7036
Message: Dienst "Roxio Upnp Server 9" befindet sich jetzt im Status "Beendet".
Record Number: 41758
Source Name: Service Control Manager
Time Written: 20100715193801.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 7036
Message: Dienst "LiveShare P2P Server 9" befindet sich jetzt im Status "Beendet".
Record Number: 41757
Source Name: Service Control Manager
Time Written: 20100715193801.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 7036
Message: Dienst "Roxio Upnp Server 9" befindet sich jetzt im Status "Ausgeführt".
Record Number: 41756
Source Name: Service Control Manager
Time Written: 20100715193801.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 7036
Message: Dienst "LiveShare P2P Server 9" befindet sich jetzt im Status "Ausgeführt".
Record Number: 41755
Source Name: Service Control Manager
Time Written: 20100715193801.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 7036
Message: Dienst "iPod-Dienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 41754
Source Name: Service Control Manager
Time Written: 20100715193758.000000+120
Event Type: Informationen
User:
=====Application event log=====
Computer Name: PETER-R1ZVKF9T6
Event Code: 102
Message: wuaueng.dll (3012) SUS20ClientDataStore: Das Datenbankmodul hat eine neue Instanz gestartet (0).
Record Number: 9200
Source Name: ESENT
Time Written: 20100331173121.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 100
Message: wuauclt (3012) Das Datenbankmodul 5.01.2600.2180 ist gestartet.
Record Number: 9199
Source Name: ESENT
Time Written: 20100331173121.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!
Record Number: 9198
Source Name: Avira AntiVir
Time Written: 20100331173041.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: PETER-R1ZVKF9T6
Event Code: 0
Message:
Record Number: 9197
Source Name: SearchAnonymizer
Time Written: 20100331173033.000000+120
Event Type: Informationen
User:
Computer Name: PETER-R1ZVKF9T6
Event Code: 1
Message:
Record Number: 9196
Source Name: Bonjour Service
Time Written: 20100331173027.000000+120
Event Type: Informationen
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Programme\QuickTime\QTSystem;C:\Programme\Gemeinsame Dateien\Roxio Shared\DLLShared;C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\DLLShared
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 12 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0c00
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"tvdumpflags"=8
"CLASSPATH"=.;C:\Programme\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre6\lib\ext\QTJava.zip
-----------------EOF-----------------
RSIT Logfile: Code:
ATTFilter Logfile of random's system information tool 1.08 (written by random/random) Run by Christian at 2010-08-02 11:48:22 Microsoft Windows XP Professional Service Pack 2 System drive C: has 4 GB (11%) free of 39 GB Total RAM: 2047 MB (75% free) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 11:48:57, on 02.08.2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\a-squared Free\a2service.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programme\Avira\AntiVir Desktop\avshadow.exe C:\WINDOWS\system32\svchost.exe C:\Programme\TomTom HOME 2\TomTomHOMEService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\vsnpstd.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Gemeinsame Dateien\Research In Motion\Auto Update\RimAutoUpdate.exe C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Eigene Dateien\Downloads\RSIT.exe C:\Programme\trend micro\Christian.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.helinet.de:3128 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programme\styler\TB\StylerTB.dll O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Stardock ObjectDock.lnk.disabled O4 - Global Startup: Logitech SetPoint.lnk.disabled O4 - Global Startup: VisualTaskTips.lnk.disabled O4 - Global Startup: Wireless Configuration Utility HW.14.lnk.disabled O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{71AEA215-C8F2-4BF9-A4C7-241044CC0D8D}: NameServer = 192.168.0.2,192.168.0.1 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programme\a-squared Free\a2service.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Programme\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Programme\Roxio\Digital Home 9\RoxioUpnpService9.exe O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: TomTomHOMEService - TomTom - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 6484 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\Programme\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-14 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-14 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - StylerToolBar - C:\Programme\styler\TB\StylerTB.dll [2006-05-02 102400] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "snpstd"=C:\WINDOWS\vsnpstd.exe [2003-12-31 40960] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-08-11 7630848] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSnD] C:\Programme\Spybot - Search & Destroy\SpybotSD.exe [2009-01-26 5365592] C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart Logitech SetPoint.lnk.disabled - C:\Programme\Logitech\SetPoint\SetPoint.exe VisualTaskTips.lnk.disabled - C:\Programme\VisualTaskTips\VisualTaskTips.exe Wireless Configuration Utility HW.14.lnk.disabled - C:\Programme\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Startmenü\Programme\Autostart Stardock ObjectDock.lnk.disabled - C:\Programme\Stardock\ObjectDock\ObjectDock.exe [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "authentication packages"=msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\seppgs.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\seppgm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\seppgs.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoDriveAutoRun"=67108863 "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"=67108863 "NoDriveTypeAutoRun"=323 "NoDrives"=0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2010-08-02 11:48:23 ----D---- C:\Programme\trend micro 2010-08-02 11:48:22 ----D---- C:\rsit 2010-08-02 10:14:39 ----SD---- C:\ComboFix 2010-07-31 17:53:02 ----D---- C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Anwendungsdaten\Zoner 2010-07-31 17:52:29 ----D---- C:\Programme\Zoner 2010-07-30 16:01:17 ----SHD---- C:\RECYCLER 2010-07-30 15:03:36 ----A---- C:\WINDOWS\PEV.exe 2010-07-30 15:03:36 ----A---- C:\WINDOWS\NIRCMD.exe 2010-07-30 15:03:36 ----A---- C:\WINDOWS\MBR.exe 2010-07-30 15:03:35 ----A---- C:\WINDOWS\zip.exe 2010-07-30 15:03:35 ----A---- C:\WINDOWS\SWREG.exe 2010-07-30 15:03:35 ----A---- C:\WINDOWS\grep.exe 2010-07-30 15:03:34 ----A---- C:\WINDOWS\sed.exe 2010-07-30 15:03:33 ----A---- C:\WINDOWS\SWXCACLS.exe 2010-07-30 15:03:33 ----A---- C:\WINDOWS\SWSC.exe 2010-07-30 15:01:34 ----D---- C:\WINDOWS\ERDNT 2010-07-30 14:59:14 ----D---- C:\Qoobox 2010-07-30 14:52:49 ----D---- C:\Programme\CCleaner 2010-07-30 14:51:03 ----D---- C:\Programme\Trojancheck 6 2010-07-28 21:26:39 ----AD---- C:\Kaspersky Rescue Disk 10.0 2010-07-24 20:28:07 ----D---- C:\Programme\Spybot - Search & Destroy 2010-07-24 20:28:07 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy 2010-07-24 18:13:26 ----D---- C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Anwendungsdaten\Avira 2010-07-24 13:56:44 ----D---- C:\Programme\Die große Kartenspiele-Box 2010-07-24 13:49:51 ----A---- C:\WINDOWS\system32\dxtmeta2.dll 2010-07-22 21:00:05 ----D---- C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Anwendungsdaten\QuickScan 2010-07-19 19:57:51 ----A---- C:\WINDOWS\system32\drivers\ssmdrv.sys 2010-07-19 19:57:46 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys 2010-07-19 19:57:46 ----A---- C:\WINDOWS\system32\drivers\avgntmgr.sys 2010-07-19 19:57:46 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys 2010-07-19 19:57:46 ----A---- C:\WINDOWS\system32\drivers\avgntdd.sys 2010-07-19 19:57:44 ----D---- C:\Programme\Avira 2010-07-19 19:57:44 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira ======List of files/folders modified in the last 1 months====== 2010-08-02 11:48:58 ----D---- C:\WINDOWS\Prefetch 2010-08-02 11:48:23 ----RD---- C:\Programme 2010-08-02 11:24:48 ----D---- C:\WINDOWS\Internet Logs 2010-08-02 11:02:09 ----D---- C:\WINDOWS\Temp 2010-08-02 11:00:00 ----D---- C:\WINDOWS\system32\CatRoot2 2010-08-02 10:26:45 ----D---- C:\WINDOWS 2010-08-02 10:19:15 ----D---- C:\WINDOWS\system32\drivers 2010-08-02 10:19:15 ----D---- C:\WINDOWS\system32 2010-08-02 10:19:14 ----D---- C:\WINDOWS\AppPatch 2010-08-02 10:19:10 ----D---- C:\Programme\Gemeinsame Dateien 2010-08-02 10:14:50 ----A---- C:\WINDOWS\SchedLgU.Txt 2010-08-02 10:10:27 ----D---- C:\WINDOWS\Minidump 2010-07-31 16:11:00 ----D---- C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Anwendungsdaten\Macromedia 2010-07-30 16:27:38 ----SHD---- C:\WINDOWS\Installer 2010-07-30 16:27:38 ----D---- C:\Config.Msi 2010-07-30 15:30:11 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2010-07-30 15:14:57 ----N---- C:\WINDOWS\system.ini 2010-07-30 15:13:46 ----D---- C:\WINDOWS\system32\drivers\etc 2010-07-30 15:12:22 ----D---- C:\WINDOWS\system32\config 2010-07-30 14:55:11 ----D---- C:\WINDOWS\Debug 2010-07-28 22:02:08 ----D---- C:\Programme\a-squared Free 2010-07-28 17:19:26 ----D---- C:\Programme\Mozilla Firefox 2010-07-26 20:55:59 ----AC---- C:\WINDOWS\NeroDigital.ini 2010-07-26 20:37:40 ----A---- C:\WINDOWS\RTacDbg.txt 2010-07-25 12:37:41 ----A---- C:\WINDOWS\winamp.ini 2010-07-24 18:12:43 ----D---- C:\Programme\Opera 2010-07-24 18:12:33 ----D---- C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Anwendungsdaten\McLoad 2010-07-24 18:05:53 ----D---- C:\Programme\DivX 2010-07-24 13:35:36 ----SHD---- C:\System Volume Information 2010-07-24 13:31:06 ----D---- C:\WINDOWS\system32\NtmsData 2010-07-24 13:30:24 ----D---- C:\WINDOWS\Registration 2010-07-19 19:56:31 ----D---- C:\Dokumente und Einstellungen\Christian.PETER-R1ZVKF9T6\Anwendungsdaten\ICQ 2010-07-06 06:20:30 ----D---- C:\WINDOWS\security ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R0 imagedrv;imagedrv; C:\WINDOWS\System32\Drivers\imagedrv.sys [2005-08-15 5888] R0 imagesrv;imagesrv; C:\WINDOWS\system32\DRIVERS\imagesrv.sys [2005-08-15 127488] R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-05-01 43528] R0 sisagp;SiS AGP Filter; C:\WINDOWS\System32\DRIVERS\SISAGPX.sys [2003-07-18 36992] R0 SiSide;SiSide; C:\WINDOWS\System32\DRIVERS\siside.sys [2003-03-25 4096] R0 sisidex;sisidex; C:\WINDOWS\system32\drivers\sisidex.sys [2002-10-17 49024] R0 sisperf;Add Performance Filter Driver; C:\WINDOWS\system32\drivers\sisperf.sys [2002-08-20 9472] R0 srescan;srescan; C:\WINDOWS\system32\ZoneLabs\srescan.sys [2008-02-27 51176] R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys [] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784] R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848] R1 KLIF;KLIF; C:\WINDOWS\system32\DRIVERS\klif.sys [2007-07-19 127768] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R1 Tcpip6;Microsoft IPv6-Protokolltreiber; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2005-01-06 223616] R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2008-07-09 394952] R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-12-26 21035] R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936] R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS-kompatibles Transportprotokoll; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2005-01-06 88448] R2 NwlnkNb;NWLink-NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2005-01-06 63232] R2 NwlnkSpx;NWLink SPX/SPXII-Protokoll; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2005-01-06 55936] R2 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2005-01-06 5888] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-08-18 4017536] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2005-01-06 9600] R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-01-23 20496] R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2007-01-23 34576] R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-01-23 33296] R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288] R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2006-08-11 3958496] R3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS\nwrdr.sys [2005-01-06 163584] R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-04-08 13924] R3 RimVSerPort;RIM Virtual Serial Port v2; C:\WINDOWS\system32\DRIVERS\RimSerial.sys [2009-01-09 27136] R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-26 81408] R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter; C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-05-04 215040] R3 tunmp;Microsoft Tun-Miniportadaptertreiber; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2005-01-06 12416] R3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448] R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616] R3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2005-01-06 26496] R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000] S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys [] S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys [] S1 seppgm;TCP x IP2 Kernel; C:\WINDOWS\system32\drivers\seppgm.sys [] S1 Tosrfcom;Bluetooth RFCOMM from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfcom.sys [2004-10-04 62799] S2 seppgs;TCP x IP2 Kernel32; C:\WINDOWS\system32\drivers\seppgs.sys [] S3 AVMWAN;AVM NDIS WAN CAPI Treiber; C:\WINDOWS\System32\DRIVERS\avmwan.sys [2002-09-11 37568] S3 catchme;catchme; \??\C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\catchme.sys [] S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2004-08-04 17024] S3 CLPCIID;CLPCIID; \??\C:\Programme\CyberLink\PowerDVD\clpciid.sys [] S3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2002-03-06 389135] S3 fpcibase;FRITZ!Card PCI; C:\WINDOWS\System32\DRIVERS\fpcibase.sys [2002-09-11 484176] S3 hidgame;Microsoft HID-zu-Joystickanschlussaktivierung; C:\WINDOWS\System32\DRIVERS\hidgame.sys [2005-01-06 8576] S3 ms_mpu401;Microsoft MPU-401 MIDI UART-Treiber; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504] S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2004-08-04 85376] S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [2005-01-06 10880] S3 NETFRITZ;AVM FRITZ!web PPP over ISDN; C:\WINDOWS\System32\DRIVERS\NETFRITZ.SYS [] S3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4.sys [2001-08-17 731648] S3 RimUsb;BlackBerry-Smartphone; C:\WINDOWS\System32\Drivers\RimUsb.sys [2008-05-20 22784] S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\System32\DRIVERS\s116bus.sys [2007-06-29 83336] S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter; C:\WINDOWS\System32\DRIVERS\s116mdfl.sys [2007-06-29 15112] S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver; C:\WINDOWS\System32\DRIVERS\s116mdm.sys [2007-06-29 108680] S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM); C:\WINDOWS\System32\DRIVERS\s116unic.sys [2007-06-29 99080] S3 s716bus;Sony Ericsson Device 716 driver (WDM); C:\WINDOWS\System32\DRIVERS\s716bus.sys [2007-06-29 83208] S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter; C:\WINDOWS\System32\DRIVERS\s716mdfl.sys [2007-06-29 15112] S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver; C:\WINDOWS\System32\DRIVERS\s716mdm.sys [2007-06-29 108552] S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM); C:\WINDOWS\System32\DRIVERS\s716mgmt.sys [2007-06-29 100360] S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS); C:\WINDOWS\System32\DRIVERS\s716nd5.sys [2007-06-29 23176] S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface; C:\WINDOWS\System32\DRIVERS\s716obex.sys [2007-06-29 98568] S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM); C:\WINDOWS\System32\DRIVERS\s716unic.sys [2007-06-29 98952] S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2002-04-16 32256] S3 SjyPkt;SjyPkt; \??\C:\WINDOWS\System32\Drivers\SjyPkt.sys [] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\System32\DRIVERS\SLIP.sys [2005-01-06 11136] S3 snpstd;TRUST 120 SPACEC@M; C:\WINDOWS\System32\DRIVERS\snpstd.sys [2004-02-19 299776] S3 streamip;BDA-IPSink; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [2005-01-06 15360] S3 toshidpt;TOSHIBA Bluetooth HID port driver; C:\WINDOWS\system32\drivers\Toshidpt.sys [2002-10-16 2851] S3 tosporte;Bluetooth Port Driver from Toshiba; C:\WINDOWS\System32\DRIVERS\tosporte.sys [2005-03-04 47230] S3 Tosrfbd;Bluetooth RFBUS from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbd.sys [2005-02-01 98560] S3 Tosrfbnp;Bluetooth RFBNEP from TOSHIBA; C:\WINDOWS\System32\Drivers\tosrfbnp.sys [2004-07-08 36531] S3 Tosrfhid;Bluetooth RFHID from TOSHIBA; C:\WINDOWS\System32\DRIVERS\Tosrfhid.sys [2004-11-15 50048] S3 tosrfnds;Bluetooth Personal Area Network from TOSHIBA; C:\WINDOWS\System32\DRIVERS\tosrfnds.sys [2005-01-06 18612] S3 TosRfSnd;Bluetooth Audio Device (WDM) from TOSHIBA; C:\WINDOWS\system32\drivers\TosRfSnd.sys [2004-12-15 50048] S3 Tosrfusb;Bluetooth USB Controller; C:\WINDOWS\System32\Drivers\tosrfusb.sys [2004-12-21 34816] S3 usbser;Motorola USB Modem Driver; C:\WINDOWS\System32\DRIVERS\usbser.sys [2005-01-06 25600] S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944] S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328] S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys [] S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-02-28 682232] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 6to4;IPv6-Hilfsdienst; C:\WINDOWS\system32\svchost.exe [2005-01-06 14336] R2 a2free;a-squared Free Service; C:\Programme\a-squared Free\a2service.exe [2009-02-25 425080] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336] R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2010-04-01 267432] R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672] R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-14 152984] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-08-11 155715] R2 NWCWorkstation;Client Service für NetWare; C:\WINDOWS\system32\svchost.exe [2005-01-06 14336] R2 TomTomHOMEService;TomTomHOMEService; C:\Programme\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2008-07-09 75304] S2 LckFldService;LckFldService; C:\WINDOWS\system32\LckFldService.exe [] S2 Roxio Upnp Server 9;Roxio Upnp Server 9; C:\Programme\Roxio\Digital Home 9\RoxioUpnpService9.exe [2007-12-06 362992] S2 RoxLiveShare9;LiveShare P2P Server 9; C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [2009-07-08 313840] S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2009-07-08 170480] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 de_serv;AVM FRITZ!web Routing Service; C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe [] S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-09-21 545568] S3 Roxio UPnP Renderer 9;Roxio UPnP Renderer 9; C:\Programme\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [2007-12-06 88560] S3 RoxMediaDB9;RoxMediaDB9; C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2009-07-08 1108464] -----------------EOF----------------- Bin gerade auch noch auf eine wichtige Info gestoßen : In der Datei 'C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\Av-test.txt' wurde ein Virus oder unerwünschtes Programm 'Eicar-Test-Signature' [virus] gefunden. Ausgeführte Aktion: Zugriff verweigern vielleicht sagt das ja auch was aus! Hoffe nun auf schnelle Hilfe von euch |
| Themen zu Computer hängt sich auf! Trojaner?! |
| 192.168.0.2, action, antivir, antivir guard, avira, bho, bonjour, computer, computer hängt, computer hängt sich auf, current, desktop, eicar-test-signature, firefox, gefunde, hallo zusammen, hijack, hijack.regedit, hijack.taskmanager, hijackthis, hkus\s-1-5-18, home, internet, internet explorer, kaspersky rescue, laufe, laufen, malwarebytes, microsoft, monitor, mozilla, msiexec.exe, nodrives, plug-in, problem, probleme, registrierung, rescue disk, rundll, schnelle, schnelle hilfe, sierra, software, sptd.sys, studio, system, trojaner, trojaner?, trojaner?!, usb, usb 2.0, version, visual studio, was tun?, windows, windows xp, wireless lan, wuauclt, zusammen |
Baum-Darstellung