Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows Sec. Suit ploppt auf, kann aber nichts anklicken, Porno Links auf Desktop (https://www.trojaner-board.de/81986-windows-sec-suit-ploppt-nichts-anklicken-porno-links-desktop.html)

CalJohnson 20.01.2010 21:12
Windows Sec. Suit ploppt auf, kann aber nichts anklicken, Porno Links auf Desktop
 
Hallo,

ich habe folgendes Problem:

Plötzlich öffneten sich diverse Windows Security Fenster, ich konnte aber keine Schaltfläche betätigen. Als ich Avira:AntiVir öffnen wollte bekam ich einen Bluescreen. Mittlerweile finden sich Porno Links auf meinem Desktop. Ich suchte bei Google und wurde hier fündig.

Avenger sagte folgendes:

Zitat:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "H8SRTd.sys" found!
ImagePath: \systemroot\system32\drivers\H8SRTyitptesieg.sys
Driver disabled successfully.

Rootkit scan completed.

Driver "h8srtd.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Daraufhin ließ ich "mbam" durchlaufen, mit folgendem Ergebnis:

Zitat:
Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3604
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

20.01.2010 20:50:21
mbam-log-2010-01-20 (20-50-10).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 315454
Laufzeit: 44 minute(s), 38 second(s)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 2
Infizierte Dateien: 22

Infizierte Speicherprozesse:
C:\Users\Carsten\AppData\Local\Temp\winhlp64.exe (Trojan.Downloader) -> No action taken.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\Program Files\malware Defense (Rogue.MalwareDefense) -> No action taken.
C:\Users\Carsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\malware Defense (Rogue.MalwareDefense) -> No action taken.

Infizierte Dateien:
C:\Users\Carsten\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2Z3XP31\z008102318801r0007J0b000601R1ebbed88W79c5cce1Xb4a8b419Yffffff0bZ03007f350[1] (Malware.Packer) -> No action taken.
C:\Program Files\malware Defense\md.db (Rogue.MalwareDefense) -> No action taken.
C:\Program Files\malware Defense\mdefense.exe (Rogue.MalwareDefense) -> No action taken.
C:\Program Files\malware Defense\mdext.dll (Rogue.MalwareDefense) -> No action taken.
C:\Program Files\malware Defense\uninstall.exe (Rogue.MalwareDefense) -> No action taken.
C:\Users\Carsten\AppData\Local\Temp\winhlp64.exe (Trojan.Downloader) -> No action taken.
C:\Users\Public\Desktop\nudetube.com.lnk (Rogue.Link) -> No action taken.
C:\Users\Public\Desktop\pornotube.com.lnk (Rogue.Link) -> No action taken.
C:\Users\Public\Desktop\youporn.com.lnk (Rogue.Link) -> No action taken.
C:\Windows\System32\H8SRTcphcmoddop.dll (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\H8SRTexcxtwuefb.dll (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\h8srtkrl32mainweq.dll (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\H8SRTmfxntpervt.dll (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\H8SRTqddpypbhin.dll (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\h8srtshsyst.dll (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\H8SRTsmtmwabxmd.dat (Rootkit.TDSS) -> No action taken.
C:\Windows\System32\drivers\H8SRTyitptesieg.sys (Rootkit.TDSS) -> No action taken.
C:\Windows\Temp\H8SRT3967.tmp (Rootkit.TDSS) -> No action taken.
C:\Windows\Temp\H8SRT3a51.tmp (Rootkit.TDSS) -> No action taken.
C:\Windows\Temp\H8SRT3ace.tmp (Rootkit.TDSS) -> No action taken.
C:\Windows\Temp\H8SRT3ca2.tmp (Rootkit.TDSS) -> No action taken.
C:\Users\Carsten\AppData\Local\Temp\H8SRT98fc.tmp (Rootkit.TDSS) -> No action taken.

Als ich die Dateien löschen wollte allerdings stürzte "mbam" ab (keine Rückmeldung) und Avira ploppte auf und Verwies auf gefundene Trojaner im "Malware Defense" Ordner.

Was soll ich nun tun? Ich lasse gerade noch "Luke Filewalker" (AVIRA) einen run machen.

Bitte um schnelle Hilfe und vielen Dank schonmal im Voraus!

cosinus 20.01.2010 22:20
Hallo und :hallo:

Bitte die RSIT Logfiles nachreichen. Es sieht aber schonmal gut aus, das H8SRT-Rootkit ist gekillt :)

CalJohnson 20.01.2010 22:50
Danke :)

Hier:

Zitat:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Carsten at 2010-01-20 22:49:03
Microsoft® Windows Vista™ Business Service Pack 1
System drive C: has 30 GB (25%) free of 120 GB
Total RAM: 3326 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:49:10, on 20.01.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18349)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
C:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Programme\AirPort\APAgent.exe
D:\Programme\Cyberlink\PowerDVD9\PDVD9Serv.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\RayV\RayV\RayV.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Steam\steam.exe
C:\Users\Carsten\AppData\Local\Temp\extrac64_cab.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Users\Carsten\AppData\Local\Temp\winhlp64.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
D:\Programme\Hotspot Shield\bin\openvpntray.exe
D:\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Carsten.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\Windows\System32\dvmurl.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\Supertoolbar\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - D:\Programme\Hotspot Shield\hssie\HssIE.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\Supertoolbar\GenericAskToolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [dlcxmon.exe] "C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AirPort Base Station Agent] "D:\Programme\AirPort\APAgent.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [RemoteControl9] D:\Programme\Cyberlink\PowerDVD9\PDVD9Serv.exe
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] D:\Programme\Cyberlink\PowerDVD9\Language\Language.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RayV] C:\Program Files\RayV\RayV\RayV.exe /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [extrac64_cab.exe] C:\Users\Carsten\AppData\Local\Temp\extrac64_cab.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - D:\Spiele\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: dlcx_device - - C:\Windows\system32\dlcxcoms.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - D:\Programme\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - D:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - D:\Programme\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 9218 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{69C356C3-5A2C-491C-B22A-298204DEE083}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-27 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask.com Toolbar - C:\Program Files\Ask.com\Supertoolbar\GenericAskToolbar.dll [2008-10-21 741768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-27 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
Hotspot Shield Class - D:\Programme\Hotspot Shield\hssie\HssIE.dll [2009-10-02 218160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask.com Toolbar - C:\Program Files\Ask.com\Supertoolbar\GenericAskToolbar.dll [2008-10-21 741768]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-06-27 6295552]
"razer"=C:\Program Files\Razer\Copperhead\razerhid.exe [2005-10-08 155648]
"FaxCenterServer"=C:\Program Files\Dell PC Fax\fm3032.exe [2006-11-03 312200]
"dlcxmon.exe"=C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe [2006-11-03 291720]
"MemoryCardManager"=C:\Program Files\Dell Photo AIO Printer 926\memcard.exe [2006-11-03 304008]
"DLCXCATS"=rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16 []
"AirPort Base Station Agent"=D:\Programme\AirPort\APAgent.exe [2008-02-13 733184]
"ANIWZCS2Service"=C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe [2005-10-19 49152]
"RemoteControl9"=D:\Programme\Cyberlink\PowerDVD9\PDVD9Serv.exe [2009-02-16 87336]
"PDVD9LanguageShortcut"=D:\Programme\Cyberlink\PowerDVD9\Language\Language.exe [2008-10-13 50472]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-11-04 98304]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2008-11-18 21633320]
"RayV"=C:\Program Files\RayV\RayV\RayV.exe [2009-03-22 2417960]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe [2008-08-21 443968]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"Steam"=c:\program files\steam\steam.exe [2009-12-02 1217808]
"extrac64_cab.exe"=C:\Users\Carsten\AppData\Local\Temp\extrac64_cab.exe [2010-01-20 712704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G]
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe [2005-11-23 1544192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30227854-240f-11de-98a9-001fd02e72f0}]
shell\AutoRun\command - H:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1c019e1-d422-11dd-969c-001fd02e72f0}]
shell\AutoRun\command - F:\AutoRun.exe


======List of files/folders created in the last 3 months======

2010-01-20 22:49:03 ----D---- C:\rsit
2010-01-20 21:47:48 ----D---- C:\Program Files\Trend Micro
2010-01-20 20:31:29 ----D---- C:\Program Files\Malware Defense
2010-01-20 20:04:19 ----D---- C:\Users\Carsten\AppData\Roaming\Malwarebytes
2010-01-20 20:04:15 ----D---- C:\ProgramData\Malwarebytes
2010-01-20 20:04:15 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-20 20:00:10 ----D---- C:\Avenger
2010-01-20 20:00:10 ----A---- C:\avenger.txt
2010-01-20 19:48:39 ----A---- C:\Windows\system32\h8srtshsyst.dll
2010-01-20 19:28:51 ----A---- C:\Windows\system32\h8srtkrl32mainweq.dll
2010-01-20 19:27:41 ----A---- C:\Windows\system32\H8SRTqddpypbhin.dll
2010-01-20 19:27:40 ----A---- C:\Windows\system32\H8SRTexcxtwuefb.dll
2010-01-20 19:27:40 ----A---- C:\Windows\system32\H8SRTcphcmoddop.dll
2010-01-20 19:27:39 ----A---- C:\Windows\system32\H8SRTmfxntpervt.dll
2010-01-20 19:27:18 ----A---- C:\ProgramData\sysReserve.ini
2010-01-13 14:38:05 ----A---- C:\Windows\system32\t2embed.dll
2010-01-13 14:38:05 ----A---- C:\Windows\system32\fontsub.dll
2010-01-10 20:35:11 ----D---- C:\ProgramData\BioWare
2009-12-12 03:00:19 ----A---- C:\Windows\system32\nshhttp.dll
2009-12-12 03:00:17 ----A---- C:\Windows\system32\httpapi.dll
2009-12-10 19:30:14 ----A---- C:\Windows\system32\winhttp.dll
2009-12-10 19:30:11 ----A---- C:\Windows\system32\occache.dll
2009-12-10 19:30:11 ----A---- C:\Windows\system32\mshtml.dll
2009-12-10 19:30:10 ----A---- C:\Windows\system32\wininet.dll
2009-12-10 19:30:10 ----A---- C:\Windows\system32\urlmon.dll
2009-12-10 19:30:10 ----A---- C:\Windows\system32\ieframe.dll
2009-12-10 19:30:09 ----A---- C:\Windows\system32\iertutil.dll
2009-12-10 19:30:09 ----A---- C:\Windows\system32\iedkcs32.dll
2009-12-10 19:30:09 ----A---- C:\Windows\system32\ieapfltr.dll
2009-12-10 19:30:08 ----A---- C:\Windows\system32\mstime.dll
2009-12-10 19:30:08 ----A---- C:\Windows\system32\msfeeds.dll
2009-12-10 19:30:08 ----A---- C:\Windows\system32\ieUnatt.exe
2009-12-10 19:30:08 ----A---- C:\Windows\system32\ieencode.dll
2009-12-10 19:30:08 ----A---- C:\Windows\system32\ieaksie.dll
2009-12-10 19:30:07 ----A---- C:\Windows\system32\jsproxy.dll
2009-12-10 19:29:52 ----A---- C:\Windows\system32\rastls.dll
2009-12-10 19:29:52 ----A---- C:\Windows\system32\raschap.dll
2009-12-05 15:17:19 ----A---- C:\Windows\system32\TURegOpt.exe
2009-12-05 15:17:17 ----A---- C:\Windows\system32\uxtuneup.dll
2009-12-05 15:17:17 ----A---- C:\Windows\system32\authuitu.dll
2009-12-05 15:16:59 ----D---- C:\Users\Carsten\AppData\Roaming\TuneUp Software
2009-12-05 15:16:51 ----D---- C:\Program Files\TuneUp Utilities 2010
2009-12-05 15:16:30 ----D---- C:\ProgramData\TuneUp Software
2009-12-05 15:16:27 ----SHD---- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-12-01 18:32:48 ----D---- C:\Program Files\Lavalys
2009-12-01 17:24:25 ----D---- C:\ProgramData\ATI
2009-12-01 15:39:04 ----D---- C:\Program Files\Common Files\Steam
2009-12-01 15:39:02 ----D---- C:\Program Files\Steam
2009-12-01 15:38:43 ----A---- C:\Windows\system32\XAudio2_5.dll
2009-12-01 15:38:43 ----A---- C:\Windows\system32\xactengine3_5.dll
2009-12-01 15:38:42 ----A---- C:\Windows\system32\d3dx11_42.dll
2009-12-01 15:38:42 ----A---- C:\Windows\system32\d3dcsx_42.dll
2009-12-01 15:38:42 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2009-12-01 15:38:41 ----A---- C:\Windows\system32\XAudio2_4.dll
2009-12-01 15:38:41 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2009-12-01 15:38:41 ----A---- C:\Windows\system32\D3DX9_41.dll
2009-12-01 15:38:41 ----A---- C:\Windows\system32\d3dx10_41.dll
2009-12-01 15:38:41 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2009-12-01 15:38:40 ----A---- C:\Windows\system32\xactengine3_4.dll
2009-12-01 15:38:40 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2009-12-01 15:38:39 ----A---- C:\Windows\system32\XAudio2_3.dll
2009-12-01 15:38:39 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2009-12-01 15:38:39 ----A---- C:\Windows\system32\D3DX9_40.dll
2009-12-01 15:38:39 ----A---- C:\Windows\system32\d3dx10_40.dll
2009-12-01 15:38:39 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2009-12-01 15:38:38 ----A---- C:\Windows\system32\XAudio2_2.dll
2009-12-01 15:38:38 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2009-12-01 15:38:38 ----A---- C:\Windows\system32\xactengine3_3.dll
2009-12-01 15:38:38 ----A---- C:\Windows\system32\xactengine3_2.dll
2009-12-01 15:38:38 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2009-11-30 20:33:46 ----A---- C:\Windows\system32\xfcodec.dll
2009-11-30 18:02:40 ----A---- C:\Windows\system32\xliveinstall.dll
2009-11-30 18:02:38 ----A---- C:\Windows\system32\xliveinstallhost.exe
2009-11-30 12:32:48 ----D---- C:\Program Files\Axon Data
2009-11-27 17:53:10 ----D---- C:\Program Files\iPod
2009-11-27 17:51:57 ----D---- C:\Program Files\QuickTime
2009-11-26 09:08:36 ----A---- C:\Windows\system32\tzres.dll
2009-11-25 11:07:08 ----A---- C:\Windows\system32\msxml6.dll
2009-11-25 11:07:08 ----A---- C:\Windows\system32\msxml3.dll
2009-11-21 04:43:53 ----A---- C:\Windows\system32\d3dx10_42.dll
2009-11-21 04:43:52 ----A---- C:\Windows\system32\D3DX9_42.dll
2009-11-13 14:07:17 ----D---- C:\Users\Carsten\AppData\Roaming\AccurateRip
2009-11-13 14:07:17 ----A---- C:\Windows\system32\SpoonUninstall.exe
2009-11-12 01:09:39 ----A---- C:\Windows\system32\WSDApi.dll
2009-11-06 10:59:54 ----A---- C:\Windows\system32\xlivefnt.dll
2009-11-06 10:59:54 ----A---- C:\Windows\system32\xlive.dll
2009-11-06 10:58:04 ----A---- C:\Windows\system32\xlive.dll.cat
2009-11-04 16:46:00 ----A---- C:\Windows\system32\ATIDEMGX.dll
2009-11-04 16:45:32 ----A---- C:\Windows\system32\atieclxx.exe
2009-11-04 16:45:02 ----A---- C:\Windows\system32\atiesrxx.exe
2009-11-04 16:43:10 ----A---- C:\Windows\system32\Oemdspif.dll
2009-11-04 16:43:00 ----A---- C:\Windows\system32\atimuixx.dll
2009-11-04 16:42:52 ----A---- C:\Windows\system32\ati2edxx.dll
2009-11-04 16:39:24 ----A---- C:\Windows\system32\atidxx32.dll
2009-11-04 16:11:30 ----A---- C:\Windows\system32\atioglxx.dll
2009-11-04 15:52:52 ----A---- C:\Windows\system32\atimpc32.dll
2009-11-04 15:52:52 ----A---- C:\Windows\system32\amdpcom32.dll
2009-11-04 15:52:18 ----A---- C:\Windows\system32\atiadlxx.dll
2009-11-04 15:47:52 ----A---- C:\Windows\system32\aticalrt.dll
2009-11-04 15:47:40 ----A---- C:\Windows\system32\aticalcl.dll
2009-11-04 15:46:34 ----A---- C:\Windows\system32\aticaldd.dll
2009-10-30 12:01:54 ----D---- C:\Program Files\DAEMON Tools Lite
2009-10-28 08:16:10 ----A---- C:\Windows\system32\wmp.dll
2009-10-28 08:16:09 ----A---- C:\Windows\system32\unregmp2.exe
2009-10-28 08:16:08 ----A---- C:\Windows\system32\wmploc.DLL
2009-10-21 09:53:46 ----A---- C:\Windows\system32\wups2.dll
2009-10-21 09:53:46 ----A---- C:\Windows\system32\wucltux.dll
2009-10-21 09:53:46 ----A---- C:\Windows\system32\wuaueng.dll
2009-10-21 09:53:46 ----A---- C:\Windows\system32\wuauclt.exe
2009-10-21 09:53:32 ----A---- C:\Windows\system32\wups.dll
2009-10-21 09:53:32 ----A---- C:\Windows\system32\wudriver.dll
2009-10-21 09:53:32 ----A---- C:\Windows\system32\wuapi.dll
2009-10-21 09:53:27 ----A---- C:\Windows\system32\wuwebv.dll
2009-10-21 09:53:27 ----A---- C:\Windows\system32\wuapp.exe

======List of files/folders modified in the last 3 months======

2010-01-20 22:49:03 ----D---- C:\Windows\Prefetch
2010-01-20 22:48:55 ----D---- C:\Windows\Temp
2010-01-20 22:47:47 ----D---- C:\Program Files\Mozilla Firefox
2010-01-20 22:47:36 ----D---- C:\Users\Carsten\AppData\Roaming\Skype
2010-01-20 22:20:17 ----D---- C:\Windows\System32
2010-01-20 22:20:17 ----D---- C:\Windows\inf
2010-01-20 22:20:17 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-01-20 21:47:48 ----RD---- C:\Program Files
2010-01-20 20:04:16 ----D---- C:\Windows\system32\drivers
2010-01-20 20:04:15 ----HD---- C:\ProgramData
2010-01-20 20:00:10 ----D---- C:\Windows
2010-01-20 19:50:41 ----D---- C:\Windows\Minidump
2010-01-20 19:48:32 ----D---- C:\Users\Carsten\AppData\Roaming\skypePM
2010-01-20 13:10:46 ----D---- C:\Program Files\dl_Cats
2010-01-20 01:38:20 ----SHD---- C:\System Volume Information
2010-01-18 19:20:32 ----SHD---- C:\Windows\Installer
2010-01-18 19:20:31 ----D---- C:\Windows\winsxs
2010-01-14 11:12:06 ----N---- C:\Windows\system32\MpSigStub.exe
2010-01-14 03:02:43 ----D---- C:\Windows\system32\catroot
2010-01-14 03:02:38 ----D---- C:\Program Files\Windows Mail
2010-01-13 14:38:00 ----D---- C:\Windows\system32\catroot2
2010-01-10 20:12:05 ----D---- C:\ProgramData\Media Center Programs
2010-01-10 20:12:04 ----D---- C:\Program Files\Common Files\BioWare
2010-01-10 20:03:56 ----D---- C:\Users\Carsten\AppData\Roaming\dvdcss
2010-01-05 01:17:46 ----A---- C:\Windows\system32\mrt.exe
2010-01-03 16:31:32 ----D---- C:\Users\Carsten\AppData\Roaming\teamspeak2
2010-01-03 02:58:24 ----D---- C:\Users\Carsten\AppData\Roaming\RayV
2009-12-17 18:12:36 ----D---- C:\ProgramData\Xfire
2009-12-17 16:25:03 ----D---- C:\Users\Carsten\AppData\Roaming\Xfire
2009-12-12 02:35:39 ----D---- C:\Windows\rescache
2009-12-11 20:08:12 ----D---- C:\Windows\system32\de-DE
2009-12-11 20:08:12 ----D---- C:\Program Files\Internet Explorer
2009-12-11 16:13:30 ----D---- C:\ProgramData\Microsoft Help
2009-12-07 02:14:14 ----D---- C:\Windows\system32\Tasks
2009-12-05 15:17:23 ----D---- C:\Program Files\Windows Sidebar
2009-12-01 17:24:54 ----D---- C:\Program Files\ATI
2009-12-01 17:20:40 ----RSD---- C:\Windows\assembly
2009-12-01 17:20:29 ----D---- C:\Program Files\ATI Technologies
2009-12-01 15:39:04 ----D---- C:\Program Files\Common Files
2009-11-30 19:26:47 ----A---- C:\Windows\system32\PnkBstrB.exe
2009-11-27 17:53:10 ----D---- C:\Program Files\Common Files\Apple
2009-11-04 16:43:42 ----A---- C:\Windows\system32\atitmmxx.dll
2009-11-04 16:43:24 ----A---- C:\Windows\system32\atipdlxx.dll
2009-11-04 16:23:10 ----A---- C:\Windows\system32\atiumdag.dll
2009-11-04 16:05:20 ----A---- C:\Windows\system32\atiumdva.dll
2009-11-02 15:18:45 ----HD---- C:\Program Files\InstallShield Installation Information
2009-10-30 12:02:35 ----D---- C:\Users\Carsten\AppData\Roaming\DAEMON Tools Lite
2009-10-30 12:01:56 ----D---- C:\Program Files\DAEMON Tools Toolbar
2009-10-29 10:53:22 ----D---- C:\Program Files\Windows Media Player
2009-10-21 09:54:09 ----D---- C:\Windows\PolicyDefinitions

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2008-01-19 350720]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 ANIO;ANIO Service; \??\C:\Windows\system32\ANIO.SYS [2005-11-09 24288]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2009-09-30 103440]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-11-04 5079040]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2010-01-20 16608]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HssDrv;Hotspot Shield Helper Miniport; C:\Windows\system32\DRIVERS\HssDrv.sys [2009-09-15 37376]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-06-27 2149912]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784]
R3 taphss;Anchorfree HSS Adapter; C:\Windows\system32\DRIVERS\taphss.sys [2009-09-15 32768]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
R3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 agm0dwli;agm0dwli; C:\Windows\system32\drivers\agm0dwli.sys []
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 jbridgep;jbridgep; \??\C:\Users\Carsten\AppData\Local\Temp\jbridgep.sys [2009-03-29 15872]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2010-01-07 38224]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\Windows\system32\DRIVERS\netaapl.sys [2009-06-05 17408]
S3 RT73;D-Link USB Wireless LAN Card Driver; C:\Windows\system32\DRIVERS\Dr71WU.sys [2008-01-15 459520]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 xnacc;Treiberdienst XBOX 360-Controller für Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2008-01-19 521216]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-11-04 172032]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-06 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
R2 Bonjour Service;Bonjour-Dienst; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 dlcx_device;dlcx_device; C:\Windows\system32\dlcxcoms.exe [2006-11-03 537480]
R2 GEST Service;GEST Service for program management.; C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe [2008-07-11 80392]
R2 HotspotShieldService;Hotspot Shield Service; D:\Programme\Hotspot Shield\bin\openvpnas.exe [2009-09-15 204848]
R2 HssSrv;Hotspot Shield Routing Service; D:\Programme\Hotspot Shield\HssWPR\hsssrv.exe [2009-09-15 331824]
R2 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-10-20 71096]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-03-14 75064]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2009-11-30 215104]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2009-11-13 1021256]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater; D:\Spiele\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-19 523776]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 HssTrayService;Hotspot Shield Tray Service; D:\Programme\Hotspot Shield\bin\HssTrayService.EXE [2009-09-15 57640]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S3 TuneUp.Defrag;@C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1; C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe [2009-12-05 435016]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2008-01-19 917504]

-----------------EOF-----------------

cosinus 20.01.2010 23:01
Bitte nochmal den Avenger anwenden

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:

http://mitglied.lycos.de/efunction/tb123/avenger.png

3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:
Code:
files to delete:
C:\Users\Carsten\AppData\Local\Temp\extrac64_cab.exe
C:\Windows\system32\h8srtshsyst.dll
C:\Windows\system32\h8srtkrl32mainweq.dll
C:\Windows\system32\H8SRTqddpypbhin.dll
C:\Windows\system32\H8SRTexcxtwuefb.dll
C:\Windows\system32\H8SRTcphcmoddop.dll
C:\Windows\system32\H8SRTmfxntpervt.dll
C:\ProgramData\sysReserve.ini
4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net - Ihr kostenloser File Hoster! hochladen und hier verlinken.

CalJohnson 20.01.2010 23:10
Danke² :)

Und hier:

Zitat:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\Users\Carsten\AppData\Local\Temp\extrac64_cab.exe" deleted successfully.
File "C:\Windows\system32\h8srtshsyst.dll" deleted successfully.
File "C:\Windows\system32\h8srtkrl32mainweq.dll" deleted successfully.
File "C:\Windows\system32\H8SRTqddpypbhin.dll" deleted successfully.
File "C:\Windows\system32\H8SRTexcxtwuefb.dll" deleted successfully.
File "C:\Windows\system32\H8SRTcphcmoddop.dll" deleted successfully.
File "C:\Windows\system32\H8SRTmfxntpervt.dll" deleted successfully.
File "C:\ProgramData\sysReserve.ini" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

cosinus 20.01.2010 23:11
Sehr schön! :daumenhoc
Bitte die backup.zip noch hochladen!

CalJohnson 20.01.2010 23:33
Uiuiui, hatte hier gerade voll das Problem.

Aus irgendeinem unerfindlichen Grund (bin ich gar im falschen Thread gelandet eben? Ich weiss es nicht) Hab ich deine Anleitung zu "Cofi" gelesen und das Programm gestartet. Das meinte dann irgendwas von wegen "Daemon Tools" und hat den PC neugestartet. Dann hat es mir wieder in Windows einen "Syntax Fehler" angezeigt. War das vielleicht meine Rettung? ^^

Jedenfalls ging dann nichts mehr mit Internet. Ich war zwar verbunden, aber Skype und Browser haben nix gefunden.

Hab neugestartet und jetzt geht es wieder.

Ich bin so doof. KA ob das Prog irgendwelche Schäden angerichtet hat, aber bisher sieht es zumindest nicht danach aus. Internet funktioniert wieder. Muss ich mir nun Sorgen machen?

Das Glück ist hier hoffentlich auch mit den Doofen gewesen ^^

Also BackupLog:

http://www.file-upload.net/download-...ackup.zip.html

PS: In dem Ordner war das Backup zip und ein Backupzip mit dem Datum von Heute. Hab nun gemäß deiner Bitte das _ohne_ Datum hochgeladen, hoffe das war/ist das, welches du meintest.

vG!


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:50 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131