Trojaner-Board - Was geht mit meinem pc? was tun? runscanner logfile

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Was geht mit meinem pc? was tun? runscanner logfile (https://www.trojaner-board.de/58261-geht-meinem-pc-tun-runscanner-logfile.html)

Kathi_87

20.08.2008 16:27

Was geht mit meinem pc? was tun? runscanner logfile

Hallo!
Also...
seit gestern spinnt mein pc (xp)
symptome:
viel werbung via pop ups trotz popupblocker
das startmenü öffnet sich von allein und die maus bewegt sich auf der linken bildschrim seite hoch und runter und es werden programme aus dem startmenü geöffnet

hab mit antivir ne systemprüfung gemacht und der hat nix gefunden :-(

wär toll wenn mir jemand helfen könnte...hab nämlich so gar keine ahnung was ich machen soll...
danke schonmal im voraus!

Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

General info
------------
Computer name : YOUR-UNQFBZEP7Z
Creation time : 19.08.2008 00:40:49
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 7.0.5730.11
OS : Microsoft Windows XP
OS Build : 2600
OS SP : Service Pack 2
RunScanner Version : 1.7.0.0
User Language : Deutsch (Deutschland)
User rights : Administrator
Windows folder : C:\WINDOWS

Running processes
-----------------
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
* C:\WINDOWS\system32\services.exe (Microsoft Corporation)
* C:\WINDOWS\System32\alg.exe (Microsoft Corporation)
C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
* C:\WINDOWS\system32\csrss.exe (Microsoft Corporation)
* C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
* C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
* C:\WINDOWS\System32\svchost.exe (Microsoft Corporation)
* C:\WINDOWS\System32\svchost.exe (Microsoft Corporation)
* C:\WINDOWS\System32\svchost.exe (Microsoft Corporation)
* C:\WINDOWS\system32\svchost.exe (Microsoft Corporation)
* C:\WINDOWS\System32\svchost.exe (Microsoft Corporation)
* C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe (HP)
* C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\Programme\Ahead\InCD\InCDsrv.exe (Nero AG)
C:\Programme\ipwins\ipwins.exe
* C:\Programme\Java\jre1.6.0_02\bin\jusched.exe (Sun Microsystems, Inc.)
* C:\WINDOWS\system32\lsass.exe (Microsoft Corporation)
* C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation)
C:\Programme\QuickTime\qttask.exe (Apple Computer, Inc.)
* C:\RunScanner.exe (Runscanner.net)
* C:\WINDOWS\system32\spoolsv.exe (Microsoft Corporation)
* C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
* C:\WINDOWS\system32\winlogon.exe (Microsoft Corporation)
* c:\windows\System32\smss.exe (Microsoft Corporation)

Unrated items
-------------
002 C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
002 C:\Programme\ipwins\ipwins.exe
002 C:\Programme\QuickTime\qttask.exe (Apple Computer, Inc.)
010 C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (Avira AntiVir Personal – Free Antivirus Guard)
010 C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira AntiVir Personal – Free Antivirus Planer)
010 C:\Programme\Canon\CAL\CALMAIN.exe (Canon Camera Access Library 8)
010 C:\Programme\Ahead\InCD\InCDsrv.exe (InCD Helper)
011 C:\WINDOWS\system32\drivers\Asapi.sys (Asapi)
011 * C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys (avgio)
011 * C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys (avgntflt)
011 * C:\WINDOWS\system32\DRIVERS\avipbb.sys (avipbb)
011 C:\WINDOWS\system32\drivers\cdrbsvsd.sys (cdrbsvsd)
011 C:\WINDOWS\system32\drivers\incdrm.sys (InCD Reader)
011 C:\WINDOWS\System32\DRIVERS\InCDPass.sys (InCDPass)
011 C:\WINDOWS\system32\drivers\pfc.sys (Padus ASPI Shell)
011 C:\WINDOWS\System32\Drivers\PxHelp20.sys (PxHelp20)
011 C:\WINDOWS\System32\Drivers\sptd.sys (sptd)
011 C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (ssmdrv)
011 C:\WINDOWS\System32\drivers\sfdrv01.sys (StarForce Protection Environment Driver (version 1.x))
011 C:\WINDOWS\System32\drivers\sfhlp02.sys (StarForce Protection Helper Driver (version 2.x))
011 C:\WINDOWS\System32\Drivers\StMp3Rec.sys (Treiber für Player-Wiederherstellungsgerät)
011 C:\WINDOWS\system32\DRIVERS\uscbs109.sys (uscbs109)
011 C:\WINDOWS\system32\DRIVERS\uscsc109.sys (uscsc109)
011 * c:\windows\System32\Drivers\vaxscsi.sys (vaxscsi)
031 C:\Programme\Gemeinsame Dateien\System\OLE DB\msdaipp.dll (Microsoft Corporation) {E1D2BF42-A96B-11d1-9C6B-0000F875AC61}
031 C:\Programme\Gemeinsame Dateien\System\OLE DB\msdaipp.dll (Microsoft Corporation) {E1D2BF42-A96B-11d1-9C6B-0000F875AC61}
031 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) {CD00020A-8B95-11D1-82DB-00C04FB1625D}
031 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) {314111c7-a502-11d2-bbca-00c04f8ec294}
031 C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) {0A9007C0-4076-11D3-8789-0000F8105754}
031 C:\Programme\Gemeinsame Dateien\System\OLE DB\msdaipp.dll (Microsoft Corporation) {E1D2BF40-A96B-11d1-9C6B-0000F875AC61}
042 C:\Programme\PartyGaming\PartyPoker\RunApp.exe {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
047 Zone: : msn
047 Zone: www.gametwist.de : *.www.gametwist.de
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d66-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d67-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d68-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d69-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6A-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6B-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6C-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6D-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6E-38d6-4dd3-83d5-9a7e07b65904}
061 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {1AC145F8-E05B-4a04-AFDC-697BD70832B1}
061 C:\Programme\Ahead\InCD\incdshx.dll (Nero AG) {950FF917-7A57-46BC-8017-59D9BF474000}
061 C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
061 C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL (Microsoft Corporation) {BDEADF00-C265-11D0-BCED-00A0C90AB50F}
061 C:\Programme\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
062 C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
100 ProxyOverride HKCU : fritz.box
100 Start Page HKCU : http://www.sevengames.de/
102 GUID / CLSID not found {32683183-48a0-441b-a342-7c2a440a9478}
104 C:\WINDOWS\opuc.dll (Microsoft Corporation) {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE}
104 * C:\WINDOWS\Downloaded Program Files\ImageUploader4.ocx (Aurigma, Inc.) {6E5E167B-1566-4316-B27F-0DDAB3484CF7}
104 GUID / CLSID not found {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
104 GUID / CLSID not found {9F1C11AA-197B-4942-BA54-47A8489BB47F}
104 C:\Programme\Java\jre1.5.0_07\bin\npjpi150_07.dll (Sun Microsystems, Inc.) {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}
104 C:\Programme\Java\jre1.5.0_08\bin\npjpi150_08.dll (Sun Microsystems, Inc.) {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}
104 * C:\WINDOWS\Downloaded Program Files\NutzNavi.dll (Nutzwerk GmbH) {D2982A7F-489A-47F5-A319-FC1F14EBC245}
104 * C:\WINDOWS\system32\FlashAX\FlashAX.ocx (Microgaming Systems) {D8089245-3211-40F6-819B-9E5E92CD61A2}
104 C:\WINDOWS\Downloaded Program Files\popcaploader.dll (PopCap Games) {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
104 C:\WINDOWS\Downloaded Program Files\Oberongamesloader.dll (Oberon Games) {E1342154-4889-42B5-BEF6-19237577048F}
105 &ICQ Toolbar Search : res://C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\ICQToolbar\toolbaru.dll/SEARCH.HTML
105 Nach Microsoft &Excel exportieren : res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
170 {be460b50-5b14-11dd-9d9a-00e04ceb1b83} : H:\preinst.exe
173 C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
173 C:\Programme\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
221 C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
221 C:\Programme\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
225 C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
225 C:\Programme\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 C:\Programme\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
227 C:\Programme\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
229 C:\Programme\Ahead\InCD\incdshx.dll (Nero AG) {950FF917-7A57-46BC-8017-59D9BF474000}
231 C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d66-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d67-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d68-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6A-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6B-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6C-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6D-38d6-4dd3-83d5-9a7e07b65904}
241 * C:\Programme\FAST Gigabank\FotoBanker.dll (FAST LTA AG) {489d8d6E-38d6-4dd3-83d5-9a7e07b65904}

Missing files
-------------
010 C:\WINDOWS\system32\directx.exe
011 C:\WINDOWS\system32\drivers\Abiosdsk.sys
011 C:\WINDOWS\system32\drivers\abp480n5.sys
011 C:\WINDOWS\system32\drivers\adpu160m.sys
011 C:\WINDOWS\system32\drivers\Aha154x.sys
011 C:\WINDOWS\system32\drivers\aic78u2.sys
011 C:\WINDOWS\system32\drivers\aic78xx.sys
011 C:\WINDOWS\system32\drivers\AliIde.sys
011 C:\WINDOWS\system32\drivers\amsint.sys
011 C:\WINDOWS\system32\drivers\asc.sys
011 C:\WINDOWS\system32\drivers\asc3350p.sys
011 C:\WINDOWS\system32\drivers\asc3550.sys
011 C:\WINDOWS\system32\drivers\Atdisk.sys
011 C:\WINDOWS\system32\drivers\bsaspi32.sys
011 C:\WINDOWS\system32\drivers\cd20xrnt.sys
011 C:\WINDOWS\system32\drivers\Changer.sys
011 C:\WINDOWS\system32\drivers\CmdIde.sys
011 C:\WINDOWS\system32\drivers\Cpqarray.sys
011 C:\WINDOWS\system32\drivers\dac2w2k.sys
011 C:\WINDOWS\system32\drivers\dac960nt.sys
011 C:\WINDOWS\system32\drivers\dpti2o.sys
011 C:\WINDOWS\system32\drivers\hpn.sys
011 C:\WINDOWS\system32\drivers\hpt3xx.sys
011 C:\WINDOWS\system32\drivers\i2omgmt.sys
011 C:\WINDOWS\system32\drivers\i2omp.sys
011 C:\WINDOWS\system32\drivers\ini910u.sys
011 C:\WINDOWS\system32\drivers\IntelIde.sys
011 C:\WINDOWS\system32\drivers\lbrtfdc.sys
011 C:\WINDOWS\system32\drivers\mraid35x.sys
011 C:\WINDOWS\system32\drivers\PCIDump.sys
011 C:\WINDOWS\system32\drivers\PCIIde.sys
011 C:\WINDOWS\system32\drivers\PDCOMP.sys
011 C:\WINDOWS\system32\drivers\PDFRAME.sys
011 C:\WINDOWS\system32\drivers\PDRELI.sys
011 C:\WINDOWS\system32\drivers\PDRFRAME.sys
011 C:\WINDOWS\system32\drivers\perc2.sys
011 C:\WINDOWS\system32\drivers\perc2hib.sys
011 C:\WINDOWS\system32\drivers\ql1080.sys
011 C:\WINDOWS\system32\drivers\Ql10wnt.sys
011 C:\WINDOWS\system32\drivers\ql12160.sys
011 C:\WINDOWS\system32\drivers\ql1240.sys
011 C:\WINDOWS\system32\drivers\ql1280.sys
011 C:\WINDOWS\system32\drivers\Simbad.sys
011 C:\WINDOWS\system32\drivers\Sparrow.sys
011 C:\WINDOWS\system32\drivers\sym_hi.sys
011 C:\WINDOWS\system32\drivers\sym_u3.sys
011 C:\WINDOWS\system32\drivers\symc810.sys
011 C:\WINDOWS\system32\drivers\symc8xx.sys
011 C:\WINDOWS\system32\drivers\TosIde.sys
011 C:\WINDOWS\system32\drivers\ultra.sys
011 C:\WINDOWS\system32\drivers\vspf5.sys
011 C:\WINDOWS\system32\drivers\vspf_hk5.sys
011 C:\WINDOWS\system32\drivers\WDICA.sys
041 C:\Programme\Safety Bar\SafetyBar.dll
042 C:\Programme\ICQLite\ICQLite.exe
042 C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe
045 C:\Programme\Safety Bar\SafetyBar.dll
052 C:\WINDOWS\system32\efedb.dll
052 C:\WINDOWS\system32\ixt2.dll
052 C:\WINDOWS\system32\jgmd400d.dll
060 C:\WINDOWS\system32\urroxtl.dll
061 deskpan.dll
061 C:\Programme\ICQLite\ICQLiteShell.dll
061 C:\Programme\eMule\Incoming\Software\WinISO\ISORecorder.dll
061 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll
061 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll
061 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll
061 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll
061 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
061 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
061 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
061 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
067 C:\WINDOWS\system32\efedb.dll
067 winwsa32.dll
166 C:\Programme\Gemeinsame Dateien\{B401E830-0510-1031-0716-020110010031}\Update.exe
167 ishost.exe
167 issearch.exe
173 C:\Programme\ICQLite\ICQLiteShell.dll
173 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
173 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll
221 C:\Programme\ICQLite\ICQLiteShell.dll
221 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
221 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll
225 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
225 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
227 C:\Programme\ICQLite\ICQLiteShell.dll
227 C:\PROGRA~1\EMULE48A\INCOMING\INCOMING\SOFTWARE\WINZIP\WZSHLSTB.DLL
227 C:\Programme\eMule\Incoming\Software\WinACE\arcext.dll

cosinus

20.08.2008 19:01

Hallo und :hallo:

Acker diese Punkte für weitere Analysen ab:

A.) Poste ein Hijackthis Logfile.

B.) Stell sicher, daß Dir auch alle Dateien angezeigt werden, danach folgende Dateien bei Virustotal.com auswerten lassen und alle Ergebnisse posten, und zwar so, daß man die der einzelnen Virenscanner sehen kann. Bitte mit Dateigrößen und Prüfsummen:

Code:

C:\Programme\ipwins\ipwins.exe

C.) Führe dieses MBR-Tool aus und poste die Ausgabe

D.) Blacklight und Malwarebytes Antimalware ausführen und Logfiles posten

E.) ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Poste die Logfiles bitte mit Codetags umschlossen (#-Button) also so:

HTML-Code:

[code] Hier das Logfile rein! [/code]

F.) Mach ein Filelisting mit diesem script:

Script abspeichern per Rechtsklick, speichern unter auf dem Desktop
Doppelklick auf listing8.cmd auf dem Desktop
nach kurzer Zeit erscheint eine listing.txt auf dem Desktop

Diese listing.txt z.B. bei File-Upload.net hochladen und hier verlinken, da dieses Logfile zu groß fürs Board ist.

Installiere nach erfolgter Bereinigung das SP3 für Windows XP!

Kathi_87

21.08.2008 18:18

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:50:50, on 21.08.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\ICQ6Toolbar\ICQ Service.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Canon\CAL\CALMAIN.exe

C:\Programme\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

C:\Programme\ipwins\ipwins.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sevengames.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = fritz.box

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {087F28D3-B9BB-463D-A02A-36149C452A83} - C:\WINDOWS\system32\jgmd400d.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {a43385f0-7113-496d-96d7-b9b550e3fcca} - C:\WINDOWS\system32\ixt2.dll (file missing)

O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Programme\Safety Bar\SafetyBar.dll (file missing)

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

O4 - HKLM\..\Run: [IpWins] C:\Programme\ipwins\ipwins.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Policies\Explorer\Run: [ishost.exe] ishost.exe

O4 - HKLM\..\Policies\Explorer\Run: [issearch.exe] issearch.exe

O4 - HKCU\..\Policies\Explorer\Run: [{B401E830-0510-1031-0716-020110010031}] "C:\Programme\Gemeinsame Dateien\{B401E830-0510-1031-0716-020110010031}\Update.exe" mc-110-12-0000272

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O15 - Trusted Zone: www.gametwist.de

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151660381628

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151662758197

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studivz.net/photouploader/ImageUploader4.cab?nocache=20071128-1

O16 - DPF: {D2982A7F-489A-47F5-A319-FC1F14EBC245} (Navigator Class) - http://www.nutzwerk.de/control/NutzNavi.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://spinpalace.microgaming.com/freeplay/FlashAX.cab

O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://gamescenter.sat1.de/online2/insaniquarium/oberongamesloader.cab

O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)

O22 - SharedTaskScheduler: {03413bf7-e34c-445b-bfc0-a2b127255871} - incestuously - (no file)

O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: DirectX Service (DirectHogf) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)

O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe
 

--

End of file - 8005 bytes

Kathi_87

21.08.2008 18:20

Code:

Datei ipwins.exe empfangen 2008.03.05 15:50:55 (CET)

Status: Beendet 

                                                  Ergebnis: 21/32 (65.62%)

Antivirus        Version        letzte aktualisierung        Ergebnis

AhnLab-V3        -        -        -

AntiVir        -        -        ADSPY/MaxFiles

Authentium        -        -        -

Avast        -        -        Win32:Adware-gen

AVG        -        -        Adware Generic.VJO

BitDefender        -        -        Adware.Maxfiles.B

CAT-QuickHeal        -        -        Adware.MaxFiles (Not a Virus)

ClamAV        -        -        -

DrWeb        -        -        Trojan.Rond

eSafe        -        -        Spyware.MaxSearch

eTrust-Vet        -        -        -

Ewido        -        -        Adware.MaxFiles

F-Prot        -        -        W32/AdwareX.FJJ

F-Secure        -        -        -

FileAdvisor        -        -        -

Fortinet        -        -        Dialer_PlayGames

Ikarus        -        -        not-a-virus:AdWare.Win32.Agent.z

Kaspersky        -        -        not-a-virus:AdWare.Win32.Agent.z

McAfee        -        -        potentially unwanted program Adware-Shorty

Microsoft        -        -        Program:Win32/IPWins

NOD32v2        -        -        probably a variant of Win32/Adware.Agent

Norman        -        -        W32/Maxifiles.Q

Panda        -        -        Adware/MaxFiles

Prevx1        -        -        Generic.Malware

Rising        -        -        -

Sophos        -        -        -

Sunbelt        -        -        Ipwins

Symantec        -        -        Adware.MaxSearch

TheHacker        -        -        -

VBA32        -        -        -

VirusBuster        -        -        -

Webwasher-Gateway        -        -        Ad-Spyware.MaxFiles

weitere Informationen

MD5: e504b3730bc4f7cf82e6e665b325d229

SHA1: d5f3a7ad39a18802cbc6d55c5bd8105e338fa5c7

SHA256: 3ea45ee7389fd00c7aa264384a8a904129f7066130e54e2bb3c3c3cf077b587b

SHA512:

674096958f9150e6c817b999f54e59463802fc211447681bcc71de3593ea4eb7

5493a15a55f4779c715f2d0323efe92c28528cd4505f7f8d09e325145560f1a8

Kathi_87

21.08.2008 18:21

Code:

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
 

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

Kathi_87

21.08.2008 18:22

Code:

08/21/08 15:24:55 [Info]: BlackLight Engine 1.0.70 initialized

08/21/08 15:24:55 [Info]: OS: 5.1 build 2600 (Service Pack 2)

08/21/08 15:25:01 [Note]: 7019 4

08/21/08 15:25:01 [Note]: 7005 0

08/21/08 15:25:28 [Note]: 7006 0

08/21/08 15:25:28 [Note]: 7011 776

08/21/08 15:25:29 [Note]: 7035 0

08/21/08 15:25:29 [Note]: 7026 0

08/21/08 15:25:29 [Note]: 7026 0

08/21/08 15:27:24 [Note]: FSRAW library version 1.7.1024

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:32:43 [Note]: 2000 1012

08/21/08 16:33:13 [Note]: 7007 0

Kathi_87

21.08.2008 18:24

Code:

Malwarebytes' Anti-Malware 1.25

Datenbank Version: 1072

Windows 5.1.2600 Service Pack 2
 

22:24:20 20.08.2008

mbam-log-08-20-2008 (22-24-20).txt
 

Scan-Methode: Vollständiger Scan (A:\|C:\|D:\|E:\|F:\|G:\|)

Durchsuchte Objekte: 199865

Laufzeit: 3 hour(s), 26 minute(s), 10 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 17

Infizierte Registrierungswerte: 3

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 2

Infizierte Dateien: 20
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{014c1107-a846-41e9-9f27-85ff75471549} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efedb (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{014c1107-a846-41e9-9f27-85ff75471549} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{1234890a-5e6e-4867-8136-ca6f1456b235} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e18b69d0-7e9e-4c6e-bdd8-879a1fff7123} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{b2a3156e-3332-4b47-af5a-5b121503514f} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winwsa32 (Dialer) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\winantivirus pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2006\WapCHK.dll (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootStera (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
 

Infizierte Dateien:

C:\WINDOWS\system32\efedb.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Kathrin\Lokale Einstellungen\Temp\ICD1.tmp\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Kathrin\Lokale Einstellungen\Temp\ICD2.tmp\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Kathrin\Lokale Einstellungen\Temp\ICD4.tmp\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Kathrin\Lokale Einstellungen\Temp\ICD5.tmp\USYP_0003_N91M0908NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Kathrin\Lokale Einstellungen\Temp\ICD6.tmp\USYP_0003_N91M0908NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\UERSU_9999_N91S2009NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\USYP_0001_N91M2807NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\USYP_0003_N91M0908NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\CONFLICT.6\UWA6PU_0001_N91M2107NetInstaller.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2006\WapCHK.dll (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\winwsa32.dll (Dialer) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.

Kathi_87

21.08.2008 18:26

Code:

ComboFix 08-08-19.06 - Kathrin 2008-08-21 18:27:59.1 - NTFSx86

ausgeführt von:: C:\Dokumente und Einstellungen\Kathrin\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt
 
 Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.
 

((((((((((((((((((((((((((((((((((((   Weitere L”schungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\Dokumente und Einstellungen\Christian\Cookies\christian@2o7[1].txt

C:\Dokumente und Einstellungen\Christian\Cookies\christian@88.198.13[2].txt

C:\Dokumente und Einstellungen\Christian\Cookies\christian@ad.yieldmanager[2].txt

C:\Dokumente und Einstellungen\Christian\Cookies\christian@komtrack[2].txt

C:\Dokumente und Einstellungen\Petra\Cookies\petra@ad.yieldmanager[2].txt

C:\Dokumente und Einstellungen\Petra\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows Media\10.0\WMSDKNSD.XML

C:\Programme\Gemeinsame Dateien\{B401E~1

C:\Programme\Gemeinsame Dateien\{B401E~1\services.dll

C:\Programme\ipwins

C:\Programme\ipwins\count.dat

C:\Programme\ipwins\data.dat

C:\Programme\ipwins\date.dat

C:\Programme\ipwins\ipwins.exe

C:\Programme\ipwins\s118.1.dat

C:\Programme\ipwins\s118.3.dat

C:\Programme\ipwins\s12k.1.dat

C:\Programme\ipwins\s12k.dat

C:\Programme\ipwins\s13k.5.dat

C:\Programme\ipwins\s144.dat

C:\Programme\ipwins\s16s.1.dat

C:\Programme\ipwins\s17g.5.dat

C:\Programme\ipwins\s17k.dat

C:\Programme\ipwins\s18s.b.dat

C:\Programme\ipwins\s19g.1.dat

C:\Programme\ipwins\s19o.1.dat

C:\Programme\ipwins\s1bg.1.dat

C:\Programme\ipwins\s1f0.1.dat

C:\Programme\ipwins\s1i0.1.dat

C:\Programme\ipwins\s1i8.6.dat

C:\Programme\ipwins\s1ig.7.dat

C:\Programme\ipwins\s1jk.3.dat

C:\Programme\ipwins\s1jo.4.dat

C:\Programme\ipwins\s1js.dat

C:\Programme\ipwins\s1ns.3.dat

C:\Programme\ipwins\s1qc.1.dat

C:\Programme\ipwins\s1qs.1.dat

C:\Programme\ipwins\s1r8.dat

C:\Programme\ipwins\s1rc.1.dat

C:\Programme\ipwins\s1rs.1.dat

C:\Programme\ipwins\s1s8.dat

C:\Programme\ipwins\s1sc.dat

C:\Programme\ipwins\s1ss.3.dat

C:\Programme\ipwins\s1ts.4.dat

C:\Programme\ipwins\s1u8.1.dat

C:\Programme\ipwins\s1v8.1.dat

C:\Programme\ipwins\s208.1.dat

C:\Programme\ipwins\s20c.1.dat

C:\Programme\ipwins\s20g.e.dat

C:\Programme\ipwins\s20k.1.dat

C:\Programme\ipwins\s20s.3.dat

C:\Programme\ipwins\s210.dat

C:\Programme\ipwins\s218.dat

C:\Programme\ipwins\s21o.1.dat

C:\Programme\ipwins\s224.dat

C:\Programme\ipwins\s228.1.dat

C:\Programme\ipwins\s228.2.dat

C:\Programme\ipwins\s22c.3.dat

C:\Programme\ipwins\s23c.1.dat

C:\Programme\ipwins\s23o.3.dat

C:\Programme\ipwins\s23s.1.dat

C:\Programme\ipwins\s24o.3.dat

C:\Programme\ipwins\s25o.dat

C:\Programme\ipwins\s264.dat

C:\Programme\ipwins\s268.1.dat

C:\Programme\ipwins\s26o.8.dat

C:\Programme\ipwins\s270.7.dat

C:\Programme\ipwins\s274.a.dat

C:\Programme\ipwins\s27c.7.dat

C:\Programme\ipwins\s27k.5.dat

C:\Programme\ipwins\s27s.3.dat

C:\Programme\ipwins\s28o.1.dat

C:\Programme\ipwins\s28o.dat

C:\Programme\ipwins\s294.3.dat

C:\Programme\ipwins\s298.dat

C:\Programme\ipwins\s29c.1.dat

C:\Programme\ipwins\s2a4.8.dat

C:\Programme\ipwins\s2ag.1.dat

C:\Programme\ipwins\s2ak.5.dat

C:\Programme\ipwins\s2ao.7.dat

C:\Programme\ipwins\s2b8.3.dat

C:\Programme\ipwins\s2bs.5.dat

C:\Programme\ipwins\s2c0.1.dat

C:\Programme\ipwins\s2d0.5.dat

C:\Programme\ipwins\s2dc.6.dat

C:\Programme\ipwins\s2dg.5.dat

C:\Programme\ipwins\s2dk.dat

C:\Programme\ipwins\s2fs.5.dat

C:\Programme\ipwins\s2g8.1.dat

C:\Programme\ipwins\s2h4.8.dat

C:\Programme\ipwins\s2hg.7.dat

C:\Programme\ipwins\s2hg.dat

C:\Programme\ipwins\s2ho.8.dat

C:\Programme\ipwins\s2ic.dat

C:\Programme\ipwins\s2j0.8.dat

C:\Programme\ipwins\s2j4.1.dat

C:\Programme\ipwins\s2j8.a.dat

C:\Programme\ipwins\s2jk.b.dat

C:\Programme\ipwins\s2k4.e.dat

C:\Programme\ipwins\s2kc.3.dat

C:\Programme\ipwins\s2kc.8.dat

C:\Programme\ipwins\s2lk.1.dat

C:\Programme\ipwins\s2lk.8.dat

C:\Programme\ipwins\s2lk.9.dat

C:\Programme\ipwins\s2mg.6.dat

C:\Programme\ipwins\s2n0.1.dat

C:\Programme\ipwins\s2p0.1.dat

C:\Programme\ipwins\s2s8.7.dat

C:\Programme\ipwins\s2ug.d.dat

C:\Programme\ipwins\s2vo.6.dat

C:\Programme\ipwins\s35s.5.dat

C:\Programme\ipwins\s3bo.1.dat

C:\Programme\ipwins\s3e4.1.dat

C:\Programme\ipwins\s3p8.8.dat

C:\Programme\ipwins\s3r8.o.dat

C:\Programme\ipwins\s3rg.dat

C:\Programme\ipwins\s3u0.3.dat

C:\Programme\ipwins\s7c.1.dat

C:\Programme\ipwins\s7g.2.dat

C:\Programme\ipwins\sa0.1.dat

C:\Programme\ipwins\sc4.1.dat

C:\Programme\ipwins\scs.2.dat

C:\Programme\ipwins\sd4.1.dat

C:\Programme\ipwins\seo.1.dat

C:\Programme\ipwins\seo.3.dat

C:\Programme\ipwins\ses.1.dat

C:\Programme\ipwins\settings.dat

C:\Programme\ipwins\settingsDate.dat

C:\Programme\ipwins\sf4.1.dat

C:\Programme\ipwins\sg8.dat

C:\Programme\ipwins\sgg.dat

C:\Programme\ipwins\sgo.1.dat

C:\Programme\ipwins\sj8.1.dat

C:\Programme\ipwins\sls.1.dat

C:\Programme\ipwins\sm0.1.dat

C:\Programme\ipwins\snc.1.dat

C:\Programme\ipwins\sng.2.dat

C:\Programme\ipwins\so8.dat

C:\Programme\ipwins\sok.1.dat

C:\Programme\ipwins\sr4.3.dat

C:\Programme\ipwins\sro.1.dat

C:\Programme\ipwins\srs.1.dat

C:\Programme\ipwins\sto.1.dat

C:\Programme\ipwins\su4.dat

C:\Programme\ipwins\suc.6.dat

C:\Programme\ipwins\sus.2.dat

C:\Programme\ipwins\sv8.4.dat

C:\Programme\ipwins\Uninst.exe

C:\Programme\toolbar888

C:\Programme\toolbar888\MyToolBar.dll

C:\WINDOWS\system32\bdefe.bak1

C:\WINDOWS\system32\bdefe.bak2

C:\WINDOWS\system32\bdefe.ini

C:\WINDOWS\system32\bdefe.ini2

C:\WINDOWS\system32\bdefe.tmp

C:\WINDOWS\system32\components

C:\WINDOWS\system32\stera.log
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_FOPN

-------\Legacy_VSPF

-------\Legacy_VSPF_HK

-------\Service_vspf

-------\Service_vspf_hk
 
 

(((((((((((((((((((((((   Dateien erstellt von 2008-07-21 bis 2008-08-21  ))))))))))))))))))))))))))))))

.
 

2008-08-21 17:48 . 2008-08-21 17:48        <DIR>        d--------        C:\Programme\CCleaner

2008-08-21 13:50 . 2008-08-21 13:50        <DIR>        d--------        C:\Programme\Trend Micro

2008-08-20 17:40 . 2008-08-20 17:40        <DIR>        d--------        C:\Programme\Malwarebytes' Anti-Malware

2008-08-20 17:40 . 2008-08-20 17:40        <DIR>        d--------        C:\Dokumente und Einstellungen\Kathrin\Anwendungsdaten\Malwarebytes

2008-08-20 17:40 . 2008-08-20 17:40        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

2008-08-20 17:40 . 2008-08-17 15:01        38,472        --a------        C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-08-20 17:40 . 2008-08-17 15:01        17,144        --a------        C:\WINDOWS\system32\drivers\mbam.sys

2008-08-19 00:43 . 2008-08-19 00:43        152,108        --a------        C:\runscanner.run

2008-08-19 00:37 . 2008-08-18 18:20        1,900,288        --a------        C:\RunScanner.exe

2008-08-14 19:14 . 2008-05-01 16:30        331,776        -----c---        C:\WINDOWS\system32\dllcache\msadce.dll

2008-08-07 00:47 . 2008-08-07 00:49        <DIR>        d--------        C:\Programme\PartyGaming

2008-08-07 00:36 . 2008-08-07 00:36        <DIR>        d--------        C:\Programme\Everest Poker

2008-07-26 15:14 . 2008-07-26 15:14        <DIR>        d--------        C:\WINDOWS\AVM_Driver

2008-07-26 15:14 . 2008-07-26 16:07        <DIR>        d--------        C:\Dokumente und Einstellungen\Kathrin\AVM_Driver

2008-07-26 15:14 . 2005-04-18 16:15        15,104        --a------        C:\WINDOWS\system32\drivers\avmunet.sys
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-18 16:54        ---------        d-----w        C:\Programme\Java

2008-08-08 00:00        ---------        d-----w        C:\Programme\eMule48a

2008-07-18 14:25        ---------        d-----w        C:\Dokumente und Einstellungen\Christian\Anwendungsdaten\ICQ

2008-07-17 16:31        ---------        d-----w        C:\Dokumente und Einstellungen\Kathrin\Anwendungsdaten\ICQ

2008-07-16 13:23        36,864        ----a-w        C:\WINDOWS\uinst001.exe

2008-07-13 08:28        ---------        d-----w        C:\Programme\Avira

2008-07-13 08:28        ---------        d-----w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

2008-07-12 15:46        ---------        d-----w        C:\Dokumente und Einstellungen\Christian\Anwendungsdaten\MailFrontier

2008-07-12 14:34        ---------        d-----w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier

2008-07-12 13:27        ---------        d-----w        C:\Dokumente und Einstellungen\Petra\Anwendungsdaten\MailFrontier

2008-07-09 16:19        ---------        d-----w        C:\Programme\FAST Gigabank

2008-07-09 16:19        ---------        d-----w        C:\Dokumente und Einstellungen\Christian\Anwendungsdaten\FAST LTA

2008-07-09 16:19        ---------        d-----w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FAST LTA

2008-07-06 12:33        ---------        d-----w        C:\Programme\PartyGaming.Net

2008-07-01 17:10        ---------        d-----w        C:\Programme\ICQ6

2008-07-01 17:09        ---------        d--h--w        C:\Programme\InstallShield Installation Information

2008-07-01 17:08        ---------        d-----w        C:\Programme\ICQ6Toolbar

2008-07-01 17:08        ---------        d-----w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ

2008-06-23 18:45        ---------        d-----w        C:\Programme\Windows Media Connect 2

2008-04-10 12:11        30,496        ----a-w        C:\Dokumente und Einstellungen\Christian\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2008-02-14 15:58        30,496        ----a-w        C:\Dokumente und Einstellungen\Kathrin\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2006-10-06 05:24        774,144        ----a-w        C:\Programme\RngInterstitial.dll

2004-10-01 23:00        40,960        ----a-w        C:\Programme\Uninstall_CDS.exe

.
 

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

REGEDIT4
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01FotoBank]

@="{489d8d66-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d66-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02FotoBank]

@="{489d8d67-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d67-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03FotoBank]

@="{489d8d68-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d68-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04FotoBank]

@="{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\05FotoBank]

@="{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\06FotoBank]

@="{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\07FotoBank]

@="{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\08FotoBank]

@="{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}"

[HKEY_CLASSES_ROOT\CLSID\{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}]

2008-02-26 16:51        1453656        --a------        C:\Programme\FAST Gigabank\FotoBanker.dll
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:57 15360]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-06-21 11:52 188416]

"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 16:30 266497]

"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-10-24 21:49 282624]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 09:57 15360]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.mjpg"= mcmjpg32.dll
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders        msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Speed Launch.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Speed Launch.lnk

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^InterVideo WinCinema Manager.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk

backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinZip Quick Pick.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk

backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

--------- 2005-07-08 16:25 1397760 C:\Programme\Ahead\InCD\InCD.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 18:24 1694208 C:\Programme\Messenger\msmsgs.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2001-07-09 21:50 155648 C:\WINDOWS\system32\NeroCheck.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar]

--------- 2004-04-21 20:26 86016 C:\Programme\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2006-10-24 21:49 282624 C:\Programme\QuickTime\qttask.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

--a------ 2003-12-09 03:35 32768 C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

--a------ 2006-09-26 16:49 35328 C:\Programme\Winamp\winampa.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Programme\\Gemeinsame Dateien\\Adobe\\ESD\\AdobeDownloadManager.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Programme\\eMule48a\\emule.exe"=

"C:\\Programme\\ICQ6\\ICQ.exe"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"4662:TCP"= 4662:TCP:tcp

"7391:TCP"= 7391:TCP:tcp

"61692:UDP"= 61692:UDP:udp
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundTimestampRequest"= 0 (0x0)

"AllowOutboundSourceQuench"= 0 (0x0)
 

R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2000-01-08 18:22]

R2 ICQ Service;ICQ Service;C:\Programme\ICQ6Toolbar\ICQ Service.exe [2008-06-11 04:26]

R3 uscbs109;uscbs109;C:\WINDOWS\system32\DRIVERS\uscbs109.sys [2005-03-22 09:00]

S2 DirectHogf;DirectX Service;C:\WINDOWS\system32\directx.exe []

S3 AVMUNET;AVM FRITZ!Box;C:\WINDOWS\system32\DRIVERS\avmunet.sys [2005-04-18 16:15]

S3 uscsc109;uscsc109;C:\WINDOWS\system32\DRIVERS\uscsc109.sys [2005-03-22 09:00]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be460b50-5b14-11dd-9d9a-00e04ceb1b83}]

\Shell\AutoRun\command - H:\preinst.exe

.

- - - - Entfernte verwaiste Registrierungseintr„ge - - - -
 

HKCU-Explorer_Run-{B401E830-0510-1031-0716-020110010031} - C:\Programme\Gemeinsame Dateien\{B401E830-0510-1031-0716-020110010031}\Update.exe

SSODL-incestuously-{03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)
 
 

.

------- Zus„tzlicher Scan -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.sevengames.de/

R0 -: HKLM-Main,Window Title = Microsoft Internet Explorer

R1 -: HKCU-Internet Settings,ProxyOverride = fritz.box

R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s

O8 -: &ICQ Toolbar Search - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 -: Nach Microsoft &Excel exportieren - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 -: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 -: {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe

O15 -: Trusted Zone: www.gametwist.de
 

O16 -: {D2982A7F-489A-47F5-A319-FC1F14EBC245} - hxxp://www.nutzwerk.de/control/NutzNavi.cab

C:\WINDOWS\Downloaded Program Files\NutzNavi.dll
 

O16 -: {E1342154-4889-42B5-BEF6-19237577048F} - hxxp://gamescenter.sat1.de/online2/insaniquarium/oberongamesloader.cab

C:\WINDOWS\Downloaded Program Files\Oberongamesloader.inf

C:\WINDOWS\Downloaded Program Files\Oberongamesloader.dll

.
 

**************************************************************************
 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-21 18:59:03

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse...
 

Scanne versteckte Autostart Eintr„ge...
 

Scanne versteckte Dateien...
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

------------------------ Weitere, laufende Prozesse ------------------------

.

C:\Programme\Ahead\InCD\InCDsrv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\Programme\Canon\CAL\CALMAIN.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2008-08-21 19:09:07 - PC wurde neu gestartet [Kathrin]

ComboFix-quarantined-files.txt  2008-08-21 17:08:48
 

Pre-Run: 2,588,323,840 Bytes frei

Post-Run: 6,432,186,368 Bytes frei
 

365        --- E O F ---        2008-08-15 09:46:47

Kathi_87

21.08.2008 18:30

File-Upload.net - listing.txt

soo...das war mal en stück arbeit ;-)
hoffe das stimmt alles...
muss noch dazu sagen, dass ich malwarebytes schon vor hijackthis und dem andern zeug ausgeführt hatte....

ist mein pc jetzt wieder sauber????

und danke schön an root24

cosinus

21.08.2008 18:51

Da wurde aber ne ganze Menge entfernt.... :eek:
Poste mal für nen Abgleich auch noch ein neues Hijackthis Logfile.

Ich kann mir übrigens gut vorstellen wo die viele Malware herkommt. :rolleyes:
Zum einen nutzt Du anscheinend fleißig emule - die meisten Programme die man dort laden kann sind nicht nur illegal sondern auch mit Malware verseucht. Es ist einfach eine nicht vertrauenswürdige Quelle. Laß emule einfach am besten sein, wenn es nicht darum geht OSS downzuloaden (erst nach nem Sigcheck ausführen!).

Zum anderen ist bei Dir noch nicht das SP3 installiert - das solltest Du schnellstens nachinstallieren. Und nutze in Zukunft NICHT mehr den Internet Explorer, den max. fürs Windows-Update, ansonsten nimmst Du stets aktuelle Versionen von Firefox, Seamonkey oder Opera.

Kathi_87

21.08.2008 18:56

ok!
danke für die tipps!!!

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:55:26, on 21.08.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\ICQ6Toolbar\ICQ Service.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\Programme\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\explorer.exe

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sevengames.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = fritz.box

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O15 - Trusted Zone: www.gametwist.de

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151660381628

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151662758197

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studivz.net/photouploader/ImageUploader4.cab?nocache=20071128-1

O16 - DPF: {D2982A7F-489A-47F5-A319-FC1F14EBC245} (Navigator Class) - http://www.nutzwerk.de/control/NutzNavi.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://spinpalace.microgaming.com/freeplay/FlashAX.cab

O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://gamescenter.sat1.de/online2/insaniquarium/oberongamesloader.cab

O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: DirectX Service (DirectHogf) - Unknown owner - C:\WINDOWS\system32\directx.exe (file missing)

O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe
 

--

End of file - 6885 bytes

cosinus

21.08.2008 19:18

Führ nochmal diesen Befehl in der Konsole (cmd.exe) aus:

Code:

sc delete DirectHogf

Mach danach für nen Abgleich ein neues Hijackthis Logfile und auch noch mal eins von silentrunners (siehe Signatur).

Kathi_87

22.08.2008 11:27

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:26:50, on 22.08.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\ICQ6Toolbar\ICQ Service.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\Programme\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\explorer.exe

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sevengames.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = fritz.box

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O15 - Trusted Zone: www.gametwist.de

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151660381628

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151662758197

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studivz.net/photouploader/ImageUploader4.cab?nocache=20071128-1

O16 - DPF: {D2982A7F-489A-47F5-A319-FC1F14EBC245} (Navigator Class) - http://www.nutzwerk.de/control/NutzNavi.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://spinpalace.microgaming.com/freeplay/FlashAX.cab

O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://gamescenter.sat1.de/online2/insaniquarium/oberongamesloader.cab

O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Ahead\InCD\InCDsrv.exe
 

--

End of file - 6775 bytes

Kathi_87

22.08.2008 11:30

Code:

"Silent Runners.vbs", revision 58, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by "{++}"
 
 

Startup items buried in registry:

---------------------------------
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."]

"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]

"avgnt" = ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]

"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"

                   \InProcServer32\(Default) = "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "SSVHelper Class"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"

  -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"

                   \InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"

  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

cosinus

22.08.2008 14:24

Das Hijackthis Logfile ist okay, das von Silentrunners unvollständig!

Kathi_87

23.08.2008 11:45

Code:

"Silent Runners.vbs", revision 58, http://www.silentrunners.org/

Operating System: Windows XP

Output limited to non-default values, except where indicated by "{++}"
 
 

Startup items buried in registry:

---------------------------------
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."]

"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]

"avgnt" = ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]

"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"

                   \InProcServer32\(Default) = "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "SSVHelper Class"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"

  -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"

                   \InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"

  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universelle Plug & Play-Geräte"

  -> {HKLM...CLSID} = "Universelle Plug & Play-Geräte"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"

  -> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung"

                   \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS]

"{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW"

  -> {HKLM...CLSID} = "Shell Extension for CDRW"

                   \InProcServer32\(Default) = "C:\Programme\Ahead\InCD\incdshx.dll" ["Nero AG"]

"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"

  -> {HKLM...CLSID} = "Microsoft Office Metadata Handler"

                   \InProcServer32\(Default) = "C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"

  -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"

                   \InProcServer32\(Default) = "C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{1AC145F8-E05B-4a04-AFDC-697BD70832B1}" = "Gigabank"

  -> {HKLM...CLSID} = "Gigabank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d66-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d67-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d68-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d69-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\

"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

  -> {HKLM...CLSID} = "WPDShServiceObj Class"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
 

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\

<<!>> ("msapsspc.dllschannel.dlldigest.dllmsnsspc.dll" [file not found]) "SecurityProviders" = "msapsspc.dllschannel.dlldigest.dllmsnsspc.dll"
 

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\

<<!>> "BootExecute" = "autocheck autochk *"| [file not found]|"??*??" (unwritable string) [file not found]
 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

<<!>> dimsntfy\DLLName = "C:\WINDOWS\System32\dimsntfy.dll" [MS]

Kathi_87

23.08.2008 11:47

die werbepopups sind weg aber mein startmenü öffnet sich immer noch von alleine und dabei piepst der pc :confused:

cosinus

23.08.2008 12:51

Das Log scheint immer noch unvollständig zu sein! Öffne doch einfach mal die Datei und markiere alles mit der Tastenkombi STRG+A, dann kopieren und nochmal hier einfügen...

Öffne dann mal auch den Registrierungseditor (regedit.exe über Start, Ausführen) und navigiere zu

Code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

Stell sicher, daß der Eintrag "BootExecute" nur diesen Wert hat:

Code:

autocheck autochk *

Kathi_87

23.08.2008 12:56

Code:

"Silent Runners.vbs", revision 58, http://www.silentrunners.org/

Operating System: Windows XP

Output limited to non-default values, except where indicated by "{++}"
 
 

Startup items buried in registry:

---------------------------------
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."]

"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" ["HP"]

"avgnt" = ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]

"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"

                   \InProcServer32\(Default) = "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "SSVHelper Class"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"

  -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"

                   \InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"

  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"

                   \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universelle Plug & Play-Geräte"

  -> {HKLM...CLSID} = "Universelle Plug & Play-Geräte"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]

"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"

  -> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung"

                   \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]

"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS]

"{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW"

  -> {HKLM...CLSID} = "Shell Extension for CDRW"

                   \InProcServer32\(Default) = "C:\Programme\Ahead\InCD\incdshx.dll" ["Nero AG"]

"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"

  -> {HKLM...CLSID} = "Microsoft Office Metadata Handler"

                   \InProcServer32\(Default) = "C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"

  -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"

                   \InProcServer32\(Default) = "C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

"{1AC145F8-E05B-4a04-AFDC-697BD70832B1}" = "Gigabank"

  -> {HKLM...CLSID} = "Gigabank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d66-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d67-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d68-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6A-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6B-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6C-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6D-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d6E-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]

"{489d8d69-38d6-4dd3-83d5-9a7e07b65904}" = "FotoBank"

  -> {HKLM...CLSID} = "FotoBank"

                   \InProcServer32\(Default) = "C:\Programme\FAST Gigabank\FotoBanker.dll" ["FAST LTA AG"]
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\

"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

  -> {HKLM...CLSID} = "WPDShServiceObj Class"

                   \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]
 

HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\

<<!>> ("msapsspc.dllschannel.dlldigest.dllmsnsspc.dll" [file not found]) "SecurityProviders" = "msapsspc.dllschannel.dlldigest.dllmsnsspc.dll"
 

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\

<<!>> "BootExecute" = "autocheck autochk *"| [file not found]|"??*??" (unwritable string) [file not found]
 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

<<!>> dimsntfy\DLLName = "C:\WINDOWS\System32\dimsntfy.dll" [MS]
 

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

  -> {HKLM...CLSID} = "PDF Shell Extension"

                   \InProcServer32\(Default) = "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Software\Adobe\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]
 

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
 

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
 

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"

  -> {HKLM...CLSID} = "MBAMShlExt Class"

                   \InProcServer32\(Default) = "C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]

Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"

  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"

                   \InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
 

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\

MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"

  -> {HKLM...CLSID} = "MBAMShlExt Class"

                   \InProcServer32\(Default) = "C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]
 
 

Default executables:

--------------------
 

<<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile"
 
 

Group Policies {policy setting}:

--------------------------------
 

Note: detected settings may not have any effect.
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
 

"NoDrives" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
 

"NoDrives" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
 

"HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"HideLogoffScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"RunLogonScriptSync" = (REG_DWORD) dword:0x00000001

{unrecognized setting}
 

"RunStartupScriptSync" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"HideStartupScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
 

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001

{Shutdown: Allow system to be shut down without having to log on}
 

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001

{Devices: Allow undock without having to log on}
 

"DisableRegistryTools" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"HideLogoffScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"RunLogonScriptSync" = (REG_DWORD) dword:0x00000001

{unrecognized setting}
 

"RunStartupScriptSync" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 

"HideStartupScripts" = (REG_DWORD) dword:0x00000000

{unrecognized setting}
 
 

Active Desktop and Wallpaper:

-----------------------------
 

Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
 

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"
 

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "C:\Dokumente und Einstellungen\Kathrin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"
 
 

Windows Portable Device AutoPlay Handlers

-----------------------------------------
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\
 

CanonCW50PicturesOnArrival\

"Provider" = "Canon CameraWindow"

"InvokeProgID" = "Cw50.AutoplayHandler"

"InvokeVerb" = "open"

HKLM\SOFTWARE\Classes\Cw50.AutoplayHandler\shell\open\command\(Default) = "C:\Programme\Canon\CameraWindow\CameraWindowMC\CameraLauncherMC.exe" [empty string]
 

CanonZB4PicturesOnArrival\

"Provider" = "ZoomBrowser EX"

"InvokeProgID" = "Zb.AutoplayHandler"

"InvokeVerb" = "open"

HKLM\SOFTWARE\Classes\Zb.AutoplayHandler\shell\open\command\(Default) = "C:\Programme\Canon\ZoomBrowser EX\Program\ZoomBrowser.exe /AUTOPLAY ""%1"""" [empty string]
 

IviCDAUDIOEventHandler\

"Provider" = "InterVideo WinDVD 7"

"InvokeProgID" = "Ivi.MediaFile"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\DVD7\WinDVD.exe %1" ["InterVideo Inc."]
 

IviDVDEventHandler\

"Provider" = "InterVideo WinDVD 7"

"InvokeProgID" = "Ivi.MediaFile"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\DVD7\WinDVD.exe %1" ["InterVideo Inc."]
 

IviVideoCDHandler\

"Provider" = "InterVideo WinDVD 7"

"InvokeProgID" = "Ivi.MediaFile"

"InvokeVerb" = "play"

HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\DVD7\WinDVD.exe %1" ["InterVideo Inc."]
 

MSWPDShellNamespaceHandler\

"Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501"

"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"

"InitCmdLine" = " "

  -> {HKLM...CLSID} = "WPDShextAutoplay"

                   \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS]
 

NeroAutoPlay2CDAudio\

"Provider" = "Nero Express"

"InvokeProgID" = "Nero.AutoPlay2"

"InvokeVerb" = "HandleCDBurningOnArrival_CDAudio"

HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "C:\Programme\Ahead\nero\nero.exe /w /New:AudioCD /Drive:%L" ["Ahead Software AG"]
 

NeroAutoPlay2CopyCD\

"Provider" = "Nero Express"

"InvokeProgID" = "Nero.AutoPlay2"

"InvokeVerb" = "PlayCDAudioOnArrival_CopyCD"

HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_CopyCD\command\(Default) = "C:\Programme\Ahead\nero\nero.exe /w /Dialog:DiscCopy /Drive:%L" ["Ahead Software AG"]
 

NeroAutoPlay2DataDisc\

"Provider" = "Nero Express"

"InvokeProgID" = "Nero.AutoPlay2"

"InvokeVerb" = "HandleCDBurningOnArrival_DataDisc"

HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_DataDisc\command\(Default) = "C:\Programme\Ahead\nero\nero.exe /w /New:ISODisc /Drive:%L" ["Ahead Software AG"]
 

NeroAutoPlay2LaunchNeroStartSmart\

"Provider" = "Nero StartSmart"

"InvokeProgID" = "Nero.AutoPlay2"

"InvokeVerb" = "HandleCDBurningOnArrival_LaunchNeroStartSmart"

HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_LaunchNeroStartSmart\command\(Default) = "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart.exe /AutoPlay /Drive:%L" ["Ahead Software AG"]
 

PDVDPlayDVDMovieOnArrival\

"Provider" = "PowerDVD"

"InvokeProgID" = "DVD"

"InvokeVerb" = "PlayWithPowerDVD"

HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Programme\CyberLink DVD Solution\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."]
 

PPCDBurningOnArrival\

"Provider" = "PowerProducer"

"InvokeProgID" = "Picture"

"InvokeVerb" = "OpenWithPowerProducer"

HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerProducer\Command\(Default) = ""C:\Programme\CyberLink DVD Solution\PowerProducer\Producer.exe"" ["Cyberlink"]
 

PPDCameraArrival\

"Provider" = "PowerProducer"

"InvokeProgID" = "Picture"

"InvokeVerb" = "OpenWithPowerProducer"

HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerProducer\Command\(Default) = ""C:\Programme\CyberLink DVD Solution\PowerProducer\Producer.exe"" ["Cyberlink"]
 

PPDVArrival\

"Provider" = "PowerProducer"

"ProgID" = "Shell.HWEventHandlerShellExecute"

"InitCmdLine" = ""C:\Programme\CyberLink DVD Solution\PowerProducer\Producer.exe""

HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"

  -> {HKLM...CLSID} = "ShellExecute HW Event Handler"

                   \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]
 
 

Winsock2 Service Provider DLLs:

-------------------------------
 

Namespace Service Providers
 

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]
 

Transport Service Providers
 

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 24

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
 
 

Toolbars, Explorer Bars, Extensions:

------------------------------------
 

Toolbars
 

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

"{855F3B16-6D32-4FE6-8A56-BBB695989046}"

  -> {HKLM...CLSID} = "ICQToolBar"

                   \InProcServer32\(Default) = "C:\Programme\ICQ6Toolbar\ICQToolBar.dll" ["ICQ"]
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\

"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = "ICQToolBar"

  -> {HKLM...CLSID} = "ICQToolBar"

                   \InProcServer32\(Default) = "C:\Programme\ICQ6Toolbar\ICQToolBar.dll" ["ICQ"]
 

Extensions (Tools menu items, main toolbar menu buttons)
 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Konsole"

"CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}"

  -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]

  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07"

                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."]
 

{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\

"ButtonText" = "PartyPoker.com"

"MenuText" = "PartyPoker.com"

"Exec" = "C:\Programme\PartyGaming\PartyPoker\RunApp.exe" [empty string]
 

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\

"ButtonText" = "ICQ Lite"

"MenuText" = "ICQ Lite"

"Exec" = "C:\Programme\ICQLite\ICQLite.exe" [file not found]
 

{E2E2DD38-D088-4134-82B7-F2BA38496583}\

"MenuText" = "@xpsp3res.dll,-20001"

"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]
 

{E59EB121-F339-4851-A3BA-FE49C35617C2}\

"ButtonText" = "ICQ6"

"MenuText" = "ICQ6"

"Exec" = "C:\Programme\ICQ6\ICQ.exe" ["ICQ, Inc."]
 

{F4430FE8-2638-42E5-B849-800749B94EED}\

"ButtonText" = "PartyPoker.net"

"MenuText" = "PartyPoker.net"

"Exec" = "C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe" [file not found]
 

{FB5F1910-F110-11D2-BB9E-00C04F795683}\

"ButtonText" = "Messenger"

"MenuText" = "Windows Messenger"

"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]
 
 

Miscellaneous IE Hijack Points

------------------------------
 

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

<<H>> "{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided)

  -> {HKLM...CLSID} = "ICQToolBar"

                   \InProcServer32\(Default) = "C:\Programme\ICQ6Toolbar\ICQToolBar.dll" ["ICQ"]
 
 

Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------
 

Avira AntiVir Personal – Free Antivirus Guard, AntiVirService, ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"]

Avira AntiVir Personal – Free Antivirus Planer, AntiVirScheduler, ""C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"]

Canon Camera Access Library 8, CCALib8, "C:\Programme\Canon\CAL\CALMAIN.exe" ["Canon Inc."]

ICQ Service, ICQ Service, "C:\Programme\ICQ6Toolbar\ICQ Service.exe" [empty string]

InCD Helper, InCDsrv, "C:\Programme\Ahead\InCD\InCDsrv.exe" ["Nero AG"]

Machine Debug Manager, MDM, ""C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
 
 

Print Monitors:

---------------
 

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\

hpzsnt05\Driver = "hpzsnt05.dll" ["HP"]
 
 

---------- (launch time: 2008-08-23 12:38:27)

<<!>>: Suspicious data at a malware launch point.

<<H>>: Suspicious data at a browser hijack point.
 

+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

  launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

  DLL launch points, use the -supp parameter or answer "No" at the

  first message box and "Yes" at the second message box.

---------- (total run time: 131 seconds, including 14 seconds for message boxes)

Der wert von bootexecute stimmt...

Dir mal ein dickes Danke Schön!!!!

Kathi_87

24.08.2008 15:53

Gibt es denn wirklich keine lösung für mein Problem???:heulen:
ist denn der virus oder was auch immer weg wenn ich windows neu installiere?

cosinus

24.08.2008 16:59

Was ist denn noch überhaupt von den Symptomen da?

Kathi_87

25.08.2008 12:57

Das startmenü öffnet sich alle paar minuten von allein und dabei piepst der pc...die maus macht sich währendessen selbstständig und öffnet programme aus dem startmenü und schließt ordner oder ie die ich gerade nutze....

cosinus

25.08.2008 16:56

Tritt das nur auf wenn Du online bist?

Kathi_87

25.08.2008 18:46

hab das jetzt mal beobachtet...es tritt nicht auf wenn ich offline bin und auch nicht wenn ich online bin aber kein ie oder firefox benutze...erst wenn ich nen browser starte...
wenn das passiert rufe ich meistens den taskmanager auf und dann lässt es nach.
danach spinnt die maus manchmal noch:linksklick entspricht dann rechtsklick...

Kathi_87

28.08.2008 21:00

ich hab jetzt mal windows neu installiert und das gleiche problem mit dem startmenü und so tritt immer noch auf...
war seit der installation noch nicht online

cosinus

29.08.2008 13:25

Du hast komplett neuinstalliert? Inkl. Formatieren der Festplatte?

Kathi_87

29.08.2008 16:25

jepp inklusive formatieren

cosinus

29.08.2008 17:38

Schonmal Maus und Tastatur gewechselt? :uglyhammer:

Kathi_87

02.09.2008 18:21

hab jetzt mal die maus und die tastatur ausgetauscht....das problem is weg...der mauszeiger bewegt sich nur noch langsam von alleine...ist das normal?

cosinus

02.09.2008 18:54

Lass mich raten.... :confused:
Du hast ne optische Maus mit ner schlechten Unterlage... :killpc:

Kathi_87

03.09.2008 13:14

schlechte unterlage stimmt...besser gesagt gar keine:huepp:
optische maus???? hab eine mit kugel...

cosinus

03.09.2008 14:02

Dann nimm die Kugel mal raus und mach die drei Rollen sauber. Da sammelt sich sehr gerne Dreck an. :teufel2:

Alle Zeitangaben in WEZ +1. Es ist jetzt 00:49 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19