Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Pop Ups: Ron Ads (https://www.trojaner-board.de/62278-pop-ups-ron-ads.html)

Melissa22 17.10.2008 16:17
Pop Ups: Ron Ads
 
Hallo,

seit gestern öffnen sich bei mir Pop Up-Fenster, die den Titel "Ron Ads by offersfortoday" tragen. Interessanterweise als IE-Pop Ups, obwohl ich selbst FF verwende.

Nun habe ich Kaspersky durchlaufen lassen - hat nichts gefunden.
Auch Malwarebytes wurde nicht fündig.

Unter Hijackthis wurde ich dann fündig, die entsprechende Datei habe ich rot markiert:
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:00:52, on 17.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programme\gemeinsame dateien\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe
C:\Programme\Analog Devices\Core\smax4pnp.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Programme\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programme\Logitech\QuickCam10\QuickCam10.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
C:\WINDOWS\System32\regsvr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\LVComSX.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\Programme\TomTom HOME 2\HOMERunner.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MWLaMaS.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Java\jre1.5.0_06\bin\jucheck.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\PROGRA~1\T-Online\T-ONLI~1\Notifier\Notifier.exe
C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = h**p://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: offersfortoday browser enhancer - {9F5B0CA9-73C6-E6C3-E20C-9B584983C987} - C:\WINDOWS\system32\kqcurxdmdmqtq.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programme\HPQ\IAM\Bin\ItIeAddIN.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [HP Software Update] c:\Programme\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AAWTray] C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [umfhccocuwlemhlf] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\kqcurxdmdmqtq.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SB1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Programme\TomTom HOME 2\HOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [InfoCockpit] C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=h**p://www.hp.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - h**p://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: OneCard - C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O24 - Desktop Component 1: Anfy WATER - C:\Programme\AnfyTeam\Applet\water\preview.html

--
End of file - 11546 bytes
Löschen konnte ich sie nicht, da sie angeblich gerade verwendet wird.

Nach Angabe der Datei unter Virustotal bekam ich folgende Ergebnisse:
h**p://www.virustotal.com/de/analisis/1a8a784e0198f9879411be7063e7f40c

Jetzt weiß ich zwar sowohl, wo sich das Übel befindet (Hijack), als auch, dass da Sachen nicht stimmen (Virustotal), hab allerdings keine Ahnung wie ich diese bereinigen soll.

:headbang:

Kann mir jemand vielleicht einen Tipp geben?

myrtille 17.10.2008 16:34
Hi,

arbeite bitte Folgendes ab:
ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir das Tool hier herunter auf den Desktop -> KLICK
Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:
  • Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser. Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.
  • Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

lg myrtille

Melissa22 20.10.2008 22:17
Hallo myrtille,

vielen Dank für deinen Tipp.
Ich habe den Cleaner durchlaufen lassen und hier ist die Logfile von Combofix (da er zu lang ist, hab ich ihn in 2 Blöcke eingeteilt):

Code:
ComboFix 08-10-19.04 - *** 2008-10-20 22:33:32.2 - NTFSx86
Microsoft Windows XP Home Edition [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\***\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - WINDOWS: deleted 24 bytes in 1 streams.

(((((((((((((((((((((((  Dateien erstellt von 2008-09-20 bis 2008-10-20  ))))))))))))))))))))))))))))))
.

2008-10-20 22:22 . 2008-10-20 22:22        <DIR>        d--------        C:\Programme\CCleaner
2008-10-17 22:03 . 2008-10-17 23:05        <DIR>        d--------        C:\Programme\Trend Micro
2008-10-17 01:31 . 2008-10-17 01:31        79,085        --a------        C:\WINDOWS\system32\tqixfnorhzq.exe
2008-10-16 23:00 . 2008-10-16 23:00        268        --ah-----        C:\sqmdata03.sqm
2008-10-16 23:00 . 2008-10-16 23:00        244        --ah-----        C:\sqmnoopt03.sqm
2008-10-14 18:24 . 2008-10-14 18:24        171,520        ---------        C:\WINDOWS\system32\kqcurxdmdmqtq.dll
2008-10-13 20:01 . 2008-10-13 20:01        <DIR>        d--------        C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\T-Online
2008-10-13 03:54 . 2008-10-13 03:57        <DIR>        d--------        C:\WINDOWS\SxsCaPendDel
2008-10-13 03:30 . 2008-10-13 03:30        <DIR>        d--------        C:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org
2008-10-13 02:53 . 2008-10-13 03:51        <DIR>        d--------        C:\Programme\OpenOffice.org 3
2008-10-06 23:20 . 2008-10-06 23:20        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2008-10-06 20:33 . 2008-10-06 20:33        <DIR>        d--------        C:\Program Files
2008-10-06 20:31 . 1996-07-18 13:06        297,472        --a------        C:\WINDOWS\uninst.exe
2008-10-06 20:13 . 2008-10-06 20:39        96,976        --a------        C:\WINDOWS\system32\drivers\klin.dat
2008-10-06 20:13 . 2008-10-06 20:13        87,855        --a------        C:\WINDOWS\system32\drivers\klick.dat
2008-10-06 20:12 . 2008-10-06 20:12        <DIR>        d--------        C:\Programme\Kaspersky Lab
2008-10-06 20:12 . 2008-10-20 22:53        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2008-10-06 20:12 . 2008-10-20 22:49        2,709,536        --ahs----        C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-06 20:12 . 2008-10-20 22:49        434,208        --ahs----        C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-06 20:12 . 2008-10-20 22:49        23,296        --ahs----        C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-06 20:12 . 2008-10-20 22:49        2,564        --ahs----        C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-06 20:04 . 2008-10-06 20:04        <DIR>        d--------        C:\Programme\Kapersky Anti-Virus 2009
2008-10-06 12:34 . 2008-10-06 12:34        <DIR>        d--------        C:\Programme\AmoK_DelayDel_v1.20
2008-10-06 00:45 . 2008-10-06 00:45        <DIR>        d--------        C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AdobeUM
2008-10-05 21:57 . 2008-10-05 21:57        <DIR>        d--------        C:\Programme\Avira
2008-10-05 21:57 . 2008-10-06 20:07        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-10-05 20:45 . 2008-10-05 20:45        <DIR>        d--------        C:\Programme\Malwarebytes' Anti-Malware
2008-10-05 20:45 . 2008-10-05 20:45        <DIR>        d--------        C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
2008-10-05 20:45 . 2008-10-05 20:45        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-10-05 20:45 . 2008-09-10 00:04        38,528        --a------        C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-05 20:45 . 2008-09-10 00:03        17,200        --a------        C:\WINDOWS\system32\drivers\mbam.sys
2008-10-05 19:52 . 2008-10-06 01:48        <DIR>        d--------        C:\Programme\Enigma Software Group
2008-10-05 19:31 . 2008-10-05 19:31        164        --a------        C:\install.dat
2008-10-05 07:05 . 2008-10-06 20:07        <DIR>        d--------        C:\Programme\Spybot - Search & Destroy
2008-10-05 06:15 . 2008-10-05 06:36        <DIR>        d-a------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-09-25 18:55 . 2008-09-25 18:55        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
2008-09-25 18:31 . 2008-09-25 18:31        <DIR>        d--------        C:\Programme\S.A.D
2008-09-24 23:03 . 2008-09-24 23:03        <DIR>        d--------        C:\Programme\MSECache
2008-09-20 16:16 . 2008-10-08 22:51        <DIR>        d--------        C:\Dokumente und Einstellungen\***\Anwendungsdaten\Search Settings
2008-09-20 16:06 . 2001-03-23 16:29        880,912        --a------        C:\WINDOWS\WM8EUTIL.exe
2008-09-20 16:02 . 2008-09-20 16:03        <DIR>        d--------        C:\Programme\mp3DirectCut

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-20 13:13        1,839        ----a-w        C:\Programme\PCBIB.INI
2008-10-10 15:49        ---------        d-----w        C:\Programme\Gemeinsame Dateien\Marmiko Shared
2008-10-03 16:58        6,066,176        ------w        C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-25 16:30        ---------        d-----w        C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-09-18 22:03        ---------        d--h--w        C:\Programme\InstallShield
C:\WINDOWS\system32\win32k.sys
2008-09-15 15:37        1,846,144        ------w        C:\WINDOWS\system32\dllcache\win32k.sys
2008-08-28 10:04        333,056        ----a-w        C:\WINDOWS\system32\drivers\srv.sys
2008-08-28 10:04        333,056        ------w        C:\WINDOWS\system32\dllcache\srv.sys
2008-08-27 08:57        3,593,216        ------w        C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:38        13,824        ------w        C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-25 08:37        70,656        ------w        C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-23 05:56        635,848        ------w        C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54        161,792        ------w        C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-14 13:36        2,188,288        ------w        C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 13:36        2,065,280        ------w        C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 13:35        2,145,280        ----a-w        C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:35        2,145,280        ------w        C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 13:35        2,023,424        ----a-w        C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 13:35        2,023,424        ------w        C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-08-14 09:51        138,368        ------w        C:\WINDOWS\system32\dllcache\afd.sys
2008-07-29 18:21        218,376        ----a-w        C:\WINDOWS\system32\klogon.dll
2007-10-12 13:36        17,544,048        ----a-w        C:\Programme\setupger.exe
2007-05-01 17:21        6,615,736        ----a-w        C:\Programme\FirefoxGoogleToolbarSetup.exe
2007-04-20 07:36        496,888        ----a-w        C:\Programme\ie6setup.exe
2006-09-24 18:37        197,120        ----a-w        C:\Programme\lame.exe
2006-09-24 18:37        169,472        ----a-w        C:\Programme\lame_enc.dll
1997-08-10 15:09        1,310,208        ----a-w        C:\Programme\pc_bib2.exe
1997-07-28 16:21        327,354        ----a-w        C:\Programme\pcbib.hlp
1997-07-23 17:03        4,689        ----a-w        C:\Programme\pcbib.cnt
1997-03-20 14:15        9,216        ----a-w        C:\Programme\HotKDL32.dll
1996-07-19 11:32        33,792        ----a-w        C:\Programme\_ISREG32.DLL
.

(((((((((((((((((((((((((((((  snapshot@2008-10-08_23.36.21.57  )))))))))))))))))))))))))))))))))))))))))
.
- 2007-02-28 16:06:02        2,140,160        ----a-w        C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
+ 2008-08-14 13:35:13        2,145,280        ----a-w        C:\WINDOWS\Driver Cache\i386\ntkrnlmp.exe
- 2007-02-28 16:06:12        2,061,696        ----a-w        C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
+ 2008-08-14 13:36:00        2,065,280        ----a-w        C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
- 2007-02-28 16:06:01        2,019,840        ----a-w        C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
+ 2008-08-14 13:35:12        2,023,424        ----a-w        C:\WINDOWS\Driver Cache\i386\ntkrpamp.exe
- 2007-02-28 16:06:10        2,184,448        ----a-w        C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2008-08-14 13:36:00        2,188,288        ----a-w        C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
+ 2008-06-23 16:14:39        124,928        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\advpack.dll
+ 2008-06-23 16:14:40        347,136        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\dxtmsft.dll
+ 2008-06-23 16:14:40        214,528        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\dxtrans.dll
+ 2008-06-23 16:14:40        133,120        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\extmgr.dll
+ 2008-06-23 16:14:40        63,488        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\icardie.dll
+ 2008-06-23 09:20:01        70,656        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ie4uinit.exe
+ 2008-06-23 16:14:40        153,088        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ieakeng.dll
+ 2008-06-23 16:14:40        230,400        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ieaksie.dll
+ 2008-06-21 05:23:54        161,792        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ieakui.dll
+ 2008-06-23 16:14:40        383,488        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ieapfltr.dll
+ 2008-06-23 16:14:40        384,512        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\iedkcs32.dll
+ 2008-06-23 16:14:41        6,066,176        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ieframe.dll
+ 2008-06-23 16:14:41        44,544        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\iernonce.dll
+ 2008-06-23 16:14:42        267,776        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\iertutil.dll
+ 2008-06-23 09:20:26        13,824        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\ieudinit.exe
+ 2008-06-23 09:20:25        625,664        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
+ 2008-06-23 16:14:42        27,648        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\jsproxy.dll
+ 2008-06-23 16:14:42        459,264        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\msfeeds.dll
+ 2008-06-23 16:14:42        52,224        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\msfeedsbs.dll
+ 2008-06-24 08:14:44        3,592,192        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\mshtml.dll
+ 2008-06-23 16:14:44        477,696        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\mshtmled.dll
+ 2008-06-23 16:14:44        193,024        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\msrating.dll
+ 2008-06-23 16:14:44        671,232        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\mstime.dll
+ 2008-06-23 16:14:44        102,912        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\occache.dll
+ 2008-06-23 16:14:44        44,544        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\pngfilt.dll
+ 2007-03-06 01:14:17        217,312        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:15:25        377,568        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\updspapi.dll
+ 2008-06-23 16:14:44        105,984        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\url.dll
+ 2008-06-23 16:14:44        1,159,680        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\urlmon.dll
+ 2008-06-23 16:14:44        233,472        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\webcheck.dll
+ 2008-06-23 16:14:45        826,368        -c----w        C:\WINDOWS\ie7updates\KB956390-IE7\wininet.dll
- 2008-06-23 16:14:39        124,928        ----a-w        C:\WINDOWS\system32\advpack.dll
+ 2008-08-26 07:57:14        124,928        ----a-w        C:\WINDOWS\system32\advpack.dll
- 2008-06-23 16:14:39        124,928        ------w        C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-08-26 07:57:14        124,928        ------w        C:\WINDOWS\system32\dllcache\advpack.dll
- 2008-06-23 16:14:40        347,136        ------w        C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-08-26 07:57:15        347,136        ------w        C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-06-23 16:14:40        214,528        ------w        C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-08-26 07:57:15        214,528        ------w        C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-06-23 16:14:40        133,120        ------w        C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-08-26 07:57:15        133,120        ------w        C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-06-23 16:14:40        63,488        ------w        C:\WINDOWS\system32\dllcache\icardie.dll
+ 2008-08-26 07:57:15        63,488        ------w        C:\WINDOWS\system32\dllcache\icardie.dll
- 2008-06-23 16:14:40        153,088        ------w        C:\WINDOWS\system32\dllcache\ieakeng.dll
+ 2008-08-26 07:57:15        153,088        ------w        C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2008-06-23 16:14:40        230,400        ------w        C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2008-08-26 07:57:15        230,400        ------w        C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2008-06-23 16:14:40        383,488        ------w        C:\WINDOWS\system32\dllcache\ieapfltr.dll
+ 2008-08-26 07:57:15        383,488        ------w        C:\WINDOWS\system32\dllcache\ieapfltr.dll
- 2008-06-23 16:14:40        384,512        ------w        C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2008-08-26 07:57:15        384,512        ------w        C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2008-06-23 16:14:41        44,544        ------w        C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2008-08-26 07:57:18        44,544        ------w        C:\WINDOWS\system32\dllcache\iernonce.dll
- 2008-06-23 16:14:42        267,776        ------w        C:\WINDOWS\system32\dllcache\iertutil.dll
+ 2008-08-26 07:57:18        267,776        ------w        C:\WINDOWS\system32\dllcache\iertutil.dll
- 2008-06-23 16:14:42        27,648        ------w        C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-08-26 07:57:18        27,648        ------w        C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-06-23 16:14:42        459,264        ------w        C:\WINDOWS\system32\dllcache\msfeeds.dll
+ 2008-08-26 07:57:19        459,264        ------w        C:\WINDOWS\system32\dllcache\msfeeds.dll
- 2008-06-23 16:14:42        52,224        ------w        C:\WINDOWS\system32\dllcache\msfeedsbs.dll
+ 2008-08-26 07:57:19        52,224        ------w        C:\WINDOWS\system32\dllcache\msfeedsbs.dll
- 2008-06-23 16:14:44        477,696        ------w        C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-08-26 07:57:21        477,696        ------w        C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-06-23 16:14:44        193,024        ------w        C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-08-26 07:57:21        193,024        ------w        C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-06-23 16:14:44        671,232        ------w        C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-08-26 07:57:21        671,232        ------w        C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-06-23 16:14:44        102,912        ------w        C:\WINDOWS\system32\dllcache\occache.dll
+ 2008-08-26 07:57:21        102,912        ------w        C:\WINDOWS\system32\dllcache\occache.dll
- 2008-06-23 16:14:44        44,544        ------w        C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-08-26 07:57:21        44,544        ------w        C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2008-06-23 16:14:44        105,984        ------w        C:\WINDOWS\system32\dllcache\url.dll
+ 2008-08-26 07:57:21        105,984        ------w        C:\WINDOWS\system32\dllcache\url.dll
- 2008-06-23 16:14:44        1,159,680        ------w        C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-08-26 07:57:22        1,159,680        ------w        C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-06-23 16:14:44        233,472        ------w        C:\WINDOWS\system32\dllcache\webcheck.dll
+ 2008-08-26 07:57:22        233,472        ------w        C:\WINDOWS\system32\dllcache\webcheck.dll
- 2008-06-23 16:14:45        826,368        ------w        C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-08-26 07:57:22        826,368        ------w        C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-06-20 10:44:38        138,368        ----a-w        C:\WINDOWS\system32\drivers\afd.sys
+ 2008-08-14 09:51:43        138,368        ----a-w        C:\WINDOWS\system32\drivers\afd.sys
- 2008-06-23 16:14:40        347,136        ----a-w        C:\WINDOWS\system32\dxtmsft.dll
+ 2008-08-26 07:57:15        347,136        ----a-w        C:\WINDOWS\system32\dxtmsft.dll
- 2008-06-23 16:14:40        214,528        ----a-w        C:\WINDOWS\system32\dxtrans.dll
+ 2008-08-26 07:57:15        214,528        ----a-w        C:\WINDOWS\system32\dxtrans.dll
- 2008-06-23 16:14:40        133,120        ------w        C:\WINDOWS\system32\extmgr.dll
+ 2008-08-26 07:57:15        133,120        ------w        C:\WINDOWS\system32\extmgr.dll
- 2008-09-25 09:56:04        194,568        ----a-w        C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-10-15 20:50:03        212,080        ----a-w        C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-06-23 16:14:40        63,488        ----a-w        C:\WINDOWS\system32\icardie.dll
+ 2008-08-26 07:57:15        63,488        ----a-w        C:\WINDOWS\system32\icardie.dll
- 2008-06-23 09:20:01        70,656        ------w        C:\WINDOWS\system32\ie4uinit.exe
+ 2008-08-25 08:37:31        70,656        ------w        C:\WINDOWS\system32\ie4uinit.exe
- 2008-06-23 16:14:40        153,088        ------w        C:\WINDOWS\system32\ieakeng.dll
+ 2008-08-26 07:57:15        153,088        ------w        C:\WINDOWS\system32\ieakeng.dll
- 2008-06-23 16:14:40        230,400        ------w        C:\WINDOWS\system32\ieaksie.dll
+ 2008-08-26 07:57:15        230,400        ------w        C:\WINDOWS\system32\ieaksie.dll
- 2008-06-21 05:23:54        161,792        ------w        C:\WINDOWS\system32\ieakui.dll
+ 2008-08-23 05:54:51        161,792        ------w        C:\WINDOWS\system32\ieakui.dll
- 2008-06-23 16:14:40        383,488        ----a-w        C:\WINDOWS\system32\ieapfltr.dll
+ 2008-08-26 07:57:15        383,488        ----a-w        C:\WINDOWS\system32\ieapfltr.dll
- 2008-06-23 16:14:40        384,512        ------w        C:\WINDOWS\system32\iedkcs32.dll
+ 2008-08-26 07:57:15        384,512        ------w        C:\WINDOWS\system32\iedkcs32.dll
- 2008-06-23 16:14:41        6,066,176        ----a-w        C:\WINDOWS\system32\ieframe.dll
+ 2008-10-03 16:58:14        6,066,176        ----a-w        C:\WINDOWS\system32\ieframe.dll
- 2008-06-23 16:14:41        44,544        ------w        C:\WINDOWS\system32\iernonce.dll
+ 2008-08-26 07:57:18        44,544        ------w        C:\WINDOWS\system32\iernonce.dll
- 2008-06-23 16:14:42        267,776        ----a-w        C:\WINDOWS\system32\iertutil.dll
+ 2008-08-26 07:57:18        267,776        ----a-w        C:\WINDOWS\system32\iertutil.dll
- 2008-06-23 09:20:26        13,824        ----a-w        C:\WINDOWS\system32\ieudinit.exe
+ 2008-08-25 08:38:00        13,824        ----a-w        C:\WINDOWS\system32\ieudinit.exe
- 2008-06-23 16:14:42        27,648        ------w        C:\WINDOWS\system32\jsproxy.dll
+ 2008-08-26 07:57:18        27,648        ------w        C:\WINDOWS\system32\jsproxy.dll
- 2008-08-26 11:28:14        16,208,504        ----a-w        C:\WINDOWS\system32\MRT.exe
+ 2008-10-07 19:19:40        16,721,856        ----a-w        C:\WINDOWS\system32\MRT.exe
- 2008-06-23 16:14:42        459,264        ----a-w        C:\WINDOWS\system32\msfeeds.dll
+ 2008-08-26 07:57:19        459,264        ----a-w        C:\WINDOWS\system32\msfeeds.dll
- 2008-06-23 16:14:42        52,224        ----a-w        C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-08-26 07:57:19        52,224        ----a-w        C:\WINDOWS\system32\msfeedsbs.dll
- 2008-06-24 08:14:44        3,592,192        ----a-w        C:\WINDOWS\system32\mshtml.dll
+ 2008-08-27 08:57:22        3,593,216        ----a-w        C:\WINDOWS\system32\mshtml.dll
- 2008-06-23 16:14:44        477,696        ------w        C:\WINDOWS\system32\mshtmled.dll
+ 2008-08-26 07:57:21        477,696        ------w        C:\WINDOWS\system32\mshtmled.dll
- 2008-06-23 16:14:44        193,024        ------w        C:\WINDOWS\system32\msrating.dll
+ 2008-08-26 07:57:21        193,024        ------w        C:\WINDOWS\system32\msrating.dll
- 2008-06-23 16:14:44        671,232        ------w        C:\WINDOWS\system32\mstime.dll
+ 2008-08-26 07:57:21        671,232        ------w        C:\WINDOWS\system32\mstime.dll
- 2008-06-23 16:14:44        102,912        ------w        C:\WINDOWS\system32\occache.dll
+ 2008-08-26 07:57:21        102,912        ------w        C:\WINDOWS\system32\occache.dll
- 2008-10-05 04:18:32        77,302        ----a-w        C:\WINDOWS\system32\perfc007.dat
+ 2008-10-10 18:49:12        77,302        ----a-w        C:\WINDOWS\system32\perfc007.dat
- 2008-10-05 04:18:33        63,862        ----a-w        C:\WINDOWS\system32\perfc009.dat
+ 2008-10-10 18:49:12        63,862        ----a-w        C:\WINDOWS\system32\perfc009.dat
- 2008-10-05 04:18:32        422,192        ----a-w        C:\WINDOWS\system32\perfh007.dat
+ 2008-10-10 18:49:12        422,192        ----a-w        C:\WINDOWS\system32\perfh007.dat
- 2008-10-05 04:18:33        406,662        ----a-w        C:\WINDOWS\system32\perfh009.dat
+ 2008-10-10 18:49:12        406,662        ----a-w        C:\WINDOWS\system32\perfh009.dat
- 2008-06-23 16:14:44        44,544        ----a-w        C:\WINDOWS\system32\pngfilt.dll
+ 2008-08-26 07:57:21        44,544        ----a-w        C:\WINDOWS\system32\pngfilt.dll
- 2007-11-30 12:39:14        18,808        ------w        C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:18:34        18,808        ------w        C:\WINDOWS\system32\spmsg.dll
- 2008-06-23 16:14:44        105,984        ----a-w        C:\WINDOWS\system32\url.dll
+ 2008-08-26 07:57:21        105,984        ----a-w        C:\WINDOWS\system32\url.dll
- 2008-06-23 16:14:44        1,159,680        ----a-w        C:\WINDOWS\system32\urlmon.dll
+ 2008-08-26 07:57:22        1,159,680        ----a-w        C:\WINDOWS\system32\urlmon.dll
- 2008-06-23 16:14:44        233,472        ----a-w        C:\WINDOWS\system32\webcheck.dll
+ 2008-08-26 07:57:22        233,472        ----a-w        C:\WINDOWS\system32\webcheck.dll
- 2008-06-23 16:14:45        826,368        ----a-w        C:\WINDOWS\system32\wininet.dll
+ 2008-08-26 07:57:22        826,368        ----a-w        C:\WINDOWS\system32\wininet.dll
.

Melissa22 20.10.2008 22:18
Hier nun der zweite Teil der Combofix-Auswertung:

Code:
-- Snapshot auf jetziges Datum zurückgesetzt --
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9F5B0CA9-73C6-E6C3-E20C-9B584983C987}]
2008-10-14 18:24        171520        ---------        C:\WINDOWS\system32\kqcurxdmdmqtq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 180736]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Programme\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"PTHOSTTR"="C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-02-14 122880]
"HP Software Update"="c:\Programme\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-31 122940]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]
"hpWirelessAssistant"="C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-03-28 454656]
"CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [2003-12-22 17920]
"QlbCtrl"="C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072]
"Cpqset"="C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe" [2006-04-21 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-20 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-03-09 806912]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 892928]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-04-06 185896]
"AAWTray"="C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 88024]
"LogitechCommunicationsManager"="C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984]
"LogitechQuickCamRibbon"="C:\Programme\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 774168]
"ToADiMon.exe"="C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2007-02-15 282624]
"umfhccocuwlemhlf"="C:\WINDOWS\system32\kqcurxdmdmqtq.dll" [2008-10-14 171520]
"AVP"="C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
"InfoCockpit"="C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-07-30 176128]
"T-Online_Software_6\WLAN-Access Finder"="C:\Programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Logitech Desktop Messenger.lnk - C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-05-08 67128]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= C:\Programme\AnfyTeam\Applet\water\preview.html
FriendlyName= Anfy WATER

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2005-07-25 20:41 40960 C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
2006-03-03 17:08 434176 C:\WINDOWS\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli AsWlnPkg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"NSCService"=2 (0x2)
"navapsvc"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=3 (0x3)
"SAVScan"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=
"C:\\Programme\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R1 PersonalSecureDrive;PersonalSecureDrive;C:\WINDOWS\system32\drivers\psd.sys [2005-11-29 36768]
R2 ASChannel;Lokaler Verbindungskanal;C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [2007-01-09 61440]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-10-21 36352]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 uscsc108;uscsc108;C:\WINDOWS\system32\DRIVERS\uscsc108.sys [2003-03-09 102336]
S0 osltx;oslt;C:\WINDOWS\system32\DRIVERS\osltx.sys [ ]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe [ ]
S3 ATMELFVNETusb(AR)(R);ATMEL FVNETusb(AR)(R) Service for Siemens Gigaset USB Adapter 11;C:\WINDOWS\system32\DRIVERS\vnetusbk.sys [ ]
S3 ATMELWinXPPCMCIAFVNETR(458AS)(R);ATMEL WinXP PCMCIAFVNETR(458AS)(R) Service for Siemens Gigaset PC Card 11;C:\WINDOWS\system32\DRIVERS\f458as51.sys [ ]
S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [2006-10-04 17280]
S3 MIINPazX;MIINPazX NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [2006-10-09 17152]
S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 17536]
S3 PCMCIAFVNETR;Siemens Gigaset PC Card 11;C:\WINDOWS\system32\DRIVERS\fvnetr.sys [ ]
S3 PONDIS5;PONDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\PONDIS5.SYS [ ]
S3 scramby_out;Scramby Output;C:\WINDOWS\system32\drivers\scramby_out.sys [2007-08-08 23840]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [ ]
S3 SiemensSiemensGigUSB(5A)(R);Siemens SiemensGigUSB(5A)(R) Service for Siemens Gigaset USB Adapter 11;C:\WINDOWS\system32\DRIVERS\vn5a8asx.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance        REG_MULTI_SZ          ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0edb2364-c932-11dc-80af-0017083ac5e2}]
\shell\verb1\command - F:\desktop.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b582fda-e31e-11db-be28-0001e340fec2}]
\shell\verb1\command - F:\desktop.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a97a24e-85a3-11dd-8262-0014a5cab6d3}]
\shell\verb1\command - F:\desktop.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6e830b8-e5e3-11db-be2e-0017083ac5e2}]
\shell\verb1\command - desktop.exe
.
Inhalt des "geplante Tasks" Ordners

2008-10-17 C:\WINDOWS\Tasks\1-Klick-Wartung.job
- C:\Programme\TuneUp Utilities 2006\SystemOptimizer.exe [2005-08-24 02:29]

2008-10-20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Programme\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2008-10-20 C:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
- C:\Programme\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
.
------- Zusätzlicher Suchlauf -------
.
FireFox -: Profile - C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\2vcci3j4.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-20 22:53:35
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe??@?????????????,?@?????xc??????R?@?????,?@

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere laufende Prozesse ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programme\HPQ\IAM\Bin\asghost.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programme\Windows Media Player\wmpnetwk.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\regsvr32.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\LVComSX.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-10-20 23:00:43 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2008-10-20 21:00:14
ComboFix2.txt  2008-10-08 21:38:21
Vor Suchlauf: 24 Verzeichnis(se), 25.550.471.168 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 25,532,669,952 Bytes frei
418        --- E O F ---        2008-10-15 20:46:15

myrtille 20.10.2008 22:25
Hi,


Lade diese Datei bitte mal bei virustotal hoch:
Zitat:
C:\WINDOWS\system32\tqixfnorhzq.exe
C:\WINDOWS\system32\kqcurxdmdmqtq.dll
lg myrtille

Melissa22 21.10.2008 20:55
Wenn ich die Dateien bei Virustotal hochlade, erscheint bei beiden die Meldung, dass sie bereits analysiert wurden.

h**://www.virustotal.com/de/reanalisis.html?cdb38741e714cbe463fd516a9741e15c
h**p://www.virustotal.com/de/reanalisis.html?0c35ceea39bb0abfff737bce680096af

myrtille 21.10.2008 21:27
Hi,

danke, das war das was ich sehen wollte. :)
Mache nun bitte das folgende:
Scripten mit Combofix

  • Öffne den Editor ( Start -> Zubehör -> Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:
file::
C:\WINDOWS\system32\tqixfnorhzq.exe
C:\WINDOWS\system32\kqcurxdmdmqtq.dll
Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt
  • Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!
http://users.pandora.be/bluepatchy/m...s/CFScript.gif
  • Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten


Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann

Berichte auch wie es deinem Rechner jetzt geht.

lg myrtille

Melissa22 22.10.2008 17:43
Hier die Combofix-Auswertung:
Code:
ComboFix 08-10-19.04 - ***2008-10-22 18:21:33.3 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1031.18.108 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\***\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: C:\Dokumente und Einstellungen\***\Desktop\cfscript.txt
 * Neuer Wiederherstellungspunkt wurde erstellt

FILE ::
C:\WINDOWS\system32\kqcurxdmdmqtq.dll
C:\WINDOWS\system32\tqixfnorhzq.exe
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\kqcurxdmdmqtq.dll
C:\WINDOWS\system32\tqixfnorhzq.exe

.
(((((((((((((((((((((((  Dateien erstellt von 2008-09-22 bis 2008-10-22  ))))))))))))))))))))))))))))))
.

2008-10-20 22:22 . 2008-10-20 22:22        <DIR>        d--------        C:\Programme\CCleaner
2008-10-17 22:03 . 2008-10-21 05:30        <DIR>        d--------        C:\Programme\Free Music Zilla
2008-10-17 22:03 . 2008-10-21 01:28        <DIR>        d--------        C:\downloads
2008-10-17 22:03 . 2008-10-17 22:05        <DIR>        d--------        C:\Dokumente und Einstellungen\***\Anwendungsdaten\FMZilla
2008-10-17 06:38 . 2008-10-17 06:38        <DIR>        d--------        C:\Programme\Trend Micro
2008-10-16 23:00 . 2008-10-16 23:00        268        --ah-----        C:\sqmdata03.sqm
2008-10-16 23:00 . 2008-10-16 23:00        244        --ah-----        C:\sqmnoopt03.sqm
2008-10-13 20:01 . 2008-10-13 20:01        <DIR>        d--------        C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\T-Online
2008-10-13 03:54 . 2008-10-13 03:57        <DIR>        d--------        C:\WINDOWS\SxsCaPendDel
2008-10-13 03:30 . 2008-10-13 03:30        <DIR>        d--------        C:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org
2008-10-13 02:53 . 2008-10-13 03:51        <DIR>        d--------        C:\Programme\OpenOffice.org 3
2008-10-06 23:20 . 2008-10-06 23:20        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2008-10-06 20:33 . 2008-10-06 20:33        <DIR>        d--------        C:\Program Files
2008-10-06 20:31 . 1996-07-18 13:06        297,472        --a------        C:\WINDOWS\uninst.exe
2008-10-06 20:13 . 2008-10-06 20:39        96,976        --a------        C:\WINDOWS\system32\drivers\klin.dat
2008-10-06 20:13 . 2008-10-06 20:13        87,855        --a------        C:\WINDOWS\system32\drivers\klick.dat
2008-10-06 20:12 . 2008-10-06 20:12        <DIR>        d--------        C:\Programme\Kaspersky Lab
2008-10-06 20:12 . 2008-10-22 17:13        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2008-10-06 20:12 . 2008-10-22 18:28        2,709,536        --ahs----        C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-06 20:12 . 2008-10-22 18:28        434,208        --ahs----        C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-06 20:12 . 2008-10-22 18:28        23,296        --ahs----        C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-06 20:12 . 2008-10-22 18:28        2,564        --ahs----        C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-06 20:04 . 2008-10-06 20:04        <DIR>        d--------        C:\Programme\Kapersky Anti-Virus 2009
2008-10-06 12:34 . 2008-10-06 12:34        <DIR>        d--------        C:\Programme\AmoK_DelayDel_v1.20
2008-10-06 00:45 . 2008-10-06 00:45        <DIR>        d--------        C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\AdobeUM
2008-10-05 21:57 . 2008-10-05 21:57        <DIR>        d--------        C:\Programme\Avira
2008-10-05 21:57 . 2008-10-06 20:07        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-10-05 20:45 . 2008-10-05 20:45        <DIR>        d--------        C:\Programme\Malwarebytes' Anti-Malware
2008-10-05 20:45 . 2008-10-05 20:45        <DIR>        d--------        C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
2008-10-05 20:45 . 2008-10-05 20:45        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-10-05 20:45 . 2008-09-10 00:04        38,528        --a------        C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-05 20:45 . 2008-09-10 00:03        17,200        --a------        C:\WINDOWS\system32\drivers\mbam.sys
2008-10-05 19:52 . 2008-10-06 01:48        <DIR>        d--------        C:\Programme\Enigma Software Group
2008-10-05 19:31 . 2008-10-05 19:31        164        --a------        C:\install.dat
2008-10-05 07:05 . 2008-10-06 20:07        <DIR>        d--------        C:\Programme\Spybot - Search & Destroy
2008-10-05 06:15 . 2008-10-05 06:36        <DIR>        d-a------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-09-25 18:55 . 2008-09-25 18:55        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
2008-09-25 18:31 . 2008-09-25 18:31        <DIR>        d--------        C:\Programme\S.A.D
2008-09-24 23:03 . 2008-09-24 23:03        <DIR>        d--------        C:\Programme\MSECache

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-21 03:37        1,841        ----a-w        C:\Programme\PCBIB.INI
2008-10-10 15:49        ---------        d-----w        C:\Programme\Gemeinsame Dateien\Marmiko Shared
2008-10-08 20:51        ---------        d-----w        C:\Dokumente und Einstellungen\***\Anwendungsdaten\Search Settings
2008-09-25 16:30        ---------        d-----w        C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-09-20 14:03        ---------        d-----w        C:\Programme\mp3DirectCut
2008-09-18 22:03        ---------        d--h--w        C:\Programme\InstallShield Installation Information
2008-09-18 17:22        ---------        d-----w        C:\Dokumente und Einstellungen\***\Anwendungsdaten\TomTom
2008-09-18 17:21        ---------        d-----w        C:\Programme\TomTom HOME 2
2008-09-18 17:21        ---------        d-----w        C:\Programme\TomTom HOME
2008-09-17 16:35        ---------        d-----w        C:\Programme\HyCam2
2008-08-28 10:04        333,056        ----a-w        C:\WINDOWS\system32\drivers\srv.sys
2008-02-16 00:43        223,744        ----a-w        C:\Programme\MySpace Music Downloader.exe
2007-10-12 13:36        17,544,048        ----a-w        C:\Programme\setupger.exe
2007-05-01 17:21        6,615,736        ----a-w        C:\Programme\FirefoxGoogleToolbarSetup.exe
2007-04-20 07:36        496,888        ----a-w        C:\Programme\ie6setup.exe
2006-09-24 18:37        197,120        ----a-w        C:\Programme\lame.exe
2006-09-24 18:37        169,472        ----a-w        C:\Programme\lame_enc.dll
1997-08-10 15:09        1,310,208        ----a-w        C:\Programme\pc_bib2.exe
1997-07-28 16:21        327,354        ----a-w        C:\Programme\pcbib.hlp
1997-07-23 17:03        4,689        ----a-w        C:\Programme\pcbib.cnt
1997-03-20 14:15        9,216        ----a-w        C:\Programme\HotKDL32.dll
1996-07-19 11:32        33,792        ----a-w        C:\Programme\_ISREG32.DLL
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"EPSON Stylus DX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE" [2007-03-01 180736]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"TomTomHOME.exe"="C:\Programme\TomTom HOME 2\HOMERunner.exe" [2008-05-06 202088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Programme\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"PTHOSTTR"="C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-02-14 122880]
"HP Software Update"="c:\Programme\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-31 122940]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]
"hpWirelessAssistant"="C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-03-28 454656]
"CognizanceTS"="C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll" [2003-12-22 17920]
"QlbCtrl"="C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-23 131072]
"Cpqset"="C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe" [2006-04-21 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-20 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-03-09 806912]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 892928]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-04-06 185896]
"AAWTray"="C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 88024]
"LogitechCommunicationsManager"="C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984]
"LogitechQuickCamRibbon"="C:\Programme\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 774168]
"ToADiMon.exe"="C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2007-02-15 282624]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
"InfoCockpit"="C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-07-30 176128]
"T-Online_Software_6\WLAN-Access Finder"="C:\Programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Logitech Desktop Messenger.lnk - C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-05-08 67128]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= C:\Programme\AnfyTeam\Applet\water\preview.html
FriendlyName= Anfy WATER

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2005-07-25 20:41 40960 C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
2006-03-03 17:08 434176 C:\WINDOWS\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli AsWlnPkg

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"NSCService"=2 (0x2)
"navapsvc"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=3 (0x3)
"SAVScan"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=
"C:\\Programme\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R1 PersonalSecureDrive;PersonalSecureDrive;C:\WINDOWS\system32\drivers\psd.sys [2005-11-29 36768]
R2 ASChannel;Lokaler Verbindungskanal;C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [2007-01-09 61440]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-10-21 36352]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 uscsc108;uscsc108;C:\WINDOWS\system32\DRIVERS\uscsc108.sys [2003-03-09 102336]
S0 osltx;oslt;C:\WINDOWS\system32\DRIVERS\osltx.sys [ ]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe [ ]
S3 ATMELFVNETusb(AR)(R);ATMEL FVNETusb(AR)(R) Service for Siemens Gigaset USB Adapter 11;C:\WINDOWS\system32\DRIVERS\vnetusbk.sys [ ]
S3 ATMELWinXPPCMCIAFVNETR(458AS)(R);ATMEL WinXP PCMCIAFVNETR(458AS)(R) Service for Siemens Gigaset PC Card 11;C:\WINDOWS\system32\DRIVERS\f458as51.sys [ ]
S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [2006-10-04 17280]
S3 MIINPazX;MIINPazX NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [2006-10-09 17152]
S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 17536]
S3 PCMCIAFVNETR;Siemens Gigaset PC Card 11;C:\WINDOWS\system32\DRIVERS\fvnetr.sys [ ]
S3 PONDIS5;PONDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\PONDIS5.SYS [ ]
S3 scramby_out;Scramby Output;C:\WINDOWS\system32\drivers\scramby_out.sys [2007-08-08 23840]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [ ]
S3 SiemensSiemensGigUSB(5A)(R);Siemens SiemensGigUSB(5A)(R) Service for Siemens Gigaset USB Adapter 11;C:\WINDOWS\system32\DRIVERS\vn5a8asx.sys [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance        REG_MULTI_SZ          ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0edb2364-c932-11dc-80af-0017083ac5e2}]
\shell\verb1\command - F:\desktop.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b582fda-e31e-11db-be28-0001e340fec2}]
\shell\verb1\command - F:\desktop.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a97a24e-85a3-11dd-8262-0014a5cab6d3}]
\shell\verb1\command - F:\desktop.exe
.
Inhalt des "geplante Tasks" Ordners

2008-10-17 C:\WINDOWS\Tasks\1-Klick-Wartung.job
- C:\Programme\TuneUp Utilities 2006\SystemOptimizer.exe [2005-08-24 02:29]

2008-10-20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Programme\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2008-10-22 C:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
- C:\Programme\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{9F5B0CA9-73C6-E6C3-E20C-9B584983C987} - C:\WINDOWS\system32\kqcurxdmdmqtq.dll
HKLM-Run-umfhccocuwlemhlf - C:\WINDOWS\system32\kqcurxdmdmqtq.dll



**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, h**p://www.gmer.net
Rootkit scan 2008-10-22 18:30:16
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Cpqset = C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe??@?????????????,?@?????xc??????R?@?????,?@

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere laufende Prozesse ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programme\HPQ\IAM\Bin\asghost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programme\Windows Media Player\wmpnetwk.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\LVComSX.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-10-22 18:34:20 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2008-10-22 16:34:11
ComboFix2.txt  2008-10-20 21:00:49
ComboFix3.txt  2008-10-08 21:38:21

Vor Suchlauf: 24 Verzeichnis(se), 25.399.918.592 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 25,400,188,928 Bytes frei

232        --- E O F ---        2008-10-15 20:46:15
Bevor ich diesen Combofix-Durchgang gestartet habe, tauchten die Pop Ups noch auf; mal sehen, wie es jetzt wird.

myrtille 22.10.2008 17:47
Hi,

das sieht eigentlich ganz gut aus.

Beobachte bitte wie es weitergeht und melde auf jedenfall falls wieder popups auftauchen sollten.

Erstelle bitte auch ein neues Hijackthislogfile und poste es hier.

lg myrtille

Melissa22 23.10.2008 14:51
Hier die neue Hijackthis-File:
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:47:21, on 23.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programme\gemeinsame dateien\logishrd\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe
C:\Programme\Analog Devices\Core\smax4pnp.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Programme\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programme\Logitech\QuickCam10\QuickCam10.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\Programme\TomTom HOME 2\HOMERunner.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\LVComSX.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MWLaMaS.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\PROGRA~1\T-Online\T-ONLI~1\Notifier\Notifier.exe
C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = h**p://go.microsoft.com/fwlink/?LinkId=54843
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programme\HPQ\IAM\Bin\ItIeAddIN.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [PTHOSTTR] C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [HP Software Update] c:\Programme\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll,RegisterModule
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AAWTray] C:\Programme\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SB1.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Programme\TomTom HOME 2\HOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [InfoCockpit] C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=h**p://www.hp.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - h**p://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: OneCard - C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O24 - Desktop Component 1: Anfy WATER - C:\Programme\AnfyTeam\Applet\water\preview.html

--
End of file - 11318 bytes

Heute war ich zwar nur kurz im Netz, aber es ist bis jetzt noch kein Pop Up aufgetaucht. Falls es nochmal passieren sollte, melde ich mich.

Vielen lieben Dank für deine Hilfe.
:dankeschoen:

myrtille 24.10.2008 01:12
Hi,

Deinstalliere bitte Combofix in dem du unter Start->Ausführen-> "%userprofile%\Desktop\Combofix.exe" /u eingibst.

Besuche bitte mit dem Internet Explorer die Seite Microsoft Windows Update und installiere alle fehlenden Updates.
Besuche vielleicht noch Secunia und überprüfe bitte ob deine Software aktuell ist. (Dazu wird Java benötigt)
lg myrtille

IffI 19.11.2008 18:14
Hi,
ich habe eben das Forum entdeckt und gesehen, dass manche das selbe Problem haben wie ich, z.B. mit dem "Ron ads...."!

Wer kann mir dies bezüglich weiter helfen?


Liebe Grüße
IffI


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:23 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27