Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Browser - Links werden auf Werbeseiten umgeleitet (https://www.trojaner-board.de/75353-browser-links-werbeseiten-umgeleitet.html)

Eiscube 16.07.2009 10:29
Browser - Links werden auf Werbeseiten umgeleitet
 
Hallo werte Community.... hab wohl meinen PC infiziert.

Es war eine .exe-Datei die beim Anklicken verschwand und 5 Minuten später meinen PC neustartete.

Bisher konnte ich keine "Anomalien" erkennen, bis auf die Browser FF und IE. Suche ich zum Beispiel etwas bei Google und klicke daraufhin bei den Suchergebnissen einen Link an, werde ich sofort weitergeleitet an Werbeseiten. Klicke ich auf "zurück", springt der Brwoser wieder auf die Werbeseite zurück.

HiJack:
Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:16, on 16.07.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Programme\Mozilla Firefox\firefox.exe
E:\Downloads\HiJackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 2651 bytes

handball10 16.07.2009 11:44
Hi Eiscube und :hallo:

downloade dir bitte folgende Programme:

Poste bitte alle anfallenden Logfiles.

Gruß
Handball10

Eiscube 16.07.2009 16:13
Danke für die recht rasche Antwort! :)

Hier die Files:

rsit:
INFO
Code:
info.txt logfile of random's system information tool 1.06 2009-07-16 16:59:33

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}
ATI - Dienstprogramm zur Deinstallation der Software-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Catalyst Registration-->MsiExec.exe /X{72736F5F-520D-472A-88CC-7B02872FD34E}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CCleaner (remove only)-->"C:\Programme\CCleaner\uninst.exe"
EASEUS Partition Manager 1.6.2-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{77213A6F-0DD6-4A78-A324-0C3506D843ED}\setup.exe" -l0x9  -removeonly
FileZilla Client 3.2.4.1-->C:\Programme\FileZilla FTP Client\uninstall.exe
HijackThis 2.0.2-->"E:\Downloads\HijackThis.exe" /uninstall
Hotfix für Windows XP (KB935448)-->"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Java(TM) 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216014FF}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 German Language Pack-->MsiExec.exe /X{E78BFA60-5393-4C38-82AB-E8019E464EB4}
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office XP Professional mit FrontPage-->MsiExec.exe /I{90280407-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.22)-->C:\Programme\Mozilla Thunderbird\uninstall\helper.exe
Mp3tag v2.43-->C:\Programme\Mp3tag\Mp3tagUninstall.EXE
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
QIP Infium 9030 Jeak-Edition-->C:\Programme\jeak.de\QIP Infium\uninstall.exe
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x7  -removeonly
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Sicherheitsupdate für Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
SmartStore.biz 5-->MsiExec.exe /I{D91AB4D6-2CA1-4427-91B3-BB31D3C6D4EE}
SUPER © Version 2009.bld.36 (June 10, 2009)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Update für Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
VLC media player 1.0.0-->C:\Programme\VideoLAN\VLC\uninstall.exe
Winamp-->"C:\Programme\Winamp\UninstWA.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows XP-Hotfix - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
WinRAR-->C:\Programme\WinRAR\uninstall.exe

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: *****
Event Code: 15007
Message: Die von URL-Präfix "http://*:2869/" identifizierte Namespacereservierung wurde erfolgreich hinzugefügt.

Record Number: 5
Source Name: HTTP
Time Written: 20090716012056.000000+120
Event Type: Informationen
User:

Computer Name: *****
Event Code: 6011
Message: Der NetBIOS-Name und DNS-Hostname dieses Computers wurden von MACHINENAME in ***** geändert.

Record Number: 4
Source Name: EventLog
Time Written: 20090716011824.000000+120
Event Type: Informationen
User:

Computer Name: MACHINENAME
Event Code: 2
Message: Bei der Überprüfung, ob \Device\Serial0 ein serieller Anschluss ist, wurde ein FIFO-Baustein entdeckt. Es wird der FIFO-Baustein verwendet.

Record Number: 3
Source Name: Serial
Time Written: 20090716021458.000000+120
Event Type: Informationen
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Der Ereignisprotokolldienst wurde gestartet.

Record Number: 2
Source Name: EventLog
Time Written: 20090716021441.000000+120
Event Type: Informationen
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090716021441.000000+120
Event Type: Informationen
User:

=====Application event log=====

Computer Name: *****
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst ContentIndex (ContentIndex) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090716011932.000000+120
Event Type: Informationen
User:

Computer Name: *****
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst TermService (Terminaldienste) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090716011931.000000+120
Event Type: Informationen
User:

Computer Name: *****
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst RemoteAccess (Routing und RAS) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090716011849.000000+120
Event Type: Informationen
User:

Computer Name: *****
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst PSched (PSched) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090716011831.000000+120
Event Type: Informationen
User:

Computer Name: *****
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst RSVP (QoS-RSVP) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090716011831.000000+120
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=1706
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------
LOG
Code:
Logfile of random's system information tool 1.06 (written by random/random)
Run by ******* at 2009-07-16 16:59:23
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 108 GB (90%) free of 120 GB
Total RAM: 3071 MB (85% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:59:32, on 16.07.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wpabaln.exe
E:\Downloads\RSIT.exe
E:\Downloads\*******.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 2704 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-16 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-16 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-05-16 155648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\InstallSeagateManager.exe

Eiscube 16.07.2009 16:16
LOG 2
Code:
======List of files/folders created in the last 1 months======

2009-07-16 16:59:23 ----D---- C:\rsit
2009-07-16 16:58:46 ----D---- C:\WINDOWS\LastGood
2009-07-16 11:50:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-07-16 11:50:24 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-07-16 11:50:22 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-07-16 11:50:19 ----HDC---- C:\WINDOWS\$NtUninstallKB935448$
2009-07-16 11:50:17 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-07-16 11:50:07 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-07-16 11:50:04 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-07-16 11:49:57 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-07-16 11:49:53 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-07-16 11:49:47 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-07-16 11:49:45 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-07-16 11:49:42 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-16 11:49:39 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-07-16 11:49:36 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-07-16 11:49:34 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-07-16 11:49:31 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-07-16 11:49:28 ----HDC---- C:\WINDOWS\$NtUninstallKB923689$
2009-07-16 11:49:22 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-07-16 11:49:20 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-07-16 11:49:16 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-07-16 11:49:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-07-16 11:49:09 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-07-16 11:49:06 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-07-16 11:49:04 ----HDC---- C:\WINDOWS\$NtUninstallKB885884$
2009-07-16 11:48:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-07-16 11:48:39 ----SHD---- C:\Config.Msi
2009-07-16 11:48:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-07-16 11:48:25 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-07-16 11:48:23 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-16 11:48:20 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-07-16 11:48:18 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-07-16 11:48:12 ----D---- C:\Programme\MSXML 4.0
2009-07-16 11:48:07 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-07-16 11:48:03 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-07-16 10:53:08 ----A---- C:\WINDOWS\ntbtlog.txt
2009-07-16 10:48:26 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Malwarebytes
2009-07-16 10:48:22 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-07-16 10:48:22 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-07-16 10:45:37 ----D---- C:\WINDOWS\Minidump
2009-07-16 10:26:49 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Download Manager
2009-07-16 10:26:44 ----D---- C:\WINDOWS\Sun
2009-07-16 03:13:33 ----SH---- C:\boot.ini
2009-07-16 03:09:32 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-16 03:09:32 ----RSD---- C:\WINDOWS\Fonts
2009-07-16 03:09:32 ----RD---- C:\WINDOWS\Web
2009-07-16 03:09:32 ----HD---- C:\WINDOWS\inf
2009-07-16 03:09:32 ----D---- C:\WINDOWS\WinSxS
2009-07-16 03:09:32 ----D---- C:\WINDOWS\twain_32
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Temp
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\wins
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\wbem
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\usmt
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\spool
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\ShellExt
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\Setup
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\ras
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\oobe
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\npp
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\mui
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\inetsrv
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\IME
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\icsxml
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\ias
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\export
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\drivers
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\dhcp
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\config
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\3com_dmi
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\3076
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\2052
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1054
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1042
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1041
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1037
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1033
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1031
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1028
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32\1025
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system32
2009-07-16 03:09:32 ----D---- C:\WINDOWS\system
2009-07-16 03:09:32 ----D---- C:\WINDOWS\security
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Resources
2009-07-16 03:09:32 ----D---- C:\WINDOWS\repair
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Provisioning
2009-07-16 03:09:32 ----D---- C:\WINDOWS\PeerNet
2009-07-16 03:09:32 ----D---- C:\WINDOWS\pchealth
2009-07-16 03:09:32 ----D---- C:\WINDOWS\OEM
2009-07-16 03:09:32 ----D---- C:\WINDOWS\mui
2009-07-16 03:09:32 ----D---- C:\WINDOWS\msapps
2009-07-16 03:09:32 ----D---- C:\WINDOWS\msagent
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Media
2009-07-16 03:09:32 ----D---- C:\WINDOWS\java
2009-07-16 03:09:32 ----D---- C:\WINDOWS\ime
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Help
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Driver Cache
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Debug
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Cursors
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Connection Wizard
2009-07-16 03:09:32 ----D---- C:\WINDOWS\Config
2009-07-16 03:09:32 ----D---- C:\WINDOWS\AppPatch
2009-07-16 03:09:32 ----D---- C:\WINDOWS\addins
2009-07-16 03:09:32 ----D---- C:\WINDOWS
2009-07-16 02:18:15 ----A---- C:\WINDOWS\system32\h323log.txt
2009-07-16 02:16:15 ----A---- C:\WINDOWS\system32\usbui.dll
2009-07-16 02:15:29 ----A---- C:\WINDOWS\imsins.BAK
2009-07-16 02:15:27 ----SHD---- C:\WINDOWS\Installer
2009-07-16 02:15:27 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-16 02:15:26 ----D---- C:\Programme\Gemeinsame Dateien\ODBC
2009-07-16 02:15:26 ----A---- C:\WINDOWS\ODBCINST.INI
2009-07-16 02:15:24 ----RD---- C:\Programme
2009-07-16 02:15:24 ----D---- C:\Programme\Gemeinsame Dateien\SpeechEngines
2009-07-16 02:15:24 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-07-16 02:15:24 ----D---- C:\Programme\Gemeinsame Dateien
2009-07-16 02:15:21 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-07-16 02:15:21 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-07-16 02:15:21 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-07-16 02:15:20 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-07-16 02:15:19 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-07-16 02:15:18 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-07-16 02:15:18 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-07-16 02:15:18 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-07-16 02:15:18 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-07-16 02:15:18 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-07-16 02:15:16 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-07-16 02:15:15 ----A---- C:\WINDOWS\system32\irclass.dll
2009-07-16 02:15:15 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-07-16 02:15:14 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-07-16 02:15:14 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-07-16 02:15:14 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-07-16 02:15:13 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-07-16 02:15:13 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-07-16 02:15:12 ----A---- C:\WINDOWS\system32\storprop.dll
2009-07-16 02:15:12 ----A---- C:\WINDOWS\system32\batt.dll
2009-07-16 02:15:12 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-07-16 02:15:07 ----RA---- C:\WINDOWS\SET29.tmp
2009-07-16 02:15:07 ----RA---- C:\WINDOWS\SET28.tmp
2009-07-16 02:15:07 ----RA---- C:\WINDOWS\SET27.tmp
2009-07-16 02:15:07 ----RA---- C:\WINDOWS\SET26.tmp
2009-07-16 02:15:07 ----RA---- C:\WINDOWS\SET25.tmp
2009-07-16 02:15:07 ----ASH---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\desktop.ini
2009-07-16 02:15:05 ----RA---- C:\WINDOWS\SET8.tmp
2009-07-16 02:15:04 ----RA---- C:\WINDOWS\SET4.tmp
2009-07-16 02:15:03 ----RA---- C:\WINDOWS\SET3.tmp
2009-07-16 02:14:59 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-16 02:14:59 ----D---- C:\WINDOWS\system32\CatRoot
2009-07-16 02:14:54 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2009-07-16 02:14:35 ----SHD---- C:\System Volume Information
2009-07-16 02:14:35 ----D---- C:\Dokumente und Einstellungen
2009-07-16 01:53:51 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\QIP
2009-07-16 01:52:35 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\ATI
2009-07-16 01:52:35 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ATI
2009-07-16 01:52:28 ----D---- C:\WINDOWS\system32\Lang
2009-07-16 01:49:50 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-07-16 01:48:47 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-07-16 01:48:34 ----D---- C:\WINDOWS\system32\PreInstall
2009-07-16 01:48:32 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-07-16 01:45:18 ----D---- C:\Programme\ATI
2009-07-16 01:44:57 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2009-07-16 01:44:43 ----D---- C:\Programme\ATI Technologies
2009-07-16 01:44:16 ----D---- C:\ATI
2009-07-16 01:36:25 ----A---- C:\WINDOWS\ODBC.INI
2009-07-16 01:35:57 ----D---- C:\Programme\Gemeinsame Dateien\Designer
2009-07-16 01:35:40 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-07-16 01:35:09 ----D---- C:\WINDOWS\ShellNew
2009-07-16 01:35:07 ----D---- C:\Programme\Microsoft Office
2009-07-16 01:34:47 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-07-16 01:28:55 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-07-16 01:28:54 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Identities
2009-07-16 01:28:53 ----HD---- C:\Programme\Uninstall Information
2009-07-16 01:28:50 ----ASH---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\desktop.ini
2009-07-16 01:28:49 ----SD---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Microsoft
2009-07-16 01:27:19 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Macromedia
2009-07-16 01:27:19 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Adobe
2009-07-16 01:26:48 ----D---- C:\WINDOWS\SoftwareDistribution
2009-07-16 01:26:47 ----SD---- C:\WINDOWS\system32\Microsoft
2009-07-16 01:26:47 ----D---- C:\WINDOWS\Prefetch
2009-07-16 01:26:47 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-16 01:23:47 ----D---- C:\WINDOWS\system32\xircom
2009-07-16 01:23:47 ----D---- C:\Programme\xerox
2009-07-16 01:23:47 ----D---- C:\Programme\microsoft frontpage
2009-07-16 01:23:39 ----A---- C:\WINDOWS\system32\OEMINFO.INI
2009-07-16 01:23:32 ----A---- C:\WINDOWS\system32\javaws.exe
2009-07-16 01:23:32 ----A---- C:\WINDOWS\system32\javaw.exe
2009-07-16 01:23:32 ----A---- C:\WINDOWS\system32\java.exe
2009-07-16 01:23:18 ----D---- C:\Programme\Java
2009-07-16 01:23:18 ----D---- C:\Programme\Gemeinsame Dateien\Java
2009-07-16 01:22:43 ----RSD---- C:\WINDOWS\assembly
2009-07-16 01:22:43 ----D---- C:\WINDOWS\Microsoft.NET
2009-07-16 01:22:42 ----D---- C:\WINDOWS\system32\URTTemp
2009-07-16 01:22:17 ----D---- C:\WINDOWS\fsc
2009-07-16 01:22:10 ----D---- C:\AddOn
2009-07-16 01:21:48 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-07-16 01:21:48 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-16 01:21:42 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-07-16 01:21:37 ----A---- C:\WINDOWS\control.ini
2009-07-16 01:21:37 ----A---- C:\AUTOEXEC.BAT
2009-07-16 01:21:32 ----A---- C:\WINDOWS\OEWABLog.txt
2009-07-16 01:21:29 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-07-16 01:21:02 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-07-16 01:21:02 ----RD---- C:\WINDOWS\Offline Web Pages
2009-07-16 01:21:02 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-07-16 01:20:59 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-07-16 01:20:57 ----HD---- C:\Programme\WindowsUpdate
2009-07-16 01:20:55 ----D---- C:\Programme\Online-Dienste
2009-07-16 01:20:46 ----D---- C:\WINDOWS\system32\DirectX
2009-07-16 01:20:34 ----A---- C:\WINDOWS\system32\atrace.dll
2009-07-16 01:20:32 ----A---- C:\WINDOWS\system32\desktop.ini
2009-07-16 01:20:32 ----A---- C:\WINDOWS\desktop.ini
2009-07-16 01:20:27 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-07-16 01:20:26 ----D---- C:\Programme\Gemeinsame Dateien\Dienste
2009-07-16 01:20:26 ----A---- C:\WINDOWS\system32\acctres.dll
2009-07-16 01:20:24 ----SD---- C:\WINDOWS\Tasks
2009-07-16 01:20:24 ----D---- C:\Programme\Gemeinsame Dateien\MSSoap
2009-07-16 01:20:24 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-07-16 01:20:21 ----D---- C:\WINDOWS\system32\Macromed
2009-07-16 01:20:21 ----D---- C:\WINDOWS\srchasst
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wups.dll
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-07-16 01:20:19 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-07-16 01:20:18 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-07-16 01:20:18 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-07-16 01:20:18 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-07-16 01:20:18 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-07-16 01:20:18 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-07-16 01:20:16 ----D---- C:\Programme\Movie Maker
2009-07-16 01:20:13 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-07-16 01:20:13 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-07-16 01:20:13 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-07-16 01:20:13 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-07-16 01:20:11 ----D---- C:\WINDOWS\system32\Restore
2009-07-16 01:20:11 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-07-16 01:20:11 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-07-16 01:20:11 ----A---- C:\WINDOWS\system32\srclient.dll
2009-07-16 01:20:11 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-07-16 01:20:11 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-07-16 01:20:10 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-07-16 01:20:10 ----A---- C:\WINDOWS\system32\msconf.dll
2009-07-16 01:20:10 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-07-16 01:20:10 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-07-16 01:20:10 ----A---- C:\WINDOWS\system32\isrdbg32.dll

Eiscube 16.07.2009 16:18
LOG3

Code:
2009-07-16 01:20:10 ----A---- C:\WINDOWS\system32\ils.dll
2009-07-16 01:20:08 ----D---- C:\Programme\NetMeeting
2009-07-16 01:20:08 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-07-16 01:20:08 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-07-16 01:20:07 ----A---- C:\WINDOWS\system32\inetres.dll
2009-07-16 01:20:07 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-07-16 01:20:06 ----D---- C:\Programme\Outlook Express
2009-07-16 01:20:06 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-07-16 01:20:06 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-07-16 01:20:06 ----A---- C:\WINDOWS\system32\mstask.dll
2009-07-16 01:20:05 ----A---- C:\WINDOWS\system32\isign32.dll
2009-07-16 01:20:05 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-07-16 01:20:05 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-07-16 01:20:05 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-07-16 01:20:02 ----D---- C:\Programme\Gemeinsame Dateien\System
2009-07-16 01:20:01 ----D---- C:\Programme\Internet Explorer
2009-07-16 01:19:52 ----D---- C:\Programme\ComPlus Applications
2009-07-16 01:19:51 ----A---- C:\WINDOWS\vbaddin.ini
2009-07-16 01:19:51 ----A---- C:\WINDOWS\vb.ini
2009-07-16 01:19:48 ----D---- C:\WINDOWS\Registration
2009-07-16 01:19:31 ----D---- C:\Programme\Windows Media Player
2009-07-16 01:19:31 ----D---- C:\Programme\Online Services
2009-07-16 01:19:25 ----D---- C:\Programme\MSN Gaming Zone
2009-07-16 01:19:25 ----A---- C:\WINDOWS\system32\write.exe
2009-07-16 01:19:20 ----A---- C:\WINDOWS\system32\winchat.exe
2009-07-16 01:19:20 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-07-16 01:19:20 ----A---- C:\WINDOWS\system32\hticons.dll
2009-07-16 01:19:20 ----A---- C:\WINDOWS\system32\avwav.dll
2009-07-16 01:19:20 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-07-16 01:19:20 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-07-16 01:19:16 ----A---- C:\WINDOWS\system32\getuname.dll
2009-07-16 01:19:15 ----A---- C:\WINDOWS\system32\winmine.exe
2009-07-16 01:19:15 ----A---- C:\WINDOWS\system32\sol.exe
2009-07-16 01:19:15 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-07-16 01:19:15 ----A---- C:\WINDOWS\system32\freecell.exe
2009-07-16 01:19:15 ----A---- C:\WINDOWS\system32\charmap.exe
2009-07-16 01:19:15 ----A---- C:\WINDOWS\system32\calc.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\tskill.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\tscon.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\shadow.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\reset.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\regini.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\msg.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\logoff.exe
2009-07-16 01:19:14 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\stclient.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-07-16 01:19:13 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-07-16 01:19:10 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-07-16 01:19:09 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\SmartStore
2009-07-16 01:19:04 ----D---- C:\Programme\MSN
2009-07-16 01:19:03 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-07-16 01:19:03 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-07-16 01:19:03 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-07-16 01:19:03 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-07-16 01:19:02 ----D---- C:\Programme\Windows NT
2009-07-16 01:19:02 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-07-16 01:19:02 ----A---- C:\WINDOWS\system32\spider.exe
2009-07-16 01:19:02 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-07-16 01:19:02 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-07-16 01:19:01 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-07-16 01:19:00 ----D---- C:\WINDOWS\system32\MsDtc
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-07-16 01:19:00 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-07-16 01:18:59 ----D---- C:\WINDOWS\system32\Com
2009-07-16 01:18:59 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-07-16 01:18:59 ----A---- C:\WINDOWS\system32\colbact.dll
2009-07-16 01:18:59 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-07-16 01:18:59 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-07-16 01:18:59 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-07-16 01:18:59 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-07-16 01:18:58 ----A---- C:\WINDOWS\system32\comuid.dll
2009-07-16 01:18:58 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-07-16 01:18:55 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-07-16 01:18:55 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-07-16 01:18:55 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-07-16 01:18:55 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-07-16 00:58:50 ----D---- C:\WINDOWS\RegisteredPackages
2009-07-16 00:58:42 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Thunderbird
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-07-16 00:58:34 ----N---- C:\WINDOWS\system32\px.dll
2009-07-16 00:58:32 ----D---- C:\Programme\Winamp
2009-07-16 00:58:32 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Winamp
2009-07-16 00:58:10 ----D---- C:\Programme\VideoLAN
2009-07-16 00:56:20 ----A---- C:\WINDOWS\system32\TUProgSt.exe
2009-07-16 00:56:19 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2009-07-16 00:56:18 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\TuneUp Software
2009-07-16 00:56:18 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-07-16 00:56:10 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2009-07-16 00:56:09 ----D---- C:\Programme\TuneUp Utilities 2009
2009-07-16 00:56:00 ----SHD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
2009-07-16 00:55:47 ----D---- C:\Programme\Mozilla Thunderbird
2009-07-16 00:55:37 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Mozilla
2009-07-16 00:55:34 ----RSH---- C:\WINDOWS\system32\nbDX.dll
2009-07-16 00:55:34 ----RSH---- C:\WINDOWS\system32\msfDX.dll
2009-07-16 00:55:33 ----RSH---- C:\WINDOWS\system32\flvDX.dll
2009-07-16 00:55:23 ----D---- C:\Programme\eRightSoft
2009-07-16 00:55:02 ----D---- C:\Programme\SmartStore
2009-07-16 00:55:02 ----D---- C:\Programme\Gemeinsame Dateien\SmartStore Shared
2009-07-16 00:54:47 ----D---- C:\WINDOWS\Downloaded Installations
2009-07-16 00:54:11 ----D---- C:\Programme\jeak.de
2009-07-16 00:53:56 ----D---- C:\Programme\Mp3tag
2009-07-16 00:53:40 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-07-16 00:53:23 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Sun
2009-07-16 00:53:12 ----D---- C:\Programme\Mozilla Firefox
2009-07-16 00:52:59 ----D---- C:\Programme\FileZilla FTP Client
2009-07-16 00:52:48 ----D---- C:\Programme\CCleaner
2009-07-16 00:48:32 ----RA---- C:\WINDOWS\system32\msvcr71.dll
2009-07-16 00:48:32 ----RA---- C:\WINDOWS\system32\msvcp71.dll
2009-07-16 00:48:32 ----RA---- C:\WINDOWS\system32\MFC71.dll
2009-07-16 00:48:31 ----D---- C:\Programme\EASEUS
2009-07-16 00:48:31 ----A---- C:\WINDOWS\system32\BootMan.exe
2009-07-16 00:48:03 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2009-07-16 00:47:59 ----D---- C:\Programme\Gemeinsame Dateien\Adobe
2009-07-16 00:47:59 ----D---- C:\Programme\Adobe
2009-07-16 00:45:42 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2009-07-16 00:45:42 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2009-07-16 00:45:42 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2009-07-16 00:45:42 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2009-07-16 00:45:42 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2009-07-16 00:45:42 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2009-07-16 00:45:41 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2009-07-16 00:45:41 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2009-07-16 00:45:41 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2009-07-16 00:45:41 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2009-07-16 00:45:41 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2009-07-16 00:45:41 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2009-07-16 00:45:40 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2009-07-16 00:45:40 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2009-07-16 00:45:40 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2009-07-16 00:45:40 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2009-07-16 00:45:39 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2009-07-16 00:45:39 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2009-07-16 00:45:39 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2009-07-16 00:45:39 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2009-07-16 00:45:39 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2009-07-16 00:45:39 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2009-07-16 00:45:38 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2009-07-16 00:45:38 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2009-07-16 00:45:38 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2009-07-16 00:45:38 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2009-07-16 00:45:38 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2009-07-16 00:45:38 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2009-07-16 00:45:37 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2009-07-16 00:45:36 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2009-07-16 00:45:36 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2009-07-16 00:45:36 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2009-07-16 00:45:36 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2009-07-16 00:45:36 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2009-07-16 00:45:35 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2009-07-16 00:45:34 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2009-07-16 00:45:34 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2009-07-16 00:45:34 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2009-07-16 00:45:34 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-07-16 00:45:34 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2009-07-16 00:45:34 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2009-07-16 00:45:33 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-07-16 00:45:32 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2009-07-16 00:45:32 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2009-07-16 00:45:32 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2009-07-16 00:45:32 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-07-16 00:45:32 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2009-07-16 00:45:32 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2009-07-16 00:45:31 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2009-07-16 00:45:21 ----D---- C:\Programme\Avira
2009-07-16 00:45:21 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-07-16 00:44:07 ----D---- C:\WINDOWS\Logs
2009-07-16 00:43:52 ----D---- C:\Dokumente und Einstellungen\*******\Anwendungsdaten\WinRAR
2009-07-16 00:42:08 ----D---- C:\Programme\WinRAR
2009-07-16 00:41:49 ----R---- C:\WINDOWS\system32\ChCfg.exe
2009-07-16 00:41:36 ----D---- C:\WINDOWS\system32\RTCOM
2009-07-16 00:41:34 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-07-16 00:41:31 ----R---- C:\WINDOWS\SoundMan.exe
2009-07-16 00:41:30 ----R---- C:\WINDOWS\SkyTel.exe
2009-07-16 00:41:29 ----R---- C:\WINDOWS\RtlUpd.exe
2009-07-16 00:41:26 ----R---- C:\WINDOWS\RTLCPL.exe
2009-07-16 00:41:18 ----R---- C:\WINDOWS\RTHDCPL.exe
2009-07-16 00:41:17 ----R---- C:\WINDOWS\MicCal.exe
2009-07-16 00:41:15 ----R---- C:\WINDOWS\Alcmtr.exe
2009-07-16 00:41:14 ----R---- C:\WINDOWS\alcwzrd.exe
2009-07-16 00:41:13 ----D---- C:\Programme\Realtek
2009-07-16 00:41:12 ----HD---- C:\Programme\InstallShield Installation Information
2009-07-16 00:41:04 ----R---- C:\WINDOWS\RtlExUpd.dll
2009-07-16 00:41:04 ----A---- C:\WINDOWS\HideWin.exe
2009-07-16 00:41:02 ----D---- C:\Programme\Gemeinsame Dateien\InstallShield
2009-07-16 00:39:07 ----SHD---- C:\RECYCLER

======List of files/folders modified in the last 1 months======

2009-07-16 02:15:23 ----A---- C:\WINDOWS\system.ini
2009-07-16 01:36:15 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40192]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-05-16 4069888]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-02-14 4676096]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 ubnafakj;ubnafakj; \??\C:\DOKUME~1\*******\LOKALE~1\Temp\ubnafakj.sys []
S3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-05-11 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-05-16 602112]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-07-16 152984]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-07-16 604416]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-05-15 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-07-16 361216]

-----------------EOF-----------------

Eiscube 16.07.2009 16:19
GMER
Code:
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-16 17:01:40
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.15 ----

Code    8A15F110                                                                                                                        ZwEnumerateKey
Code    8A170BC8                                                                                                                        ZwFlushInstructionCache
Code    8A1B730E                                                                                                                        ZwSaveKey
Code    8A16B096                                                                                                                        ZwSaveKeyEx
Code    8A21598E                                                                                                                        IofCallDriver
Code    8A215E2E                                                                                                                        IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text    ntkrnlpa.exe!IofCallDriver                                                                                                      804EF0BC 5 Bytes  JMP 8A215993
.text    ntkrnlpa.exe!IofCompleteRequest                                                                                                804EF14C 5 Bytes  JMP 8A215E33
PAGE    ntkrnlpa.exe!ZwFlushInstructionCache                                                                                            805B528A 5 Bytes  JMP 8A170BCC
PAGE    ntkrnlpa.exe!ZwSaveKey                                                                                                          806205D8 5 Bytes  JMP 8A1B7312
PAGE    ntkrnlpa.exe!ZwSaveKeyEx                                                                                                        80620668 5 Bytes  JMP 8A16B09A
PAGE    ntkrnlpa.exe!ZwEnumerateKey                                                                                                    8062296E 5 Bytes  JMP 8A15F114

---- User code sections - GMER 1.0.15 ----

.text    C:\Programme\Avira\AntiVir Desktop\avgnt.exe[448] ntdll.dll!LdrLoadDll                                                          7C925CBB 5 Bytes  JMP 014A000A
.text    C:\Programme\Avira\AntiVir Desktop\avguard.exe[468] ntdll.dll!LdrLoadDll                                                        7C925CBB 5 Bytes  JMP 003D000A
.text    C:\WINDOWS\system32\winlogon.exe[836] ntdll.dll!LdrLoadDll                                                                      7C925CBB 5 Bytes  JMP 0065000A
.text    C:\WINDOWS\System32\TUProgSt.exe[868] ntdll.dll!LdrLoadDll                                                                      7C925CBB 5 Bytes  JMP 0073000A
.text    C:\WINDOWS\system32\services.exe[928] ntdll.dll!LdrLoadDll                                                                      7C925CBB 5 Bytes  JMP 0064000A
.text    ...                                                                                                                           
---- Processes - GMER 1.0.15 ----

Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Avira\AntiVir Desktop\avgnt.exe [448]    0x003E0000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Avira\AntiVir Desktop\avguard.exe [468]  0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Java\jre6\bin\jqs.exe [640]              0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [836]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\System32\TUProgSt.exe [868]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [928]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [940]                  0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wdfmgr.exe [1004]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [1136]              0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1280]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1380]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1488]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [1540]              0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiapsrv.exe [1696]          0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1720]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [1888]                    0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiprvse.exe [1980]          0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Avira\AntiVir Desktop\sched.exe [2032]  0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [2040]                        0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiprvse.exe [2284]          0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ E:\Downloads\073jzjld.exe [3128]                      0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wpabaln.exe [3856]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [3956]                0x10000000                     

---- EOF - GMER 1.0.15 ----

AntiMalWare
Code:
Malwarebytes' Anti-Malware 1.39
Datenbank Version: 2421
Windows 5.1.2600 Service Pack 2

16.07.2009 17:09:27
mbam-log-2009-07-16 (17-09-25).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|)
Durchsuchte Objekte: 117316
Laufzeit: 5 minute(s), 24 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
\\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (Trojan.TDSS) -> No action taken.

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
\\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (Trojan.TDSS) -> No action taken.
c:\dokumente und einstellungen\*******\lokale einstellungen\Temp\keygen.exe (Trojan.Downloader) -> No action taken.



Sorry, wegen der vielen Posts, aber anders gings nich.

handball10 16.07.2009 18:02
moin Eiscube,

herzlichen Glückwunsch!
Code:
c:\dokumente und einstellungen\*******\lokale einstellungen\Temp\keygen.exe (Trojan.Downloader)
War das die Datei, die beim Anklicken verschwand? :rolleyes:

Des weiteren hast du dir eine ganz neue Version des TDSS-Rootkits eingefangen:
Code:
---- Processes - GMER 1.0.15 ----

Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Avira\AntiVir Desktop\avgnt.exe [448]    0x003E0000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Avira\AntiVir Desktop\avguard.exe [468]  0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Java\jre6\bin\jqs.exe [640]              0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [836]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\System32\TUProgSt.exe [868]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [928]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [940]                  0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wdfmgr.exe [1004]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [1136]              0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1280]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1380]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1488]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [1540]              0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiapsrv.exe [1696]          0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1720]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [1888]                    0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiprvse.exe [1980]          0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\Programme\Avira\AntiVir Desktop\sched.exe [2032]  0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [2040]                        0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiprvse.exe [2284]          0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ E:\Downloads\073jzjld.exe [3128]                      0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wpabaln.exe [3856]                0x10000000                     
Library  \\?\globalroot\systemroot\system32\geyekrmqlmlqps.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [3956]                0x10000000
Weißt du, was das hier ist?
Code:
Running processes:
E:\Downloads\*******.exe
Gruß
Handball10

Eiscube 16.07.2009 19:19
Ja das ist die Datei gewesen,... nur mit anderem Namen.

Iwo stand in den Post-Regeln, man solle den Computernammen verschleiern.

Hab also statt des PC-Namens die ******* reingemacht.

Wie werd ich das Rootkit zeugs los?

handball10 16.07.2009 19:56
Zitat:
Zitat von Eiscube
Ja das ist die Datei gewesen,... nur mit anderem Namen.
Hier gehts weiter:
http://www.trojaner-board.de/51262-a...sicherung.html

Warum?
YouTube - Effects of crack programs and keygens on your PC

Viel Erfolg.

Gruß
Handball10

Eiscube 16.07.2009 20:08
Na super... da wird man mal schwach und man muss es schließlich bitter bereuen. Naja selbst Schuld.

Gestern erst formatiert, da komm ich heut wohl auch nich drum rum

Danke für die Analyse


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:40 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131