Logfile of HijackThis v1.99.1 Scan saved at 19:30:00, on 23.05.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\LEXBCES.EXE D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\LEXPPS.EXE D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\dcomcfg.exe G:\Programme\ICQLite\ICQLite.exe D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe G:\Programme\iTunes\iTunesHelper.exe D:\Programme\Java\jre1.5.0_04\bin\jusched.exe D:\Programme\SurfAccuracy\SAcc.exe D:\WINDOWS\wjoyok.exe G:\programme\steam\steam.exe D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE D:\WINDOWS\system32\ctfmon.exe D:\Programme\Alwil Software\Avast4\aswUpdSv.exe D:\Programme\Alwil Software\Avast4\ashServ.exe D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe D:\WINDOWS\System32\nvsvc32.exe D:\Programme\iPod\bin\iPodService.exe D:\Programme\Alwil Software\Avast4\ashMaiSv.exe D:\Programme\Alwil Software\Avast4\ashWebSv.exe D:\WINDOWS\system32\wuauclt.exe D:\Programme\Mozilla Firefox\firefox.exe G:\Programme\WinRar\WinRAR.exe D:\DOKUME~1\Zeus\LOKALE~1\Temp\Rar$EX00.947\HijackThis.exe O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - D:\WINDOWS\system32\hp22F.tmp O4 - HKLM\..\Run: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [EPSON Stylus C86 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE /P23 "EPSON Stylus C86 Series" /O6 "USB002" /M "Stylus C86" O4 - HKLM\..\Run: [Microsoft Wins Service] wins32.exe O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [iTunesHelper] "G:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Programme\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [SurfAccuracy] D:\Programme\SurfAccuracy\SAcc.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "G:\Programme\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ReJf5vH] D:\WINDOWS\wjoyok.exe O4 - HKCU\..\Run: [Steam] "g:\programme\steam\steam.exe" -silent O4 - HKCU\..\Run: [EPSON Stylus C86 Series] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0R2.EXE /P23 "EPSON Stylus C86 Series" /M "Stylus C86" /EF "HKCU" O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk = D:\Dokumente und Einstellungen\Zeus\Lokale Einstellungen\Temp\{913F8534-4ADA-4652-A0C1-41E6670AFADB}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = G:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = G:\Programme\Microsoft Office\Office10\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe O15 - Trusted Zone: http://secure.gestrip.com (HKLM) O15 - Trusted Zone: http://update.randhi.com (HKLM) O16 - DPF: {1F831FA3-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://G:\Programme\Acadm 6\InstFred.ocx O16 - DPF: {33331111-1111-1111-1111-611111193423} - O16 - DPF: {33331111-1111-1111-1111-611111193429} - O16 - DPF: {33331111-1111-1111-1111-615111193427} - O16 - DPF: {33331111-1131-1111-1111-611111193428} - O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday-Steuerung) - file://G:\Programme\Acadm 6\AcDcToday.ocx O16 - DPF: {AE563724-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://G:\Programme\Acadm 6\InstBanr.ocx O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview-Steuerung) - file://G:\Programme\Acadm 6\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{DC6280DB-99FD-40FF-B3FA-5B85EC10033A}: NameServer = 217.237.151.97 217.237.150.33 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - D:\WINDOWS\system32\vbsys2.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: C-DillaSrv - C-Dilla Ltd - D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Programme\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE O23 - Service: AOpen NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe