Virus TR/Vundo.Gen |
||
|---|---|---|
| #0
| ||
|
27.04.2007, 14:25
...neu hier
Beiträge: 3 |
||
 
|
|
|
|
27.04.2007, 15:06
Moderator
Beiträge: 7805 |
#2
Weisst du, wo du dir diesen Trojaner eingefangen hast?
Poste bitte Hijackthis und Combofix report: http://board.protecus.de/t23187.htm und nutze Vundofix: http://virus-protect.org/artikel/tools/vundofixx.html __________ MfG Ralf SEO-Spam Hunter |
|
|
|
|
|
|
27.04.2007, 15:55
...neu hier
Themenstarter Beiträge: 3 |
#3
Hijackthis
Logfile of HijackThis v1.99.1 Scan saved at 15:14:55, on 27.04.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\Java\jre1.5.0_03\bin\jusched.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Siemens\Gigaset USB Adapter 54\PRISMSVR.EXE C:\WINDOWS\system32\RunDll32.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Gemeinsame Dateien\DriveCleaner Free\udcwap.exe C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe C:\Programme\Siemens\Gigaset USB Adapter 54\GigasetUSBMonitor.exe C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programme\Virtual CD v8\System\VC8SecS.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Azureus\Azureus.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Winamp\winamp.exe C:\Programme\qip\qip.exe C:\Programme\Valve\Steam\Steam.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Dokumente und Einstellungen\Marvin\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/de/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - {2B0FF705-554A-42A6-81E0-06C5C75F4B1A} - C:\WINDOWS\system32\wvuspnl.dll O2 - BHO: IE PopUp-Killer - {49E0E0F0-5C30-11D4-945D-000000000003} - C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll O2 - BHO: (no name) - {56CB612D-E6BA-4E72-9AC7-8F06BD078159} - C:\WINDOWS\system32\mlljg.dll O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - (no file) O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Programme\Siemens\Gigaset USB Adapter 54\PRISMSVR.EXE" /APPLY O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\ycedgfcr.dll",setvm O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [WA6PU_Check] "C:\Programme\Gemeinsame Dateien\DriveCleaner Free\udcwap.exe" O4 - HKCU\..\Run: [Steam] "c:\programme\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Ashampoo PopUpBlocker] C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Adapter 54\GigasetUSBMonitor.exe O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\programme\bonjour\mdnsnsp.dll O20 - Winlogon Notify: mlljg - C:\WINDOWS\system32\mlljg.dll O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing) O20 - Winlogon Notify: wvuspnl - C:\WINDOWS\SYSTEM32\wvuspnl.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Virtual CD v8 Management Service (VC8SecS) - H+H Software GmbH - C:\Programme\Virtual CD v8\System\VC8SecS.exe Combofix "Marvin" - 07-04-27 15:26:59 Service Pack 2 ComboFix 07-04-25.4V - Running from: "C:\Dokumente und Einstellungen\Marvin\Desktop\" (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\wvuspnl.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((( Files Created from 2007-03-27 to 2007-04-27 )))))))))))))))))))))))))))))))))) 2007-04-22 21:14 <DIR> d-------- C:\Programme\Ashampoo 2007-04-22 18:20 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\DriveCleaner Free 2007-04-20 18:37 <DIR> d-------- C:\Programme\TrackMania Nations ESWC 2007-04-20 14:40 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\ICQ 2007-04-20 14:37 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-04-20 14:37 <DIR> d-------- C:\Programme\Gemeinsame Dateien\DriveCleaner Free 2007-04-20 07:00 163,840 --a------ C:\WINDOWS\BJPSUNST.EXE 2007-04-20 06:59 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-04-20 06:59 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-04-20 06:59 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-04-20 06:52 86,016 -ra------ C:\WINDOWS\system32\CNMCP5y.exe 2007-04-20 06:52 7,680 --a------ C:\WINDOWS\system32\CNMVS5y.DLL 2007-04-20 06:52 116,736 --a------ C:\WINDOWS\system32\CNMLM5y.DLL 2007-04-20 06:52 <DIR> d--h----- C:\BJPrinter 2007-04-20 06:52 <DIR> d-------- C:\WINDOWS\StartHtmico 2007-04-20 06:52 <DIR> d-------- C:\WINDOWS\IP1500 2007-04-20 06:51 <DIR> d-------- C:\Programme\Canon 2007-04-20 06:48 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-04-19 20:26 671,023 ---hs---- C:\WINDOWS\system32\gjllm.ini2 2007-04-19 19:21 43,584 --a------ C:\WINDOWS\system32\drivers\avipbb.sys 2007-04-19 19:21 28,352 --a------ C:\WINDOWS\system32\drivers\ssmdrv.sys 2007-04-06 11:36 672,166 ---hs---- C:\WINDOWS\system32\gjllm.bak2 2007-04-05 18:41 <DIR> d-------- C:\Programme\BearShare 2007-04-05 18:41 <DIR> d-------- C:\My Downloads 2007-04-05 11:36 512,014 ---hs---- C:\WINDOWS\system32\gjllm.bak1 2007-04-05 11:36 280,676 --------- C:\WINDOWS\system32\mlljg.dll 2007-04-02 16:54 <DIR> d-------- C:\Programme\IrfanView 2007-04-02 15:01 57,344 --a------ C:\WINDOWS\system32\WNASPINT.DLL 2007-04-02 14:53 811,008 --a------ C:\WINDOWS\system32\NCTAudioCDGrabber2.dll 2007-04-02 14:53 643,072 --a------ C:\WINDOWS\system32\DVDProX2.dll 2007-04-02 14:53 315,392 --a------ C:\WINDOWS\system32\NCTAudioPlayer2.dll 2007-04-02 14:53 11,520 --a------ C:\WINDOWS\system32\drivers\HHCDHelp.sys 2007-04-02 14:53 100,352 --a------ C:\WINDOWS\system32\drivers\vdrv8000.sys 2007-04-02 14:53 1,843,200 --a------ C:\WINDOWS\system32\NCTAudioFile2.dll 2007-04-02 14:53 1,044,480 --------- C:\WINDOWS\system32\ROBOEX32.DLL 2007-04-02 14:53 <DIR> d-------- C:\Programme\Virtual CD v8 2007-04-02 12:15 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\FLEXnet 2007-04-02 12:14 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-04-02 12:00 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Macrovision Shared 2007-04-02 12:00 <DIR> d-------- C:\Programme\Bonjour 2007-03-31 00:58 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\Apple Computer 2007-03-31 00:44 <DIR> d-------- C:\Programme\QuickTime 2007-03-31 00:44 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer 2007-03-30 12:19 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\vlc 2007-03-30 08:30 <DIR> d-------- C:\Temp 2007-03-29 23:56 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\Azureus 2007-03-29 21:48 77,824 --a------ C:\WINDOWS\system32\eJ_Enumerator.dll 2007-03-29 21:48 36,864 --a------ C:\WINDOWS\system32\eJayWMExport.dll 2007-03-29 21:48 29,696 --a------ C:\WINDOWS\system32\pthread.dll 2007-03-29 21:48 236,032 --a------ C:\WINDOWS\system32\devil.dll 2007-03-29 21:48 159,744 --a------ C:\WINDOWS\system32\DartSock.dll 2007-03-29 21:48 106,496 --a------ C:\WINDOWS\system32\DartWeb.dll 2007-03-29 21:48 <DIR> d-------- C:\ejay 2007-03-29 21:48 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\Help 2007-03-29 00:09 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\ICQ Toolbar 2007-03-28 23:16 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\teamspeak2 2007-03-28 20:36 <DIR> d-------- C:\Programme\EA GAMES 2007-03-28 20:05 1,177 --a------ C:\WINDOWS\mozver.dat 2007-03-28 18:57 <DIR> d-------- C:\DOKUME~1\Marvin\Shared 2007-03-28 18:57 <DIR> d-------- C:\DOKUME~1\Marvin\Incomplete 2007-03-28 18:56 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\LimeWire 2007-03-28 18:37 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared 2007-03-28 18:03 <DIR> d-------- C:\Program Files 2007-03-28 18:02 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\ICQLite 2007-03-28 17:20 262,144 --a------ C:\DOKUME~1\ALLUSE~1\ntuser.dat 2007-03-28 17:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Windows Genuine Advantage 2007-03-28 17:11 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-03-28 17:01 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache 2007-03-28 17:01 <DIR> dr--s---- C:\WINDOWS\Fonts 2007-03-28 17:01 <DIR> dr------- C:\WINDOWS\Web 2007-03-28 17:01 <DIR> d--h----- C:\WINDOWS\inf 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\WinSxS 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\twain_32 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\wins 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\wbem 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\usmt 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\spool 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\ShellExt 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\Setup 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\ras 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\oobe 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\npp 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\mui 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\inetsrv 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\IME 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\icsxml 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\ias 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\export 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\drivers\etc 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\drivers 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\dhcp 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\config 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\3com_dmi 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\3076 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\2052 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1054 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1042 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1041 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1037 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1033 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1031 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1028 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32\1025 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system32 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\system 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\security 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Resources 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\repair 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Provisioning 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\PeerNet 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\pchealth 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\mui 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\msapps 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\msagent 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Media 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\ime 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Help 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\ehome 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Driver Cache 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Debug 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Cursors 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Connection Wizard 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\Config 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\AppPatch 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS\addins 2007-03-28 17:01 <DIR> d-------- C:\WINDOWS 2007-03-28 16:46 <DIR> d-------- C:\WINDOWS\pss 2007-03-28 16:46 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\NVIDIA 2007-03-28 16:44 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-03-28 16:44 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-03-28 16:44 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups 2007-03-28 16:44 <DIR> d-------- C:\WINDOWS\nview 2007-03-28 16:43 <DIR> d-------- C:\NVIDIA 2007-03-28 16:29 <DIR> d-------- C:\Programme\Azureus 2007-03-28 16:25 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-03-28 16:25 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-28 16:25 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-28 16:25 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-03-28 16:25 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-03-28 16:25 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-03-28 16:24 <DIR> d-------- C:\Programme\Winamp 2007-03-28 16:23 <DIR> d-------- C:\Programme\VideoLAN 2007-03-28 16:23 <DIR> d-------- C:\Programme\qip 2007-03-28 16:12 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys 2007-03-28 16:12 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys 2007-03-28 16:12 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-03-28 16:12 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2007-03-28 16:12 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-03-28 16:12 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2007-03-28 16:12 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2007-03-28 16:12 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys 2007-03-28 16:12 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-03-28 16:12 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2007-03-28 16:12 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys 2007-03-28 16:12 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys 2007-03-28 16:11 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-03-28 16:11 57,600 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-03-28 16:11 44,672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS 2007-03-28 16:11 4,527,488 --a------ C:\WINDOWS\system32\nv4_disp.dll 2007-03-28 16:11 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-03-28 16:11 3,994,624 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-03-28 16:11 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys 2007-03-28 16:11 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-03-28 16:11 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2007-03-28 16:10 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-03-28 16:10 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys 2007-03-28 16:10 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys 2007-03-28 16:09 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2007-03-28 16:09 9,200 --a------ C:\WINDOWS\system\VER.DLL 2007-03-28 16:09 86,556 --a------ C:\WINDOWS\system32\dgsetup.dll 2007-03-28 16:09 82,944 --a------ C:\WINDOWS\system\OLECLI.DLL 2007-03-28 16:09 8,704 --a------ C:\WINDOWS\system32\batt.dll 2007-03-28 16:09 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll 2007-03-28 16:09 76,288 --a------ C:\WINDOWS\system32\storprop.dll 2007-03-28 16:09 70,368 --a------ C:\WINDOWS\system\AVICAP.DLL 2007-03-28 16:09 70,144 --a------ C:\WINDOWS\NOTEPAD.EXE 2007-03-28 16:09 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll 2007-03-28 16:09 69,632 --a------ C:\WINDOWS\system\MMSYSTEM.DLL 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll 2007-03-28 16:09 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll 2007-03-28 16:09 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll 2007-03-28 16:09 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll 2007-03-28 16:09 5,120 --a------ C:\WINDOWS\system\SHELL.DLL 2007-03-28 16:09 33,744 --a------ C:\WINDOWS\system\COMMDLG.DLL 2007-03-28 16:09 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2007-03-28 16:09 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL 2007-03-28 16:09 19,200 --a------ C:\WINDOWS\system\TAPI.DLL 2007-03-28 16:09 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll 2007-03-28 16:09 15,872 --a------ C:\WINDOWS\TASKMAN.EXE 2007-03-28 16:09 13,824 --a------ C:\WINDOWS\system32\irclass.dll 2007-03-28 16:09 127,104 --a------ C:\WINDOWS\system\MSVIDEO.DLL 2007-03-28 16:09 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys 2007-03-28 16:09 109,504 --a------ C:\WINDOWS\system\AVIFILE.DLL 2007-03-28 16:09 103,936 --a------ C:\WINDOWS\system32\EqnClass.Dll 2007-03-28 16:09 <DIR> dr-h----- C:\DOKUME~1\DEFAUL~1\Lokale Einstellungen 2007-03-28 16:09 <DIR> dr------- C:\Programme 2007-03-28 16:09 <DIR> dr------- C:\DOKUME~1\DEFAUL~1\Startmen 2007-03-28 16:09 <DIR> dr------- C:\DOKUME~1\ALLUSE~1\Startmen 2007-03-28 16:09 <DIR> dr------- C:\DOKUME~1\ALLUSE~1\Dokumente 2007-03-28 16:09 <DIR> d--hs---- C:\WINDOWS\Installer 2007-03-28 16:09 <DIR> d--h----- C:\DOKUME~1\DEFAUL~1\Vorlagen 2007-03-28 16:09 <DIR> d--h----- C:\DOKUME~1\DEFAUL~1\Netzwerkumgebung 2007-03-28 16:09 <DIR> d--h----- C:\DOKUME~1\DEFAUL~1\Druckumgebung 2007-03-28 16:09 <DIR> d--h----- C:\DOKUME~1\ALLUSE~1\Vorlagen 2007-03-28 16:09 <DIR> d-------- C:\Programme\Gemeinsame Dateien\SpeechEngines 2007-03-28 16:09 <DIR> d-------- C:\Programme\Gemeinsame Dateien\ODBC 2007-03-28 16:09 <DIR> d-------- C:\DOKUME~1\DEFAUL~1\Favoriten 2007-03-28 16:09 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\Favoriten 2007-03-28 16:08 <DIR> dr-h----- C:\DOKUME~1\DEFAUL~1\Anwendungsdaten 2007-03-28 16:08 <DIR> dr-h----- C:\DOKUME~1\ALLUSE~1\Anwendungsdaten 2007-03-28 16:08 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2007-03-28 16:08 <DIR> d-------- C:\WINDOWS\system32\CatRoot 2007-03-28 16:06 <DIR> d--hs---- C:\System Volume Information 2007-03-28 16:06 <DIR> d-------- C:\Dokumente und Einstellungen 2007-03-28 16:01 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-03-28 16:01 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-03-28 16:01 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2007-03-28 15:52 <DIR> d-------- C:\Programme\Lavasoft 2007-03-28 15:52 <DIR> d-------- C:\DOKUME~1\Marvin\ANWEND~1\Lavasoft 2007-03-28 15:50 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic 2007-03-28 15:47 <DIR> d--hs---- C:\RECYCLER 2007-03-28 15:46 <DIR> d-------- C:\Programme\Valve 2007-03-28 15:39 0 --a------ C:\WINDOWS\nsreg.dat 2007-03-28 15:36 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-03-28 15:34 <DIR> d--h----- C:\Programme\InstallShield Installation Information 2007-03-28 15:34 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Prism 2007-03-28 15:33 379,232 -ra------ C:\WINDOWS\system32\drivers\SE4501D.sys 2007-03-28 15:32 15,781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys 2007-03-28 15:32 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-03-28 15:32 <DIR> d-------- C:\Programme\Siemens 2007-03-28 15:32 <DIR> d-------- C:\Programme\Gemeinsame Dateien\InstallShield 2007-03-28 15:28 917,504 --a------ C:\WINDOWS\system\cmids3d.dll 2007-03-28 15:28 812,416 --a------ C:\WINDOWS\system32\drivers\cmuda.sys 2007-03-28 15:28 712,704 --a------ C:\WINDOWS\system32\Audio3D.dll 2007-03-28 15:28 712,704 --a------ C:\WINDOWS\system32\a3d.dll 2007-03-28 15:28 328,704 --a------ C:\WINDOWS\IsUn0407.exe 2007-03-28 15:28 32,768 --a------ C:\WINDOWS\system32\udaprop.dll 2007-03-28 15:28 28,672 --a------ C:\WINDOWS\system32\cmirmdrv.dll 2007-03-28 15:28 28,672 --a------ C:\WINDOWS\CMIRmDriver.dll 2007-03-28 15:28 266,240 --a------ C:\WINDOWS\CMIUninstall.exe 2007-03-28 15:28 233,472 --a------ C:\WINDOWS\system32\cmirmdrv.exe 2007-03-28 15:28 225,280 --a------ C:\WINDOWS\CmiRmRedundDir.exe 2007-03-28 15:28 151,552 --a------ C:\WINDOWS\system32\cmuda.dll 2007-03-28 15:28 1,454,080 --a------ C:\WINDOWS\system\SmWizard.exe 2007-03-28 15:28 <DIR> d-------- C:\Programme\C-Media 3D Audio 2007-03-28 15:25 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-03-28 15:24 2,359,296 --ah----- C:\DOKUME~1\Marvin\NTUSER.DAT 2007-03-28 15:24 <DIR> dr-h----- C:\DOKUME~1\Marvin\Anwendungsdaten 2007-03-28 15:24 <DIR> dr------- C:\DOKUME~1\Marvin\Startmen 2007-03-28 15:24 <DIR> dr------- C:\DOKUME~1\Marvin\Favoriten 2007-03-28 15:24 <DIR> dr------- C:\DOKUME~1\Marvin\Eigene Dateien 2007-03-28 15:24 <DIR> d--h----- C:\DOKUME~1\Marvin\Vorlagen 2007-03-28 15:24 <DIR> d--h----- C:\DOKUME~1\Marvin\Netzwerkumgebung 2007-03-28 15:24 <DIR> d--h----- C:\DOKUME~1\Marvin\Lokale Einstellungen 2007-03-28 15:24 <DIR> d--h----- C:\DOKUME~1\Marvin\Druckumgebung 2007-03-28 15:23 229,376 --ah----- C:\DOKUME~1\LOCALS~1\NTUSER.DAT 2007-03-28 15:23 <DIR> d--h----- C:\DOKUME~1\LOCALS~1\Lokale Einstellungen 2007-03-28 15:23 <DIR> d-------- C:\WINDOWS\SoftwareDistribution 2007-03-28 15:23 <DIR> d-------- C:\WINDOWS\Prefetch 2007-03-28 15:23 <DIR> d-------- C:\DOKUME~1\LOCALS~1\Anwendungsdaten 2007-03-28 15:22 229,376 --ah----- C:\DOKUME~1\NETWOR~1\NTUSER.DAT 2007-03-28 15:22 <DIR> d--h----- C:\DOKUME~1\NETWOR~1\Lokale Einstellungen 2007-03-28 15:22 <DIR> d-------- C:\DOKUME~1\NETWOR~1\Anwendungsdaten 2007-03-28 15:19 229,376 ---h----- C:\DOKUME~1\DEFAUL~1\NTUSER.DAT 2007-03-28 15:19 0 -rahs---- C:\MSDOS.SYS 2007-03-28 15:19 0 -rahs---- C:\IO.SYS 2007-03-28 15:19 0 --a------ C:\CONFIG.SYS 2007-03-28 15:19 0 --a------ C:\AUTOEXEC.BAT 2007-03-28 15:19 <DIR> d-------- C:\WINDOWS\system32\xircom 2007-03-28 15:19 <DIR> d-------- C:\Programme\microsoft frontpage 2007-03-28 15:18 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2007-03-28 15:18 <DIR> d--hs---- C:\DOKUME~1\ALLUSE~1\DRM 2007-03-28 15:17 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2007-03-28 15:17 <DIR> dr------- C:\WINDOWS\Offline Web Pages 2007-03-28 15:17 <DIR> d--h----- C:\Programme\WindowsUpdate 2007-03-28 15:17 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files 2007-03-28 15:17 <DIR> d-------- C:\WINDOWS\system32\DirectX 2007-03-28 15:17 <DIR> d-------- C:\Programme\Online-Dienste 2007-03-28 15:16 86,016 --a------ C:\WINDOWS\system32\isign32.dll 2007-03-28 15:16 81,920 --a------ C:\WINDOWS\system32\ils.dll 2007-03-28 15:16 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2007-03-28 15:16 73,728 --a------ C:\WINDOWS\system32\icwdial.dll 2007-03-28 15:16 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2007-03-28 15:16 70,144 --a------ C:\WINDOWS\system32\acctres.dll 2007-03-28 15:16 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2007-03-28 15:16 69,632 --a------ C:\WINDOWS\system32\msconf.dll 2007-03-28 15:16 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-03-28 15:16 67,584 --a------ C:\WINDOWS\system32\srclient.dll 2007-03-28 15:16 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll 2007-03-28 15:16 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll 2007-03-28 15:16 51,712 --a------ C:\WINDOWS\system32\inetres.dll 2007-03-28 15:16 466,200 --a------ C:\WINDOWS\system32\wuapi.dll 2007-03-28 15:16 45,568 --a------ C:\WINDOWS\system32\safrslv.dll 2007-03-28 15:16 44,032 --a------ C:\WINDOWS\system32\racpldlg.dll 2007-03-28 15:16 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2007-03-28 15:16 41,240 --a------ C:\WINDOWS\system32\wups.dll 2007-03-28 15:16 382,464 --a------ C:\WINDOWS\system32\qmgr.dll 2007-03-28 15:16 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll 2007-03-28 15:16 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2007-03-28 15:16 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2007-03-28 15:16 29,696 --a------ C:\WINDOWS\system32\safrdm.dll 2007-03-28 15:16 282,624 --a------ C:\WINDOWS\system32\inetcfg.dll 2007-03-28 15:16 280,064 --a------ C:\WINDOWS\system32\mstask.dll 2007-03-28 15:16 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2007-03-28 15:16 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll 2007-03-28 15:16 242,176 --a------ C:\WINDOWS\system32\srrstr.dll 2007-03-28 15:16 23,040 --a------ C:\WINDOWS\system32\fltmc.exe 2007-03-28 15:16 194,840 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-03-28 15:16 192,000 --a------ C:\WINDOWS\system32\schedsvc.dll 2007-03-28 15:16 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2007-03-28 15:16 174,872 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-03-28 15:16 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2007-03-28 15:16 171,008 --a------ C:\WINDOWS\system32\srsvc.dll 2007-03-28 15:16 16,896 --a------ C:\WINDOWS\system32\fltlib.dll 2007-03-28 15:16 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2007-03-28 15:16 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys 2007-03-28 15:16 128,280 --a------ C:\WINDOWS\system32\wucltui.dll 2007-03-28 15:16 124,696 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-03-28 15:16 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2007-03-28 15:16 12,288 --a------ C:\WINDOWS\system32\mstinit.exe 2007-03-28 15:16 105,984 --a------ C:\WINDOWS\system32\msoert2.dll 2007-03-28 15:16 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-03-28 15:16 <DIR> d---s---- C:\WINDOWS\Tasks 2007-03-28 15:16 <DIR> d-------- C:\WINDOWS\system32\Restore 2007-03-28 15:16 <DIR> d-------- C:\WINDOWS\system32\Macromed 2007-03-28 15:16 <DIR> d-------- C:\WINDOWS\srchasst 2007-03-28 15:16 <DIR> d-------- C:\Programme\Movie Maker 2007-03-28 15:16 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MSSoap 2007-03-28 15:16 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Dienste 2007-03-28 15:15 97,792 --a------ C:\WINDOWS\system32\comrepl.dll 2007-03-28 15:15 80,896 --a------ C:\WINDOWS\system32\charmap.exe 2007-03-28 15:15 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2007-03-28 15:15 683,520 --a------ C:\WINDOWS\system32\getuname.dll 2007-03-28 15:15 57,344 --a------ C:\WINDOWS\system32\sol.exe 2007-03-28 15:15 55,808 --a------ C:\WINDOWS\system32\freecell.exe 2007-03-28 15:15 54,272 --a------ C:\WINDOWS\system32\stclient.dll 2007-03-28 15:15 5,632 --a------ C:\WINDOWS\system32\write.exe 2007-03-28 15:15 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2007-03-28 15:15 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2007-03-28 15:15 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2007-03-28 15:15 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2007-03-28 15:15 35,840 --a------ C:\WINDOWS\system32\winchat.exe 2007-03-28 15:15 33,792 --a------ C:\WINDOWS\system32\regini.exe 2007-03-28 15:15 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2007-03-28 15:15 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2007-03-28 15:15 232,960 --a------ C:\WINDOWS\system32\avtapi.dll 2007-03-28 15:15 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe 2007-03-28 15:15 22,528 --a------ C:\WINDOWS\system32\msg.exe 2007-03-28 15:15 21,740 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-03-28 15:15 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2007-03-28 15:15 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe 2007-03-28 15:15 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe 2007-03-28 15:15 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2007-03-28 15:15 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe 2007-03-28 15:15 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2007-03-28 15:15 15,872 --a------ C:\WINDOWS\system32\logoff.exe 2007-03-28 15:15 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2007-03-28 15:15 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe 2007-03-28 15:15 15,360 --a------ C:\WINDOWS\system32\tscon.exe 2007-03-28 15:15 15,360 --a------ C:\WINDOWS\system32\shadow.exe 2007-03-28 15:15 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2007-03-28 15:15 139,776 --a------ C:\WINDOWS\system32\sndvol32.exe 2007-03-28 15:15 128,000 --a------ C:\WINDOWS\system32\mshearts.exe 2007-03-28 15:15 120,320 --a------ C:\WINDOWS\system32\winmine.exe 2007-03-28 15:15 114,688 --a------ C:\WINDOWS\system32\calc.exe 2007-03-28 15:15 10,240 --a------ C:\WINDOWS\system32\reset.exe 2007-03-28 15:15 1,237 --a------ C:\WINDOWS\system32\usrlogon.cmd 2007-03-28 15:15 <DIR> d-------- C:\WINDOWS\Registration 2007-03-28 15:15 <DIR> d-------- C:\Programme\Online Services 2007-03-28 15:15 <DIR> d-------- C:\Programme\MSN Gaming Zone 2007-03-28 15:15 <DIR> d-------- C:\Programme\Messenger 2007-03-28 15:14 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-03-28 15:14 94,720 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2007-03-28 15:14 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-03-28 15:14 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2007-03-28 15:14 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2007-03-28 15:14 67,072 --a------ C:\WINDOWS\system32\rdshost.exe 2007-03-28 15:14 655,360 --a------ C:\WINDOWS\system32\mstscax.dll 2007-03-28 15:14 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-03-28 15:14 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe 2007-03-28 15:14 61,440 --a------ C:\WINDOWS\system32\remotepg.dll 2007-03-28 15:14 60,416 --a------ C:\WINDOWS\system32\colbact.dll 2007-03-28 15:14 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2007-03-28 15:14 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll 2007-03-28 15:14 58,880 --a------ C:\WINDOWS\system32\licwmi.dll 2007-03-28 15:14 56,320 --a------ C:\WINDOWS\system32\servdeps.dll 2007-03-28 15:14 540,160 --a------ C:\WINDOWS\system32\comuid.dll 2007-03-28 15:14 539,136 --a------ C:\WINDOWS\system32\spider.exe 2007-03-28 15:14 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll 2007-03-28 15:14 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2007-03-28 15:14 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-03-28 15:14 412,672 --a------ C:\WINDOWS\system32\mstsc.exe 2007-03-28 15:14 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2007-03-28 15:14 39,424 --a------ C:\WINDOWS\system32\cfgbkend.dll 2007-03-28 15:14 356,352 --a------ C:\WINDOWS\system32\hypertrm.dll 2007-03-28 15:14 346,624 --a------ C:\WINDOWS\system32\mspaint.exe 2007-03-28 15:14 297,472 --a------ C:\WINDOWS\system32\termsrv.dll 2007-03-28 15:14 225,792 --a------ C:\WINDOWS\system32\catsrv.dll 2007-03-28 15:14 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2007-03-28 15:14 20,480 --a------ C:\WINDOWS\system32\qprocess.exe 2007-03-28 15:14 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2007-03-28 15:14 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2007-03-28 15:14 189,440 --a------ C:\WINDOWS\system32\cmprops.dll 2007-03-28 15:14 188,416 --a------ C:\WINDOWS\system32\accwiz.exe 2007-03-28 15:14 17,920 --a------ C:\WINDOWS\system32\mmfutil.dll 2007-03-28 15:14 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-03-28 15:14 147,968 --a------ C:\WINDOWS\system32\rdchost.dll 2007-03-28 15:14 142,848 --a------ C:\WINDOWS\system32\sessmgr.exe 2007-03-28 15:14 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2007-03-28 15:14 133,120 --a------ C:\WINDOWS\system32\sndrec32.exe 2007-03-28 15:14 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2007-03-28 15:14 124,928 --a------ C:\WINDOWS\system32\mplay32.exe 2007-03-28 15:14 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2007-03-28 15:14 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-03-28 15:14 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll 2007-03-28 15:14 11,264 --a------ C:\WINDOWS\system32\icaapi.dll 2007-03-28 15:14 104,448 --a------ C:\WINDOWS\system32\clipbrd.exe 2007-03-28 15:14 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-03-28 15:14 <DIR> d-------- C:\WINDOWS\system32\MsDtc 2007-03-28 15:14 <DIR> d-------- C:\WINDOWS\system32\Com 2007-03-28 15:14 <DIR> d-------- C:\Programme\Windows NT (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-02 15:02 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-03-31 10:59 48156 --a------ C:\WINDOWS\system32\perfc007.dat 2007-03-31 10:59 316594 --a------ C:\WINDOWS\system32\perfh007.dat 2007-03-28 16:09 62 --ahs---- C:\DOKUME~1\Marvin\ANWEND~1\desktop.ini 2007-03-17 15:44 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-15 18:17 337280 --a------ C:\WINDOWS\system32\wgatray.old.exe 2007-03-08 17:36 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:32 1843712 --a------ C:\WINDOWS\system32\win32k.sys 2007-02-05 22:18 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {49E0E0F0-5C30-11D4-945D-000000000003} C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll {A442C0BD-F63F-4D92-B5DD-7EA7738D45D2} C:\WINDOWS\system32\mlljg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "nwiz"="nwiz.exe /install" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_03\\bin\\jusched.exe" "avgnt"="\"C:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "PRISMSVR.EXE"="\"C:\\Programme\\Siemens\\Gigaset USB Adapter 54\\PRISMSVR.EXE\" /APPLY" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "Easy-PrintToolBox"="C:\\Programme\\Canon\\Easy-PrintToolBox\\BJPSMAIN.EXE /logon" "WA6PU_Check"="\"C:\\Programme\\Gemeinsame Dateien\\DriveCleaner Free\\udcwap.exe\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Steam"="\"c:\\programme\\valve\\steam\\steam.exe\" -silent" "Ashampoo PopUpBlocker"="C:\\PROGRA~1\\Ashampoo\\ASHAMP~1\\PopUpKiller.exe" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlljg HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="BearShare" "hkey"="HKLM" "command"="\"C:\\Programme\\BearShare\\BearShare.exe\" /pause" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ICQ" "hkey"="HKCU" "command"="\"C:\\Programme\\ICQ6\\ICQ.exe\" silent" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ICQLite" "hkey"="HKLM" "command"="\"C:\\Programme\\ICQLite\\ICQLite.exe\" -minimize" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VC8Player] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="VC8Play" "hkey"="HKLM" "command"="C:\\Programme\\Virtual CD v8\\System\\VC8Play.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\\Programme\\Winamp\\winampa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-04-27 15:32:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-27 15:32:32 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 07-04-27 15:32 datfind.bat Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 1C00-D658 Verzeichnis von c:\ 27.04.2007 15:36 0 dirdat.txt 27.04.2007 15:32 35.114 ComboFix.txt 27.04.2007 15:32 343 ComboFix-quarantined-files.txt 27.04.2007 15:29 536.399.872 hiberfil.sys 27.04.2007 15:29 805.306.368 pagefile.sys 22.04.2007 18:12 211 boot.ini 29.03.2007 21:49 0 data.txt 28.03.2007 15:19 0 MSDOS.SYS 28.03.2007 15:19 0 CONFIG.SYS 28.03.2007 15:19 0 IO.SYS 28.03.2007 15:19 0 AUTOEXEC.BAT 31.12.2002 14:00 251.184 ntldr 31.12.2002 14:00 47.564 NTDETECT.COM 31.12.2002 14:00 4.952 bootfont.bin 14 Datei(en) 1.342.045.608 Bytes 0 Verzeichnis(se), 54.472.105.984 Bytes frei Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 1C00-D658 Verzeichnis von C:\WINDOWS\system32 27.04.2007 15:35 671.023 gjllm.ini2 27.04.2007 15:30 88.566 nvapps.xml 27.04.2007 15:28 670.704 gjllm.ini 27.04.2007 15:25 670.704 gjllm.tmp 27.04.2007 15:20 672.166 gjllm.bak2 27.04.2007 13:08 1.514.270 rcfgdecy.ini 25.04.2007 14:10 2.206 wpa.dbl 18.04.2007 19:09 512.014 gjllm.bak1 05.04.2007 11:36 280.676 mlljg.dll 05.04.2007 03:08 1.403.968 FNTCACHE.DAT 03.04.2007 22:48 13.511.640 MRT.exe 02.04.2007 14:21 428.032 swreg.exe 31.03.2007 10:59 39.992 perfc009.dat 31.03.2007 10:59 316.594 perfh007.dat 31.03.2007 10:59 311.604 perfh009.dat 31.03.2007 10:59 723.744 PerfStringBackup.INI 31.03.2007 10:59 48.156 perfc007.dat 28.03.2007 23:16 34.064 lhacm.acm 28.03.2007 17:19 122.142 TZLog.log 28.03.2007 16:28 3.534 jupdate-1.5.0_03-b07.log 28.03.2007 16:13 0 h323log.txt 28.03.2007 15:22 261 $winnt$.inf 28.03.2007 15:19 2.951 CONFIG.NT 28.03.2007 15:18 16.832 amcompat.tlb 28.03.2007 15:18 23.392 nscompat.tlb 28.03.2007 15:17 488 logonui.exe.manifest 28.03.2007 15:17 488 WindowsLogon.manifest 28.03.2007 15:17 749 nwc.cpl.manifest 28.03.2007 15:17 749 sapi.cpl.manifest 28.03.2007 15:17 749 wuaucpl.cpl.manifest 28.03.2007 15:17 749 cdplayer.exe.manifest 28.03.2007 15:17 749 ncpa.cpl.manifest 28.03.2007 15:15 21.740 emptyregdb.dat 22.03.2007 05:48 102.400 SampleGrabber.ax 17.03.2007 15:44 293.376 winsrv.dll 15.03.2007 18:19 1.476.992 LegitCheckControl.dll 15.03.2007 18:17 337.280 WgaTray.old.exe 09.03.2007 12:24 123.392 xpsp3res.dll 08.03.2007 17:36 40.960 mf3216.dll 08.03.2007 17:36 579.072 user32.dll 08.03.2007 17:36 281.600 gdi32.dll 08.03.2007 17:32 1.843.712 win32k.sys 28.02.2007 18:02 2.059.904 ntkrnlpa.exe 28.02.2007 18:02 2.182.656 ntoskrnl.exe 16.02.2007 10:54 49.152 QuickTime.qts 16.02.2007 10:54 65.536 QuickTimeVR.qtx 05.02.2007 22:18 185.856 upnphost.dll 29.01.2007 10:58 60.416 tzchange.exe 25.01.2007 14:52 617.472 urlmon.dll 23.01.2007 21:30 546.304 hhctrl.ocx 04.01.2007 15:41 664.576 wininet.dll 04.01.2007 15:41 474.624 shlwapi.dll 04.01.2007 15:41 1.494.528 shdocvw.dll 04.01.2007 15:41 532.480 mstime.dll 04.01.2007 15:41 39.424 pngfilt.dll 04.01.2007 15:40 146.432 msrating.dll 04.01.2007 15:40 448.512 mshtmled.dll 04.01.2007 15:40 3.077.632 mshtml.dll 04.01.2007 15:40 96.768 inseng.dll 04.01.2007 15:40 16.384 jsproxy.dll 04.01.2007 15:40 251.392 iepeers.dll 04.01.2007 15:40 205.312 dxtrans.dll 04.01.2007 15:40 357.888 dxtmsft.dll 04.01.2007 15:40 1.056.256 danim.dll 04.01.2007 15:40 55.808 extmgr.dll 04.01.2007 15:40 152.064 cdfview.dll 04.01.2007 15:40 1.023.488 browseui.dll ------------------------------------------------ Mehr Logfiles krieg ich nicht hin bei datfind.bat. Schritt 3 klappt nicht, da kein Command Fenster erscheint. |
|
|
|
|
|
|
27.04.2007, 16:08
Moderator
Beiträge: 7805 |
#4
Das passt schon, du musst nun nochmal ein Hijackthis log posten(entschuldige, ich haette die Reihenfolgen sagen sollen....) Wie gefragt, weisst du, wo du dir den Vundo eingefangen hast.
__________ MfG Ralf SEO-Spam Hunter |
|
|
|
|
|
|
27.04.2007, 16:18
...neu hier
Themenstarter Beiträge: 3 |
#5
Puhh, leider weiß ich das nicht. Ich hoffe das man das Problem trotzdem beheben kann.
----------------------------- Logfile of HijackThis v1.99.1 Scan saved at 16:18:09, on 27.04.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\nvsvc32.exe C:\Programme\Virtual CD v8\System\VC8SecS.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\Java\jre1.5.0_03\bin\jusched.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Siemens\Gigaset USB Adapter 54\PRISMSVR.EXE C:\WINDOWS\system32\RunDll32.exe C:\Programme\Gemeinsame Dateien\DriveCleaner Free\udcwap.exe C:\programme\valve\steam\steam.exe C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe C:\Programme\Siemens\Gigaset USB Adapter 54\GigasetUSBMonitor.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\qip\qip.exe C:\Dokumente und Einstellungen\Marvin\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/de/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: IE PopUp-Killer - {49E0E0F0-5C30-11D4-945D-000000000003} - C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll O2 - BHO: (no name) - {A442C0BD-F63F-4D92-B5DD-7EA7738D45D2} - C:\WINDOWS\system32\mlljg.dll (file missing) O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Programme\Siemens\Gigaset USB Adapter 54\PRISMSVR.EXE" /APPLY O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [WA6PU_Check] "C:\Programme\Gemeinsame Dateien\DriveCleaner Free\udcwap.exe" O4 - HKCU\..\Run: [Steam] "c:\programme\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Ashampoo PopUpBlocker] C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUpKiller.exe O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Adapter 54\GigasetUSBMonitor.exe O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\programme\bonjour\mdnsnsp.dll O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Virtual CD v8 Management Service (VC8SecS) - H+H Software GmbH - C:\Programme\Virtual CD v8\System\VC8SecS.exe |
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Seite(n): 1
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
Ich habe ein ziemlich nerviges Problem. Immer wenn ich Firefox starten will oder mit Firefox arbeite kommt diese Meldung:
Egal was ich drücke, ob löschen, ignorieren oder die anderen Sachen es passiert nix und die Meldung kommt immer wieder. Langsam nervt das.
Hoffe ihr könnt helfen. Danke !!!