Internetspeed verlangsamt

#16 so hier das neue log --->


ComboFix 08-04-16.5 - Administrator 2008-04-18 23:38:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.1602 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Administrator\Desktop\ComboFix.exe

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.

((((((((((((((((((((((( Dateien erstellt von 2008-03-18 bis 2008-04-18 ))))))))))))))))))))))))))))))
.

2008-04-18 16:56 . 2008-04-18 16:56 <DIR> d-------- C:\_OTMoveIt
2008-04-16 02:14 . 2008-04-16 02:14 <DIR> d-------- C:\Programme\Avira
2008-04-16 02:14 . 2008-04-16 02:14 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-04-14 23:50 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-04-14 23:50 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-04-14 23:50 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-04-14 16:17 . 2008-04-14 16:17 137,084 --a------ C:\boosterlogfile.rtf
2008-04-14 14:14 . 2008-04-14 14:14 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue
2008-04-14 14:13 . 2008-04-14 14:13 <DIR> d-------- C:\Programme\Uniblue
2008-04-14 13:24 . 2008-04-14 13:24 <DIR> d-------- C:\Programme\Trend Micro
2008-04-12 19:29 . 2008-04-12 19:29 <DIR> d-------- C:\Programme\Lavasoft
2008-04-12 19:29 . 2008-04-12 19:30 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lavasoft
2008-04-12 17:59 . 2008-04-12 17:59 <DIR> d-------- C:\Programme\SCHLECKER
2008-04-12 17:59 . 2008-04-12 17:59 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps
2008-04-12 17:59 . 2008-04-12 17:59 1,025 --a------ C:\WINDOWS\system32\sysprs7.tgz
2008-04-12 17:59 . 2008-04-12 17:59 1,025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-04-12 17:59 . 2008-04-12 17:59 1,025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-04-12 17:59 . 2008-04-12 17:59 1,025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-04-12 17:59 . 2008-04-12 17:59 219 --a------ C:\WINDOWS\system32\lsprst7.tgz
2008-04-12 17:59 . 2008-04-12 17:59 87 --a------ C:\WINDOWS\system32\ssprs.tgz
2008-04-12 01:28 . 2008-04-12 01:28 <DIR> d-------- C:\Programme\Sygate
2008-04-12 01:28 . 2008-04-12 19:28 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-04-12 01:28 . 2004-02-02 12:06 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2008-04-12 01:28 . 2004-02-02 10:51 55,891 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2008-04-12 01:28 . 2004-02-02 10:53 18,518 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-04-12 01:28 . 2004-02-02 10:37 11,914 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2008-04-12 01:17 . 2008-04-12 01:17 <DIR> d-------- C:\Programme\Ashampoo
2008-04-11 16:05 . 2008-04-10 21:00 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-04-11 16:05 . 2008-04-08 22:44 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-04-11 16:05 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-04-11 16:05 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-11 16:05 . 2008-04-11 16:05 1,380 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-08 13:20 . 2008-04-16 13:06 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-08 13:20 . 2008-04-08 13:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-08 13:19 . 2008-04-08 13:19 <DIR> d-------- C:\Programme\QuickTime
2008-04-08 13:19 . 2008-04-08 13:19 <DIR> d-------- C:\Programme\iTunes
2008-04-08 13:19 . 2008-04-08 13:19 <DIR> d-------- C:\Programme\iPod
2008-04-08 13:19 . 2008-04-08 13:19 <DIR> d-------- C:\Programme\Bonjour
2008-04-08 13:19 . 2008-04-08 13:25 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2008-04-08 13:19 . 2008-04-08 13:25 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Apple Computer
2008-04-08 13:18 . 2008-04-08 13:18 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Apple
2008-04-08 13:18 . 2008-04-08 13:18 <DIR> d-------- C:\Programme\Apple Software Update
2008-04-08 13:18 . 2008-04-08 13:18 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2008-04-08 13:18 . 2008-02-18 11:16 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys
2008-04-08 12:32 . 2008-04-08 12:32 <DIR> d-------- C:\Programme\QIP
2008-04-07 22:06 . 2008-04-16 19:33 <DIR> d-------- C:\Pictures
2008-04-06 18:01 . 2008-04-06 18:01 <DIR> d-------- C:\Programme\Xvid
2008-04-06 18:00 . 2008-04-06 18:00 <DIR> d-------- C:\Programme\aTube Catcher 1.0
2008-04-06 16:31 . 2008-04-06 16:31 98,304 --a------ C:\WINDOWS\system32\qttask.exe
2008-04-06 16:30 . 2003-08-18 05:10 122,880 --a------ C:\WINDOWS\system32\directx.cpl
2008-04-06 16:30 . 2003-03-25 05:49 106,544 --a------ C:\WINDOWS\system32\tweakui.cpl
2008-04-06 16:30 . 2003-03-25 05:49 98,304 --a------ C:\WINDOWS\system32\startup.cpl
2008-04-06 16:30 . 2004-02-17 10:11 53,248 --a------ C:\WINDOWS\system32\vp6dec_settings.cpl
2008-04-06 16:30 . 2003-03-25 05:49 51,238 --a------ C:\WINDOWS\system32\tweakui.hlp
2008-04-06 16:29 . 2008-04-08 13:19 <DIR> d-------- C:\WINDOWS\system32\QuickTime
2008-04-06 16:29 . 2004-11-08 20:01 360,504 --a------ C:\WINDOWS\system32\qtplugin.ocx
2008-04-06 16:29 . 2008-04-07 20:04 8,890 --a------ C:\WINDOWS\system32\quicktime.qtp
2008-04-06 16:28 . 2008-04-06 16:30 <DIR> d-------- C:\Programme\ACE Mega CoDecS Pack
2008-04-06 16:25 . 2008-04-06 16:26 <DIR> d-------- C:\Programme\VistaCodecPack
2008-04-05 22:05 . 2008-04-09 12:36 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\HP
2008-04-05 22:04 . 2006-06-03 21:29 48,640 --a------ C:\WINDOWS\system32\hpzll4pi.dll
2008-04-05 21:51 . 2008-04-05 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HP
2008-04-05 21:50 . 2008-04-05 21:50 <DIR> d-------- C:\Programme\Hewlett-Packard
2008-04-05 21:45 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-04-05 21:45 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll
2008-04-05 21:45 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2008-04-05 21:45 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2008-04-05 21:45 . 2007-08-09 09:27 73,728 --a------ C:\WINDOWS\system32\HPZipm12.exe
2008-04-05 21:45 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe
2008-04-05 21:45 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2008-04-05 21:44 . 2008-04-05 22:04 <DIR> d-------- C:\Programme\HP
2008-04-05 21:44 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-05 21:44 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-04-05 21:43 . 2008-04-05 22:09 135,820 --a------ C:\WINDOWS\HPHins12.dat
2008-04-05 21:43 . 2006-06-13 00:21 14,916 --------- C:\WINDOWS\hphmdl12.dat
2008-04-05 21:01 . 2008-04-05 21:01 <DIR> d-------- C:\fsaua.data
2008-04-05 20:52 . 2008-04-09 19:51 250 --a------ C:\WINDOWS\gmer.ini
2008-04-05 19:13 . 2008-04-18 16:04 <DIR> d-------- C:\Programme\KaLoMa
2008-04-05 18:11 . 2008-04-05 18:11 <DIR> d-------- C:\Programme\FastStone Image Viewer
2008-04-05 18:11 . 2008-04-05 18:11 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\FastStone
2008-04-05 00:35 . 2008-04-05 00:35 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\vlc
2008-04-05 00:34 . 2008-04-05 00:34 <DIR> d-------- C:\Programme\VideoLAN
2008-04-04 22:53 . 2004-08-04 00:57 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-04-04 19:26 . 2008-04-18 00:59 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\.housecall6.6
2008-04-04 19:25 . 2008-04-04 19:25 <DIR> d-------- C:\WINDOWS\Sun
2008-04-04 19:24 . 2008-04-04 19:24 <DIR> d-------- C:\Programme\Java
2008-04-04 19:24 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-04 19:22 . 2008-04-04 19:22 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Java
2008-04-04 18:51 . 2008-04-05 21:37 <DIR> d-------- C:\Programme\Panda Security
2008-04-04 18:51 . 2008-04-04 20:41 2,517 --a------ C:\WINDOWS\mozver.dat
2008-04-04 18:48 . 2008-04-04 18:48 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\UserData
2008-04-04 17:55 . 2008-04-04 18:42 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Contacts
2008-04-04 17:54 . 2008-04-14 23:59 <DIR> d-------- C:\WINDOWS\$hf_mig$
2008-04-04 17:51 . 2008-04-04 17:53 <DIR> d--hsc--- C:\Programme\Gemeinsame Dateien\WindowsLiveInstaller
2008-04-04 17:51 . 2008-04-04 17:54 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLInstaller
2008-04-04 16:41 . 2008-04-08 13:18 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-04-04 16:41 . 2008-04-04 17:51 <DIR> d-------- C:\Programme\Windows Live
2008-04-04 01:36 . 2008-04-04 01:50 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\InfraRecorder
2008-04-03 23:28 . 2008-04-03 23:28 <DIR> d-------- C:\Programme\InfraRecorder
2008-04-03 22:31 . 2008-04-03 22:31 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-03 19:13 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-04-03 18:50 --------- d-----w C:\Programme\Gemeinsame Dateien\ATI Technologies
2008-04-03 18:50 --------- d-----w C:\Programme\ATI Technologies
2008-04-03 18:49 --------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield
2008-04-03 18:42 --------- d-----w C:\Programme\Realtek
2008-04-03 18:27 --------- d-----w C:\Programme\AMD
2008-04-03 17:08 --------- d-----w C:\Programme\microsoft frontpage
2008-04-03 17:07 --------- d-----w C:\Programme\Online-Dienste
2008-04-03 17:06 --------- d-----w C:\Programme\Gemeinsame Dateien\Dienste
2008-03-20 08:03 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 17:07 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-06 22:29 966,656 ----a-w C:\WINDOWS\system32\VSFilter.dll
2008-03-01 12:54 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:50 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:33 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-01-29 10:02 107,368 ----a-w C:\WINDOWS\system32\GEARAspi.dll
.

((((((((((((((((((((((((((((( snapshot@2008-04-18_13.07.03,71 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-18 11:02:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-18 21:36:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"MsnMsgr"="C:\Programme\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 09:34 16143872 C:\WINDOWS\RTHDCPL.exe]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"HP Software Update"="C:\Programme\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]
"QuickTime Task"="C:\Programme\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-02-24 16:35 2372760]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:57 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Programme\iTunes\iTunesHelper.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\QIP\\qip.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=

R3 TSMPacket;DSL-Manager Service;C:\WINDOWS\system32\DRIVERS\tsmpkt.sys [2007-06-26 11:53]
S3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\dsltestSp5.sys [2007-09-12 17:24]
S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\OnlineScanner\Anti-Virus\fsgk.sys []
S3 NTGUARD;NTGUARD;C:\Programme\Ikarus\virus utilities\bin\NTGUARD.SYS []
S3 TDslMgrService;DSL-Manager;"C:\Programme\T-Online\DSL-Manager\DslMgrSvc.exe" [2007-11-26 14:50]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 23:39:44
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-04-18 23:40:12
ComboFix-quarantined-files.txt 2008-04-18 21:40:09
ComboFix2.txt 2008-04-18 11:07:12

9 Verzeichnis(se), 174,516,535,296 Bytes frei
11 Verzeichnis(se), 174,505,177,088 Bytes frei
.
2008-04-14 21:59:27 --- E O F ---

#17 ja, die Viren sind raus

«
Start - Ausführen - Kopiere rein: Combofix /U
- klicke "OK"

««
otmoveIt
klicken: CleanUp! button
Begin cleanup process? klicke: Yes. - "Do you want to reboot?" klicke Yes
so wird von OTMoveIt2 automatisch alles an Tools entfernt, die zur Virenreinigung geladen wurden.

««
wie rollert der PC und das Net ? Besser ?
__________
MfG Sabina

rund um die PC-Sicherheit

#18 Vielen Dank Sabina du bist die Beste.*bussi*

#19 hab nochmal mit Gmer gescannt hier das Ergebnis--->

#20 hab anscheinend wieder nen Rootkit drauf--->

Zitat

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-04-29 23:50:56
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT BAFB167C ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwMapViewOfSection [0xBAC598D0]
SSDT BAFB1668 ZwOpenProcess
SSDT BAFB166D ZwOpenThread
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwShutdownSystem [0xBAC59E70]
SSDT BAFB1677 ZwTerminateProcess
SSDT BAFB1672 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.14 ----

.text tcpip.sys!IPTransmit + 10BC A9C63CFA 6 Bytes CALL BA5F3200 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text tcpip.sys!IPTransmit + 263D A9C6527B 6 Bytes CALL BA5F3200 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text tcpip.sys!ARPRcv + 521E A9C6A4BE 6 Bytes CALL BA5F3200 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text wanarp.sys BAA5D3FD 4 Bytes CALL BA5F3350 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text wanarp.sys BAA5D402 2 Bytes [ 90, 90 ]

---- User code sections - GMER 1.0.14 ----

.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!LoadResource 7C809FB5 7 Bytes JMP 28001CD0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!FindResourceExW 7C80AC88 7 Bytes JMP 28001B10 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!FindResourceW 7C80BBCE 7 Bytes JMP 28001A90 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!SizeofResource 7C80BC69 7 Bytes JMP 28001D90 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!FindResourceA 7C80BE89 7 Bytes JMP 28001BA0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!LockResource 7C80CC97 5 Bytes JMP 28001E00 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!CreateEventA 7C8308AD 5 Bytes JMP 28001850 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!FindResourceExA 7C835F78 7 Bytes JMP 28001C30 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 0056DBBD C:\Programme\Windows Live\Messenger\msnmsgr.exe (Windows Live Messenger/Microsoft Corporation)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] kernel32.dll!OutputDebugStringW 7C85A42D 5 Bytes JMP 28001E60 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] ADVAPI32.dll!CryptDeriveKey 77DBA685 7 Bytes JMP 28001000 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] ADVAPI32.dll!CryptDecrypt 77DBA7B1 2 Bytes JMP 28001060 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] ADVAPI32.dll!CryptDecrypt + 3 77DBA7B4 4 Bytes [ 24, B0, CC, CC ]
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!PeekMessageW 7E36929B 5 Bytes JMP 280040C0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!CreateWindowExW 7E36FC25 5 Bytes JMP 28003850 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!SetWindowRgn 7E36FFB2 7 Bytes JMP 280059A0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!LoadIconW 7E370894 5 Bytes JMP 280062B0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!LoadImageW 7E372CFE 5 Bytes JMP 280060C0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!CreateDialogParamW 7E377D4F 5 Bytes JMP 28005AC0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!SetWindowPlacement 7E37D84C 5 Bytes JMP 28005860 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!MessageBoxIndirectW 7E3B62AB 5 Bytes JMP 28005CB0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] USER32.dll!TrackPopupMenuEx 7E3BCD28 5 Bytes JMP 280049A0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WS2_32.dll!send 71A1428A 5 Bytes JMP 2800A2C0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 2800A0A0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WS2_32.dll!recv 71A1615A 5 Bytes JMP 28009F00 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 2800A4A0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2800A6E0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] SHELL32.dll!Shell_NotifyIconW 7E6D1B92 5 Bytes JMP 28003000 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] ole32.dll!CoInitializeEx 774CEF6B 5 Bytes JMP 28002110 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] ole32.dll!CoRegisterClassObject 774E8720 5 Bytes JMP 28002210 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WININET.dll!InternetCloseHandle 441EDA59 5 Bytes JMP 28009110 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WININET.dll!HttpOpenRequestA 441F4331 5 Bytes JMP 28008DD0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WININET.dll!InternetReadFile 441FABA4 5 Bytes JMP 28008F60 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[3388] WININET.dll!HttpSendRequestA 441FCD28 5 Bytes JMP 28009040 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Patchou)

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [BA5F3CB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [BA5F3CB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [BA5F3CB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [BA5F3CB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [BA5F3CB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [BA5F3B30] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [BA5F3CB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [BA5F3DB0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [BA5F3D50] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)

---- Devices - GMER 1.0.14 ----

Device \Driver\Tcpip \Device\Ip wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\Tcp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\Udp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\RawIp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\Tcpip \Device\IPMULTICAST wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\ssmdrv\Products@Avira AntiVir Personal \x2013 Free Antivirus C:\Programme\Avira\AntiVir PersonalEdition Classic\??????????????????????????????????????????????????????????????????????????????
Reg HKLM\SYSTEM\ControlSet002\Services\ssmdrv\Products@Avira AntiVir Personal \x2013 Free Antivirus C:\Programme\Avira\AntiVir PersonalEdition Classic\??????????????????????????????????????????????????????????????????????????????
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls@Avira AntiVir Personal \x2013 Free Antivirus C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

---- EOF - GMER 1.0.14 ----

#21 wo ist der Rootkit ??? Du siehst mehr als ich...
avira, Sygate und der Messenger Plus! Live....
__________
MfG Sabina

rund um die PC-Sicherheit

#22 kann es sein das Rootkits rot angezeigt werden??

#23 eigentlich ja...aber im Grunde wird unbekanntes rot angezeigt, bedeutet haber nicht, dass es "böse" ist.
Was ist rot ?
__________
MfG Sabina

rund um die PC-Sicherheit

#24 hab mich dann wohl geirrt.... dachte alles was in dem Fenster Rootkit zu sehn ist ist schlecht.