Schadcode auf Website |
||
|---|---|---|
| #0
| ||
|
16.06.2008, 12:21
Member
Beiträge: 31 |
||
 
|
|
|
|
16.06.2008, 15:17
Moderator
Beiträge: 5694 |
#2
Hallo
1. lösche mit cleaner die temp-Dateien http://www.ccleaner.de/?protecus.de 2. scannre mit rvaxo + poste den report http://virus-protect.org/artikel/tools/rvaxo.html 3. wende combofix an + warnmeldung wegklicken + poste den report http://virus-protect.org/artikel/tools/combofix.html 4. Scanne mit Counterspy + poste das Log http://www.virus-protect.org/counterspy1.html Sagt dir dieses Programm was? C:\Programme\Voipwise.com\Voipwise\Voipwise.exe Gruss Swiss Dieser Beitrag wurde am 16.06.2008 um 15:23 Uhr von Tonstudio editiert.
|
|
|
|
|
|
|
16.06.2008, 18:03
Member
Themenstarter Beiträge: 31 |
#3
ComboFix 08-06-15.4 - Robert 2008-06-16 16:02:05.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.43.1031.18.393 [GMT 2:00] ausgeführt von:: C:\Download\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt * Resident AV is active [color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color] . (((((((((((((((((((((((((((((((((((( Weitere L”schungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pskt.ini . ((((((((((((((((((((((( Dateien erstellt von 2008-05-16 bis 2008-06-16 )))))))))))))))))))))))))))))) . 2008-06-16 16:00 . 2008-06-16 16:10 <DIR> d-------- C:\RVAXO 2008-06-16 15:53 . 2008-06-16 16:01 117,950 --a------ C:\RVAXO.reg 2008-06-16 15:52 . 2008-05-29 21:30 828,824 --a------ C:\WINDOWS\system32\RVAXO.bat 2008-06-16 15:52 . 2001-10-01 14:51 69,632 --a------ C:\WINDOWS\system32\remove.exe 2008-06-16 14:09 . 2008-06-16 14:09 <DIR> d-------- C:\Programme\Acunetix 2008-06-16 14:07 . 2008-06-16 14:10 790 --a------ C:\WINDOWS\WVS_InstDBLogFile.csv 2008-06-16 14:07 . 2008-06-16 14:07 8 --a------ C:\WINDOWS\system32\ptl.dat.{F9EC52FA-7EC9-4CB0-AC04-73ECCDD900F5} 2008-06-16 12:50 . 2008-06-16 12:50 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2008-06-13 22:21 . 2008-06-13 22:23 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-06-13 21:27 . 2008-04-14 17:51 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-13 21:27 . 2008-04-14 17:51 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-13 17:06 . 2008-06-13 17:06 <DIR> d-------- C:\Programme\Audiograbber 2008-06-06 12:53 . 2008-06-06 12:53 <DIR> d-------- C:\Programme\Microsoft Works 2008-06-06 11:53 . 2008-06-13 21:23 1,354 --a------ C:\WINDOWS\Sandboxie.ini 2008-06-06 11:27 . 2008-06-06 11:29 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lavasoft 2008-06-06 05:41 . 2008-06-06 11:28 <DIR> d-------- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Lavasoft 2008-06-05 20:23 . 2008-06-06 11:28 <DIR> d-------- C:\Programme\Lavasoft 2008-06-05 20:15 . 2008-06-05 20:15 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Prevx 2008-06-05 20:14 . 2008-06-06 07:48 <DIR> d-------- C:\Temp 2008-06-05 16:52 . 2008-06-05 16:52 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-06-05 16:52 . 2008-06-05 16:52 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab 2008-06-05 16:44 . 2008-06-05 20:09 <DIR> d-------- C:\Programme\Sandboxie 2008-06-03 10:44 . 2008-06-16 09:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-03 10:44 . 2008-06-03 10:44 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-02 23:44 . 2008-06-02 23:44 <DIR> d-------- C:\WINDOWS\system32\ffdshow 2008-06-02 23:44 . 2006-03-11 04:56 438,272 --a------ C:\WINDOWS\system32\Mpeg2DecFilter.ax 2008-06-02 23:44 . 2006-03-11 04:48 434,176 --a------ C:\WINDOWS\system32\MatroskaSplitter.ax 2008-06-02 23:44 . 2007-03-28 11:27 364,544 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax 2008-06-02 23:44 . 2005-07-10 02:12 241,664 --a------ C:\WINDOWS\system32\CoreVorbis.ax 2008-06-02 23:44 . 2004-08-18 00:04 217,088 --a------ C:\WINDOWS\system32\CoreFLACDecoder.ax 2008-06-02 23:44 . 2007-09-26 15:47 122,880 --a------ C:\WINDOWS\system32\stQTSource.ax 2008-06-02 22:45 . 2008-06-02 22:45 333 --a------ C:\WINDOWS\system32\temp_0000_85-30.aok 2008-06-02 22:44 . 2008-06-02 22:44 173 --a------ C:\WINDOWS\system32\test.aok 2008-05-30 14:54 . 2008-05-30 14:54 <DIR> d-------- C:\Programme\ActiveFax 2008-05-30 10:16 . 2008-05-30 14:54 435,392 --a------ C:\WINDOWS\system32\ActMonNT.dll 2008-05-30 10:16 . 2008-05-30 14:54 99,150 --a------ C:\WINDOWS\system32\ActMon32.hlp 2008-05-30 10:16 . 2008-05-30 14:54 90,112 --a------ C:\WINDOWS\system32\ActMonRe.dll 2008-05-30 10:16 . 2008-05-30 14:54 83,136 --a------ C:\WINDOWS\UIActFax.exe 2008-05-30 10:16 . 2008-05-30 14:54 69,632 --a------ C:\WINDOWS\UIActFax.dll 2008-05-30 10:16 . 2008-05-30 14:54 8,352 --a------ C:\WINDOWS\UIActFax.hlp 2008-05-30 10:16 . 2008-05-30 14:54 591 --a------ C:\WINDOWS\system32\ActMon32.cnt 2008-05-30 10:16 . 2008-05-30 14:54 136 --a------ C:\WINDOWS\UIActFax.cnt 2008-05-30 10:16 . 2008-05-30 14:54 69 --a------ C:\WINDOWS\system32\ActiveFax.Cmd 2008-05-26 16:38 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2008-05-25 16:30 . 2008-06-06 12:29 <DIR> d-------- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Hide IP NG 2008-05-25 16:28 . 2008-05-25 16:29 <DIR> d-------- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\HideIP 2008-05-23 12:37 . 2008-05-23 12:37 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared 2008-05-22 22:16 . 2008-05-22 22:16 <DIR> d-------- C:\Programme\MSXML 6.0 2008-05-21 12:30 . 2008-06-06 12:25 <DIR> d-------- C:\Programme\Panda Security 2008-05-20 18:17 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-05-20 18:16 . 2008-05-20 18:16 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Java 2008-05-20 13:48 . 2008-05-20 13:48 3 --a------ C:\WINDOWS\system32\EUupdate.installed 2008-05-20 13:46 . 2006-12-04 01:34 1,698,048 --------- C:\WINDOWS\system32\XpsSvcs.dll 2008-05-20 13:46 . 2006-12-04 01:34 1,698,048 -----c--- C:\WINDOWS\system32\dllcache\XpsSvcs.dll 2008-05-20 13:46 . 2006-12-04 01:34 671,744 -----c--- C:\WINDOWS\system32\dllcache\PrintFilterPipelineSvc.exe 2008-05-20 13:46 . 2006-12-04 01:34 580,352 --------- C:\WINDOWS\system32\XPSSHHDR.dll 2008-05-20 13:46 . 2006-12-04 01:34 580,352 -----c--- C:\WINDOWS\system32\dllcache\XPSSHHDR.dll 2008-05-20 13:46 . 2006-12-04 01:34 124,416 --------- C:\WINDOWS\system32\prntvpt.dll 2008-05-20 13:46 . 2006-12-04 01:34 27,648 -----c--- C:\WINDOWS\system32\dllcache\FilterPipelinePrintProc.dll 2008-05-20 13:46 . 2006-12-04 01:34 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-05-20 13:41 . 2006-10-31 12:26 36,864 -----c--- C:\WINDOWS\system32\dllcache\hidclass.sys 2008-05-20 13:38 . 2006-10-23 13:14 143,488 -----c--- C:\WINDOWS\system32\dllcache\usbport.sys 2008-05-20 13:38 . 2006-11-08 10:51 62,336 --------- C:\WINDOWS\system32\drivers\rspndr.sys 2008-05-20 13:38 . 2006-10-23 13:14 59,264 -----c--- C:\WINDOWS\system32\dllcache\usbhub.sys 2008-05-20 13:38 . 2006-10-23 13:14 30,208 -----c--- C:\WINDOWS\system32\dllcache\usbehci.sys 2008-05-20 13:38 . 2006-10-23 13:14 20,608 -----c--- C:\WINDOWS\system32\dllcache\usbuhci.sys 2008-05-20 13:38 . 2006-10-23 13:14 17,152 -----c--- C:\WINDOWS\system32\dllcache\usbohci.sys 2008-05-20 13:38 . 2006-11-08 10:51 10,752 --------- C:\WINDOWS\system32\rspndr.exe 2008-05-20 13:38 . 2008-05-20 13:38 3 --a------ C:\WINDOWS\system32\vbrun60sp6.installed 2008-05-20 13:36 . 2006-08-18 14:38 476,160 -----c--- C:\WINDOWS\system32\dllcache\wzcsvc.dll 2008-05-20 13:36 . 2006-08-18 14:38 52,736 -----c--- C:\WINDOWS\system32\dllcache\wzcsapi.dll 2008-05-20 13:36 . 2006-08-18 11:36 14,592 -----c--- C:\WINDOWS\system32\dllcache\ndisuio.sys 2008-05-20 13:32 . 2008-05-20 13:32 3 --a------ C:\WINDOWS\system32\Wordpad-Converter-ZLib-update.installed 2008-05-20 13:30 . 2008-05-20 13:30 <DIR> d-------- C:\WINDOWS\system32\de 2008-05-20 13:30 . 2006-01-09 15:11 397,312 --------- C:\WINDOWS\system32\mmcex.dll 2008-05-20 13:30 . 2006-01-10 01:10 184,320 --------- C:\WINDOWS\system32\microsoft.managementconsole.dll 2008-05-20 13:30 . 2006-01-10 01:11 106,496 --------- C:\WINDOWS\system32\mmcfxcommon.dll 2008-05-20 13:30 . 2006-01-11 03:20 33,792 --------- C:\WINDOWS\system32\mmcperf.exe 2008-05-20 13:25 . 2005-07-30 02:01 121,856 --------- C:\WINDOWS\system32\drivers\usbvideo.sys 2008-05-20 12:07 . 2008-06-16 16:08 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2008-05-20 10:19 . 2008-06-02 16:08 <DIR> d-------- C:\Programme\Malwarebytes' Anti-Malware 2008-05-20 10:19 . 2008-05-20 10:19 <DIR> d-------- C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Malwarebytes 2008-05-20 10:19 . 2008-05-20 10:19 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2008-05-20 10:19 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-05-20 10:19 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-05-19 19:40 . 2008-05-19 19:40 <DIR> d-------- C:\Programme\CCleaner 2008-05-19 17:35 . 2008-05-19 17:35 <DIR> d-------- C:\Programme\Trend Micro 2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-16 13:36 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Babylon 2008-06-16 13:06 --------- d-----w C:\Programme\WS_FTP Pro 2008-06-06 11:00 --------- d-----w C:\Programme\Spybot - Search & Destroy 2008-06-06 10:54 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help 2008-06-06 10:51 --------- d-----w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Uniblue 2008-06-06 10:33 --------- d--h--w C:\Programme\InstallShield Installation Information 2008-06-06 10:33 --------- d-----w C:\Programme\Motorola Phone Tools 2008-06-06 10:33 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software 2008-06-06 10:32 --------- d---a-w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP 2008-06-06 10:24 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy 2008-06-06 09:59 --------- d-----w C:\Programme\Gemeinsame Dateien\Webroot Shared 2008-06-06 09:26 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard 2008-06-03 04:24 --------- d-----w C:\Programme\DivX 2008-06-02 21:44 --------- d-----w C:\Programme\SourceTec 2008-06-02 13:53 --------- d-----w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Skype 2008-05-30 11:07 --------- d-----w C:\Programme\Zoom Search Engine 5.1 2008-05-28 16:31 --------- d-----w C:\Programme\TotalValidatorTool 2008-05-26 14:43 --------- d-----w C:\Programme\Microsoft Lernen und Wissen 2008-05-26 08:12 --------- d-----w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\BitTorrent 2008-05-25 14:28 --------- d-----w C:\Programme\Hide IP Platinum 2008-05-24 15:09 --------- d-----w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\IBP 2008-05-23 10:54 --------- d-----w C:\Programme\XoftSpySE 2008-05-23 09:50 --------- d-----w C:\Programme\MSECACHE 2008-05-20 16:17 --------- d-----w C:\Programme\Java 2008-05-20 12:00 --------- d-----w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Babylon 2008-05-20 09:27 --------- d-----w C:\Programme\ITSolution 2008-05-19 15:53 --------- d-----w C:\Programme\Bytescout Movies Extractor Scout 2008-05-19 12:50 --------- d-----w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\AdobeUM 2008-05-19 11:37 --------- d-----w C:\Programme\Gemeinsame Dateien\Adobe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys 2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys 2008-04-10 19:50 74,752 ----a-w C:\WINDOWS\ST6UNST.EXE 2008-04-10 19:50 253,952 ------w C:\WINDOWS\Setup1.exe 2008-01-13 20:38 49,958 ----a-w C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\wklnhst.dat 2007-04-12 20:05 25,600 ----a-w C:\Dokumente und Einstellungen\Robert\usbsermptxp.sys 2007-04-12 20:05 22,768 ----a-w C:\Dokumente und Einstellungen\Robert\usbsermpt.sys 2007-01-08 09:44 774,144 ----a-w C:\Programme\RngInterstitial.dll 2006-04-25 19:39 46 ----a-w C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\wklnhst.dat 2007-04-09 20:09 278,528 ----a-w C:\Programme\internet explorer\plugins\PanoViewer.dll 2007-04-09 20:09 98,304 ----a-w C:\Programme\internet explorer\plugins\UPjpeg.dll 2007-07-01 20:42 23 --sha-w C:\WINDOWS\system32\daed_r.dll . ((((((((((((((((((((((((((((( snapshot_2008-05-20_16.20.02.96 ))))))))))))))))))))))))))))))))))))))))) . + 2008-05-26 14:39:08 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll + 2008-05-26 14:39:09 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll + 2008-05-26 14:39:10 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll + 2008-05-26 14:39:03 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:05 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:05 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:06 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:06 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:06 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:06 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:07 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:07 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:10 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-05-26 14:39:10 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll + 2008-05-26 14:39:10 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll + 2008-05-26 14:39:10 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll + 2008-05-26 14:39:10 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll + 2008-05-26 14:39:08 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll - 2008-05-20 14:10:38 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-16 14:10:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-14 15:51:00 273,024 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys + 2008-03-01 12:53:51 124,928 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll + 2008-03-01 12:53:51 347,136 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll + 2008-03-01 12:53:52 214,528 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll + 2008-03-01 12:53:52 133,120 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll + 2008-03-01 12:53:52 63,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll + 2008-02-29 08:54:43 70,656 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe + 2008-03-01 12:53:52 153,088 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll + 2008-03-01 12:53:52 230,400 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll + 2008-02-15 05:44:25 161,792 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll + 2008-03-01 12:53:52 383,488 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll + 2008-03-01 12:53:53 384,512 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll + 2008-03-01 12:53:56 6,066,176 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll + 2008-03-01 12:53:57 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll + 2008-03-01 12:53:57 267,776 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll + 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe + 2008-02-29 08:55:08 625,664 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe + 2008-03-01 12:53:58 27,648 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll + 2008-03-01 12:53:59 459,264 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll + 2008-03-01 12:53:59 52,224 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll + 2008-03-01 16:24:04 3,591,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll + 2008-03-01 12:54:02 478,208 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll + 2008-03-01 12:54:03 193,024 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll + 2008-03-01 12:54:03 671,232 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll + 2008-03-01 12:54:03 102,912 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll + 2008-03-01 12:54:04 44,544 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll + 2007-03-06 01:14:13 217,312 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe + 2007-03-06 01:15:25 377,568 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll + 2008-03-01 12:54:04 105,984 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\url.dll + 2008-03-01 12:54:04 1,159,680 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll + 2008-03-01 12:54:05 233,472 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll + 2008-03-01 12:54:05 826,368 -c----w C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll + 2008-05-26 14:51:18 368,640 ----a-r C:\WINDOWS\Installer\{08101881-FCA5-44A7-B863-D66037A16AAF}\ENCICO6B.EXE - 2008-05-20 11:06:00 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe + 2008-06-06 10:53:56 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe - 2008-05-20 11:06:01 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe + 2008-06-06 10:53:56 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe - 2008-05-20 11:06:00 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe + 2008-06-06 10:53:56 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe - 2008-05-20 11:06:00 184,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2008-06-06 10:53:56 184,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe - 2008-05-20 11:06:01 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe + 2008-06-06 10:53:56 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe - 2008-05-20 11:06:01 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2008-06-06 10:53:56 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe - 2008-05-20 11:06:02 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe + 2008-06-06 10:53:56 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe - 2008-05-20 11:06:01 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe + 2008-06-06 10:53:56 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe - 2008-05-20 11:06:01 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2008-06-06 10:53:56 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe - 2008-05-20 11:06:01 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe + 2008-06-06 10:53:56 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe - 2008-05-20 11:06:01 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe + 2008-06-06 10:53:56 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe - 2008-05-20 11:06:00 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2008-06-06 10:53:56 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2008-06-05 18:14:17 382,303 ----a-w C:\WINDOWS\Installer\SandboxieInstall.exe + 2005-03-18 14:23:10 53,248 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll + 2005-03-18 14:23:10 12,800 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll + 2005-03-18 14:23:14 473,600 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll + 2004-09-29 10:38:58 2,676,224 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll + 2005-03-18 14:23:10 145,920 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll + 2005-03-18 14:23:10 159,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll + 2005-03-18 14:23:14 364,544 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll + 2005-03-18 14:23:12 178,176 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll + 2005-03-18 14:23:14 223,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll + 2004-12-01 13:53:06 2,846,720 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll + 2005-02-05 17:32:54 563,712 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll + 2005-03-18 15:23:14 567,296 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll + 2005-05-26 13:15:56 576,000 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll + 2005-07-22 15:21:34 577,024 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll + 2005-09-28 12:11:52 577,536 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll + 2005-12-05 15:20:50 577,536 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll + 2006-02-03 05:40:48 578,560 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll + 2006-03-31 09:27:50 578,560 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll + 2008-03-19 17:23:20 114,688 ----a-w C:\WINDOWS\system32\Adobe\Director\np32dsw.dll + 2008-03-19 17:36:22 202,168 ----a-w C:\WINDOWS\system32\Adobe\Director\SwDir.dll + 2008-03-19 17:24:02 487,424 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\Control.dll + 2008-03-19 16:46:26 1,798,144 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\dirapi.dll + 2008-03-19 17:24:04 9,216 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\DynaPlayer.dll + 2008-03-19 16:36:14 754,688 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\gi.dll + 2008-03-19 16:36:16 1,145,896 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\gt.exe + 2008-03-19 16:36:14 52,288 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\gtapi.dll + 2008-03-19 16:42:42 892,928 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\iml32.dll + 2008-03-19 17:22:34 249,856 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll + 2008-03-19 17:25:36 442,368 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\Proj.dll + 2008-03-19 17:36:06 439,736 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1100429.exe + 2008-03-19 17:26:20 110,592 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SwInit.exe + 2008-03-19 17:22:22 94,208 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SwMenu.dll + 2008-03-19 16:36:14 50,808 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL + 1999-06-25 08:55:30 149,504 ----a-w C:\WINDOWS\system32\Adobe\Shockwave 11\UNWISE.EXE - 2008-03-01 12:53:51 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2008-04-23 04:16:29 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2005-02-05 17:45:26 2,222,800 ----a-w C:\WINDOWS\system32\d3dx9_24.dll + 2005-03-18 15:19:58 2,337,488 ----a-w C:\WINDOWS\system32\d3dx9_25.dll + 2005-07-22 17:59:04 2,319,568 ----a-w C:\WINDOWS\system32\d3dx9_27.dll + 2006-02-03 06:43:16 2,332,368 ----a-w C:\WINDOWS\system32\d3dx9_29.dll - 2008-03-01 12:53:51 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll + 2008-04-23 04:16:29 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll - 2008-03-01 12:53:51 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-04-23 04:16:29 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2008-03-01 12:53:52 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-04-23 04:16:29 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2008-03-01 12:53:52 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-04-23 04:16:29 133,120 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2008-03-01 12:53:52 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll + 2008-04-23 04:16:29 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll - 2008-02-29 08:54:43 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2008-04-22 07:39:48 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2008-03-01 12:53:52 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2008-04-23 04:16:29 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2008-03-01 12:53:52 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2008-04-23 04:16:29 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2008-02-15 05:44:25 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2008-04-20 05:07:51 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll - 2008-03-01 12:53:52 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2008-04-23 04:16:29 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2008-03-01 12:53:53 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2008-04-23 04:16:29 384,512 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2008-03-01 12:53:56 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll + 2008-04-23 04:16:30 6,066,176 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll - 2008-03-01 12:53:57 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll + 2008-04-23 04:16:30 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll - 2008-03-01 12:53:57 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll + 2008-04-23 04:16:30 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll - 2008-02-22 10:00:51 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe + 2008-04-22 07:39:58 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe - 2008-02-29 08:55:08 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2008-04-22 07:40:19 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe - 2008-03-01 12:53:58 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-04-23 04:16:30 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2006-07-17 00:00:00 297,472 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll + 2008-02-26 11:49:00 297,984 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll - 2008-03-01 12:53:59 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2008-04-23 04:16:30 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll - 2008-03-01 12:53:59 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2008-04-23 04:16:30 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2008-03-01 16:24:04 3,591,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-04-23 20:16:32 3,591,680 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll - 2008-03-01 12:54:02 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-04-23 04:16:31 478,208 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2008-03-01 12:54:03 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-04-23 04:16:31 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2008-03-01 12:54:03 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-04-23 04:16:31 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2008-03-01 12:54:03 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll + 2008-04-23 04:16:31 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll - 2008-03-01 12:54:04 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-04-23 04:16:31 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2007-10-29 22:42:30 1,293,312 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll + 2008-05-07 05:14:45 1,293,312 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll - 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys + 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys - 2008-03-01 12:54:04 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll + 2008-04-23 04:16:31 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll - 2008-03-01 12:54:04 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-04-23 04:16:31 1,159,680 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2008-03-01 12:54:05 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll + 2008-04-23 04:16:32 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll - 2008-03-01 12:54:05 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-04-23 04:16:32 826,368 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll - 2008-03-01 12:53:51 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-04-23 04:16:29 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2008-03-01 12:53:52 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-04-23 04:16:29 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2008-03-01 12:53:52 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-04-23 04:16:29 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll + 2006-08-25 12:19:42 344,064 ----a-w C:\WINDOWS\system32\ffdshow\ff_kernelDeint.dll + 2006-08-25 12:20:58 40,960 ----a-w C:\WINDOWS\system32\ffdshow\ff_liba52.dll + 2006-08-25 12:21:08 155,648 ----a-w C:\WINDOWS\system32\ffdshow\ff_libdts.dll + 2006-08-25 12:19:32 253,952 ----a-w C:\WINDOWS\system32\ffdshow\ff_libfaad2.dll + 2006-08-25 12:20:06 118,784 ----a-w C:\WINDOWS\system32\ffdshow\ff_libmad.dll + 2006-08-25 12:21:02 122,880 ----a-w C:\WINDOWS\system32\ffdshow\ff_samplerate.dll + 2006-08-25 12:20:04 143,360 ----a-w C:\WINDOWS\system32\ffdshow\ff_theora.dll + 2006-08-25 12:21:02 45,568 ----a-w C:\WINDOWS\system32\ffdshow\ff_tremor.dll + 2006-08-25 12:21:06 38,400 ----a-w C:\WINDOWS\system32\ffdshow\ff_unrar.dll + 2006-08-25 12:19:20 26,624 ----a-w C:\WINDOWS\system32\ffdshow\ff_wmv9.dll + 2006-08-25 12:36:04 405,504 ----a-w C:\WINDOWS\system32\ffdshow\ff_x264.dll + 2005-11-30 03:17:26 5,632 ----a-w C:\WINDOWS\system32\ffdshow\FLT_ffdshow.dll + 2006-08-25 13:33:34 1,654,784 ----a-w C:\WINDOWS\system32\ffdshow\libavcodec.dll + 2006-08-25 15:25:04 139,264 ----a-w C:\WINDOWS\system32\ffdshow\libmplayer.dll + 2006-08-25 12:20:56 245,760 ----a-w C:\WINDOWS\system32\ffdshow\TomsMoComp_ff.dll + 2005-12-31 02:10:30 761,856 ----a-w C:\WINDOWS\system32\ffdshow\xvidcore.dll - 2008-05-20 14:10:34 331,480 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-05-28 14:24:04 331,480 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2008-03-01 12:53:52 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2008-04-23 04:16:29 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2008-02-29 08:54:43 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2008-04-22 07:39:48 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2008-03-01 12:53:52 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2008-04-23 04:16:29 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll - 2008-03-01 12:53:52 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2008-04-23 04:16:29 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll - 2008-02-15 05:44:25 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll + 2008-04-20 05:07:51 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll - 2008-03-01 12:53:52 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll + 2008-04-23 04:16:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2008-03-01 12:53:53 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2008-04-23 04:16:29 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll - 2008-03-01 12:53:56 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll + 2008-04-23 04:16:30 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll - 2008-03-01 12:53:57 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll + 2008-04-23 04:16:30 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll - 2008-03-01 12:53:57 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll + 2008-04-23 04:16:30 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2008-02-22 10:00:51 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2008-04-22 07:39:58 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2008-05-20 14:11:15 224,608 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2008-06-16 14:11:02 224,613 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2008-03-24 23:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe + 2008-03-24 23:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-03-25 00:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe - 2008-03-01 12:53:58 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-04-23 04:16:30 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2005-05-24 10:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-10-21 19:40:14 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-10-21 19:40:16 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2007-11-29 22:30:16 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll + 2008-05-13 01:51:10 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll - 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe + 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe - 2006-07-17 00:00:00 297,472 ----a-w C:\WINDOWS\system32\MSCTF.dll + 2008-02-26 11:49:00 297,984 ----a-w C:\WINDOWS\system32\msctf.dll - 2008-03-01 12:53:59 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2008-04-23 04:16:30 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2008-03-01 12:53:59 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2008-04-23 04:16:30 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2008-03-01 16:24:04 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-04-23 20:16:32 3,591,680 ----a-w C:\WINDOWS\system32\mshtml.dll - 2008-03-01 12:54:02 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-04-23 04:16:31 478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2008-03-01 12:54:03 193,024 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-04-23 04:16:31 193,024 ----a-w C:\WINDOWS\system32\msrating.dll - 2008-03-01 12:54:03 671,232 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-04-23 04:16:31 671,232 ----a-w C:\WINDOWS\system32\mstime.dll + 2007-05-15 13:43:10 1,320,800 ----a-w C:\WINDOWS\system32\msxml6.dll + 2005-09-07 23:03:50 86,728 ----a-w C:\WINDOWS\system32\msxml6r.dll - 2008-03-01 12:54:03 102,912 ----a-w C:\WINDOWS\system32\occache.dll + 2008-04-23 04:16:31 102,912 ----a-w C:\WINDOWS\system32\occache.dll - 2008-05-20 12:03:45 149,198 ----a-w C:\WINDOWS\system32\perfc007.dat + 2008-06-16 06:40:44 148,482 ----a-w C:\WINDOWS\system32\perfc007.dat - 2008-05-20 12:03:45 121,090 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-06-16 06:40:44 120,416 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-05-20 12:03:45 599,538 ----a-w C:\WINDOWS\system32\perfh007.dat + 2008-06-16 06:40:44 597,862 ----a-w C:\WINDOWS\system32\perfh007.dat - 2008-05-20 12:03:45 548,270 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-06-16 06:40:44 547,596 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-13 08:48:36 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll + 2008-05-23 10:36:14 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll - 2007-11-13 08:48:43 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll + 2008-05-23 10:36:23 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll - 2007-11-13 08:48:43 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll + 2008-05-23 10:36:23 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll - 2008-03-01 12:54:04 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-04-23 04:16:31 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-10-29 22:42:30 1,293,312 ----a-w C:\WINDOWS\system32\quartz.dll + 2008-05-07 05:14:45 1,293,312 ----a-w C:\WINDOWS\system32\quartz.dll - 2007-11-13 08:49:19 185,688 ----a-w C:\WINDOWS\system32\rmoc3260.dll + 2008-05-23 10:36:48 185,944 ----a-w C:\WINDOWS\system32\rmoc3260.dll - 2006-10-08 20:51:14 14,640 ------w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 11:18:34 18,808 ------w C:\WINDOWS\system32\spmsg.dll + 2008-05-30 12:54:38 11,776 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\2\ACTFAX.DLL + 2008-05-30 08:16:28 72,912 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\2\RASDD.DLL + 2008-05-30 08:16:28 71,440 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\2\RASDDUI.DLL + 2008-05-30 12:54:38 11,776 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\ActFax.dll + 2008-05-30 08:16:28 72,912 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\RASDD.DLL + 2008-05-30 08:16:28 71,440 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\RASDDUI.DLL - 2007-11-29 22:30:16 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll + 2008-05-13 01:51:10 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll - 2008-03-01 12:54:04 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2008-04-23 04:16:31 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2008-03-01 12:54:04 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-04-23 04:16:31 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll - 2008-03-01 12:54:05 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-04-23 04:16:32 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll - 2008-03-01 12:54:05 826,368 ----a-w C:\WINDOWS\system32\wininet.dll + 2008-04-23 04:16:32 826,368 ----a-w C:\WINDOWS\system32\wininet.dll + 2006-03-31 10:39:24 62,672 ----a-w C:\WINDOWS\system32\xinput1_1.dll + 2005-12-05 16:07:30 61,136 ----a-w C:\WINDOWS\system32\xinput9_1_0.dll . -- Snapshot reset to current date -- . (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-07-17 02:00 15360] "DeskCalc"="c:\programme\deskcalc pro\deskcalc.exe" [2006-07-25 19:58 2797568] "Voipwise"="C:\Programme\Voipwise.com\Voipwise\Voipwise.exe" [2007-09-06 11:24 7394608] "RoboForm"="C:\Programme\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-10-30 14:26 160592] "L08DXLRD_20610375"="C:\Programme\Microsoft Lernen und Wissen\Microsoft Encarta 2008 – Lernen und Wissen DVD\EDICT.exe" [ ] "SandboxieControl"="D:\Programme\Sandboxie\SbieCtrl.exe" [2008-04-27 15:22 512512] "WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:56 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ledpointer"="CNYHKey.exe" [2004-03-02 20:24 5576704 C:\WINDOWS\CNYHKey.exe] "Google Desktop Search"="C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-14 09:11 1838592] "SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE] "OSSelectorReinstall"="C:\Programme\Gemeinsame Dateien\Acronis\Acronis Disk Director\oss_reinstall.exe" [2006-04-12 15:15 1261475] "Babylon Client"="C:\Programme\Babylon\Babylon-Pro\Babylon.exe" [2006-12-13 16:15 2785256] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 21:07 7110656] "Outpost Firewall"="C:\Programme\Agnitum\Outpost Firewall\outpost.exe" [2007-04-05 16:56 94720] "OutpostFeedBack"="C:\Programme\Agnitum\Outpost Firewall\feedback.exe" [2007-06-28 13:18 335872] "egui"="C:\Programme\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072] "QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2007-02-16 10:54 282624] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-07-17 02:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 0 (0x0) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli scecli [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat - Schnellstart.lnk] backup=C:\WINDOWS\pss\Adobe Acrobat - Schnellstart.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] --a------ 2008-04-23 02:08 483328 C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2005-07-20 21:07 7110656 C:\WINDOWS\system32\NvCpl.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Window Washer"=C:\Programme\Webroot\Washer\wwDisp.exe "BitTorrent"="C:\Programme\BitTorrent\bittorrent.exe" --force_start_minimized "updateMgr"=C:\Programme\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_5 -reboot 1 "Skype"="C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized "WMPNSCFG"=C:\Programme\Windows Media Player\WMPNSCFG.exe "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" "SecurityLayer"=C:\Programme\trustDesk\SecurityLayer.exe -autostart "Voipwise"="C:\Programme\Voipwise.com\Voipwise\Voipwise.exe" -nosplash -minimized "swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "RealTray"=C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER "Acrobat Assistant 7.0"="C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" "Acronis Scheduler2 Service"="C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" "QuickTime Task"="C:\Programme\QuickTime\qttask.exe" -atboottime "PCMService"="C:\Programme\CyberLink\PowerCinema\PCMService.exe" "Ulead AutoDetector v2"=C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe "SMSERIAL"=sm56hlpr.exe "RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe "TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot "USBToolTip"="C:\Programme\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" "TrueImageMonitor.exe"=C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe "AcronisTimounterMonitor"=C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe "GrooveMonitor"="C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup "NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit "PWRISOVM.EXE"=C:\Programme\PowerISO\PWRISOVM.EXE "hpppta"=C:\Programme\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hpppta.exe /ICON "nwiz"=nwiz.exe /install "NVRaidService"=C:\WINDOWS\system32\nvraidservice.exe "HP Update 5370C"=D:\SAFE\Scanner\hpupdate.exe 5370C+ "SecurityLayer"=C:\Programme\trustDesk\securitylayer.exe "NeroFilterCheck"=C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe "InCD"=C:\Programme\Nero\Nero 7\InCD\InCD.exe "Realtime Audio Engine"="mmrtkrnl.exe" /i "CHotkey"=mHotkey.exe "SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_06\bin\jusched.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Programme\\LimeWire\\LimeWire.exe"= "C:\\Programme\\Voipwise.com\\Voipwise\\Voipwise.exe"= "C:\\Programme\\IBP 9\\IBP.exe"= "C:\\Programme\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R1 bizVSerial;Franson VSerial;C:\WINDOWS\system32\drivers\bizVSerialNT.sys [2007-05-31 08:38] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52] R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;C:\WINDOWS\system32\drivers\hcw88aud.sys [2005-05-31 12:34] R1 rsct_bus;REINER SCT PC/SC Bus;C:\WINDOWS\system32\DRIVERS\rsct_bus.sys [2004-09-10 17:35] R1 VFILT;Outpost Firewall Kernel Driver;C:\Programme\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2007-04-05 16:56] R2 AcuWVSSchedulerv5;Acunetix WVS Scheduler v5;"C:\Programme\Acunetix\Web Vulnerability Scanner 5\WVSScheduler.exe" [2007-06-21 16:31] R2 Prvflder;Prvflder;C:\WINDOWS\system32\DRIVERS\prvflder.sys [2006-04-21 09:22] R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2007-04-05 16:57] R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\ARP.DLL [2007-04-05 16:57] R3 cjusb;REINER SCT cyberJack pinpad/e-com USB;C:\WINDOWS\system32\DRIVERS\cjusb.sys [2007-05-31 08:38] R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2007-04-05 16:57] R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2007-04-05 16:57] R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2007-04-05 16:57] R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\WINDOWS\system32\drivers\hcw88bda.sys [2005-05-31 12:34] R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\WINDOWS\system32\drivers\hcw88tse.sys [2005-05-31 15:43] R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;C:\WINDOWS\system32\drivers\hcw88tun.sys [2005-05-31 12:34] R3 hcw88vid;Hauppauge WinTV 88x Video;C:\WINDOWS\system32\drivers\hcw88vid.sys [2005-05-31 15:43] R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;C:\WINDOWS\system32\drivers\HCW88BAR.sys [2005-05-31 12:34] R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2007-04-05 16:57] R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2007-04-05 16:57] R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2007-04-05 16:57] R3 IMT0521;Inmax USB IMT-0521 Smartcard Reader;C:\WINDOWS\system32\Drivers\IMT0521.sys [2003-07-11 09:50] R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2007-04-05 16:57] R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2007-04-05 16:57] R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2007-04-05 16:57] R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2007-04-05 16:57] R3 SbieDrv;SbieDrv;D:\Programme\Sandboxie\SbieDrv.sys [2008-04-27 15:22] R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2007-04-05 16:57] S3 ActiveFaxServiceNT;ActiveFax-Server-Dienst;C:\Programme\ActiveFax\Server\ActSrvNT.exe [2008-05-30 14:54] S3 cjpcsc;cyberJack PC/SC COM Service ;C:\WINDOWS\system32\cjpcsc.exe [2008-01-07 13:19] S3 ITSPrinterService;IT Solution Signature Printer;C:\Programme\trustDesk\plugins\printer\itsprintersrv.exe [2007-04-16 22:06] S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 15:36] S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-22 20:33] S3 rsct_dev;REINER PC/SC SmartCard Reader Device Driver;C:\WINDOWS\system32\DRIVERS\rsct_dev.sys [2004-09-23 13:12] S3 SCR33X USB Smart Card Reader;SCR33X USB Smart Card Reader;C:\WINDOWS\system32\DRIVERS\SCR33X2K.sys [2003-12-03 04:22] S3 trustLogon;trustLogon;"C:\Programme\trustDesk\plugins\logon\trustlogon.exe" [2007-01-23 12:35] S3 wwEngineSvc;Window Washer Engine;C:\Programme\Webroot\Washer\WasherSvc.exe [2007-11-26 15:47] S4 MSSQL$PRISO;MSSQL$PRISO;C:\Programme\Priso Datenbank\MSSQL$PRISO\Binn\sqlservr.exe [2002-12-17 17:55] S4 SQLAgent$PRISO;SQLAgent$PRISO;C:\Programme\Priso Datenbank\MSSQL$PRISO\Binn\sqlagent.EXE [2002-12-17 17:23] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f859054-10cc-11da-b357-009027bfa409}] \Shell\AutoRun\command - E:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63b57571-157e-11da-acd9-000feaece007}] \Shell\AutoRun\command - M:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada67554-186e-11da-8373-000feaece007}] \Shell\AutoRun\command - L:\Setup.exe . Inhalt des "geplante Tasks" Ordners "2008-06-16 14:00:00 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Programme\TuneUp Utilities 2008\OneClickStarter.exe "2008-06-15 19:39:15 C:\WINDOWS\Tasks\User_Feed_Synchronization-{4FBD8FD6-1383-42F4-B3B8-6C1FF9715BF1}.job" - C:\WINDOWS\system32\msfeedssync.exe "2008-06-16 06:35:20 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Programme\XoftSpySE\XoftSpy.exe "2008-05-31 09:04:58 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Programme\XoftSpySE\XoftSpy.exe "2006-10-29 14:03:04 C:\WINDOWS\Tasks\_viceversapr2_task_BackUp.job" - C:\Programme\ViceVersa Pro 2\ViceVersa.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-16 16:11:19 Windows 5.1.2600 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostart Eintr„ge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\programme\deskcalc pro\CalcHook.dll . ------------------------ Other Running Processes ------------------------ . C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\scardsvr.exe C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Programme\FolderSize\FolderSizeSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\WINDOWS\system32\nvsvc32.exe D:\Programme\Sandboxie\SbieSvc.exe C:\WINDOWS\system32\tcpsvcs.exe C:\Programme\Microsoft Lernen und Wissen\Microsoft Encarta 2008 D:\Programme\Sandboxie\SbieCtrl.exe C:\Programme\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe . ************************************************************************** . Zeit der Fertigstellung: 2008-06-16 16:18:11 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-16 14:17:50 ComboFix2.txt 2008-05-20 15:27:58 ComboFix3.txt 2008-05-20 14:20:41 ComboFix4.txt 2008-05-20 11:06:52 ComboFix5.txt 2008-05-19 18:08:10 27 Verzeichnis(se), 80,434,642,944 Bytes frei 34 Verzeichnis(se), 80,511,094,784 Bytes frei 636 --- E O F --- 2008-06-13 21:02:20 von CounterSpy: Bifrost Backdoor macht mich nervös! Sagt dir dieses Programm was? C:\Programme\Voipwise.com\Voipwise\Voipwise.exe das ein gewöhnliches VOIP-Programm Scan History Details Start Date: 16.06.2008 17:19:59 End Date: 16.06.2008 17:50:32 Total Time: 30 Min 33 Sec Detected security risks KaZaA P2P Program more information... Details: KaZaA is a peer-to-peer (P2P) application that allows its users to join together in a network via the Internet and share files from each other's hard drives. Status: Deleted Registry entries detected HKEY_USERS\S-1-5-21-164601823-2529933474-2537397741-1006\SOFTWARE\KAZAA HKEY_USERS\S-1-5-21-164601823-2529933474-2537397741-1006\SOFTWARE\KAZAA\LocalContent Bifrost Backdoor more information... Details: Bifrost is an advanced remote administration tool that allows users to remotely control computers that are behind firewalls and routers. Status: Deleted Registry entries detected HKEY_USERS\S-1-5-21-164601823-2529933474-2537397741-1006\SOFTWARE\WGET Yazzle Components Misc (General) more information... Details: Yazzle Components includes software that is used by multiple applications from Clickspring, LLC, the authors of Yazzle applications such as Yazzle Sudoku, Cowabanga and Snowball Wars. Status: Deleted Registry entries detected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/DOWNLOADED PROGRAM FILES/YAZZLEACTIVEX.OCX HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/DOWNLOADED PROGRAM FILES/YAZZLEACTIVEX.OCX HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/DOWNLOADED PROGRAM FILES/YAZZLEACTIVEX.OCX HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/SYSTEM32/MFC42.DLL HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/SYSTEM32/OLEPRO32.DLL Trojan-Downloader.Win32.Agent.aww Trojan Downloader more information... Status: Deleted Files detected C:\WINDOWS\swxcacls.exe Cookie: Tracking Cookies Cookie (General) more information... Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count unique visitors to web pages; and to allow web surfers to use virtual "shopping carts." Online advertising networks use cookies to track users across web sites and to measure ad impressions and click-throughs. Status: Deleted Cookies detected c:\dokumente und einstellungen\robert\cookies\robert@ad.yieldmanager[1].txt c:\dokumente und einstellungen\robert\cookies\robert@doubleclick[1].txt c:\dokumente und einstellungen\robert\cookies\robert@hitbox[2].txt c:\dokumente und einstellungen\robert\cookies\robert@statcounter[1].txt c:\dokumente und einstellungen\robert\cookies\robert@statcounter[2].txt c:\dokumente und einstellungen\robert\cookies\robert@zedo[1].txt Zitat |
|
|
|
|
|
|
17.06.2008, 00:14
Ehrenmitglied
 Beiträge: 29434 |
#4
Hallo zzi
Bifrost Backdoor und SOFTWARE\KAZAA ... ist meiner Ansicht nach obligatorischer Einträge von Counterspy, dennoch sollten wir nicht meckern, er hat immerhin einiges rausgeholt. Das Problem sollte behoben sein, oder kommen noch popups ? Zitat Zudem fügt sich auf der eigenen Website (zinseszins.net) immer wieder von selbst Schadcode einwelcher Code ? - erscheint etwas auf deiner Seite, was da nicht hingehört ? Hast du dir den Quellcode der Seite angesehen ? __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.06.2008, 09:04
Member
Themenstarter Beiträge: 31 |
#5
Die popups sind nun weg!
Hier zwei Beispiele des Codes, der auf der Website nach dem body tag immer wieder auftaucht: Code <script>function v483e3ca829a4c(v483e3ca829e51){ function v483e3ca82a257 Code <!-- |
|
|
|
|
|
|
17.06.2008, 10:20
Ehrenmitglied
Beiträge: 29434 |
#6
ich habe noch mal nachgesehen, im moment ist der java code nicht zu sehen...ist wieder alles, wie es sein soll oder trägt sich der code immer wieder neu ein ?
__________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.06.2008, 10:35
Member
Themenstarter Beiträge: 31 |
#7
Momentan ist die Website ok. Aber der Code trägt sich von Zeit zu Zeit wieder neu ein. keine Ahnung wodurch. Habe jetzt auch die FTP-Daten erneuert. Der Server dürfte auch clean sein.
|
|
|
|
|
|
|
17.06.2008, 10:39
Ehrenmitglied
Beiträge: 29434 |
#8
ich habe den Beitrag vrschoben, vielleicht kennt sich hier jemand mit java-scripts und schade-codes aus.
sobald der eintrag wieder auftaucht, melde dich. __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.06.2008, 10:56
Member
Themenstarter Beiträge: 31 |
#9
ok wir werden sehen - Danke !!
|
|
|
|
|
|
|
19.06.2008, 14:58
Member
Beiträge: 3716 |
#10
Hallo,
ich würde alle passwörter, die du für deinen server hast endern. sie sollten sicher sein also sonderzeichen enthalten und so lang wie möglich sein. weiterhin sollte dein server die neuesten updates bekommen und das regelmäßig. auch solltest du dich über einstellmöglichkeiten deines auf dem server befindlichen betriebssystemes informieren, die die sicherheit erhöhen. |
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Seite(n): 1
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
erhalte neuerdings beim browsen mit IE ständig eine meldung über "advancedxpdefender" der zu download der software auffordert.
Zudem fügt sich auf der eigenen Website (zinseszins.net) immer wieder von selbst Schadcode ein, der bei den Dateien am lokalen PC nicht zu finden ist.
Hier das LogFile:
Logfile of Trend Micro HiJackThis v2.0.2
Scan saved at 12:10:38, on 16.06.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CNYHKey.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Babylon\Babylon-Pro\Babylon.exe
C:\Programme\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\programme\deskcalc pro\deskcalc.exe
C:\Programme\Voipwise.com\Voipwise\Voipwise.exe
C:\Programme\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Programme\Microsoft Lernen und Wissen\Microsoft Encarta 2008 – Lernen und Wissen DVD\EDICT.EXE
D:\Programme\Sandboxie\SbieCtrl.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\Programme\FolderSize\FolderSizeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Agnitum\Outpost Firewall\outpost.exe
D:\Programme\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe
C:\DOKUME~1\Robert\LOKALE~1\Temp\Adobelm_Cleanup.0 001
C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
C:\DOKUME~1\Robert\LOKALE~1\Temp\Adobelm_Cleanup.0 001
C:\WINDOWS\system32\notepad.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zinseszins.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http:**//www.zinseszins.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http**://www.zinseszins.net/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin .dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301. 7164\swg.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Programme\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Programme\Gemeinsame Dateien\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Programme\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Outpost Firewall] C:\Programme\Agnitum\Outpost Firewall\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\Programme\Agnitum\Outpost Firewall\feedback.exe /dumps_startup
O4 - HKLM\..\Run: [egui] "C:\Programme\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DeskCalc] "c:\programme\deskcalc pro\deskcalc.exe" /hide
O4 - HKCU\..\Run: [Voipwise] "C:\Programme\Voipwise.com\Voipwise\Voipwise.e xe" -nosplash -minimized
O4 - HKCU\..\Run: [RoboForm] "C:\Programme\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [L08DXLRD_20610375] "C:\Programme\Microsoft Lernen und Wissen\Microsoft Encarta 2008 – Lernen und Wissen DVD\EDICT.EXE" -m
O4 - HKCU\..\Run: [SandboxieControl] "D:\Programme\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Link mit Mega Manager herunterladen... - C:\Programme\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Mit dem LeechGet Wizard laden - file://C:\Programme\LeechGet 2007\\Wizard.html
O8 - Extra context menu item: Mit LeechGet herunterladen - file://C:\Programme\LeechGet 2007\\AddUrl.html
O8 - Extra context menu item: Mit LeechGet parsen - file://C:\Programme\LeechGet 2007\\Parser.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: RF - Formular ausfüllen - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RF - Formular speichern - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: RF - Menü anpassen - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RF - Passwortgenerator - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComPasswordGenerator.html
O8 - Extra context menu item: RF - RoboForm-Leiste ein/aus - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Programme\Gemeinsame Dateien\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Translate with &Babylon - res://C:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: RF - Formular ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: RF - Formular speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF - RoboForm-Leiste ein/aus - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Encarta Suchleiste - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programme\Gemeinsame Dateien\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Programme\Gemeinsame Dateien\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3911F463-03E8-45A5-B7BE-A89E096ACB79} (ClientCheckX Control) - http://www.a-trust.at/html/ClientCheck/ClientCheckX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124708231312
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {E8304464-1EA9-4F39-A031-522874AAC230} (ESD Object) -
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.mediamax.com/Upload/XUpload.ocx
O16 - DPF: {FCF77DBD-0AE7-4EA8-B9EF-A733F6879B4E} (KardToolX Control) - http://www.a-trust.at/html/CardCheck/KardToolX.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{941E4DE3-F3C6-43EA-9C10-603D3C0150BC}: NameServer = 195.34.133.21 195.34.133.22
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: ActiveFax-Server-Dienst (ActiveFaxServiceNT) - ActFax Communication - C:\Programme\ActiveFax\Server\ActSrvNT.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: cyberJack PC/SC COM Service (cjpcsc) - REINER SCT - C:\WINDOWS\system32\cjpcsc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Programme\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Programme\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IT Solution Signature Printer (ITSPrinterService) - IT Solution GmbH - C:\Programme\trustDesk\plugins\printer\itsprinters rv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MSSQLServerADHelper - Unknown owner - C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Programme\Agnitum\Outpost Firewall\outpost.exe
O23 - Service: Private Folder Service (prfldsvc) - Unknown owner - C:\Programme\Microsoft Private Folder 1.0\PrfldSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe (file missing)
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - D:\Programme\Sandboxie\SbieSvc.exe
O23 - Service: Streamload Service (StreamloadService) - Streamload - C:\Programme\Streamload\MediaMax XL\StreamloadService.exe
O23 - Service: trustLogon - IT Solution GmbH - C:\Programme\trustDesk\plugins\logon\trustlogon.ex e
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe (file missing)
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Programme\Webroot\Washer\WasherSvc.exe
O24 - Desktop Component 0: My Current Home Page - http://www.8ung.at/zinseszins/images/mitte2.jpg
--
End of file - 16716 bytes