Home » Viren, Trojaner & Malware Forum » VERMUTUNG: evtl mit dem TR/Vundo.Gen / antivirus08 infiziert » Themenansicht
VERMUTUNG: evtl mit dem TR/Vundo.Gen / antivirus08 infiziert |
||
|---|---|---|
| #0
| ||
|
09.08.2008, 11:37
Member
Beiträge: 13 |
||
 
|
|
|
|
09.08.2008, 18:23
Moderator
Beiträge: 5694 |
#2
Hallo magicc
>> Bitte den TeaTimer von Spybot S & D deaktivieren: C:\Programme\Spybot - Search & Destroy\TeaTimer.exe abstellen! Starte dazu Spybot S&D, deaktiviere den "Resident "TeaTimer". Klicke auf "Advanced mode" > "JA" > "Tools" -Menu > klicke auf "Resident" > das Häkchen entfernen aus der "Resident TeaTimer" (Schutz aller Systemeinstellungen) > "exit". (der TeaTimer be- bzw. verhindert alle weiteren Reinigungmaßnahmen! >> Lass folgende Datei bei www.virustotal.com/de prüfen und poste das Log: C:\WINDOWS\system32\dapotmro.exe >> Dein Malwarebytes' Anti-Malware 1.24 Datenbank Version: 1012 Und meins Malwarebytes' Anti-Malware 1.24 Datenbank Version: 1035 Update Malwarebytes erst und scanne nochmal und lass das gefundene auch löschen. >> Hast du mal eine spezielle Windows CD mit nlite erstellt? >> Schliesse alle Fenster und starte Hijack This Klicke: Do a Systemscan only Setze ein Häckchen in das Kästchen vor den genannten Eintrag bei Zitat O4 - HKLM\..\Run: [SMrhc7s7j0ejcj] C:\Programme\rhc7s7j0ejcj\rhc7s7j0ejcj.exeklicke: Fix checked Dein Internet Explorer muss geschlossen wenn Du Fix Checked klickst >> Update dein JAVA http://board.protecus.de/t32385-1.htm Gruss Swiss Dieser Beitrag wurde am 09.08.2008 um 18:30 Uhr von Tonstudio editiert.
|
|
|
|
|
|
|
09.08.2008, 19:35
Moderator
Beiträge: 7805 |
#3
Folgendes ist gleichzusetzen mit "mach ihn total PLatt"
Bck/Ciadoor.FQ Virus/Trojan Rootkit/Booto.C Virus/Worm Wobei dazu auch gehoert die Festplatte neu zu partitionieren! __________ MfG Ralf SEO-Spam Hunter |
|
|
|
|
|
|
10.08.2008, 07:58
Member
Themenstarter Beiträge: 13 |
#4
Zitat raman postetekeine rettung?? *snief* joar musste dank damals neuester hardware treiber etc mit nlite erstellen, da windOOf alle sata net kannte ;/ Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.9.0 2008.08.08 - AntiVir 7.8.1.19 2008.08.09 - Authentium 5.1.0.4 2008.08.10 - Avast 4.8.1195.0 2008.08.09 - AVG 8.0.0.156 2008.08.09 Downloader.Swizzor BitDefender 7.2 2008.08.10 - CAT-QuickHeal 9.50 2008.08.08 - ClamAV 0.93.1 2008.08.10 - DrWeb 4.44.0.09170 2008.08.09 - eSafe 7.0.17.0 2008.08.07 - eTrust-Vet 31.6.6019 2008.08.08 - Ewido 4.0 2008.08.09 - F-Prot 4.4.4.56 2008.08.10 - F-Secure 7.60.13501.0 2008.08.10 - Fortinet 3.14.0.0 2008.08.10 W32/PolySmall.BP!tr GData 2.0.7306.1023 2008.08.10 - Ikarus T3.1.1.34.0 2008.08.10 Trojan.Win32.Busky.EC K7AntiVirus 7.10.408 2008.08.09 - Kaspersky 7.0.0.125 2008.08.10 - McAfee 5357 2008.08.08 - Microsoft 1.3807 2008.08.09 Trojan:Win32/Busky.EC NOD32v2 3343 2008.08.10 a variant of Win32/TrojanDownloader.FakeAlert.BP Norman 5.80.02 2008.08.08 - Panda 9.0.0.4 2008.08.09 - PCTools 4.4.2.0 2008.08.09 - Prevx1 V2 2008.08.10 Malware Downloader Rising 20.56.41.00 2008.08.08 - Sophos 4.32.0 2008.08.10 Mal/EncPk-DG Sunbelt 3.1.1538.1 2008.08.09 - Symantec 10 2008.08.10 - TheHacker 6.2.96.395 2008.08.08 - TrendMicro 8.700.0.1004 2008.08.08 - VBA32 3.12.8.3 2008.08.09 - ViRobot 2008.8.8.1329 2008.08.08 - VirusBuster 4.5.11.0 2008.08.09 - Webwasher-Gateway 6.6.2 2008.08.09 - weitere Informationen File size: 81920 bytes MD5...: f7ee21bd99e9bd32537916faf8a83bab SHA1..: 6677bb057e6b693683ad27a57819c4397f50fac8 SHA256: f3ec83e7b3da8d115cc4b373d2329f257f9c08d1a8cb20e9bcaaa2f65fc906ed SHA512: c80996dcef75672cb6fab880b1a6a5da3a103b8f36553620698d41218b481ddf 15e9b82ee41ac367bec1f76abdf9252f5908a64487e11466edfdc2c82b3f4c87 PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x401d8e timedatestamp.....: 0x489c985d (Fri Aug 08 19:02:53 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .ajumz 0x1000 0x100f4 0x11000 6.61 86a0d34f7ce963a00e90272b37fba330 .xxgi 0x12000 0x6b8 0x1000 2.85 70274a12a4a5a3f47cdb9a4800695974 .wsoetq 0x13000 0x59cc 0x1000 0.56 ab7e032f57fdd599d783edbbfe2be6d2 ( 4 imports ) > KERNEL32.dll: GetModuleHandleW, GetCurrentProcess, ReadFile, SetEvent, FindResourceW, LoadLibraryA, SetThreadPriority, GetLogicalDrives, CloseHandle, GetProcAddress, SuspendThread, SetFilePointer, QueryDosDeviceW, FindFirstFileW, FileTimeToSystemTime, WideCharToMultiByte, WriteFile, lstrlenW, FindNextChangeNotification, GlobalAddAtomW, VirtualFree, FindNextFileW, SetCurrentDirectoryW > USER32.dll: TrackPopupMenu, GetCursorPos, SetDlgItemTextW, OffsetRect, GetParent, ReleaseCapture, AppendMenuW, EnableWindow, SystemParametersInfoW, LoadCursorW, PostThreadMessageW, DestroyMenu, GetMessageW, RegisterWindowMessageW, GetWindowThreadProcessId, WindowFromPoint, LoadBitmapW, RegisterClassExW, EndDialog, LoadIconW, FillRect, LoadStringW, DispatchMessageW, TranslateMessage, GetKeyState, SetCursor > GDI32.dll: SetMapMode, StretchBlt, CreateRoundRectRgn, CreatePen, GetMapMode, MoveToEx, DPtoLP, CreateBitmap > ADVAPI32.dll: StartServiceW, RegCreateKeyExW, RegOpenKeyExW, RegSetValueExW, RegCloseKey ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=43BC147600B58DAE40A2017838CB3B00069B8153 __________ Ich lebe ewig! (bisher erfolgreich)  Dieser Beitrag wurde am 10.08.2008 um 08:02 Uhr von magicc editiert.
|
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Seite(n): 1
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
leider hat meine semi-noob-suche keinen genauen Aufschluss über die Infizierunge ergeben, da ich natürlich versucht ahbe den Schaden selber zu beheben
Evtl kann mir ja wer von den PRO's weiterhelfen... THX (ps, wer mag, lust und zeit hat, erklärungen für alles werden 10fach gelesen
Also CCleaner benutzt
Malwarebytes ergab folgendes:
Malwarebytes' Anti-Malware 1.24
Datenbank Version: 1012
Windows 5.1.2600 Service Pack 3
10:30:46 09.08.2008
mbam-log-8-9-2008 (10-30-40).txt
Scan-Methode: Quick-Scan
Durchsuchte Objekte: 39522
Laufzeit: 3 minute(s), 45 second(s)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 5
Infizierte Dateien: 18
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\uninstall (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhc7s7j0ejcj (Trojan.FakeAlert) -> No action taken.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\rhc7s7j0ejcj (Rogue.Multiple) -> No action taken.
C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\rhc7s7j0ejcj\Quarantine (Rogue.Multiple) -> No action taken.
C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\rhc7s7j0ejcj\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\rhc7s7j0ejcj\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\rhc7s7j0ejcj\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
Infizierte Dateien:
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> No action taken.
Combofix sagte dieses hier:
((((((((((((((((((((((( Dateien erstellt von 2008-07-09 bis 2008-08-09 ))))))))))))))))))))))))))))))
.
2008-08-09 11:04 . 2008-08-09 11:04 <DIR> d-------- C:\Programme\Trend Micro
2008-08-09 10:25 . 2008-08-09 10:25 <DIR> d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-08-09 10:25 . 2008-08-09 10:25 <DIR> d-------- C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\Malwarebytes
2008-08-09 10:25 . 2008-08-09 10:25 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-08-09 10:25 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-09 10:25 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-09 10:11 . 2008-08-09 10:11 <DIR> d-------- C:\Programme\CCleaner
2008-08-08 23:09 . 2008-08-08 23:09 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\zedirmjk
2008-08-08 23:09 . 2008-08-08 23:09 81,920 --a------ C:\WINDOWS\system32\dapotmro.exe
2008-08-08 22:28 . 2008-08-08 22:28 <DIR> d-------- C:\WINDOWS\uninstall\Purgatio Pro
2008-08-08 22:28 . 2008-08-08 22:28 <DIR> d-------- C:\WINDOWS\uninstall
2008-08-08 22:28 . 2008-08-08 22:54 <DIR> d-------- C:\Programme\BACKUP
2008-08-08 22:02 . 2008-06-14 19:32 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-08-08 22:02 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-08-08 21:50 . 2008-08-08 21:50 <DIR> d-------- C:\WINDOWS\system32\de
2008-08-08 21:50 . 2008-08-08 21:50 <DIR> d-------- C:\WINDOWS\system32\bits
2008-08-08 21:50 . 2008-08-08 21:50 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-08 21:32 . 2008-04-14 04:22 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll
2008-08-08 21:32 . 2008-04-14 04:22 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll
2008-08-08 21:32 . 2008-04-14 04:22 276,992 --------- C:\WINDOWS\system32\wmphoto.dll
2008-08-08 21:32 . 2008-04-14 04:22 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-08-08 21:30 . 2008-04-14 04:22 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-08-08 21:29 . 2008-04-14 04:22 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-08-08 21:16 . 2008-08-08 21:16 134 --a------ C:\WINDOWS\DelMR.bat
2008-08-08 21:04 . 2008-08-08 21:04 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Office Genuine Advantage
2008-08-02 22:02 . 2008-08-02 22:02 <DIR> d-------- C:\Programme\iPod
2008-08-02 11:08 . 2008-08-02 11:09 <DIR> d-------- C:\Programme\ICQ6Toolbar
2008-08-02 11:08 . 2008-08-02 14:51 <DIR> d-------- C:\Programme\ICQ6
2008-08-02 11:08 . 2008-08-02 11:09 <DIR> d-------- C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\ICQ
2008-08-02 11:08 . 2008-08-02 11:08 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
2008-07-23 11:05 . 2008-07-23 11:05 <DIR> d-------- C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\Apple Computer
2008-07-23 11:04 . 2008-07-23 11:04 <DIR> d-------- C:\Programme\QuickTime
2008-07-23 11:04 . 2008-08-08 23:59 <DIR> d-------- C:\Programme\Bonjour
2008-07-23 11:04 . 2008-07-23 11:04 <DIR> d-------- C:\Programme\Apple Software Update
2008-07-23 11:04 . 2008-07-23 11:04 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2008-07-23 11:03 . 2008-07-23 11:03 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Apple
2008-07-23 11:03 . 2008-07-23 11:03 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 08:13 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-08-08 21:13 --------- d-----w C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\Azureus
2008-08-08 20:55 891 ----a-w C:\Programme\WASHANDGO.ini
2008-08-08 20:42 --------- d-----w C:\Programme\Winamp
2008-08-08 20:42 --------- d-----w C:\Programme\Trillian
2008-08-08 20:42 --------- d-----w C:\Programme\PartyGaming
2008-08-08 20:42 --------- d-----w C:\Programme\Gemeinsame Dateien\ACD Systems
2008-08-08 20:42 --------- d-----w C:\Programme\Drive Image 2002
2008-08-08 20:42 --------- d-----w C:\Programme\bwin
2008-08-08 20:41 --------- d-----w C:\Programme\Quicken2007
2008-08-08 20:38 --------- d-----w C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\The Bat!
2008-08-08 20:38 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MP3Find
2008-08-08 20:29 1 ----a-w C:\Programme\WashAndGo.cho
2008-08-08 19:17 --------- d-----w C:\Programme\Gemeinsame Dateien\Teleca Shared
2008-08-08 19:16 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-08-08 19:14 --------- d-----w C:\Programme\mg11
2008-08-08 17:42 --------- d-----w C:\Programme\Starcraft
2008-08-08 14:47 --------- d-----w C:\Programme\Spybot - Search & Destroy
2008-07-27 10:25 --------- d-----w C:\Programme\Wertpapieranalyse_2006
2008-07-03 13:19 --------- d-----w C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\HP
2008-07-03 13:16 --------- d-----w C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\Image Zone Express
2008-07-03 06:57 --------- d-----w C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\Printer Info Cache
2008-07-03 06:54 --------- d-----w C:\Programme\Gemeinsame Dateien\HP
2008-07-03 06:54 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WEBREG
2008-07-03 06:54 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HP
2008-07-03 06:53 --------- d-----w C:\Programme\HP
2008-07-03 06:53 --------- d-----w C:\Programme\Gemeinsame Dateien\Hewlett-Packard
2008-07-03 06:53 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HP Product Assistant
2008-07-02 15:18 --------- d-----w C:\Programme\Azureus
2008-07-02 11:44 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AAV
2008-06-30 12:49 --------- d-----w C:\Programme\Veoh Networks
2008-06-30 10:36 --------- d-----w C:\Programme\DivX
2008-06-20 17:46 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:32 273,024 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 13:51 --------- d-----w C:\Programme\TomTom HOME 2
2008-06-11 13:41 --------- d-----w C:\Programme\TomTom DesktopSuite
2008-05-22 22:20 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2005-02-05 17:53 612 ----a-w C:\Programme\WhatsNew.txt
2005-02-05 17:13 164,352 ----a-w C:\Programme\WashAndGo.d01
2005-02-05 17:12 198,656 ----a-w C:\Programme\WashAndGo.doc
2005-02-05 17:12 198,656 ----a-w C:\Programme\WashAndGo.d00
2005-02-05 17:10 91,330 ----a-w C:\Programme\WashAndGo.chm
2005-02-05 17:10 91,330 ----a-w C:\Programme\WashAndGo.c00
2005-02-05 17:08 87,404 ----a-w C:\Programme\WashAndGo.c01
2005-02-05 16:41 14,816 ----a-w C:\Programme\WashAndGo.t07
2005-02-05 16:36 14,293 ----a-w C:\Programme\WashAndGo.t01
2005-02-05 16:31 15,633 ----a-w C:\Programme\WashAndGo.t02
2005-02-05 16:16 14,762 ----a-w C:\Programme\WashAndGo.t013
2005-02-05 16:13 14,530 ----a-w C:\Programme\WashAndGo.t09
2005-02-05 16:13 13,903 ----a-w C:\Programme\WashAndGo.t08
2005-02-05 16:12 14,831 ----a-w C:\Programme\WashAndGo.t04
2005-02-05 16:12 14,498 ----a-w C:\Programme\WashAndGo.t05
2005-02-05 16:12 14,196 ----a-w C:\Programme\WashAndGo.t06
2005-02-05 16:11 14,599 ----a-w C:\Programme\WashAndGo.t03
2005-02-05 16:11 14,496 ----a-w C:\Programme\WashAndGo.t011
2005-02-05 16:11 14,025 ----a-w C:\Programme\WashAndGo.t012
2005-02-05 16:10 13,865 ----a-w C:\Programme\WashAndGo.t010
2005-01-19 20:46 15,809 ----a-w C:\Programme\WashAndGo.t00
2005-01-19 20:46 15,809 ----a-w C:\Programme\WashAndGo.def
2005-01-04 22:12 2,193,920 ----a-w C:\Programme\WashAndGo.exe
2004-03-13 10:57 116,224 ----a-w C:\Programme\WashAndGo.d09
2004-02-21 20:07 38 ----a-w C:\Programme\WASHANDGO.key
2004-02-21 19:47 247 ----a-w C:\Programme\WashAndGo.dat
2004-02-21 19:08 98,304 ----a-w C:\Programme\WashAndGo.d02
2004-02-03 22:37 18,930 ----a-w C:\Programme\washandgo.sk4_2.ani
2004-02-03 22:35 4,812 ----a-w C:\Programme\washandgo.sk1_1.ani
2004-02-03 22:34 7,984 ----a-w C:\Programme\washandgo.sk5_1.ani
2004-02-03 22:05 6,846 ----a-w C:\Programme\washandgo.sk2_1.ani
2004-02-03 16:54 24,761 ----a-w C:\Programme\washandgo.bg1.jpg
2004-02-03 16:54 11,384 ----a-w C:\Programme\washandgo.bg2.jpg
2004-02-03 16:54 10,839 ----a-w C:\Programme\washandgo.bg3.jpg
2004-02-03 14:40 11,088 ----a-w C:\Programme\washandgo.sk5_2.ani
2003-04-07 17:21 71,680 ----a-w C:\Programme\Checker.exe
2003-03-31 07:40 384,512 ----a-w C:\Programme\AbTrans1.dll
2003-03-20 22:50 3,127 ----a-w C:\Programme\washandgo.bg0.jpg
2001-10-19 18:37 749 ----a-w C:\Programme\WashAndGo.exe.Manifest
2001-09-17 15:21 149,504 ----a-w C:\Programme\washandgo.d03
2001-07-20 11:17 10,428 ----a-w C:\Programme\WashAndGo.c09
2001-07-20 11:17 10,428 ----a-w C:\Programme\WashAndGo.c03
2001-07-20 11:17 10,428 ----a-w C:\Programme\WashAndGo.c02
1998-08-07 16:49 4,786 ----a-w C:\Programme\washandgo.sk0_1.ani
1998-06-01 23:10 6,806 ----a-w C:\Programme\washandgo.sk2_2.ani
1998-05-01 21:14 2,696 ----a-w C:\Programme\schhht.wav
1998-04-13 22:00 684 ----a-w C:\Programme\klick.wav
1998-04-13 21:58 13,940 ----a-w C:\Programme\finished.wav
1996-10-09 18:06 33,826 ----a-w C:\Programme\washandgo.sk3_2.ani
1996-10-09 18:06 33,826 ----a-w C:\Programme\washandgo.sk3_1.ani
1995-07-31 10:22 18,722 ----a-w C:\Programme\washandgo.sk4_1.ani
1993-11-06 14:12 4,786 ----a-w C:\Programme\washandgo.sk0_2.ani
1993-11-06 14:08 4,778 ----a-w C:\Programme\washandgo.sk1_2.ani
1993-05-07 17:28 26,540 ----a-w C:\Programme\start.wav
2008-02-15 12:12 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech SetPoint Event Manager (UNICODE)"="C:\Programme\Logitech\SetPoint\SetPoint.exe" [2008-05-02 02:44 805392]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-10-17 20:36 36864]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:22 15360]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-30 14:45 1829712]
"WashAndGo - Cleanup of old Backupfiles"="C:\Programme\\checker.exe" [2003-04-07 19:21 71680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"NVRaidService"="C:\WINDOWS\system32\nvraidservice.exe" [2005-01-17 08:43 84480]
"Easy Synchronization"="C:\Programme\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 12:00 53248]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-07-18 12:28 266497]
"WinPatrol"="C:\Programme\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 07:38 316728]
"AppleSyncNotifier"="C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-03 02:23 116040]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 11:09 77824 C:\WINDOWS\SOUNDMAN.EXE]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 04:23 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:22 15360]
C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
BlueSoleil.lnk - C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-09-20 10:28:16 1200128]
Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe [2006-05-27 16:04:05 805392]
ZDWLan Utility.lnk - C:\Programme\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-01-05 14:00:24 487424]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{FE24CD78-7C63-465D-8787-4EDF7FC79895}"= "C:\Programme\Logitech\Easy Synchronization\shellexecutehook.dll" [2005-10-05 12:00 69632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"TVgenial"=C:\Programme\TVgenial\TVgenial.exe -d
"TuneUp MemOptimizer"="C:\Programme\TuneUpUtilities2006\MemOptimizer.exe" autostart
"LogitechSoftwareUpdate"=C:\Programme\Logitech\Video\ManifestEngine.exe boot
"PhilipsLime"="C:\Programme\Philips\Philips Lime Service\bin\LimeAlive.exe"
"Veoh"="C:\Programme\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
"TomTomHOME.exe"="C:\Programme\TomTom HOME 2\HOMERunner.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"=C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"LogitechVideoRepair"=C:\Programme\Logitech\Video\ISStart.exe
"LogitechVideoTray"=C:\Programme\Logitech\Video\LogiTray.exe
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
"OutpostFeedBack"=C:\Programme\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
"PCSuiteTrayApplication"=C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
"AppleSyncNotifier"=C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"HP Software Update"=E:\prog's in benutzung\HP Software Update\HPWuSchd2.exe
"iTunesHelper"="E:\prog's in benutzung\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\SmartFTP\\SmartFTP.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
R0 Defrag32b;Defrag32Boot;C:\WINDOWS\system32\drivers\Defrag32b.sys [2005-10-10 13:00]
R1 SandBox;Outpost Firewall Sandbox Driver;C:\Programme\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2006-10-26 18:27]
R1 vcdrom;Virtual CD-ROM Device Driver;C:\WINDOWS\system32\drivers\VCdRom.sys [2001-12-19 12:45]
R1 VFILT;Outpost Firewall Kernel Driver;C:\Programme\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2006-10-20 15:48]
R2 AAV UpdateService;AAV UpdateService;C:\Programme\Gemeinsame Dateien\AAV\aavus.exe [2007-10-04 15:32]
R2 ACEDRV06;ACEDRV06;C:\WINDOWS\system32\drivers\ACEDRV06.sys [2007-08-12 22:51]
R2 AntiVirMailService;AntiVir PersonalEdition Premium MailGuard;C:\Programme\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-18 12:28]
R2 AVEService;AntiVir PersonalEdition Premium MailGuard Hilfsdienst;C:\Programme\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-07-18 12:28]
R2 Defrag32;Defrag32;C:\WINDOWS\system32\drivers\Defrag32.sys [2005-10-10 13:00]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 00:53]
R2 PDSched;PDScheduler;C:\Programme\Raxco\PerfectDisk\PDSched.exe [2005-10-10 13:00]
R3 cjusb;REINER SCT cyberJack pinpad/e-com USB;C:\WINDOWS\system32\DRIVERS\cjusb.sys [2005-10-04 08:24]
R3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2004-09-25 00:36]
S3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2006-10-20 15:49]
S3 AR5523;Gigaset USB Adapter 108;C:\WINDOWS\system32\DRIVERS\ar5523.sys [2005-07-27 21:11]
S3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\ARP.DLL [2006-10-20 15:49]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 19:44]
S3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2006-10-20 15:49]
S3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2006-10-20 15:49]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe []
S3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2006-10-20 15:49]
S3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2006-10-20 15:49]
S3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2006-10-20 15:49]
S3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2006-10-20 15:49]
S3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys [2004-03-03 09:50]
S3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2006-10-20 15:49]
S3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2006-10-20 15:49]
S3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2006-10-20 15:49]
S3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2006-10-20 15:49]
S3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Programme\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2006-10-20 15:49]
S3 UPnPService;UPnPService;C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe [2006-10-25 19:22]
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 14:44]
S3 zebrmdm;Sony Ericsson Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdm.sys [2006-04-21 10:22]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\SETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae922506-7699-11dc-a8cf-00148522e861}]
\Shell\AutoRun\command - N:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef8448d7-97c6-11da-9aed-806d6172696f}]
\Shell\AutoRun\command - H:\SETUP.EXE
.
Inhalt des "geplante Tasks" Ordners
2006-02-07 C:\WINDOWS\Tasks\1-Klick-Wartung.job
- C:\Programme\TuneUpUtilities2006\SystemOptimizer.exe [2005-08-17 23:50]
2008-07-23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Programme\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
.
------- Zusätzlicher Scan -------
.
FireFox -: Profile - C:\Dokumente und Einstellungen\Magicc\Anwendungsdaten\Mozilla\Firefox\Profiles\lkgintwz.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.die-staemme.de/
FF -: plugin - C:\Programme\Adobe\Acrobat 7.0\Acrobat\browser\nppdf32.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPJava11.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPJava12.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPJava13.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPJava14.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPJava32.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF -: plugin - C:\Programme\Java\jre1.5.0_06\bin\NPOJI610.dll
FF -: plugin - C:\Programme\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF -: plugin - E:\prog's in benutzung\Mozilla Plugins\npitunes.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-09 11:09:30
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostart Einträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
Zeit der Fertigstellung: 2008-08-09 11:10:27
ComboFix-quarantined-files.txt 2008-08-09 09:10:12
ComboFix2.txt 2008-08-09 09:01:36
Pre-Run: 2,561,728,512 Bytes frei
Post-Run: 2,551,234,560 Bytes frei
291
Hijackthis brachte dieses hier zu tage:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:06:40, on 09.08.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTSERV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
C:\Programme\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Logitech\Easy Synchronization\servicestub.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\Programme\Logitech\Easy Synchronization\LogitechEasySync.exe
C:\Programme\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\Programme\Logitech\SetPoint\LBTWiz.exe
C:\Programme\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir PersonalEdition Premium\avmailc.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Raxco\PerfectDisk\PDSched.exe
C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE
C:\Programme\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [Easy Synchronization] C:\Programme\Logitech\Easy Synchronization\LogitechEasySync.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [WinPatrol] C:\Programme\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SMrhc7s7j0ejcj] C:\Programme\rhc7s7j0ejcj\rhc7s7j0ejcj.exe
O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Programme\Logitech\Easy Synchronization\LogitechEasySync.exe --ports
O4 - HKCU\..\Run: [Logitech SetPoint Event Manager (UNICODE)] C:\Programme\Logitech\SetPoint\SetPoint.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WashAndGo - Cleanup of old Backupfiles] C:\Programme\\checker.exe /check
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Programme\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} (HWTest.HWTestControl) - http://service.maxdome.de/de/systemcheck/HWTest.CAB
O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} (HidInputMonitorX Control) - file://H:\components\hidinputmonitorx.ocx
O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} (A9Helper.A9) - file://H:\components\A9.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193680393203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1193680343828
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.studivz.net/photouploader/ImageUploader4.cab?nocache=20071128-1
O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} (WMVHDRatingCtrl Class) - file://H:\components\wmvhdrating.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFD75D35-171A-479A-94DA-983FE3527C20}: NameServer = 192.168.178.1
O18 - Protocol: bw+0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O18 - Protocol: offline-8876480 - {274BDCBD-7E34-42DE-8755-C7B88111F0DE} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: AAV UpdateService - Unknown owner - C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTSERV.EXE
O23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Programme\Logitech\Easy Synchronization\servicestub.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDSched.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe
O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
--
End of file - 26352 bytes
und die datfind.bat dieses:
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: A4C9-4DB0
Verzeichnis von C:\WINDOWS\system32
09.08.2008 11:24 63.324 perfc009.dat
09.08.2008 11:24 404.104 perfh009.dat
09.08.2008 11:24 76.212 perfc007.dat
09.08.2008 11:24 419.300 perfh007.dat
09.08.2008 11:24 968.180 PerfStringBackup.INI
09.08.2008 10:59 2.228 wpa.dbl
09.08.2008 10:56 4.154.292 OODBS.lor
08.08.2008 23:09 81.920 dapotmro.exe
08.08.2008 21:56 90 spupdwxp.log
08.08.2008 21:55 224.024 FNTCACHE.DAT
02.08.2008 14:36 124.688 mswinsck.ocx
25.06.2008 09:15 17.972.344 MRT.exe
20.06.2008 19:46 147.968 dnsapi.dll
20.06.2008 19:46 247.296 mswsock.dll
27.05.2008 10:50 90.112 QuickTimeVR.qtx
27.05.2008 10:50 57.344 QuickTime.qts
23.05.2008 00:20 200.704 ssldivx.dll
23.05.2008 00:20 1.044.480 libdivx.dll
11.05.2008 13:00 1.197 lvcoinst.log
07.05.2008 07:10 1.293.824 quartz.dll
02.05.2008 02:40 84.496 KemXML.dll
02.05.2008 02:40 117.264 KemWnd.dll
02.05.2008 02:39 145.936 KemUtil.dll
02.05.2008 02:39 170.512 kemutb.dll
02.05.2008 02:38 301.656 BtCoreIf.dll
Zum Problem kann ich noch folgendes sagen...
Antivirus xp 2008 icon war auf auf dem desktop (gelöscht natürlich, aber welche wunder problem noch da
Muss um 23.11 ca aufgetreten sein, da ich da was "installieren" wollte und Antivir verrückt spielte.
Ausserdem habe ich noch ne Datei angefügt in der ich eine ca alle 5min wiederkehrende WinPatrol meldung bekomme und wenn ich das Fenster einige Male geschlossen habe öffnet sich der IE leer...
PS:
Also vundofix (oderso??) sagt nix gefunden
.pandasecurity.com :
so.. panda hat gefunden:
Bck/Ciadoor.FQ Virus/Trojan
Rootkit/Booto.C Virus/Worm
Application/Psexec.A HackTools
Application/MotherboardMonitor.A HackTools
THX for help
__________
Ich lebe ewig!
(bisher erfolgreich)