mdfree

Hallo!

Ich bekomme seit ein paar Tagen nach dem Hochfahren immer folgende Fehlermeldung:

Warnung: Dateiname
Die Datei oder der Ordner "C:\Program.RPT" kann bestimmte Anwendungen in ihrer Funktion beeinträchtigen. Das Problem könnte durch Umbenennen in "C:\Program1.RPT" gelöst werden. Soll die Datei/der Ordner jetzt umbenannt werden?

_ Prüfung beim Start nicht mehr ausführen
Umbenennen oder Ignorieren

Außerdem hängt sich das Notebook seid Neustem manchmal beim Hochfahren kurz vor der Benutzerkontenauswahl mit einen schwarzen Schirm auf!
Und gestern Abend hing auch Windows zum ersten mal fest.

Beim Googeln bin ich auf diesen Forenbeitrag hier bei euch gestoßen:
http://www.modernboard.de/thread/536...NER-Avira.html

Nun befürchte ich, daß ich mir vielleicht auch etwas eingefangen haben könnte. Ein erster Scan mit Kaspersky zeigte aber nichts.
Ich werde es jetzt nochmal mit Spybot, Adaware und Malewarebytes versuchen und die Logs präsentieren.

Hab schonmal einen Scan mit Hijackthis gemacht, hier das Logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:19:36, on 06.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\vsnp2uvc.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
C:\Program Files\Copy Handler\ch.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\prevhost.exe
D:\Download\Sicherheit\HiJack This\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [WLSS] C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROG RA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

--
End of file - 4942 bytes

Ich hoffe ihr könnt damit etwas anfangen!

lg

mdfree

Humdinger

Hallo

Dein Kaspersky ist nicht aktuell.

Kaspersky 7 - Nutzer sollten auf die neue Kaspersky Version 2009 umsteigen.

http://forum.kaspersky.com/index.php?showtopic=71383


Ansonsten sieht es unauffällig aus. Mach mal folgendes:

CCleaner zuerst ausführen.
http://www.paules-pc-infothek.de/ppf...pic.php?t=1138

Lade dir bitte Combofix
http://virus-protect.org/artikel/tools/combofix.html
ComboFix.exe Version /auf dem Desktop speichern (Kaspersky vor dem ausführen beenden!) und ausführen, klicke die Warnmeldung 0/100 weg (keine Angst das Prog. ist sicher trotz der Meldung)
nichts machen, keine Mausbewegung, abwarten und das Log dann posten.

+

Windows Taste + R drücken, tippe: notepad
File-->Open
navigiere zu: C:\Program.RPT
öffne es und kopiere den Inhalt hier rein.

mdfree

Vielen Dank für die schnelle Antwort.

Das mit kaspersky hab ich nicht gewußt, hab immer nur die normalen updates bekommen. Leider funktioniert der Download der KIS 09 im mom nicht werd mich da aber an den Support wenden.

Der CCleaner hat doch tatsächlich an die 3,5 Gig freihgeschaufelt!

Hiermal das Combofix Log und im Anschluß die Programm.RPT:

ComboFix 08-09-05.02 - Mike_mobil 2008-09-06 18:01:16.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1132 [GMT 2:00]
ausgeführt von:: C:\Users\Mike_mobil\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2008-08-06 bis 2008-09-06 ))))))))))))))))))))))))))))))
.

2008-09-06 18:08 . 2008-09-06 18:09 330,742,291 --a------ C:\Windows\MEMORY.DMP
2008-09-06 15:54 . 2008-09-06 15:54 <DIR> d-------- C:\Program Files\CCleaner
2008-09-06 13:10 . 2008-09-06 13:10 <DIR> d-------- C:\Program Files\Lavalys
2008-09-06 01:38 . 2008-09-06 01:38 11,727 --a------ C:\Program.RPT
2008-09-05 20:29 . 2008-09-06 00:09 <DIR> d-------- C:\Users\Mike_mobil\AppData\Roaming\skypePM
2008-09-05 20:29 . 2008-09-05 20:29 56 --ah----- C:\Windows\System32\ezsidmv.dat
2008-09-05 20:27 . 2008-09-06 01:27 <DIR> d-------- C:\Users\Mike_mobil\AppData\Roaming\Skype
2008-09-05 20:26 . 2008-09-05 20:26 <DIR> d-------- C:\Users\All Users\Skype
2008-09-05 20:26 . 2008-09-05 20:26 <DIR> d-------- C:\ProgramData\Skype
2008-09-05 20:26 . 2008-09-05 20:26 <DIR> d-------- C:\Program Files\Skype
2008-09-05 20:26 . 2008-09-05 20:26 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-09-05 13:09 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-09-05 13:09 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-09-05 13:09 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-09-05 13:09 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-09-05 13:08 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-09-05 13:08 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-09-05 11:47 . 2008-09-05 11:47 0 --a------ C:\ss_router.cfg
2008-09-04 17:24 . 2008-09-04 17:24 11,725 --a------ C:\Program1.RPT
2008-09-02 11:04 . 2008-09-02 11:04 <DIR> d--hs---- C:\Windows\ftpcache
2008-09-01 16:30 . 2008-09-06 15:54 19 --a------ C:\Windows\retrieve.ini
2008-09-01 16:05 . 2008-09-06 15:54 <DIR> d-------- C:\Program Files\GSHH08
2008-09-01 14:21 . 2008-09-01 14:21 <DIR> d-------- C:\Users\Mike_mobil\AppData\Roaming\Smart PC Solutions
2008-08-31 21:52 . 2008-08-31 21:56 <DIR> d-------- C:\Program Files\Happyneuron
2008-08-29 11:21 . 2008-09-02 18:11 <DIR> d-------- C:\Users\Mike_mobil\AppData\Roaming\SPORE Creature Creator
2008-08-27 16:30 . 2008-08-27 16:30 4,096 --a------ C:\Windows\d3dx.dat
2008-08-27 16:17 . 2008-08-27 16:17 <DIR> d-------- C:\Program Files\JoWooD Productions Software AG
2008-08-27 16:06 . 2008-08-27 16:06 2,368 --a------ C:\Windows\System32\SVKP.sys
2008-08-26 22:03 . 2008-08-26 22:03 154 --a------ C:\Windows\ETACoreGUI.INI
2008-08-25 22:58 . 2008-05-30 14:11 3,850,760 --a------ C:\Windows\System32\D3DX9_38.dll
2008-08-25 22:58 . 2008-05-30 14:11 1,491,992 --a------ C:\Windows\System32\D3DCompiler_38.dll
2008-08-25 22:58 . 2008-05-30 14:19 507,400 --a------ C:\Windows\System32\XAudio2_1.dll
2008-08-25 22:58 . 2008-05-30 14:11 467,984 --a------ C:\Windows\System32\d3dx10_38.dll
2008-08-25 22:58 . 2008-05-30 14:18 238,088 --a------ C:\Windows\System32\xactengine3_1.dll
2008-08-25 22:58 . 2008-05-30 14:17 65,032 --a------ C:\Windows\System32\XAPOFX1_0.dll
2008-08-25 22:58 . 2008-05-30 14:17 25,608 --a------ C:\Windows\System32\X3DAudio1_4.dll
2008-08-20 19:11 . 2008-08-20 19:11 <DIR> d-------- C:\Program Files\Bullzip
2008-08-20 19:11 . 2008-04-22 08:19 187,392 --a------ C:\Windows\System32\bzpdf.dll
2008-08-20 19:11 . 2008-04-02 08:13 147,456 --a------ C:\Windows\System32\bzpdfc.dll
2008-08-18 09:54 . 2008-08-18 09:54 <DIR> d-------- C:\Program Files\Paint.NET
2008-08-15 22:29 . 2008-08-15 22:29 <DIR> d-------- C:\Program Files\Copy Handler
2008-08-15 20:38 . 2008-08-15 20:38 <DIR> d-------- C:\Users\Mike_mobil\AppData\Roaming\EDrawings
2008-08-15 20:37 . 2008-08-15 20:37 <DIR> d-------- C:\Program Files\Common Files\SolidWorks Shared
2008-08-15 20:37 . 2008-08-15 20:37 0 --a------ C:\Windows\eDrawingOfficeAutomator.INI
2008-08-15 08:02 . 2008-08-15 08:02 0 --a------ C:\Windows\nsreg.dat
2008-08-15 07:41 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-15 07:38 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-15 07:38 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-15 07:38 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-15 07:38 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-15 07:38 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-10 20:21 . 2008-08-10 20:21 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_ 00.Wdf
2008-08-08 19:16 . 2008-08-08 19:16 <DIR> d-------- C:\Users\Mike_mobil\AppData\Roaming\Bullzip
2008-08-06 10:44 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-08-06 10:44 . 2008-04-26 10:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-08-06 10:44 . 2008-04-26 10:26 891,448 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-08-06 10:44 . 2008-04-12 05:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll
2008-08-06 10:44 . 2008-05-10 05:35 564,736 --a------ C:\Windows\System32\emdmgmt.dll
2008-08-06 10:44 . 2008-04-05 03:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys
2008-08-06 10:44 . 2008-04-05 05:34 15,360 --a------ C:\Windows\System32\pacerprf.dll
2008-08-06 10:43 . 2008-05-08 23:59 430,080 --a------ C:\Windows\System32\vbscript.dll
2008-08-06 10:43 . 2008-05-08 23:59 180,224 --a------ C:\Windows\System32\scrobj.dll
2008-08-06 10:43 . 2008-05-08 23:59 172,032 --a------ C:\Windows\System32\scrrun.dll
2008-08-06 10:43 . 2008-05-08 23:59 155,648 --a------ C:\Windows\System32\wscript.exe
2008-08-06 10:43 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\wshom.ocx
2008-08-06 10:43 . 2008-05-08 23:58 135,168 --a------ C:\Windows\System32\cscript.exe
2008-08-06 10:43 . 2008-05-08 23:59 90,112 --a------ C:\Windows\System32\wshext.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))) ))))
.
2008-09-06 11:55 --------- d-----w C:\Users\Mike_mobil\AppData\Roaming\Dateicommander
2008-09-06 11:55 --------- d-----w C:\ProgramData\Dateicommander
2008-09-06 11:55 --------- d-----w C:\Program Files\DateiCommander
2008-09-06 10:58 --------- d-----w C:\Users\Mike_mobil\AppData\Roaming\OpenOffice.org 2
2008-09-06 10:58 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-09-05 23:40 66,778,912 --sha-w C:\Windows\system32\drivers\fidbox.dat
2008-09-05 23:37 28,314 ----a-w C:\Users\Mike_mobil\AppData\Roaming\nvModes.dat
2008-09-05 07:21 866,168 --sha-w C:\Windows\system32\drivers\fidbox.idx
2008-08-31 14:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-25 21:00 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
2008-08-25 20:54 --------- d-----w C:\Program Files\Common Files\BioWare
2008-08-11 06:12 96,976 ----a-w C:\Windows\system32\drivers\klin.dat
2008-08-06 08:38 --------- d-----w C:\ProgramData\NVIDIA
2008-08-06 08:35 174 --sha-w C:\Program Files\desktop.ini
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Sidebar
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Mail
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Journal
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Defender
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Collaboration
2008-08-06 08:25 --------- d-----w C:\Program Files\Windows Calendar
2008-08-06 08:10 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-08-06 08:10 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-08-05 09:26 --------- d-----w C:\Program Files\Easy2Sync
2008-07-29 20:24 --------- d-----w C:\Program Files\Foxit Software
2008-07-29 07:04 --------- d-----w C:\ProgramData\Adobe Systems
2008-07-29 07:04 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-07-25 19:51 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
2008-07-25 19:18 --------- d-----w C:\Program Files\dena Energieausweis
2008-07-25 06:15 --------- d-----w C:\Users\Mike_mobil\AppData\Roaming\Itsth
2008-07-24 17:45 --------- d-----w C:\Users\Mike_mobil\AppData\Roaming\softTECH
2008-07-24 17:44 --------- d-----w C:\Program Files\SOFTTECH
2008-07-24 17:33 --------- d-----w C:\ProgramData\Softtech
2008-07-24 10:42 87,855 ----a-w C:\Windows\system32\drivers\klick.dat
2008-07-24 09:44 --------- d-----w C:\Program Files\dena Energiepass
2008-07-24 09:43 --------- d-----w C:\Program Files\Rowa-Soft GmbH
2008-07-18 04:58 2,549,248 ----a-w C:\Windows\System32\aksllmtp.exe
2008-07-15 17:18 12,400 ----a-w C:\Windows\system32\drivers\secdrv.sys
2008-07-12 13:19 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-07-09 20:06 --------- d-----w C:\Users\Mike_mobil\AppData\Roaming\Ashampoo
2008-07-09 20:06 --------- d-----w C:\ProgramData\ashampoo
2008-06-26 03:29 801,280 ----a-w C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45 2,644,480 ----a-w C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45 12,240,896 ----a-w C:\Windows\System32\NlsLexicons0007.dll
2008-06-16 10:05 191,488 ----a-w C:\Windows\System32\hlvdd.dll
2008-06-07 21:54 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-06-07 21:54 315,392 ----a-w C:\Windows\HideWin.exe
2008-06-07 21:39 444,952 ----a-w C:\Windows\System32\wrap_oal.dll
2008-06-07 21:39 109,080 ----a-w C:\Windows\System32\OpenAL32.dll
2008-06-06 16:22 988,216 ----a-w C:\Windows\System32\winload.exe
2008-06-06 16:22 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-06-06 16:22 615,992 ----a-w C:\Windows\System32\ci.dll
2008-06-06 16:22 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-06-06 16:22 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-06-06 16:22 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-06-06 16:22 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-06-06 16:22 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-06-06 16:22 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-06-06 16:22 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-06-06 16:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-06-06 16:20 295,936 ----a-w C:\Windows\System32\gdi32.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\UE AFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-03-28 19:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\UE AFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-03-28 19:59 2953216 --a------ C:\Program Files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Copy Handler"="C:\Program Files\Copy Handler\ch.exe" [2008-03-25 425472]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 33048]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2007-03-28 49168]
"snp2uvc"="C:\Windows\vsnp2uvc.exe" [2006-12-29 569344]
"WLSS"="C:\Program Files\Compal\Wireless Select Switch\WLSS.exe" [2007-03-29 190000]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2008-01-11 92704]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-01-11 8534560]
"NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [2008-01-11 88608]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-12-18 227856]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-10 C:\Windows\RtHDVCpl.exe]

C:\Users\Mike_mobil\AppData\Roaming\Microsoft\Wind ows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableLUA"= 0 (0x0)
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-03-28 19:46 90112 C:\Windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\r3h ook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dl l

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"TCP Query User{19A835F8-5DEC-4DD3-B29D-C60130B22F91}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\german\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\german\setup.exe:Installationsprogramm für Kaspersky Internet Security 7.0
"UDP Query User{B3A55274-FDB2-4317-BCC7-0C1E15E150B2}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.321\\german\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.321\german\setup.exe:Installationsprogramm für Kaspersky Internet Security 7.0
"{0487F542-9687-401F-9BB4-A95BFCEFF18D}"= UDP:\Spiele\Mass Effect\Binaries\MassEffect.exe:Mass Effect Game
"{DC15C834-4AFA-445B-B2AC-1C9188DC819B}"= TCP:\Spiele\Mass Effect\Binaries\MassEffect.exe:Mass Effect Game
"{E01F7B4F-5995-4A57-859C-E522B2C93B74}"= UDP:\Spiele\Mass Effect\MassEffectLauncher.exe:Mass Effect Launcher
"{E1D0F3A9-FD38-40EA-9505-EDD2DE883B70}"= TCP:\Spiele\Mass Effect\MassEffectLauncher.exe:Mass Effect Launcher
"{C40DE1D1-4874-45E7-9735-9303592CC60C}"= C:\Program Files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 EMSC;COMPAL Embedded System Control;C:\Windows\system32\DRIVERS\EMSC.SYS [2007-02-13 11776]
R0 iaNvStor;Intel(R) Turbo Memory Technology NAND Controller;C:\Windows\system32\DRIVERS\iaNvStor.sy s [2007-03-11 210432]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-10-16 20496]
R2 SVKP;SVKP;C:\Windows\system32\SVKP.sys [2008-08-27 2368]
R3 b57nd60x;%SvcDispName%;C:\Windows\system32\DRIVERS \b57nd60x.sys [2008-01-19 179712]
S3 Wibukey2;Wibukey2;C:\Windows\system32\drivers\wibu key2.sys [2007-11-02 16384]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{af3567b3-33d7-11dd-8d82-806e6f6e6963}]
\shell\AutoRun\command - E:\pcwstart.exe

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{cfe88a38-33db-11dd-b262-0016d4dde0ba}]
\shell\AutoRun\command - F:\KIS7_MEHRPLATZ.EXE
.
.
------- Zus„tzlicher Scan -------
.
FireFox -: Profile - C:\Users\Mike_mobil\AppData\Roaming\Mozilla\Firefo x\Profiles\g4artmrr.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.de/
.

************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-06 18:10:09
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

************************************************** ************************
.
------------------------ Weitere, laufende Prozesse ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Protector Suite QL\upeksvr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\dllhost.exe
.
************************************************** ************************
.
Zeit der Fertigstellung: 2008-09-06 18:17:05 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2008-09-06 16:16:53

Pre-Run: 12 Verzeichnis(se), 39,074,836,480 Bytes frei
Post-Run: 18 Verzeichnis(se), 38,506,106,880 Bytes frei

241 --- E O F --- 2008-09-05 11:14:10




Und hier nun die Programm.RPT:

//======================UNHANDLED EXCEPTION======================
//======================UNHANDLED EXCEPTION======================
gothic2.exe caused a EXCEPTION_ACCESS_VIOLATION in module gothic2.exe at 001B:0076C224
EAX=435A05A8 EBX=7FF12E68 ECX=BDCE8990 EDX=7FF12F04 ESI=7FE90034
EDI=008E8518 EBP=00000004 ESP=0166F958 EIP=0076C224 FLG=00210202
CS=001B DS=0023 SS=0023 ES=0023 FS=003B GS=0000
//===================== INFOS =========================
Gothic II - 2.5 (dev), Parser Version: 50
User: Mike_mobil, CPUType: 586, Mem: 2046 MB total, 1001 MB free
Camera: Pos(13056.6172/-1188.91223/14091.7207), At(-0.763379574/-0.123482071/-0.634037673)
//====================== CALLSTACK ========================
001B:0076C224 (0x00000000 0x00000000 0x00000000 0x00000000) gothic2.exe
//================================================== ===

//===================== MODULES =======================

Module list: names, addresses, sizes, time stamps and file times:
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\gothic2.exe, loaded at 0x00400000 - 5370880 bytes - 3f31f102 - file date is 8/7/2003 13:26:12
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\SHW32.DLL, loaded at 0x02bb0000 - 124656 bytes - 39983012 - file date is 10/11/2000 19:08:30
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\BUGSLAYERUTIL.DLL, loaded at 0x02be0000 - 32827 bytes - 37f8d416 - file date is 10/4/1999 17:22:48
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\VDFS32G.DLL, loaded at 0x02c00000 - 93696 bytes - 2a425e19 - file date is 1/22/2003 01:30:00
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\BINKW32.DLL, loaded at 0x12160000 - 375808 bytes - 3e9e0f4d - file date is 4/16/2003 19:19:58
C:\Windows\system32\WLDAP32.dll, loaded at 0x127e0000 - 289280 bytes - 4791a7de - file date is 1/19/2008 09:36:58
C:\Windows\system32\nvd3dum.dll, loaded at 0x13170000 - 5263360 bytes - 478786f6 - file date is 1/11/2008 08:43:00
C:\Windows\system32\dmime.dll, loaded at 0x15060000 - 178688 bytes - 4791a683 - file date is 1/19/2008 09:34:06
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\MSS32.DLL, loaded at 0x21100000 - 370688 bytes - 3e767330 - file date is 3/17/2003 17:15:30
C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll, loaded at 0x30000000 - 84496 bytes - 4766ed7e - file date is 12/18/2007 00:44:42
C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll, loaded at 0x30780000 - 72208 bytes - 4766ed7e - file date is 12/18/2007 00:45:00
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\msdbi.dll, loaded at 0x63420000 - 102672 bytes - 37715ac8 - file date is 6/23/1999 16:08:10
C:\Windows\AppPatch\AcGenral.DLL, loaded at 0x67a30000 - 2153984 bytes - 47d213cf - file date is 3/8/2008 06:19:22
C:\Windows\system32\DDRAW.DLL, loaded at 0x6b2e0000 - 522752 bytes - 4791a66c - file date is 1/19/2008 09:34:04
C:\Windows\system32\D3DIM700.DLL, loaded at 0x6baf0000 - 816128 bytes - 4791a65f - file date is 1/19/2008 09:34:02
C:\Windows\system32\DSOUND.dll, loaded at 0x6fbf0000 - 444416 bytes - 4791a6b5 - file date is 1/19/2008 09:34:08
C:\Windows\system32\ShimEng.dll, loaded at 0x6ff10000 - 111104 bytes - 4549bdb7 - file date is 11/2/2006 11:46:14
C:\Windows\system32\IconCodecService.dll, loaded at 0x700b0000 - 9728 bytes - 4549bcec - file date is 11/2/2006 14:34:34
C:\Windows\system32\dwmapi.dll, loaded at 0x70940000 - 39936 bytes - 4791a6c1 - file date is 1/19/2008 09:34:08
C:\Windows\system32\SensApi.dll, loaded at 0x70cd0000 - 8704 bytes - 4549bdd6 - file date is 11/2/2006 11:46:14
C:\Windows\system32\sfc.dll, loaded at 0x71330000 - 4608 bytes - 4549bdb4 - file date is 11/2/2006 11:46:14
C:\Program Files\JoWooD Productions Software AG\Gothic II Gold\system\imagehl2.dll, loaded at 0x71460000 - 85264 bytes - 35da03d4 - file date is 8/18/1998 09:47:18
C:\Windows\system32\WSOCK32.DLL, loaded at 0x71e30000 - 15360 bytes - 4791a7c1 - file date is 1/19/2008 09:37:12
C:\Windows\system32\dmstyle.dll, loaded at 0x71ff0000 - 105472 bytes - 4549bceb - file date is 11/2/2006 14:34:34
C:\Windows\system32\dmsynth.dll, loaded at 0x72050000 - 105472 bytes - 4791a689 - file date is 1/19/2008 09:34:06
C:\Windows\system32\HID.DLL, loaded at 0x73620000 - 22016 bytes - 4549bcde - file date is 11/2/2006 11:46:06
C:\Windows\system32\WindowsCodecs.dll, loaded at 0x73680000 - 712192 bytes - 4791a7ac - file date is 1/19/2008 09:36:56
C:\Windows\system32\midimap.dll, loaded at 0x73740000 - 17408 bytes - 4791a714 - file date is 1/19/2008 09:34:48
C:\Windows\system32\MSACM32.dll, loaded at 0x73750000 - 71680 bytes - 4791a704 - file date is 1/19/2008 09:34:56
C:\Windows\system32\audioeng.dll, loaded at 0x737b0000 - 397312 bytes - 4791a639 - file date is 1/19/2008 09:33:46
C:\Windows\system32\AUDIOSES.DLL, loaded at 0x73820000 - 116224 bytes - 4791a63b - file date is 1/19/2008 09:33:46
C:\Windows\system32\msacm32.drv, loaded at 0x73880000 - 21504 bytes - 4791a705 - file date is 1/19/2008 09:32:58
C:\Windows\system32\wdmaud.drv, loaded at 0x73950000 - 166912 bytes - 4791a773 - file date is 1/19/2008 09:32:58
C:\Windows\system32\ksuser.dll, loaded at 0x73ac0000 - 4608 bytes - 4549bd89 - file date is 11/2/2006 11:46:06
C:\Windows\system32\DCIMAN32.dll, loaded at 0x73ae0000 - 10240 bytes - 4549bccc - file date is 11/2/2006 11:46:04
C:\Windows\system32\MMDevAPI.DLL, loaded at 0x73af0000 - 149504 bytes - 4791a6ed - file date is 1/19/2008 09:34:50
C:\Windows\system32\cryptnet.dll, loaded at 0x73b20000 - 97792 bytes - 4791a771 - file date is 1/19/2008 09:34:02
C:\Windows\system32\dmcompos.dll, loaded at 0x73bd0000 - 62976 bytes - 4549bce2 - file date is 11/2/2006 14:34:34
C:\Windows\system32\sfc_os.dll, loaded at 0x73e60000 - 38912 bytes - 4791a759 - file date is 1/19/2008 09:36:26
C:\Windows\system32\DINPUT.DLL, loaded at 0x73ff0000 - 136192 bytes - 4549bcd6 - file date is 11/2/2006 14:34:32
C:\Windows\system32\dmusic.dll, loaded at 0x74040000 - 101888 bytes - 4791a68a - file date is 1/19/2008 09:34:06
C:\Windows\system32\msadp32.acm, loaded at 0x74080000 - 17408 bytes - 4549bd3e - file date is 11/2/2006 11:44:50
C:\Windows\system32\AVRT.dll, loaded at 0x741a0000 - 12800 bytes - 4791a655 - file date is 1/19/2008 09:33:48
C:\Windows\system32\OLEACC.dll, loaded at 0x741b0000 - 215040 bytes - 4791a74d - file date is 1/19/2008 09:36:02
C:\Windows\system32\WINMM.dll, loaded at 0x741f0000 - 189952 bytes - 4791a7b6 - file date is 1/19/2008 09:36:56
C:\Windows\system32\dmband.dll, loaded at 0x74300000 - 30208 bytes - 4549bce1 - file date is 11/2/2006 14:34:34
C:\Windows\system32\dmloader.dll, loaded at 0x74310000 - 38400 bytes - 4791a685 - file date is 1/19/2008 09:34:06
C:\Windows\system32\UxTheme.dll, loaded at 0x744c0000 - 240128 bytes - 4791a77a - file date is 1/19/2008 09:36:48
C:\Windows\system32\WINTRUST.dll, loaded at 0x745f0000 - 171520 bytes - 4791a7c9 - file date is 1/19/2008 09:36:58
C:\Windows\system32\POWRPROF.dll, loaded at 0x747a0000 - 97280 bytes - 4791a780 - file date is 1/19/2008 09:36:08
C:\Windows\system32\NTMARTA.DLL, loaded at 0x747c0000 - 121344 bytes - 4791a7b8 - file date is 1/19/2008 09:36:00
C:\Windows\system32\GPAPI.dll, loaded at 0x74af0000 - 75264 bytes - 4791a6a9 - file date is 1/19/2008 09:34:24
C:\Windows\system32\rsaenh.dll, loaded at 0x74b10000 - 242744 bytes - 4791a754 - file date is 1/19/2008 09:38:04
C:\Windows\system32\VERSION.dll, loaded at 0x74e00000 - 20480 bytes - 4791a776 - file date is 1/19/2008 09:36:48
C:\Windows\system32\BCRYPT.dll, loaded at 0x74eb0000 - 274432 bytes - 4791a639 - file date is 1/19/2008 09:33:48
C:\Windows\system32\ncrypt.dll, loaded at 0x74f00000 - 204288 bytes - 4791a724 - file date is 1/19/2008 09:35:36
C:\Windows\system32\slc.dll, loaded at 0x75020000 - 225792 bytes - 4791a73f - file date is 1/19/2008 09:36:12
C:\Windows\system32\CRYPT32.dll, loaded at 0x75060000 - 977408 bytes - 4791a76d - file date is 1/19/2008 09:34:02
C:\Windows\system32\MPR.dll, loaded at 0x75160000 - 68608 bytes - 4791a6ea - file date is 1/19/2008 09:34:54
C:\Windows\system32\MSASN1.dll, loaded at 0x751c0000 - 59904 bytes - 4549bd41 - file date is 11/2/2006 11:46:08
C:\Windows\system32\SAMLIB.dll, loaded at 0x751e0000 - 57344 bytes - 4791a74d - file date is 1/19/2008 09:36:20
C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdb aa5a083979cc\comctl32.dll, loaded at 0x75370000 - 1684480 bytes - 4791a752 - file date is 1/19/2008 09:26:36
C:\Windows\system32\NETAPI32.dll, loaded at 0x755e0000 - 466944 bytes - 4791a72e - file date is 1/19/2008 09:35:36
C:\Windows\system32\apphelp.dll, loaded at 0x75710000 - 171008 bytes - 4791a628 - file date is 1/19/2008 09:33:44
C:\Windows\system32\Secur32.dll, loaded at 0x75770000 - 72704 bytes - 4791a777 - file date is 1/19/2008 09:36:22
C:\Windows\system32\USERENV.dll, loaded at 0x75790000 - 108032 bytes - 4791a775 - file date is 1/19/2008 09:36:48
C:\Windows\system32\PSAPI.DLL, loaded at 0x75840000 - 12288 bytes - 4549bd99 - file date is 11/2/2006 11:46:14
C:\Windows\system32\OLEAUT32.dll, loaded at 0x758e0000 - 563200 bytes - 4791a74f - file date is 1/19/2008 09:36:02
C:\Windows\system32\LPK.DLL, loaded at 0x75970000 - 23552 bytes - 4791a6e9 - file date is 1/19/2008 09:34:44
C:\Windows\system32\USER32.DLL, loaded at 0x75980000 - 627200 bytes - 4791a773 - file date is 1/19/2008 09:36:48
C:\Windows\system32\USP10.dll, loaded at 0x75a20000 - 501760 bytes - 4791a776 - file date is 1/19/2008 09:36:48
C:\Windows\system32\CLBCatQ.DLL, loaded at 0x75aa0000 - 523776 bytes - 4791a66f - file date is 1/19/2008 09:33:54
C:\Windows\system32\RPCRT4.dll, loaded at 0x75b30000 - 784896 bytes - 48002c9c - file date is 4/12/2008 05:32:12
C:\Windows\system32\imagehlp.dll, loaded at 0x75c10000 - 153088 bytes - 4791a709 - file date is 1/19/2008 09:34:34
C:\Windows\system32\msvcrt.dll, loaded at 0x75c40000 - 680448 bytes - 4791a727 - file date is 1/19/2008 09:35:16
C:\Windows\system32\WS2_32.dll, loaded at 0x75cf0000 - 179200 bytes - 4791a798 - file date is 1/19/2008 09:37:10
C:\Windows\system32\ole32.dll, loaded at 0x75d20000 - 1315328 bytes - 4791a74c - file date is 1/19/2008 09:36:02
C:\Windows\system32\kernel32.dll, loaded at 0x75e70000 - 888320 bytes - 4791a76d - file date is 1/19/2008 09:34:38
C:\Windows\system32\GDI32.dll, loaded at 0x75fd0000 - 295936 bytes - 47be5636 - file date is 6/6/2008 18:20:32
C:\Windows\system32\SHELL32.DLL, loaded at 0x76020000 - 11580416 bytes - 4810129c - file date is 4/24/2008 06:58:22
C:\Windows\system32\SETUPAPI.dll, loaded at 0x76b30000 - 1590272 bytes - 4791a754 - file date is 1/19/2008 09:36:26
C:\Windows\system32\ADVAPI32.dll, loaded at 0x76cc0000 - 798720 bytes - 4791a64b - file date is 1/19/2008 09:33:44
C:\Windows\system32\MSCTF.dll, loaded at 0x76e60000 - 806912 bytes - 4791a720 - file date is 1/19/2008 09:34:56
C:\Windows\system32\urlmon.dll, loaded at 0x76f30000 - 1166336 bytes - 486468d2 - file date is 6/27/2008 06:15:30
C:\Windows\system32\ntdll.dll, loaded at 0x77060000 - 1203792 bytes - 4791a7a6 - file date is 1/19/2008 09:38:16
C:\Windows\system32\IMM32.DLL, loaded at 0x77190000 - 114688 bytes - 4791a715 - file date is 1/19/2008 09:34:34
C:\Windows\system32\iertutil.dll, loaded at 0x771b0000 - 270336 bytes - 4791a6df - file date is 1/19/2008 09:34:32
C:\Windows\system32\SHLWAPI.dll, loaded at 0x77250000 - 351744 bytes - 4791a75c - file date is 1/19/2008 09:36:30
C:\Windows\system32\NSI.dll, loaded at 0x772b0000 - 8192 bytes - 4791a7a4 - file date is 1/19/2008 09:35:58
//================================================== ===

mdfree

Und nochmal mein aktuelles HJT Log nach CCleaner:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:28:24, on 06.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\vsnp2uvc.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Copy Handler\ch.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Windows\Explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Download\Sicherheit\HiJack This\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [WLSS] C:\Program Files\Compal\Wireless Select Switch\WLSS.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Copy Handler] C:\Program Files\Copy Handler\ch.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROG RA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

--
End of file - 4421 bytes

mdfree

Hab Problem mit der Programm.rpt gefunden.
Wer lesen kann ist im Vorteil hatte letzte Woche von einer Heftdvd das beigefügte Spiel Gothic2 installiert. das verursacht anscheinend ein Kompatibilitätsproblem mit nvideatreibern was zu Fehlermeldungen führt.

Siehe : http://forum.jowood.de/showthread.php?t=75199&page=1

Lösungsvorschlag da ist einen älteren Treiber zu benutzen

Falls jetzt in meinem HJT Log nichts mehr zu finden ist, bin ich versorgt


Hab vielen Dank, find das echt super, das es Leute gibt die sich all die Logs anschaun und helfen, vielen Dank

lg

mdfree

Humdinger

Hallo

Sicherheitshalber überprüfe noch:

C:\Windows\System32\ci.dll

auf

http://www.virustotal.com/de/

hier abkopieren und bei Virustotal einkopieren (mit Strg V)

Ergebnis abkopieren und hier vollständig posten

Tipp:
Nutze zusätzlich immer die Freeware Sandboxie für alle Browser / Mailproggi etc.. (außer dem IE )
http://www.paules-pc-infothek.de/ppf...pic.php?t=1136
Die neuste Version ist jetzt auch direkt auf Deutsch einstellbar.

mdfree

Hoffe das ist so richtig und nochmals danke.

Den Tipp mit Sandboxie werd ich beherzigen, hört sich gut an.

So, dann wünsch ich dir einen guten Start in die neue Woche

lg
mdfree



AhnLab-V3 2008.9.6.0 2008.09.07 -
AntiVir 7.8.1.28 2008.09.07 -
Authentium 5.1.0.4 2008.09.07 -
Avast 4.8.1195.0 2008.09.07 -
AVG 8.0.0.161 2008.09.07 -
BitDefender 7.2 2008.09.07 -
CAT-QuickHeal 9.50 2008.09.06 -
ClamAV 0.93.1 2008.09.07 -
DrWeb 4.44.0.09170 2008.09.07 -
eSafe 7.0.17.0 2008.09.07 -
eTrust-Vet 31.6.6072 2008.09.05 -
Ewido 4.0 2008.09.07 -
F-Prot 4.4.4.56 2008.09.07 -
F-Secure 8.0.14332.0 2008.09.07 -
Fortinet 3.112.0.0 2008.09.07 -
GData 19 2008.09.07 -
Ikarus T3.1.1.34.0 2008.09.07 -
K7AntiVirus 7.10.443 2008.09.05 -
Kaspersky 7.0.0.125 2008.09.07 -
McAfee 5378 2008.09.05 -
Microsoft 1.3903 2008.09.07 -
NOD32v2 3424 2008.09.07 -
Norman 5.80.02 2008.09.05 -
Panda 9.0.0.4 2008.09.07 -
PCTools 4.4.2.0 2008.09.07 -
Prevx1 V2 2008.09.07 -
Rising 20.60.62.00 2008.09.07 -
Sophos 4.33.0 2008.09.07 -
Sunbelt 3.1.1616.1 2008.09.07 -
Symantec 10 2008.09.07 -
TheHacker 6.3.0.8.075 2008.09.06 -
TrendMicro 8.700.0.1004 2008.09.05 -
VBA32 3.12.8.5 2008.09.07 suspected of Win32.BrokenEmbeddedSignature (paranoid heuristics)
ViRobot 2008.9.5.1365 2008.09.06 -
VirusBuster 4.5.11.0 2008.09.07 -
Webwasher-Gateway 6.6.2 2008.09.07 -

weitere Informationen
File size: 615992 bytes
MD5...: f935df6f39bc274dea31ba84071ed89d
SHA1..: 95128b81992342af9b3e09e33843cc02b8379ca4
SHA256: 62dc2654198df856d929390408147d2f67821a1641334a89e4 766e56abb33c36
SHA512: 24dcd03eca1b7278d76a37a30afd563a599fc79f26ac7e1fde 9d99d44ec3faeb
acc0b68fed4631b3459912a1e249289fe2ee7aa9ec30363628 abd48ae62f853f
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x32f10000
timedatestamp.....: 0x47be5708 (Fri Feb 22 05:00:56 2008)
machinetype.......: 0x14c (I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x7ef88 0x7f000 5.51 1c261294f7cdd6115c8d710dab6845f7
.data 0x80000 0x49e98 0x2e00 7.93 a2314a9a4afcd3f2ea1e39e66c89b43e
PAGE 0xca000 0xbb25 0xbc00 6.72 bac430894cebe6993b0fc31a71f3ac61
.edata 0xd6000 0xc9 0x200 2.46 f205c39d21007fb7b785b7b9f40e3e93
PAGECONS 0xd7000 0x15ac 0x1600 7.37 ca107de80573fdec5f2b15e75d2d444d
PAGEDATA 0xd9000 0x30 0x200 0.65 52e26cb23585ae513469166f68d1d2cc
INIT 0xda000 0x990 0xa00 5.45 f6fab839bd4b6eee874d0d982b13f6ce
.rsrc 0xdb000 0x2560 0x2600 3.59 267b9cec864009f2dc9569a26c9c2a19
.reloc 0xde000 0x15ce 0x1600 4.64 1731ad9bc491c21a83f196e73e1a7e47

( 1 imports )
> ntoskrnl.exe: ExfAcquirePushLockExclusive, ExfTryToWakePushLock, RtlCopyUnicodeString, ExAllocatePoolWithTag, KdDebuggerNotPresent, KdDebuggerEnabled, ZwClose, ZwQueryInformationFile, ZwOpenFile, EtwEventEnabled, ZwQueryValueKey, ZwOpenKey, RtlInitUnicodeString, ExQueueWorkItem, ExFreePoolWithTag, KeBugCheckEx, KeTickCount, KeSetTimer, KeInitializeDpc, KeInitializeTimer, EtwUnregister, InitSafeBootMode, EtwRegister, _allmul, PsGetCurrentProcess, DbgBreakPoint, DbgPrint, ObOpenObjectByPointer, IoFileObjectType, ObQueryNameString, memcpy, KeUnstackDetachProcess, RtlFreeUnicodeString, KeStackAttachProcess, memset, PsIsProtectedProcess, RtlImageNtHeader, FsRtlGetFileSize, memmove, ExAllocatePoolWithQuotaTag, PsIsCurrentThreadPrefetching, ZwReadFile, EtwWrite, SeReportSecurityEventWithSubCategory, MmUnlockPages, KeWaitForSingleObject, IoPageRead, KeInitializeEvent, MmProbeAndLockPages, MmSizeOfMdl, RtlUnwind, ZwUnmapViewOfSection, ZwMapViewOfSection, ZwCreateSection, ZwFreeVirtualMemory, RtlCompareMemory, qsort, ZwAllocateVirtualMemory, KeLeaveCriticalRegion, ExReleaseResourceLite, ExAcquireResourceExclusiveLite, KeEnterCriticalRegion, ExAcquireResourceSharedLite, ExInitializeResourceLite, ExDeleteResourceLite, RtlCompressBuffer, RtlGetCompressionWorkSpaceSize, ZwWriteFile, ZwCreateFile, RtlDecompressBuffer, RtlAppendUnicodeStringToString, ExConvertExclusiveToSharedLite, RtlCompareUnicodeString, ZwQueryDirectoryFile, RtlCreateUnicodeString, bsearch, atol, _aulldiv, PsCreateSystemThread, RtlAppendUnicodeToString, wcschr, RtlAnsiStringToUnicodeString, RtlInitAnsiString, ZwQuerySystemInformation, PsSetCreateProcessNotifyRoutine, IoGetCurrentProcess, PsGetProcessId, PsInitialSystemProcess, PsTerminateSystemThread, RtlRunOnceExecuteOnce, KeSetPriorityThread, KeGetCurrentThread, NtSetInformationThread, NtQueryInformationThread, wcsncmp, ExAllocatePool

( 5 exports )
CiFindPageHashesInCatalog, CiFindPageHashesInSignedFile, CiFreePolicyInfo, CiGetPEInformation, CiInitialize