Die 30 neuesten Dateien im Ordner Windows:
29.08.2007 winamp.ini 10 14:155
29.08.2007 m3jpeg.ini 01 17:714
28.08.2007 NeroDigital.ini 02 35:116
28.08.2007 QTFont.qfn 02 11:54.156
28.08.2007 QTFont.for 02 11:1.409
28.08.2007 WindowsUpdate.log 01 04:1.977.470
28.08.2007 0.log 00 45:0
28.08.2007 wiadebug.log 00 45:157
Systems 28.08.2007 ModemLog_Agere 00 45:3.834
28.08.2007 bootstat.dat 00 45:2.048
28.08.2007 SchedLgU.Txt 00 44:32.552
28.08.2007 wiaservc.log 00 44:50
28.08.2007 wininit.ini 00 31:265
25.08.2007 setupact.log 11 17:220.060
24.08.2007 setupapi.log 18 08:309.025
12.08.2007 m3jp2k.ini 04 40:761
11.08.2007 wmsetup.log 18 17:37.552
11.07.2007 iun6002.exe 14 39:737.280
09.07.2007 iun600.exe 19 50:724.992
07.07.2007 scummvm.ini 17 31:934
13.06.2007 KB933566.log 03 02:20.839
13.06.2007 imsins.log 03 02:1.374
13.06.2007 msgsocm.log 03 02:33.997
13.06.2007 tsoc.log 03 02:262.634
13.06.2007 ntdtcsetup.log 03 02:141.864
13.06.2007 comsetup.log 03 02:226.007
13.06.2007 iis6.log 03 02:95.923
Die 50 neuesten Dateien im Ordner Windows\system32:
28.08.2007 quicktime.qtp 02 11:9.214
20.08.2007 wpa.dbl 17 53:2.206
11.08.2007 amcompat.tlb 18 17:16.832
11.08.2007 nscompat.tlb 18 17:23.392
11.08.2007 w95inf16.dll 18 17:2.272
11.08.2007 w95inf32.dll 18 17:4.608
30.07.2007 wuaucpl.cpl.mui 19 20:30.040
30.07.2007 wuapi.dll.mui 19 20:30.040
30.07.2007 wuaueng.dll 19 19:1.712.984
30.07.2007 wuapi.dll 19 19:549.720
30.07.2007 wucltui.dll 19 19:325.976
30.07.2007 wuweb.dll 19 19:203.096
30.07.2007 wuaucpl.cpl 19 19:216.408
30.07.2007 cdm.dll 19 19:92.504
30.07.2007 wuauclt.exe 19 19:53.080
30.07.2007 wups2.dll 19 19:43.352
30.07.2007 wucltui.dll.mui 19 18:34.136
30.07.2007 wups.dll 19 18:33.624
30.07.2007 wuaueng.dll.mui 19 18:20.824
12.06.2007 ~tmp1260.$$$ 15 58:780.973
06.06.2007 MRT.exe 08 38:15.747.032
31.05.2007 FNTCACHE.DAT 15 46:167.504
29.05.2007 sporder.dll 09 38:8.464
16.05.2007 inetcomm.dll 17 11:683.520
04.05.2007 mshtml.dll 14 27:3.079.680
25.04.2007 schannel.dll 16 22:144.896
18.04.2007 msi.dll 18 13:2.854.400
18.04.2007 urlmon.dll 14 31:617.472
18.04.2007 wininet.dll 14 31:664.576
18.04.2007 pngfilt.dll 14 31:39.424
18.04.2007 shdocvw.dll 14 31:1.494.528
18.04.2007 mstime.dll 14 31:532.480
18.04.2007 msrating.dll 14 31:146.432
18.04.2007 mshtmled.dll 14 31:449.024
18.04.2007 shlwapi.dll 14 31:474.624
18.04.2007 cdfview.dll 14 31:152.064
18.04.2007 dxtmsft.dll 14 31:357.888
18.04.2007 danim.dll 14 31:1.056.256
18.04.2007 extmgr.dll 14 31:55.808
18.04.2007 inseng.dll 14 31:96.768
18.04.2007 dxtrans.dll 14 31:205.312
18.04.2007 jsproxy.dll 14 31:16.384
18.04.2007 iepeers.dll 14 31:251.392
18.04.2007 browseui.dll 14 31:1.023.488
18.04.2007 xpsp3res.dll 12 27:123.392
16.04.2007 kernel32.dll 17 53:1.058.304
13.04.2007 lsdelete.exe 15 19:7.680
# Copyright (c) 1993-1999 Microsoft Corp.
#
# Dies ist eine HOSTS-Beispieldatei, die von Microsoft TCP/IP
# für Windows 2000 verwendet wird.
#
# Diese Datei enthält die Zuordnungen der IP-Adressen zu Hostnamen.
# Jeder Eintrag muss in einer eigenen Zeile stehen. Die IP-
# Adresse sollte in der ersten Spalte gefolgt vom zugehörigen
# Hostnamen stehen.
# Die IP-Adresse und der Hostname müssen durch mindestens ein
# Leerzeichen getrennt sein.
#
# Zusätzliche Kommentare (so wie in dieser Datei) können in
# einzelnen Zeilen oder hinter dem Computernamen eingefügt werden,
# aber müssen mit dem Zeichen '#' eingegeben werden.
#
# Zum Beispiel:
#
# 102.54.94.97 rhino.acme.com # Quellserver
# 38.25.63.10 x.acme.com # x-Clienthost
127.0.0.1 localhost
Logfile of HijackThis v1.99.1
Scan saved at 11:58:48, on 29.08.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\D-Tools\daemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Azureus\Azureus.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\thilo\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://WWW.BenQ.COM/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.1:80
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5DDE5591-A8AB-4897-93EF-1E4E943F85A7} - C:\Programme\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [dndm1.exe] C:\WINDOWS\TEMP\dndm1.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://WWW.BenQ.COM/
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
Search Navipromo version 2.0.9 began on 29.08.2007 at 12:13:16,84
!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Programme\navilog1
Updated on 20.08.2007 at 22h30 by IL-MAFIOSO
Done in normal mode
*** Searching for installed Software ***
*** Search folders in C:\WINDOWS ***
*** Search folders in C:\Programme ***
*** Search folders in C:\Dokumente und Einstellungen\All Users\Application Data ***
*** Search folders in C:\Dokumente und Einstellungen\thilo\Anwendungsdaten ***
*** Search with BlackLight Engine/F-secure ***
BlackLight Engine is a product of F-secure, for more info:
http://www.f-secure.com/blacklight/blacklight_help.html
F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================
Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.
[+] Started on 08/29/07 at 12:13:17.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 08/29/07 at 12:13:38 (return code = 0).
*** Search with GenericNaviSearch ***
!!! Possibility of legitims files in the result !!!
!!! To be always checked before manually deleting !!!
Files found :
No File found !
Suspicious Files :
No Suspicious File found !
*** Search files ***
*** Search registry keys ***
Search in [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
Search in [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]
Search Magic Control Key
*** Complementary Search ***
(Search specifics files)
1)Search known files:
2)Heuristic Search :
*
**
***
****
*****
******
*******
********
3)Certificates Search :
Certificate Egroup not found !
*** Search completed on 29.08.2007 at 12:13:45,04 ***
Search Navipromo version 2.0.9 began on 29.08.2007 at 12:13:16,84
!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Programme\navilog1
Updated on 20.08.2007 at 22h30 by IL-MAFIOSO
Done in normal mode
*** Searching for installed Software ***
*** Search folders in C:\WINDOWS ***
*** Search folders in C:\Programme ***
*** Search folders in C:\Dokumente und Einstellungen\All Users\Application Data ***
*** Search folders in C:\Dokumente und Einstellungen\thilo\Anwendungsdaten ***
*** Search with BlackLight Engine/F-secure ***
BlackLight Engine is a product of F-secure, for more info:
http://www.f-secure.com/blacklight/blacklight_help.html
F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================
Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.
[+] Started on 08/29/07 at 12:13:17.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 08/29/07 at 12:13:38 (return code = 0).
*** Search with GenericNaviSearch ***
!!! Possibility of legitims files in the result !!!
!!! To be always checked before manually deleting !!!
Files found :
No File found !
Suspicious Files :
No Suspicious File found !
*** Search files ***
*** Search registry keys ***
Search in [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
Search in [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]
Search Magic Control Key
*** Complementary Search ***
(Search specifics files)
1)Search known files:
2)Heuristic Search :
*
**
***
****
*****
******
*******
********
3)Certificates Search :
Certificate Egroup not found !
*** Search completed on 29.08.2007 at 12:13:45,04 ***
weiß ja nicht ob ihr da was raus lesen könnt aber wie es aussieht finden auch diese programme auch nichts verdächtiges...oder zumindest ein hinweis wo der mist jetzt herkommt...