Pc sehr langsam Einstellungen

[r00t]

hi also mein kollege hat ein Problem mit seinem PC und zwar friert das Bild immer komplett ein und naja ist sau langsam inet verbindung ist sehr schlecht usw ... ich hatte ihn gesagt er soll ma comboscann durchrennen lassen und des hier ist das ergebniss nur werde ich net ganz schlau draus ^^


vielleicht kann sich des wer von euch ma anschauen

ComboScan v20070306.20 run by Craig Freeman on 2008-07-22 at 22:59:26
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 2 Restore Point(s) --
2: 2008-07-22 19:25:07 UTC - RP399 - OpenOffice.org Installer 1.0 wird installiert
1: 2008-07-22 19:22:24 UTC - RP398 - Installed Java™ 6 Update 7


Performed disk cleanup.


-- HijackThis (run as Craig Freeman.exe) ---------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 23:00:44, on 22.07.2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\D-Link\Air Utility\AirCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe
C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Users\Craig Freeman\Documents\ICQ\259202381\ReceivedFiles\338508457 r00tsyst3m\comboscan.exe
C:\Windows\system32\SearchFilterHost.exe
C:\PROGRA~1\HIJACK~1\Craig Freeman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 80.239.180.111 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.112 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.113 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.114 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.115 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.116 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.117 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.109 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.110 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.111 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.112 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.113 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.114 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.115 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.178.116 eu.logon.worldofwarcraft.com
O1 - Hosts: 80.239.180.110 eu.logon.worldofwarcraft.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [D-Link Air Utility] C:\Program Files\D-Link\Air Utility\AirCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: -editiert- iSCSI Service (-editiert-Service) - Rocket Division Software - C:\Program Files\-editiert-\-editiert-\-editiert-\-editiert-Service.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)


-- File Associations -----------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "%SystemRoot%\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\winhlp32.exe %1
.inf - inffile - %SystemRoot%\system32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\system32\NOTEPAD.EXE %1
.js - JSFile - unable to read value
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - "%SystemRoot%\System32\WScript.exe" "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

2R ANIO (ANIO Service) - \??\C:\Windows\system32\ANIO.SYS
2R atksgt - C:\Windows\System32\drivers\atksgt.sys
1R avgio - \??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys
3R avgntflt - \??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys
1R avipbb - C:\Windows\System32\drivers\avipbb.sys
3R FET5X86V (VIA Rhine-Family Fast-Ethernet Adapter Driver Service) - C:\Windows\System32\drivers\fetnd5bv.sys
3S FETNDIS (VIA Rhine-Familie--Fast-Ethernet-Adaptertreiberdienst) - C:\Windows\System32\drivers\fetnd5.sys
3R GEARAspiWDM - C:\Windows\System32\drivers\GEARAspiWDM.sys
3S HdAudAddService (Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst) - C:\Windows\System32\drivers\HdAudio.sys
4S iaStor (Intel AHCI Controller) - C:\Windows\System32\drivers\iaStor.sys
3R IntcAzAudAddService (Service for Realtek HD Audio (WDM)) - C:\Windows\System32\drivers\RTKVHDA.sys
2R lirsgt - C:\Windows\System32\drivers\lirsgt.sys
3R NETDLWL (D-Link Air Wireless Adapter(DL) NT Driver) - C:\Windows\System32\drivers\NETDLWL.sys
3S nmwcd (Nokia USB Phone Parent) - C:\Windows\System32\drivers\nmwcd.sys
3S nmwcdc (Nokia USB Generic) - C:\Windows\System32\drivers\nmwcdc.sys
3S nmwcdcj (Nokia USB Port) - C:\Windows\System32\drivers\nmwcdcj.sys
3S nmwcdcm (Nokia USB Modem) - C:\Windows\System32\drivers\nmwcdcm.sys
4S nvatabus - C:\Windows\System32\drivers\nvatabus.sys
3R nvlddmkm - C:\Windows\System32\drivers\nvlddmkm.sys
3S OVT511Plus (Dual Mode USB Camera Plus) - C:\Windows\System32\drivers\omcamvid.sys
3R Point32 (Microsoft IntelliPoint Filter Driver) - C:\Windows\System32\drivers\point32k.sys
1R ssmdrv - C:\Windows\System32\drivers\ssmdrv.sys
3R USBSTOR (USB-Massenspeichertreiber) - C:\Windows\System32\drivers\USBSTOR.SYS
3S vaxscsi - C:\Windows\System32\drivers\vaxscsi.sys
4S viamraid - C:\Windows\System32\drivers\viamraid.sys
0R videX32 - C:\Windows\System32\drivers\videX32.sys
3S WpdUsb - C:\Windows\System32\drivers\WpdUsb.sys
3R WUDFRd - C:\Windows\System32\drivers\WUDFRd.sys
0R xfilt (VIA SATA IDE Hot-plug Driver) - C:\Windows\System32\drivers\xfilt.sys
3S XUIF (X10 USB Wireless Transceiver) - C:\Windows\System32\drivers\x10ufx2.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

2R AntiVirScheduler (AntiVir PersonalEdition Classic Planer) - "C:\Program Files\AntiVir PersonalEdition Classic\sched.exe"
2R AntiVirService (AntiVir PersonalEdition Classic Guard) - "C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe"
2R Apple Mobile Device - "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
2R Bonjour Service (Bonjour-Dienst) - "C:\Program Files\Bonjour\mDNSResponder.exe"
2S CLTNetCnService (Symantec Lic NetConnect service) - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon
3R iPod Service (iPod-Dienst) - "C:\Program Files\iPod\bin\iPodService.exe"
2R ProtexisLicensing - C:\Windows\system32\PSIService.exe
2R -editiert-Service (-editiert- iSCSI Service) - C:\Program Files\-editiert-\-editiert-\-editiert-\-editiert-Service.exe
2R TestHandler (Fujitsu Siemens Computers Diagnostic Testhandler) - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
3R usnjsvc (Messenger USN Journal Reader-Service für freigegebene Ordner) - "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
3S WLSetupSvc (Windows Live Setup Service) - "C:\Program Files\Windows Live\installer\WLSetupSvc.exe"


-- Files created between 2008-06-22 and 2008-07-22 -----------------------------



-- Find3M Report ---------------------------------------------------------------

2008-07-22 22:29:41 651112 --a------ C:\Windows\system32\perfh007.dat
2008-07-22 22:29:41 120908 --a------ C:\Windows\system32\perfc007.dat
2008-07-22 21:25:17 0 d-------- C:\Program Files\Sun
2008-07-22 21:24:42 0 d-------- C:\Program Files\Java
2008-07-22 13:34:54 0 d-------- C:\Program Files\AntiVir PersonalEdition Classic<ANTIVI~1>
2008-07-20 21:25:04 0 d-------- C:\Program Files\Yahoo!
2008-07-20 21:01:28 0 d-------- C:\Users\Craig Freeman\AppData\Roaming\UseNeXT
2008-07-20 19:02:36 0 d-------- C:\Users\Craig Freeman\AppData\Roaming\Yahoo!
2008-07-20 18:00:12 0 d-------- C:\Program Files\AviSynth 2.5<AVISYN~1.5>
2008-07-20 17:59:31 0 d-------- C:\Program Files\eRightSoft<ERIGHT~1>
2008-07-16 14:35:05 0 d-------- C:\Program Files\World of Warcraft<WORLDO~1>
2008-07-16 02:43:59 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2008-07-10 03:08:46 174 --ahs---- C:\Program Files\desktop.ini
2008-07-10 03:00:52 0 d-------- C:\Program Files\Windows Mail<WINDOW~1>
2008-07-02 14:51:50 0 d-------- C:\Users\Craig Freeman\AppData\Roaming\teamspeak2<TEAMSP~1>
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData0c1a.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData081a.dll
2008-06-26 05:22:33 4493312 --a------ C:\Windows\system32\NlsData0816.dll
2008-06-26 05:22:33 4493312 --a------ C:\Windows\system32\NlsData0416.dll
2008-06-26 05:22:33 4493312 --a------ C:\Windows\system32\NlsData0414.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData004e.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData004c.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData004b.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData004a.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData0049.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData0047.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData0046.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData0045.dll
2008-06-26 05:22:33 1799168 --a------ C:\Windows\system32\NlsData003e.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData0039.dll
2008-06-26 05:22:33 1799168 --a------ C:\Windows\system32\NlsData002a.dll
2008-06-26 05:22:33 1965056 --a------ C:\Windows\system32\NlsData0027.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData0026.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData0024.dll
2008-06-26 05:22:33 1799168 --a------ C:\Windows\system32\NlsData0022.dll
2008-06-26 05:22:33 1799168 --a------ C:\Windows\system32\NlsData0021.dll
2008-06-26 05:22:33 3102720 --a------ C:\Windows\system32\NlsData0020.dll
2008-06-26 05:22:33 4493312 --a------ C:\Windows\system32\NlsData001d.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData001b.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData001a.dll
2008-06-26 05:22:33 4495360 --a------ C:\Windows\system32\NlsData0019.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData0018.dll
2008-06-26 05:22:33 3464704 --a------ C:\Windows\system32\NlsData0013.dll
2008-06-26 05:22:33 2655232 --a------ C:\Windows\system32\NlsData0011.dll
2008-06-26 05:22:33 4493312 --a------ C:\Windows\system32\NlsData0010.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData000f.dll
2008-06-26 05:22:33 2340864 --a------ C:\Windows\system32\NlsData000d.dll
2008-06-26 05:22:33 2641408 --a------ C:\Windows\system32\NlsData000c.dll
2008-06-26 05:22:33 9845248 --a------ C:\Windows\system32\NlsData000a.dll
2008-06-26 05:22:33 4874240 --a------ C:\Windows\system32\NlsData0009.dll
2008-06-26 05:22:33 2241024 --a------ C:\Windows\system32\NlsData0007.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData0003.dll
2008-06-26 05:22:33 1963520 --a------ C:\Windows\system32\NlsData0002.dll
2008-06-26 05:22:33 2597888 --a------ C:\Windows\system32\NlsData0001.dll
2008-06-26 05:22:33 1523200 --a------ C:\Windows\system32\NlsData0000.dll
2008-06-26 05:22:33 797696 --a------ C:\Windows\system32\NaturalLanguage6.dll
2008-06-26 02:34:39 7964672 --a------ C:\Windows\system32\NlsLexicons0024.dll
2008-06-26 02:34:37 6585856 --a------ C:\Windows\system32\NlsLexicons001b.dll
2008-06-26 02:34:36 4093440 --a------ C:\Windows\system32\NlsLexicons004c.dll
2008-06-26 02:34:34 1236992 --a------ C:\Windows\system32\NlsLexicons0020.dll
2008-06-26 02:34:33 5499904 --a------ C:\Windows\system32\NlsLexicons0022.dll
2008-06-26 02:34:30 5791232 --a------ C:\Windows\system32\NlsLexicons0026.dll
2008-06-26 02:34:26 4096 --a------ C:\Windows\system32\NlsLexicons002a.dll
2008-06-26 02:34:25 3419136 --a------ C:\Windows\system32\NlsLexicons004a.dll
2008-06-26 02:34:24 1558016 --a------ C:\Windows\system32\NlsLexicons0049.dll
2008-06-26 02:34:23 1972736 --a------ C:\Windows\system32\NlsLexicons004e.dll
2008-06-26 02:34:22 1702912 --a------ C:\Windows\system32\NlsLexicons004b.dll
2008-06-26 02:34:20 4164096 --a------ C:\Windows\system32\NlsLexicons0002.dll
2008-06-26 02:34:18 1793536 --a------ C:\Windows\system32\NlsLexicons0045.dll
2008-06-26 02:34:14 6346240 --a------ C:\Windows\system32\NlsLexicons001d.dll
2008-06-26 02:34:11 7042560 --a------ C:\Windows\system32\NlsLexicons081a.dll
2008-06-26 02:34:09 6917120 --a------ C:\Windows\system32\NlsLexicons0c1a.dll
2008-06-26 02:34:03 6781440 --a------ C:\Windows\system32\NlsLexicons0019.dll
2008-06-26 02:34:01 3331072 --a------ C:\Windows\system32\NlsLexicons0018.dll
2008-06-26 02:33:58 1808896 --a------ C:\Windows\system32\NlsLexicons0046.dll
2008-06-26 02:33:57 5090816 --a------ C:\Windows\system32\NlsLexicons0416.dll
2008-06-26 02:33:56 5031936 --a------ C:\Windows\system32\NlsLexicons0816.dll
2008-06-26 02:33:54 4616192 --a------ C:\Windows\system32\NlsLexicons0414.dll
2008-06-26 02:33:52 4045824 --a------ C:\Windows\system32\NlsLexicons003e.dll
2008-06-26 02:33:50 6224896 --a------ C:\Windows\system32\NlsLexicons0027.dll
2008-06-26 02:33:49 4175872 --a------ C:\Windows\system32\NlsLexicons0010.dll
2008-06-26 02:33:48 5654528 --a------ C:\Windows\system32\NlsLexicons000f.dll
2008-06-26 02:33:46 1782272 --a------ C:\Windows\system32\NlsLexicons0039.dll
2008-06-26 02:33:45 1411072 --a------ C:\Windows\system32\NlsLexicons0047.dll
2008-06-26 02:33:43 6014976 --a------ C:\Windows\system32\NlsLexicons001a.dll
2008-06-26 02:33:41 1452544 --a------ C:\Windows\system32\NlsLexicons0003.dll
2008-06-26 02:33:40 2136064 --a------ C:\Windows\system32\NlsLexicons0021.dll
2008-06-26 02:33:39 9892864 --a------ C:\Windows\system32\NlsLexicons000a.dll
2008-06-26 02:33:37 2466816 --a------ C:\Windows\system32\NlsLexicons0011.dll
2008-06-26 02:33:36 1722368 --a------ C:\Windows\system32\NlsLexicons000d.dll
2008-06-26 02:33:35 12240896 --a------ C:\Windows\system32\NlsLexicons0007.dll
2008-06-26 02:33:34 6237696 --a------ C:\Windows\system32\NlsLexicons000c.dll
2008-06-26 02:33:33 2644480 --a------ C:\Windows\system32\NlsLexicons0009.dll
2008-06-26 02:33:12 4981248 --a------ C:\Windows\system32\NlsLexicons0013.dll
2008-06-26 02:33:04 11722752 --a------ C:\Windows\system32\NlsLexicons0001.dll
2008-06-26 02:33:01 5071872 --a------ C:\Windows\system32\NlsModels0011.dll
2008-06-21 01:41:30 0 d-------- C:\Users\Craig Freeman\AppData\Roaming\Adobe
2008-06-20 00:05:41 0 d-------- C:\Program Files\UseNeXT
2008-06-18 21:23:32 0 d-------- C:\Program Files\Common Files\Logitech
2008-06-18 21:23:28 0 d-------- C:\Program Files\Logitech
2008-06-18 20:44:09 900 --ahs---- C:\Windows\system32\KGyGaAvL.sys
2008-06-12 15:58:14 0 d-------- C:\Program Files\GameSpy
2008-06-12 15:58:03 0 d-------- C:\Program Files\ICQToolbar<ICQTOO~1>
2008-06-12 15:56:35 22328 --a------ C:\Users\Craig Freeman\AppData\Roaming\PnkBstrK.sys
2008-06-11 09:51:23 0 d-------- C:\Program Files\Virtual Hottie 2<VIRTUA~1>
2008-06-10 21:20:35 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2008-06-10 17:10:35 0 d-------- C:\Program Files\iTunes
2008-06-10 17:10:27 0 d-------- C:\Program Files\iPod
2008-06-10 17:09:41 0 d-------- C:\Program Files\Bonjour
2008-06-10 17:09:31 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2008-06-10 17:08:49 0 d-------- C:\Program Files\Apple Software Update<APPLES~1>
2008-06-10 17:07:54 0 d-------- C:\Program Files\Common Files\Apple
2008-06-08 15:31:55 0 d-------- C:\Users\Craig Freeman\AppData\Roaming\Games
2008-05-22 14:16:03 122130 --a------ C:\Windows\GXTranscoder v2 Uninstaller.exe<GXTRAN~1.EXE>
2008-05-22 14:16:02 0 d-------- C:\Program Files\GXTranscoder v2<GXTRAN~1>
2008-05-10 05:30:50 14848 --a------ C:\Windows\system32\wshrm.dll
2008-04-26 10:02:05 1327104 --a------ C:\Windows\system32\quartz.dll
2008-04-25 06:23:06 180736 --a------ C:\Windows\system32\ieui.dll
2008-04-25 06:23:06 56320 --a------ C:\Windows\system32\iesetup.dll
2008-04-25 06:23:06 44544 --a------ C:\Windows\system32\iernonce.dll
2008-04-25 06:23:06 6066176 --a------ C:\Windows\system32\ieframe.dll
2008-04-25 06:23:06 383488 --a------ C:\Windows\system32\ieapfltr.dll
2008-04-25 06:23:06 63488 --a------ C:\Windows\system32\icardie.dll
2008-04-25 06:23:05 124928 --a------ C:\Windows\system32\advpack.dll
2008-04-25 06:22:36 26624 --a------ C:\Windows\system32\ieUnatt.exe
2008-04-25 06:22:36 70656 --a------ C:\Windows\system32\ie4uinit.exe
2008-04-23 06:27:04 292352 --a------ C:\Windows\system32\psisdecd.dll
2008-04-23 06:27:01 1244672 --a------ C:\Windows\system32\mcmde.dll
2008-04-23 06:27:00 428032 --a------ C:\Windows\system32\EncDec.dll


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Sidebar"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun"
"MsnMsgr"="\"C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe\" /background"
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\ISUSPM.exe\" -startup"
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"ehTray.exe"="C:\\Windows\\ehome\\ehTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Windows Defender"=hex(2):25,50,72,6f,67,72,61,6d,46,69,6c,65,73,25,5c,57,69,\
6e,64,6f,77,73,20,44,65,66,65,6e,64,65,72,5c,4d,53,41,53,43,75,69,2e,65,78,\
65,20,2d,68,69,64,65,00
"RtHDVCpl"="RtHDVCpl.exe"
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"NvSvc"="RUNDLL32.EXE C:\\Windows\\system32\\nvsvc.dll,nvsvcStart"
"NvCplDaemon"="RUNDLL32.EXE C:\\Windows\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\Windows\\system32\\NvMcTray.dll,NvTaskbarInit"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\""
"Corel Photo Downloader"="\"C:\\Program Files\\Common Files\\Corel\\Corel PhotoDownloader\\Corel Photo Downloader.exe\" -startup"
"D-Link Air Utility"="C:\\Program Files\\D-Link\\Air Utility\\AirCFG.exe"
"ANIWZCSService"="C:\\Program Files\\Alpha Networks\\ANIWZCS Service\\WZCSLDR.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"Launch LCDMon"="\"C:\\Program Files\\Common Files\\Logitech\\LCD Manager\\lcdmon.exe\""
"Launch LGDCore"="\"C:\\Program Files\\Common Files\\Logitech\\G-series Software\\LGDCore.exe\" /SHOWHIDE"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=dword:00000002
"ConsentPromptBehaviorUser"=dword:00000001
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"scforceoption"=dword:00000000
"FilterAdministratorToken"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\UIPI]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\UIPI\Clipboard]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="credssp.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AppInfo
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\KeyIso
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\NTDS
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\ProfSvc
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sacsvr
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\SWPRV
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\TabletInputService
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\TBS
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\TrustedInstaller
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\volmgr.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\volmgrx.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ nsi\0lltdsvc\0SSDPSRV\0upnphost\0SCardSvr\0w32time\0EventSystem\0RemoteRegistry\0WinHttpAutoProxySvc\0lanmanworkstation\0TBS\0SLUINotify\0THREADORDER\0fdrespub\0netprofm\0fdphost\0wcncsvc\0QWAVE\0Mcx2Svc\0WebClient\0\0
LocalSystemNetworkRestricted REG_MULTI_SZ hidserv\0UxSms\0WdiSystemHost\0Netman\0trkwks\0AudioEndpointBuilder\0WUDFSvc\0irmon\0sysmain\0IPBusEnum\0dot3svc\0PcaSvc\0EMDMgmt\0TabletInputService\0wlansvc\0WPDBusEnum\0\0
NetworkServiceNetworkRestricted REG_MULTI_SZ PolicyAgent\0\0
LocalServiceNoNetwork REG_MULTI_SZ PLA\0DPS\0BFE\0mpssvc\0ehstart\0\0
NetworkService REG_MULTI_SZ CryptSvc\0DHCP\0TermService\0KtmRm\0DNSCache\0NapAgent\0nlasvc\0WinRM\0WECSVC\0Tapisrv\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WerSvcGroup REG_MULTI_SZ wersvc\0\0
swprv REG_MULTI_SZ swprv\0\0
LocalServiceNetworkRestricted REG_MULTI_SZ DHCP\0eventlog\0AudioSrv\0LmHosts\0wscsvc\0p2pimsvc\0PNRPSvc\0p2psvc\0WPCSvc\0PnrpAutoReg\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
regsvc REG_MULTI_SZ RemoteRegistry\0\0
wcssvc REG_MULTI_SZ WcsPlugInService\0\0
DcomLaunch REG_MULTI_SZ PlugPlay\0DcomLaunch\0\0
wdisvc REG_MULTI_SZ WdiServiceHost\0\0
sdrsvc REG_MULTI_SZ sdrsvc\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
secsvcs REG_MULTI_SZ WinDefend\0\0

HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
AeLookupSvc
wercplsupport
CertPropSvc
SCPolicySvc
gpsvc
IKEEXT
LogonHours
PCAudit
iphlpsvc
AppInfo
msiscsi
MMCSS
ProfSvc
EapHost
SessionEnv
hkmsvc


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{461aa97d-687d-11dc-acb0-0019db71b6ba}]
shell\AutoRun\command M:\AutoRunCD.exe


-- Hosts -----------------------------------------------------------------------

80.239.180.111 eu.logon.worldofwarcraft.com
80.239.180.112 eu.logon.worldofwarcraft.com
80.239.180.113 eu.logon.worldofwarcraft.com
80.239.180.114 eu.logon.worldofwarcraft.com
80.239.180.115 eu.logon.worldofwarcraft.com
80.239.180.116 eu.logon.worldofwarcraft.com
80.239.180.117 eu.logon.worldofwarcraft.com
80.239.178.109 eu.logon.worldofwarcraft.com
80.239.178.110 eu.logon.worldofwarcraft.com
80.239.178.111 eu.logon.worldofwarcraft.com

6 more entries in hosts file.


-- End of ComboScan: finished at 2008-07-22 at 23:01:03 ------------------------



vielen dank

[Voyager]

nur werde ich net ganz schlau draus ^^

Wo kommst du denn nicht weiter ?

[Rouven]

Schon mal unter www.hijackthis.de in die automatische Auswertung gepackt?

[zausel]

Hallo,
eigentlich eine ganz einfache Sache....
Du ,bzw. dein Kumpel... .., ist als Dieb entlarvt.
Die O1 Einträge zeigen es überdeutlich .
Da wird nämlich der Host umgebogen um zu verhindern das sich das Spiel zuhause meldet bzw sich registrieren will....

Als Strafe dafür gab es einen ZBot wie der O23 Eintrag zeigt.
Hier steht zu lesen was der kann :http://www.avira.de/de/threats/section/fulldetails/id_vir/4118/tr_spy.zbot.nm.html

Viel Spass bei der Neuinstallation !!
Die hast du /dein Kumpel dir redlichst verdient.....
Zausel