aktuelle Warnungen | Help Worm SDbot.86142

code:

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ofps.exe
C:\WINDOWS\System32\slpservice.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\slpmonx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Java\j2re1.4.2_07\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Euro\Desktop\FxMydoom.exe
C:\Programme\Internet Explorer\iexplore.exe
F:\Software Todd\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://de.yahoo.com/[/URL]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = [URL]http://riviera.cc[/URL] (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = [URL]http://riviera.cc[/URL] (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [sys] regedit -s sysdll.reg
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_07\bin\jusched.exe
O4 - HKLM\..\Run: [NexusServer] "C:\Programme\Gemeinsame Dateien\Canopus Shared\ProCoder 2\Kernel\PNXSERVR.exe" -SelfLaunch
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar3.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MedionShop - {811DDDB7-933B-4717-8A6B-4F86A67E0F9F} - [URL]http://www.medionshop.de/[/URL] (file missing) (HKCU)
O16 - DPF: FFPApplet - [URL]https://www13.firmenfinanzportal.de/ta/login/FFPApplet.cab[/URL]
O16 - DPF: Yahoo! Backgammon - [URL]http://download.games.yahoo.com/games/clients/y/at1_x.cab[/URL]
O16 - DPF: Yahoo! Chess - [URL]http://download.games.yahoo.com/games/clients/y/ct1_x.cab[/URL]
O16 - DPF: Yahoo! Dots - [URL]http://download.games.yahoo.com/games/clients/y/dtt1_x.cab[/URL]
O16 - DPF: {00000000-0000-0000-0000-000020040000} - [URL]http://207.234.185.217/ABoxInst_int4.exe[/URL]
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - [URL]http://install.homestead.com/~site/InstallFiles/SIFiles/lpxlive/HS_live.cab[/URL]
O16 - DPF: {0DF86CB3-1923-11D5-B470-0050BA1B3C6F} (JpegServerPushControl Class) - [URL]http://towercam.intershop.de/ConvisionVideo.cab[/URL]
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - [URL]http://www.musicnotes.com/download/mnviewer.cab[/URL]
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - [URL]https://br-iv-extern.brnet.de/iNotes.cab[/URL]
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [URL]http://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/dribnif/de/win/QuickTimeInstaller.exe[/URL]
O16 - DPF: {51EA44E6-C8C3-4E30-8F3D-D8EE71A44DCB} (Upload Control) - [URL]https://img.web.de/v/fotoalbum/activex/upload_1111.cab[/URL]
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - [URL]http://software-dl.real.com/20e984a205d5fb675715/netzip/RdxIE601_de.cab[/URL]
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - [URL]http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe[/URL]
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - [URL]http://toolbar.google.com/data/de/big/1.1.62-big/GoogleNav.cab[/URL]
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - [URL]http://www.bitdefender.com/scan/Msie/bitdefender.cab[/URL]
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - [URL]http://www.latschenhof-websline.com/ITmaxxDeluxe/Templates/plugins/mssurvid.cab[/URL]
O16 - DPF: {C32E3130-F455-4083-B29E-414FA449C23A} (COMOPlayerPluginFlt Control) - [URL]http://213.178.67.57/contentdisk_static_new/plugins/comoplayer.cab[/URL]
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - [URL]http://ccon.futuremark.com/global/msc34.cab[/URL]
O16 - DPF: {EF803EE6-5D8B-409C-BDC4-4CDDD360E66F} (DownloadPlugin Control) - [URL]http://213.178.67.57/contentdisk_static_new/plugins/ComoPlugins.cab[/URL]
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A9CB17E-667C-4BC8-9F3A-DB8646D77B7F}: NameServer = 212.18.0.5 212.18.3.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{549B9E4B-7958-4A34-8410-E1D3421B5FC0}: NameServer = 212.18.3.5
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: MySql - Unknown owner - c:\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OmniForm Printer - Unknown owner - C:\WINDOWS\System32\ofps.exe
O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\System32\slpservice.exe