Virus das Mailt?

[Taurizius]

Hi,

ich habe zwar schon länger das Problem, das mein Email-Eingang von Phishing-Mails zum Thema Wow überläuft, aber seit neuestem bekomme ich immer Mails, dass es nicht möglich war Emails zuzustellen, jedoch habe ich diese nicht geschrieben. Der Abfänger hört sich meistens nicht wirklich nach einer echten Person an und als Absender steht eine gefakte Adresse von Blizzard.

Der eigentliche Text der Mail ist (Für mich) unverständlich:

Hi. This is the qmail-send program at yahoo.com.I'm afraid I wasn't able to deliver your message to the following addresses.This is a permanent error; I've given up. Sorry it didn't work out.
*******@pneumadyne.com>:72.25.131.74 does not like recipient.Remote host said: 550 5.1.1 User unknownGiving up on 72.25.131.74.--- Below this line is a copy of the message.Return-Path: *******@yahoo.deReceived: (qmail 6457 invoked from network); 4 Aug 2010 01:15:10 -0000DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.de; s=s1024; t=1280884510; bh=P3KUFZE2ii68i5gNL5kQ7VQM+SSjjl3RHkUmay1ns3E=; h=Received:X-Yahoo-SMTP:X-YMail-OSG:X-Yahoo-Newman-Property:Message-ID:From:To:Subjectate:MIME-Version:Content-Type:X-Priority:X-MSMail-Priority:X-Mailer:X-MimeOLE; b=kzesFcFbrueDHO//QsaO0l+8G+zH0N5XDVTf3k7kKBv38Lri4QEv+r3nQbCzn6xOPA7ns0NkPQk/M8GSxI+yRiwBQgxLkr9Sbauv4uTtRHL1OE0gMNj2kMXhhhYE9RAkxDuMopVylfDc4E3VZ99ysqpuKOwpcYXlrs3SE/COesY=Received: from phsmy (******@68.71.46.138 with login) by smtp106.plus.mail.re1.yahoo.com with SMTP; 03 Aug 2010 18:14:30 -0700 PDTX-Yahoo-SMTP: CVTEsfGswBAAWr6Kg0g0erAl0qAlu_1yRVY3X-YMail-OSG: B_4G39UVM1k.1bQRRIqSQAO1rmT4nVY.B.P4zce1G7SboAk CVzg-X-Yahoo-Newman-Property: ymail-3Message-ID: <D302503FF484F79794A99FEC57F1DFA1@phsmy>From: "Blizzard Entertainment" <wowaccountadmin@blizzard.com>To: *******@pneumadyne.comSubject: World of Warcraft ReminderDate: Wed, 4 Aug 2010 09:14:51 +0800MIME-Version: 1.0Content-Type: multipart/alternative; boundary="----=_NextPart_000_0EE2_0102B69C.1538F2A0"X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2900.5512X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512This is a multi-part message in MIME format.


Drunter folgen noch mehrere Blöcke mit wirren Buchstaben
Also, kann es jetzt sein, das ich ein Virus habe, dass diese Mails versendet?
Ich benutze Mozilla Thunderbird um meine Mails zu verwalten.

Schon mal vielen Dank im Vorraus!

 

[Bloodletting]

Ein Virus versendet keine Mails, das machen Trojaner.
Wenn dann ist das ein Spambot, der die Emails an dich verschickt.
Das hat nichts mit deinem Pc zu tun sondern lediglich mit deiner Email-Adresse.

 

[Klos1]

Es gibt viele Schädlinge, wo das Versenden von Emails denkbar wäre. Auch bei einen Keylogger könnte es sein, dass dieser die gesammelten Daten an eine Email-Adresse versendet.
Allerdings sollte das einen guten Virenprogramm auffallen, wenn da ein Prozess einfach mal ne Email versendet.

Vielleicht erstellst du mal ein Logfile mit allen Prozessen erstellen, die bei dir laufen. Auch mal in der Registry oder msconfig schauen, was da im Autostart so drin steht.

 

[Dracun]

http://kb.acronis.com/node/8823

Wenn du net weißt wie des mit dem Logfile geht dann kannste ja des hier nutzen .. weiß jetzt gerade net ob des auch der Process Explorer des auch macht

http://www.chip.de/downloads/Process-Explorer_12996492.html

 

[ZAM]

Vielleicht erstellst du mal ein Logfile mit allen Prozessen erstellen, die bei dir laufen. Auch mal in der Registry oder msconfig schauen, was da im Autostart so drin steht.

Bei rootkits schlechte Karten da was zu finden...

 

[Taurizius]

Also AntiVir ist nichts aufgefallen Hier ist mal ein Log von allen Prozessen:

Spoiler

Process PID CPU Private Bytes Working Set Description Company Name
System Idle Process 0 93.85 0 K 28 K
Interrupts n/a 0 K 0 K Hardware Interrupts
DPCs n/a 0 K 0 K Deferred Procedure Calls
System 4 0 K 240 K
smss.exe 1048 172 K 416 K Windows NT-Sitzungs-Manager Microsoft Corporation
csrss.exe 1392 0.77 1.888 K 4.696 K Client Server Runtime Process Microsoft Corporation
winlogon.exe 1416 6.072 K 3.668 K Windows NT-Anmeldung Microsoft Corporation
services.exe 1460 1.956 K 4.008 K Anwendung für Dienste und Controller Microsoft Corporation
svchost.exe 1664 3.236 K 5.388 K Generic Host Process for Win32 Services Microsoft Corporation
wmiprvse.exe 3828 2.768 K 7.008 K WMI Microsoft Corporation
svchost.exe 1712 2.024 K 4.676 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 156 14.988 K 25.076 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 192 2.404 K 3.408 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 376 2.012 K 4.300 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 736 3.388 K 7.376 K Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 864 3.980 K 5.752 K Spooler SubSystem App Microsoft Corporation
sched.exe 912 3.700 K 832 K Antivirus Scheduler Avira GmbH
svchost.exe 1080 1.192 K 3.340 K Generic Host Process for Win32 Services Microsoft Corporation
avguard.exe 2376 90.688 K 11.560 K Antivirus On-Access Service Avira GmbH
AppleMobileDeviceService.exe 2388 1.876 K 2.784 K Apple Mobile Device Service Apple Inc.
mDNSResponder.exe 2400 1.328 K 3.936 K Bonjour Service Apple Inc.
E_S00RP1.EXE 2440 416 K 1.484 K EPSON Status Monitor 3 SEIKO EPSON CORPORATION
GSvr.exe 2480 0.77 832 K 2.156 K
hamachi-2.exe 2496 2.844 K 5.756 K Hamachi2 Client Tunneling Engine LogMeIn Inc.
openvpnas.exe 2676 1.180 K 3.588 K
hsssrv.exe 3224 1.736 K 5.528 K AnchorFree Inc.
hsswd.exe 3500 2.072 K 6.436 K
jqs.exe 3592 6.444 K 1.380 K Java™ Quick Starter Service Sun Microsystems, Inc.
LckFldService.exe 3628 944 K 3.836 K
mysqld.exe 3680 86.740 K 17.704 K
nvsvc32.exe 3756 2.896 K 4.704 K NVIDIA Driver Helper Service, Version 182.06 NVIDIA Corporation
PnkBstrA.exe 3776 4.408 K 6.448 K
iPodService.exe 3552 2.568 K 4.320 K iPodService Module (32-bit) Apple Inc.
wmiapsrv.exe 176 1.912 K 4.588 K WMI-Leistungsadapter-Dienst Microsoft Corporation
alg.exe 3872 1.220 K 3.652 K Application Layer Gateway Service Microsoft Corporation
PnkBstrB.exe 3944 4.760 K 5.240 K
lsass.exe 1472 4.128 K 6.664 K LSA Shell (Export Version) Microsoft Corporation
explorer.exe 1328 31.564 K 43.176 K Windows Explorer Microsoft Corporation
rundll32.exe 1768 2.760 K 4.288 K Eine DLL-Datei als Anwendung ausführen Microsoft Corporation
RTHDCPL.EXE 1788 25.352 K 26.744 K Realtek HD Audio Control Panel Realtek Semiconductor Corp.
avgnt.exe 1800 2.480 K 1.596 K Antivirus System Tray Tool Avira GmbH
jusched.exe 1824 828 K 2.852 K Java™ Update Scheduler Sun Microsystems, Inc.
iBoardHelper.exe 1884 9.580 K 14.452 K iBoardHelper Application MC Squared Incorporated
iTunesHelper.exe 1892 8.736 K 14.176 K iTunesHelper Apple Inc.
ctfmon.exe 1948 996 K 3.664 K CTF Loader Microsoft Corporation
LogitechDesktopMessenger.exe 1956 11.996 K 6.420 K Logitech Desktop Messenger Logitech
Program.Blasc3.exe 452 73.012 K 76.616 K Blasc 3 Computec Media AG
SetPoint.exe 536 5.660 K 10.300 K Logitech SetPoint Event Manager (UNICODE) Logitech Inc.
KHALMNPR.EXE 580 2.492 K 3.852 K Logitech KHAL Main Process Logitech Inc.
iTunes.exe 1316 80.912 K 97.920 K iTunes Apple Inc.
AppleMobileDeviceHelper.exe 1868 9.888 K 14.496 K MobileDeviceHelper Apple Inc.
distnoted.exe 288 2.700 K 5.336 K distnoted Apple Inc.
iexplore.exe 3044 8.488 K 18.772 K Internet Explorer Microsoft Corporation
iexplore.exe 780 52.484 K 61.788 K Internet Explorer Microsoft Corporation
iexplore.exe 324 42.436 K 53.680 K Internet Explorer Microsoft Corporation
procexp1204.exe 3196 4.62 11.988 K 16.432 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com
TosBtMng.exe 512 4.816 K 6.384 K TosBtMng TOSHIBA CORPORATION.
TosA2dp.exe 1300 2.824 K 4.212 K TosA2dp TOSHIBA CORPORATION.
TosBtHSP.exe 1380 2.832 K 4.584 K TosBtHSP TOSHIBA CORPORATION.
TosOBEX.exe 2028 4.940 K 7.244 K tosOBEX TOSHIBA CORPORATION.
TosBtProc.exe 2332 1.580 K 3.996 K TosBtProc TOSHIBA CORPORATION.
openvpntray.exe 316 1.564 K 6.172 K
pbsetup.exe 3084 7.228 K 13.448 K

 

[Klos1]

Mach mal ein Hijackthis Logfile, damit man auch die Pfade sieht.

 

[Taurizius]

Spoiler

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:01:38, on 04.08.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Programme\Avira\AntiVir Desktop\sched.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\RUNDLL32.EXE
F:\WINDOWS\RTHDCPL.EXE
F:\Programme\Avira\AntiVir Desktop\avgnt.exe
F:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
F:\Programme\iBoards\iBoardHelper\iBoardHelper.exe
F:\Programme\iTunes\iTunesHelper.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
F:\Dokumente und Einstellungen\Thorsten\Lokale Einstellungen\Anwendungsdaten\Blasc3\Program.Blasc3.exe
F:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
F:\Programme\Logitech\SetPoint\SetPoint.exe
F:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
F:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
F:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
F:\Programme\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
F:\Programme\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
F:\Programme\Avira\AntiVir Desktop\avguard.exe
F:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
F:\Programme\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\E_S00RP1.EXE
F:\Programme\GIGABYTE\EnergySaver\GSvr.exe
F:\Programme\LogMeIn Hamachi\hamachi-2.exe
F:\Programme\Hotspot Shield\bin\openvpnas.exe
F:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
F:\Programme\Hotspot Shield\bin\hsswd.exe
F:\Programme\Java\jre6\bin\jqs.exe
F:\WINDOWS\system32\LckFldService.exe
F:\Programme\MySQL\MySQL Server 5.1\bin\mysqld.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\Programme\iPod\bin\iPodService.exe
F:\WINDOWS\system32\wbem\wmiapsrv.exe
F:\Programme\Hotspot Shield\bin\openvpntray.exe
F:\DOKUME~1\Thorsten\LOKALE~1\Temp\Rar$EX00.313\pbsetup.exe
F:\Programme\iTunes\iTunes.exe
F:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
F:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\distnoted.exe
F:\WINDOWS\system32\PnkBstrB.exe
F:\Programme\Internet Explorer\iexplore.exe
F:\Programme\Internet Explorer\iexplore.exe
F:\Programme\Internet Explorer\iexplore.exe
F:\Programme\Java\jre6\bin\java.exe
F:\Dokumente und Einstellungen\Thorsten\Desktop\HiJackThis204.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.112.139.28:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - F:\WINDOWS\system32\dvmurl.dll
R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - F:\Programme\DVDVideoSoftTB\tbDVDV.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - F:\Programme\Winamp Toolbar\winamptb.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - F:\Programme\DVDVideoSoftTB\tbDVDV.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - F:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: kikin Plugin - {E601996F-E400-41CA-804B-CD6373A7EEE2} - F:\Programme\kikin\ie_kikin.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - F:\Programme\Hotspot Shield\HssIE\HssIE.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - F:\Programme\Winamp Toolbar\winamptb.dll
O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - F:\Programme\DVDVideoSoftTB\tbDVDV.dll
O4 - HKLM\..\Run: [GEST] m'|\ü
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avgnt] "F:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Automatisch EPSON Stylus Photo R240 Series auf HOPPEPC] F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /F "F:\WINDOWS\TEMP\E_S3A.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iBoardHelper] F:\Programme\iBoards\iBoardHelper\iBoardHelper.exe
O4 - HKLM\..\Run: [iTunesHelper] "F:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] F:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [Vidalia] "F:\Programme\Vidalia Bundle\Vidalia\vidalia.exe"
O4 - HKCU\..\Run: [Blasc3] "F:\Dokumente und Einstellungen\Thorsten\Lokale Einstellungen\Anwendungsdaten\Blasc3\Program.Blasc3.exe" -silent
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "F:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="F:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="e:\driver\common\win2k_xp\PhysX_9.09.0203_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: hamachi.lnk = G:\Hamachi\hamachi.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: hamachi.lnk = G:\Hamachi\hamachi.exe (User 'Default user')
O4 - Startup: hamachi.lnk = G:\Hamachi\hamachi.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = F:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = F:\Programme\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Winamp Search - F:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Free YouTube to Mp3 Converter - F:\Dokumente und Einstellungen\Thorsten\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
O9 - Extra button: (no name) - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - F:\Programme\kikin\ie_kikin.dll
O9 - Extra 'Tools' menuitem: My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - F:\Programme\kikin\ie_kikin.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - F:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - F:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - F:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\msmsgs.exe
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefi...er_4.0.21.0.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius....tiveXPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O16 - DPF: {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} (ActiveFormX Element) - http://www.wohnmoebe...me%20Priess.cab
O18 - Protocol: bw+0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {9773C4DA-F6C7-4CD3-B9DB-ECBCDBFC16BD} - F:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - F:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - F:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - F:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - F:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - F:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - F:\WINDOWS\system32\E_S00RP1.EXE
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - F:\Programme\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - F:\Programme\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - F:\Programme\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - F:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - F:\Programme\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - F:\Programme\Hotspot Shield\bin\hsswd.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - F:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LckFldService - Unknown owner - F:\WINDOWS\system32\LckFldService.exe
O23 - Service: MySQL - Unknown owner - F:\Programme\MySQL\MySQL.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - F:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - F:\Programme\SiSoftware\SiSoftware Sandra Lite 2010c\RpcAgentSrv.exe

--
End of file - 24627 bytes