StartupList report, 18.09.2007, 20:01:53 StartupList version: 1.52.2 Started from : C:\DOKUME~1\noob\LOKALE~1\Temp\Rar$EX19.332\HijackThis.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\Mixer.exe C:\Programme\Winamp\winampa.exe C:\Programme\D-Tools\daemon.exe C:\Programme\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\system32\wdfmgr.exe C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\ISW\alice\signup\alicecnn.exe C:\Programme\eMule\emule.exe C:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\Programme\Winamp\Winamp.exe C:\Programme\WinRAR\WinRAR.exe C:\Programme\Opera\Opera.exe C:\DOKUME~1\noob\LOKALE~1\Temp\Rar$EX19.332\HijackThis.exe ————————————————– Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, ————————————————– Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ZoneAlarm Client = "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" avgnt = "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min C-Media Mixer = Mixer.exe /startup Adobe Reader Speed Launcher = "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" WinampAgent = C:\Programme\Winamp\winampa.exe DAEMON Tools-1033 = "C:\Programme\D-Tools\daemon.exe" -lang 1033 ————————————————– Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SpybotSD TeaTimer = C:\Programme\Spybot - Search & Destroy\TeaTimer.exe AWMON = "C:\Programme\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe ————————————————– Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run [OptionalComponents] = ————————————————– Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry value not found* HKLM\..\Policies: Shell=*Registry value not found* ————————————————– Enumerating Browser Helper Objects: (no name) - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F} (no name) - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045} ————————————————– Enumerating Task Scheduler jobs: Spybot - Search & Destroy - Scheduled Task.job ————————————————– Enumerating Windows NT logon/logoff scripts: *No scripts set to run* Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: C:\WINDOWS\system32\ZoneLabs\spyware.dat.zlbak ————————————————– Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\system32\webcheck.dll SysTray: C:\WINDOWS\system32\stobject.dll ————————————————– Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run Generic Host Process = C:\WINDOWS\system32\scvhost.exe ————————————————– End of report, 5.528 bytes Report generated in 0,100 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only